Merge pull request #577 from wazuh/new-packages-release

Wazuh indexer and dashboard release

.github/workflows/push.yml

@@ -11,13 +11,13 @@ jobs:
       uses: actions/checkout@v2
 
     - name: Build the docker-compose stack
-      run: docker-compose -f build-from-sources.yml up -d --build
+      run: docker-compose -f build-wazuh-images.yml up -d --build
 
     - name: Check running containers
       run: docker ps -a
 
     - name: Shutdown the stack
-      run: docker-compose -f build-from-sources.yml kill
+      run: docker-compose -f build-wazuh-images.yml kill
 
     - name: Install Goss
       uses: e1himself/goss-installation-action@v1.0.3
@@ -25,12 +25,7 @@ jobs:
         version: v0.3.16
 
     - name: Execute Goss tests (wazuh-odfe)
-      run: dgoss run wazuh/wazuh-odfe:dev-version
+      run: dgoss run wazuh/wazuh-manager:4.3.0
       env:
         GOSS_SLEEP: 30
-        GOSS_FILE: .goss.yaml
+        GOSS_FILE: .goss.yaml
-
-    - name: Execute Goss tests (wazuh-kibana-odfe)
-      run: dgoss run wazuh/wazuh-kibana-odfe:dev-version
-      env:
-        GOSS_FILE: .goss.kibana.yaml

.goss.kibana.yaml

@@ -1,53 +0,0 @@
-file:
-  /usr/share/kibana/config/kibana.yml:
-    exists: true
-    mode: "0664"
-    owner: kibana
-    group: root
-    filetype: file
-    contains: []
-  /usr/share/kibana/src/core/server/core_app/assets/legacy_light_theme.css:
-    exists: true
-    mode: "0664"
-    owner: kibana
-    group: root
-    filetype: file
-    contains: []
-  /usr/share/kibana/src/core/server/core_app/assets/wazuh_logo_circle.svg:
-    exists: true
-    mode: "0644"
-    owner: kibana
-    group: root
-    filetype: file
-    contains: []
-  /usr/share/kibana/src/core/server/core_app/assets/wazuh_wazuh_bg.svg:
-    exists: true
-    mode: "0644"
-    owner: kibana
-    group: root
-    filetype: file
-    contains: []
-  /usr/share/kibana/data/wazuh/config/wazuh.yml:
-    exists: true
-    mode: "0644"
-    owner: kibana
-    group: kibana
-    filetype: file
-    contains: []
-  /usr/share/kibana/src/legacy/ui/ui_render/bootstrap/template.js.hbs:
-    exists: true
-    mode: "0664"
-    owner: kibana
-    group: root
-    filetype: file
-    contains: []
-user:
-  kibana:
-    exists: true
-    groups:
-    - kibana
-    home: /usr/share/kibana
-    shell: /bin/bash
-group:
-  kibana:
-    exists: true

README.md

@@ -7,13 +7,13 @@
 
 In this repository you will find the containers to run:
 
-* wazuh-opendistro: It runs the Wazuh manager, Wazuh API and Filebeat OSS (for integration with ODFE)
+* Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS
-* wazuh-kibana-opendistro: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status.
+* Wazuh dashboard: provides a web user interface to browse through alerts data and allows you to visualize agents configuration and status.
-* opendistro-for-elasticsearch: An Elasticsearch (ODFE) container (working as a single-node cluster) using ODFE Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
+* Wazuh indexer: Wazuh indexer container (working as a single-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
 
 In addition, a docker-compose file is provided to launch the containers mentioned above.
 
-* Elasticsearch cluster. In the Elasticsearch Dockerfile we can visualize variables to configure an Elasticsearch Cluster. These variables are used in the file *config_cluster.sh* to set them in the *elasticsearch.yml* configuration file. You can see the meaning of the node variables [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html) and other cluster settings [here](https://github.com/elastic/elasticsearch/blob/master/distribution/src/config/elasticsearch.yml).
+* Wazuh indexer cluster. In the Wazuh indexer Dockerfile we can visualize variables to configure an Wazuh indexer Cluster. These variables are used in the file *config_cluster.sh* to set them in the *opensearch.yml* configuration file. You can see the meaning of the node variables [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html) and other cluster settings [here](https://github.com/elastic/elasticsearch/blob/master/distribution/src/config/elasticsearch.yml).
 
 ## Documentation
 
@@ -39,9 +39,9 @@ API_USERNAME="wazuh"                                # Wazuh API username
 API_PASSWORD="wazuh"                                # Wazuh API password - Must comply with requirements
                                                     # (8+ length, uppercase, lowercase, specials chars)
 
-ELASTICSEARCH_URL=https://elasticsearch:9200        # Elasticsearch URL
+INDEXER_URL=https://wazuh1.indexer:9200             # Wazuh indexer URL
-ELASTIC_USERNAME=admin                              # Elasticsearch Username
+INDEXER_USERNAME=admin                              # Wazuh indexer Username
-ELASTIC_PASSWORD=admin                              # Elasticsearch Password
+INDEXER_PASSWORD=admin                              # Wazuh indexer Password
 FILEBEAT_SSL_VERIFICATION_MODE=full                 # Filebeat SSL Verification mode (full or none)
 SSL_CERTIFICATE_AUTHORITIES=""                      # Path of Filebeat SSL CA
 SSL_CERTIFICATE=""                                  # Path of Filebeat SSL Certificate
@@ -88,61 +88,67 @@ ADMIN_PRIVILEGES=true               # App privileges
 
 ## Directory structure
 
-    ├── CHANGELOG.md
+├── build-wazuh-images.yml
-    ├── docker-compose.yml
+├── CHANGELOG.md
-    ├── generate-opendistro-certs.yml
+├── docker-compose.yml
-    ├── kibana-odfe
+├── generate-indexer-certs.yml
-    │   ├── config
+├── LICENSE
-    │   │   ├── custom_welcome
+├── production_cluster
-    │   │   │   ├── light_theme.style.css
+│   ├── nginx
-    │   │   │   ├── template.js.hbs
+│   │   ├── nginx.conf
-    │   │   │   ├── wazuh_logo_circle.svg
+│   │   └── ssl
-    │   │   │   └── wazuh_wazuh_bg.svg
+│   │       └── generate-self-signed-cert.sh
-    │   │   ├── entrypoint.sh
+│   ├── wazuh_cluster
-    │   │   ├── kibana_settings.sh
+│   │   ├── wazuh_manager.conf
-    │   │   ├── wazuh_app_config.sh
+│   │   └── wazuh_worker.conf
-    │   │   ├── wazuh.yml
+│   ├── wazuh_dashboard
-    │   │   └── welcome_wazuh.sh
+│   │   └── opensearch_dashboards.yml
-    │   └── Dockerfile
+│   ├── wazuh-indexer
-    ├── LICENSE
+│   │   ├── internal_users.yml
-    ├── production_cluster
+│   │   ├── opensearch.yml
-    │   ├── elastic_opendistro
+│   │   ├── wazuh1.indexer.yml
-    │   │   ├── elasticsearch-node1.yml
+│   │   ├── wazuh2.indexer.yml
-    │   │   ├── elasticsearch-node2.yml
+│   │   └── wazuh3.indexer.yml
-    │   │   ├── elasticsearch-node3.yml
+│   └── wazuh_indexer_ssl_certs
-    │   │   └── internal_users.yml
+│       └── certs.yml
-    │   ├── kibana_ssl
+├── production-cluster.yml
-    │   │   └── generate-self-signed-cert.sh
+├── README.md
-    │   ├── nginx
+├── VERSION
-    │   │   ├── nginx.conf
+├── wazuh-dashboard
-    │   │   └── ssl
+│   ├── config
-    │   │       └── generate-self-signed-cert.sh
+│   │   ├── opensearch_dashboards.yml
-    │   ├── ssl_certs
+│   │   ├── entrypoint.sh
-    │   │   └── certs.yml
+│   │   ├── wazuh_app_config.sh
-    │   └── wazuh_cluster
+│   │   └── wazuh.yml
-    │       ├── wazuh_manager.conf
+│   └── Dockerfile
-    │       └── wazuh_worker.conf
+├── wazuh-indexer
-    ├── production-cluster.yml
+│   ├── config
-    ├── README.md
+│   │   ├── config.sh
-    ├── VERSION
+│   │   ├── config.yml
-    └── wazuh-odfe
+│   │   ├── entrypoint.sh
-        ├── config
+│   │   ├── opensearch.yml
-        │   ├── create_user.py
+│   │   ├── securityadmin.sh
-        │   ├── etc
+│   │   └── unattended_installer.tar.gz
-        │   │   ├── cont-init.d
+│   └── Dockerfile
-        │   │   │   ├── 0-wazuh-init
+└── wazuh-manager
-        │   │   │   ├── 1-config-filebeat
+    ├── config
-        │   │   │   └── 2-manager
+    │   ├── create_user.py
-        │   │   └── services.d
+    │   ├── etc
-        │   │       └── filebeat
+    │   │   ├── cont-init.d
-        │   │           ├── finish
+    │   │   │   ├── 0-wazuh-init
-        │   │           └── run
+    │   │   │   ├── 1-config-filebeat
-        │   ├── filebeat.yml
+    │   │   │   └── 2-manager
-        │   ├── permanent_data.env
+    │   │   └── services.d
-        │   ├── permanent_data.sh
+    │   │       ├── filebeat
-        │   └── wazuh.repo
+    │   │       │   ├── finish
-        └── Dockerfile
+    │   │       │   └── run
-
+    │   │       └── ossec-logs
+    │   │           └── run
+    │   ├── filebeat.yml
+    │   ├── permanent_data.env
+    │   ├── permanent_data.sh
+    │   └── wazuh.repo
+    └── Dockerfile
 
 
 ## Branches
@@ -154,7 +160,7 @@ ADMIN_PRIVILEGES=true               # App privileges
 
 | Wazuh version | ODFE    | XPACK  |
 |---------------|---------|--------|
-| v4.3.0        | 1.13.2  | 7.11.2 |
+| v4.3.0        |         |        |
 | v4.2.5        | 1.13.2  | 7.11.2 |
 | v4.2.4        | 1.13.2  | 7.11.2 |
 | v4.2.3        | 1.13.2  | 7.11.2 |

build-wazuh-images.yml

@@ -2,10 +2,10 @@
 version: '3.7'
 
 services:
-  wazuh:
+  wazuh.manager:
-    build:  wazuh-odfe/
+    build:  wazuh-manager/
-    image: wazuh/wazuh-odfe:dev-version
+    image: wazuh/wazuh-manager:4.3.0
-    hostname: wazuh-manager
+    hostname: wazuh.manager
     restart: always
     ports:
       - "1514:1514"
@@ -13,9 +13,9 @@ services:
       - "514:514/udp"
       - "55000:55000"
     environment:
-      - ELASTICSEARCH_URL=https://elasticsearch:9200
+      - INDEXER_URL=https://wazuh1.indexer:9200
-      - ELASTIC_USERNAME=admin
+      - INDEXER_USERNAME=admin
-      - ELASTIC_PASSWORD=admin
+      - INDEXER_PASSWORD=admin
       - FILEBEAT_SSL_VERIFICATION_MODE=none
     volumes:
       - ossec_api_configuration:/var/ossec/api/configuration
@@ -30,18 +30,15 @@ services:
       - filebeat_etc:/etc/filebeat
       - filebeat_var:/var/lib/filebeat
 
-  elasticsearch:
+  wazuh1.indexer:
-    image: amazon/opendistro-for-elasticsearch:1.13.2
+    build: wazuh-indexer/
-    hostname: elasticsearch
+    image: wazuh/wazuh-indexer:4.3.0
+    hostname: wazuh1.indexer
     restart: always
     ports:
       - "9200:9200"
     environment:
-      - discovery.type=single-node
+      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
-      - cluster.name=wazuh-cluster
-      - network.host=0.0.0.0
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
-      - bootstrap.memory_lock=true
     ulimits:
       memlock:
         soft: -1
@@ -50,25 +47,23 @@ services:
         soft: 65536
         hard: 65536
 
-  kibana:
+  wazuh.dashboard:
-    build: kibana-odfe/
+    build: wazuh-dashboard/
-    image: wazuh/wazuh-kibana-odfe:dev-version
+    image: wazuh/wazuh-dashboard:4.3.0
-    hostname: kibana
+    hostname: wazuh.dashboard
     restart: always
     ports:
-      - 443:5601
+      - 443:443
     environment:
-      - ELASTICSEARCH_USERNAME=admin
+      - INDEXER_USERNAME=admin
-      - ELASTICSEARCH_PASSWORD=admin
+      - INDEXER_PASSWORD=admin
-      - SERVER_SSL_ENABLED=true
+      - SERVER_SSL_ENABLED=false
-      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert
+      - WAZUH_API_URL=https://wazuh.manager
-      - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key
-
     depends_on:
-      - elasticsearch
+      - wazuh1.indexer
     links:
-      - elasticsearch:elasticsearch
+      - wazuh1.indexer:wazuh1.indexer
-      - wazuh:wazuh
+      - wazuh.manager:wazuh.manager
 
 volumes:
   ossec_api_configuration:

docker-compose.yml

@@ -2,9 +2,9 @@
 version: '3.7'
 
 services:
-  wazuh:
+  wazuh.manager:
-    image: wazuh/wazuh-odfe:4.3.0
+    image: wazuh/wazuh-manager:4.3.0
-    hostname: wazuh-manager
+    hostname: wazuh.manager
     restart: always
     ports:
       - "1514:1514"
@@ -12,9 +12,9 @@ services:
       - "514:514/udp"
       - "55000:55000"
     environment:
-      - ELASTICSEARCH_URL=https://elasticsearch:9200
+      - INDEXER_URL=https://wazuh1.indexer:9200
-      - ELASTIC_USERNAME=admin
+      - INDEXER_USERNAME=admin
-      - ELASTIC_PASSWORD=admin
+      - INDEXER_PASSWORD=admin
       - FILEBEAT_SSL_VERIFICATION_MODE=none
     volumes:
       - ossec_api_configuration:/var/ossec/api/configuration
@@ -29,18 +29,14 @@ services:
       - filebeat_etc:/etc/filebeat
       - filebeat_var:/var/lib/filebeat
 
-  elasticsearch:
+  wazuh1.indexer:
-    image: amazon/opendistro-for-elasticsearch:1.13.2
+    image: wazuh/wazuh-indexer:4.3.0
-    hostname: elasticsearch
+    hostname: wazuh1.indexer
     restart: always
     ports:
       - "9200:9200"
     environment:
-      - discovery.type=single-node
+      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
-      - cluster.name=wazuh-cluster
-      - network.host=0.0.0.0
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
-      - bootstrap.memory_lock=true
     ulimits:
       memlock:
         soft: -1
@@ -49,24 +45,21 @@ services:
         soft: 65536
         hard: 65536
 
-  kibana:
+  wazuh.dashboard:
-    image: wazuh/wazuh-kibana-odfe:4.3.0
+    image: wazuh/wazuh-dashboard:4.3.0
-    hostname: kibana
+    hostname: wazuh.dashboard
     restart: always
     ports:
-      - 443:5601
+      - 443:443
     environment:
-      - ELASTICSEARCH_USERNAME=admin
+      - INDEXER_USERNAME=admin
-      - ELASTICSEARCH_PASSWORD=admin
+      - INDEXER_PASSWORD=admin
-      - SERVER_SSL_ENABLED=true
+      - WAZUH_API_URL=https://wazuh.manager
-      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert
-      - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key
-
     depends_on:
-      - elasticsearch
+      - wazuh1.indexer
     links:
-      - elasticsearch:elasticsearch
+      - wazuh1.indexer:wazuh1.indexer
-      - wazuh:wazuh
+      - wazuh.manager:wazuh.manager
 
 volumes:
   ossec_api_configuration:

generate-elasticsearch-certs.yml

@@ -1,17 +0,0 @@
-version: '2.2'
-
-services:
-  generator:
-    container_name: generator
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
-    command: >
-      bash -c '
-        if [[ ! -f config/certificates/bundle.zip ]]; then
-          bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out config/certificates/bundle.zip;
-          unzip config/certificates/bundle.zip -d config/certificates/;
-        fi;
-        chown -R 1000:0 config/certificates
-      '
-    user: "0"
-    working_dir: /usr/share/elasticsearch
-    volumes: ['./xpack:/usr/share/elasticsearch/config/certificates']

generate-indexer-certs.yml

@@ -0,0 +1,10 @@
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+version: '3'
+
+services:
+  generator:
+    image: wazuh/wazuh-certs-generator:0.0.1
+    hostname: wazuh-certs-generator
+    volumes:
+      - ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/config.yml
+      - ./production_cluster/wazuh_indexer_ssl_certs/:/certificates/

generate-opendistro-certs.yml

@@ -1,10 +0,0 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-version: '3'
-
-services:
-  generator:
-    image: wazuh/opendistro-certs-generator:0.1
-    hostname: opendistro-certs-generator
-    volumes:
-      - ./production_cluster/ssl_certs/certs.yml:/usr/src/config/myconf.yml
-      - ./production_cluster/ssl_certs/:/usr/src/certs/out/ 

indexer_certs_creator/Dockerfile

@@ -0,0 +1,12 @@
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+FROM ubuntu:focal
+
+RUN apt-get update && apt-get install openssl curl -y
+
+WORKDIR /
+
+COPY config/entrypoint.sh /
+
+RUN chmod 700 /entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]

indexer_certs_creator/config/entrypoint.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+
+##############################################################################
+# Downloading Cert Gen Tool
+##############################################################################
+
+## Variables
+CERT_TOOL=wazuh-certs-tool.sh
+PASSWORD_TOOL=wazuh-passwords-tool.sh
+PACKAGES_URL=https://packages.wazuh.com/4.3/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/
+
+## Check if the cert tool exists in S3 buckets
+CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+
+## If cert tool exists in some bucket, download it, if not exit 1
+if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
+  curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL
+  echo "Cert tool exists in Packages bucket"
+elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
+  curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL
+  echo "Cert tool exists in Packages-dev bucket"
+else
+  echo "Cert tool does not exist in any bucket"
+  echo "ERROR: certificates were not created"
+  exit 1
+fi
+
+chmod 700 /$CERT_TOOL
+
+##############################################################################
+# Creating Cluster certificates
+##############################################################################
+
+/$CERT_TOOL
+echo "Moving created certificates to destination directory"
+cp /certs/* /certificates/
+echo "changing certificate permissions"
+chmod -R 666 /certificates/*

kibana-odfe/Dockerfile

@@ -1,59 +0,0 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2
-USER kibana
-ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.3.0
-ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
-
-WORKDIR /usr/share/kibana
-RUN ./bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip
-
-WORKDIR /
-USER root
-COPY config/entrypoint.sh ./entrypoint.sh
-RUN chmod 755 ./entrypoint.sh
-
-ENV PATTERN="" \
-    CHECKS_PATTERN="" \
-    CHECKS_TEMPLATE="" \
-    CHECKS_API="" \
-    CHECKS_SETUP="" \
-    EXTENSIONS_PCI="" \
-    EXTENSIONS_GDPR="" \
-    EXTENSIONS_HIPAA="" \
-    EXTENSIONS_NIST="" \
-    EXTENSIONS_TSC="" \
-    EXTENSIONS_AUDIT="" \
-    EXTENSIONS_OSCAP="" \
-    EXTENSIONS_CISCAT="" \
-    EXTENSIONS_AWS="" \
-    EXTENSIONS_GCP="" \
-    EXTENSIONS_VIRUSTOTAL="" \
-    EXTENSIONS_OSQUERY="" \
-    EXTENSIONS_DOCKER="" \
-    APP_TIMEOUT="" \
-    API_SELECTOR="" \
-    IP_SELECTOR="" \
-    IP_IGNORE="" \
-    WAZUH_MONITORING_ENABLED="" \
-    WAZUH_MONITORING_FREQUENCY="" \
-    WAZUH_MONITORING_SHARDS="" \
-    WAZUH_MONITORING_REPLICAS="" \
-    ADMIN_PRIVILEGES=""
-
-USER kibana
-
-COPY ./config/custom_welcome /tmp/custom_welcome
-COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
-RUN chmod +x ./welcome_wazuh.sh
-ARG CHANGE_WELCOME="true"
-RUN ./welcome_wazuh.sh
-
-COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/data/wazuh/config/wazuh.yml
-COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
-RUN chmod +x ./wazuh_app_config.sh
-
-COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
-RUN chmod +x ./kibana_settings.sh
-
-ENTRYPOINT ./entrypoint.sh

kibana-odfe/config/custom_welcome/template.js.hbs

@@ -1,112 +0,0 @@
-var kbnCsp = JSON.parse(document.querySelector('kbn-csp').getAttribute('data'));
-window.__kbnStrictCsp__ = kbnCsp.strictCsp;
-window.__kbnThemeTag__ = "{{themeTag}}";
-window.__kbnPublicPath__ = {{publicPathMap}};
-window.__kbnBundles__ = {{kbnBundlesLoaderSource}}
-
-if (window.__kbnStrictCsp__ && window.__kbnCspNotEnforced__) {
-  var legacyBrowserError = document.getElementById('kbn_legacy_browser_error');
-  legacyBrowserError.style.display = 'flex';
-} else {
-  if (!window.__kbnCspNotEnforced__ && window.console) {
-    window.console.log("^ A single error about an inline script not firing due to content security policy is expected!");
-  }
-  var loadingMessage = document.getElementById('kbn_loading_message');
-  loadingMessage.style.display = 'flex';
-
-  window.onload = function () {
-    //WAZUH 
-      var interval = setInterval(() => {  
-        var title = document.querySelector("#kibana-body > div > div.app-wrapper.hidden-chrome > div > div.application > div > ul > div.euiText.euiText--medium > div")
-        if (!!title) {
-          clearInterval(interval);
-	  var content = document.querySelector("#kibana-body > div");
-          content.classList.add("wz-login")
-          title.textContent = "Welcome to Wazuh";
-          var subtitle = document.querySelector("#kibana-body > div > div.app-wrapper.hidden-chrome > div > div.application > div > ul > div.euiText.euiText--small > div")
-          subtitle.textContent = "The Open Source Security Platform";
-          var logo = document.querySelector("#kibana-body > div > div.app-wrapper.hidden-chrome > div > div.application > div > ul > figure");
-          logo.remove();
-          var logoContainer = document.querySelector("#kibana-body > div > div.app-wrapper.hidden-chrome > div > div.application > div > ul");
-          $(logoContainer).prepend('<span class="loginWelcome__logo"></span>');
-        } 
-      })  
-    //
-
-    function failure() {
-      // make subsequent calls to failure() noop
-      failure = function () {};
-
-      var err = document.createElement('h1');
-      err.style['color'] = 'white';
-      err.style['font-family'] = 'monospace';
-      err.style['text-align'] = 'center';
-      err.style['background'] = '#F44336';
-      err.style['padding'] = '25px';
-      err.innerText = document.querySelector('[data-error-message]').dataset.errorMessage;
-
-      document.body.innerHTML = err.outerHTML;
-    }
-
-    var stylesheetTarget = document.querySelector('head meta[name="add-styles-here"]')
-    function loadStyleSheet(url, cb) {
-      var dom = document.createElement('link');
-      dom.rel = 'stylesheet';
-      dom.type = 'text/css';
-      dom.href = url;
-      dom.addEventListener('error', failure);
-      dom.addEventListener('load', cb);
-      document.head.insertBefore(dom, stylesheetTarget);
-    }
-
-    var scriptsTarget = document.querySelector('head meta[name="add-scripts-here"]')
-    function loadScript(url, cb) {
-      var dom = document.createElement('script');
-      {{!-- NOTE: async = false is used to trigger async-download/ordered-execution as outlined here: https://www.html5rocks.com/en/tutorials/speed/script-loading/ --}}
-      dom.async = false;
-      dom.src = url;
-      dom.addEventListener('error', failure);
-      dom.addEventListener('load', cb);
-      document.head.insertBefore(dom, scriptsTarget);
-    }
-
-    function load(urls, cb) {
-      var pending = urls.length;
-      urls.forEach(function (url) {
-        var innerCb = function () {
-          pending = pending - 1;
-          if (pending === 0 && typeof cb === 'function') {
-            cb();
-          }
-        }
-
-        if (typeof url !== 'string') {
-          load(url, innerCb);
-        } else if (url.slice(-4) === '.css') {
-          loadStyleSheet(url, innerCb);
-        } else {
-          loadScript(url, innerCb);
-        }
-      });
-    }
-
-    load([
-      {{#each jsDependencyPaths}}
-        '{{this}}',
-      {{/each}}
-    ], function () {
-      {{#unless legacyBundlePath}}
-        __kbnBundles__.get('entry/core/public').__kbnBootstrap__();
-      {{/unless}}
-
-      load([
-        {{#if legacyBundlePath}}
-          '{{legacyBundlePath}}',
-        {{/if}}
-        {{#each styleSheetPaths}}
-          '{{this}}',
-        {{/each}}
-      ]);
-    });
-  }
-}

kibana-odfe/config/custom_welcome/wazuh_logo_circle.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 84.67 84.67"><defs><style>.a{fill:#fff;}.b{fill:#00a9e5;}</style></defs><title>wazuh_logo_circle</title><circle class="a" cx="42.34" cy="42.34" r="42.34"/><path class="b" d="M58.13,9.2,50,26.32H35.07L26.16,9.2,20,31l-8.53,9.72,19.18,17.6,7.47,17.21h8.53l7-16.91L73.24,40.83l-8.73-9.57ZM48.58,55.13a1.79,1.79,0,0,1-.74.62,2.49,2.49,0,0,1-1,.2,2.52,2.52,0,0,1-1-.2,1.84,1.84,0,0,1-.71-.62l-2.88-4.36-2.9,4.36a1.87,1.87,0,0,1-.72.62,2.48,2.48,0,0,1-.95.2,1.94,1.94,0,0,1-1.7-.82L21.3,41.37h4.09L37.87,52.3l2.49-3.89h3.93L47,52.3,59.63,40.9h3.74Z"/></svg>

kibana-odfe/config/entrypoint.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-
-set -e
-
-##############################################################################
-# Waiting for elasticsearch
-##############################################################################
-
-if [ "x${ELASTICSEARCH_URL}" == "x" ]; then
-  if [[ ${ENABLED_SECURITY} == "false" ]]; then
-    export el_url="http://elasticsearch:9200"
-  else
-    export el_url="https://elasticsearch:9200"
-  fi
-else
-  export el_url="${ELASTICSEARCH_URL}"
-fi
-
-if [[ ${ENABLED_SECURITY} == "false" || "x${ELASTICSEARCH_USERNAME}" == "x" || "x${ELASTICSEARCH_PASSWORD}" == "x" ]]; then
-  auth=""
-  # remove security plugin from kibana if elasticsearch is not using it either
-  /usr/share/kibana/bin/kibana-plugin remove opendistro_security
-else
-  export auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} -k"
-fi
-
-until curl -XGET $el_url ${auth}; do
-  >&2 echo "Elastic is unavailable - sleeping"
-  sleep 5
-done
-
-sleep 2
-
->&2 echo "Elasticsearch is up."
-
-
-##############################################################################
-# Waiting for wazuh alerts template
-##############################################################################
-
-strlen=0
-
-while [[ $strlen -eq 0 ]]
-do
-  template=$(curl ${auth} $el_url/_cat/templates/wazuh -s)
-  strlen=${#template}
-  >&2 echo "Wazuh alerts template not loaded - sleeping."
-  sleep 2
-done
-
-sleep 2
-
->&2 echo "Wazuh alerts template is loaded."
-
-
-./wazuh_app_config.sh
-
-sleep 5
-
-./kibana_settings.sh &
-
-sleep 2
-
-/usr/local/bin/kibana-docker

kibana-odfe/config/kibana_settings.sh

@@ -1,58 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-
-WAZUH_MAJOR=4
-
-##############################################################################
-# Wait for the Kibana API to start. It is necessary to do it in this container
-# because the others are running Elastic Stack and we can not interrupt them.
-#
-# The following actions are performed:
-#
-# Add the wazuh alerts index as default.
-# Set the Discover time interval to 24 hours instead of 15 minutes.
-# Do not ask user to help providing usage statistics to Elastic.
-##############################################################################
-
-##############################################################################
-# Customize elasticsearch ip
-##############################################################################
-sed -i "s|elasticsearch.hosts:.*|elasticsearch.hosts: $el_url|g" /usr/share/kibana/config/kibana.yml
-
-# If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate.
-if [ "$KIBANA_INDEX" != "" ]; then
-  if grep -q 'kibana.index' /usr/share/kibana/config/kibana.yml; then
-    sed -i '/kibana.index/d' /usr/share/kibana/config/kibana.yml
-  fi
-    echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
-fi
-
-while [[ "$(curl -XGET -I  -s -o /dev/null -w '%{http_code}' -k https://127.0.0.1:5601/app/login)" != "200" ]]; do
-  echo "Waiting for Kibana API. Sleeping 5 seconds"
-  sleep 5
-done
-
-# Prepare index selection.
-echo "Kibana API is running"
-
-default_index="/tmp/default_index.json"
-
-cat > ${default_index} << EOF
-{
-  "changes": {
-    "defaultIndex": "wazuh-alerts-${WAZUH_MAJOR}.x-*"
-  }
-}
-EOF
-
-sleep 5
-# Add the wazuh alerts index as default.
-curl ${auth} -POST -k https://127.0.0.1:5601/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
-rm -f ${default_index}
-
-sleep 5
-# Configuring Kibana TimePicker.
-curl ${auth} -POST -k "https://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
-'{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-12h\",\n  \"to\": \"now\"}"}}'
-
-echo "End settings"

kibana-odfe/config/wazuh.yml

@@ -1,162 +0,0 @@
----
-#
-# Wazuh app - App configuration file
-# Copyright (C) 2015-2021 Wazuh, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Find more information about this on the LICENSE file.
-#
-# ======================== Wazuh app configuration file ========================
-#
-# Please check the documentation for more information on configuration options:
-# https://documentation.wazuh.com/current/installation-guide/index.html
-#
-# Also, you can check our repository:
-# https://github.com/wazuh/wazuh-kibana-app
-#
-# ------------------------------- Index patterns -------------------------------
-#
-# Default index pattern to use.
-#pattern: wazuh-alerts-*
-#
-# ----------------------------------- Checks -----------------------------------
-#
-# Defines which checks must to be consider by the healthcheck
-# step once the Wazuh app starts. Values must to be true or false.
-#checks.pattern : true
-#checks.template: true
-#checks.api     : true
-#checks.setup   : true
-#checks.metaFields: true
-#
-# --------------------------------- Extensions ---------------------------------
-#
-# Defines which extensions should be activated when you add a new API entry.
-# You can change them after Wazuh app starts.
-# Values must to be true or false.
-#extensions.pci       : true
-#extensions.gdpr      : true
-#extensions.hipaa     : true
-#extensions.nist      : true
-#extensions.tsc       : true
-#extensions.audit     : true
-#extensions.oscap     : false
-#extensions.ciscat    : false
-#extensions.aws       : false
-#extensions.gcp       : false
-#extensions.virustotal: false
-#extensions.osquery   : false
-#extensions.docker    : false
-#
-# ---------------------------------- Time out ----------------------------------
-#
-# Defines maximum timeout to be used on the Wazuh app requests.
-# It will be ignored if it is bellow 1500.
-# It means milliseconds before we consider a request as failed.
-# Default: 20000
-#timeout: 20000
-#
-# -------------------------------- API selector --------------------------------
-#
-# Defines if the user is allowed to change the selected
-# API directly from the Wazuh app top menu.
-# Default: true
-#api.selector: true
-#
-# --------------------------- Index pattern selector ---------------------------
-#
-# Defines if the user is allowed to change the selected
-# index pattern directly from the Wazuh app top menu.
-# Default: true
-#ip.selector: true
-#
-# List of index patterns to be ignored
-#ip.ignore: []
-#
-# -------------------------------- X-Pack RBAC ---------------------------------
-#
-# Custom setting to enable/disable built-in X-Pack RBAC security capabilities.
-# Default: enabled
-#xpack.rbac.enabled: true
-#
-# ------------------------------ wazuh-monitoring ------------------------------
-#
-# Custom setting to enable/disable wazuh-monitoring indices.
-# Values: true, false, worker
-# If worker is given as value, the app will show the Agents status
-# visualization but won't insert data on wazuh-monitoring indices.
-# Default: true
-#wazuh.monitoring.enabled: true
-#
-# Custom setting to set the frequency for wazuh-monitoring indices cron task.
-# Default: 900 (s)
-#wazuh.monitoring.frequency: 900
-#
-# Configure wazuh-monitoring-* indices shards and replicas.
-#wazuh.monitoring.shards: 2
-#wazuh.monitoring.replicas: 0
-#
-# Configure wazuh-monitoring-* indices custom creation interval.
-# Values: h (hourly), d (daily), w (weekly), m (monthly)
-# Default: d
-#wazuh.monitoring.creation: d
-#
-# Default index pattern to use for Wazuh monitoring
-#wazuh.monitoring.pattern: wazuh-monitoring-*
-#
-# --------------------------------- wazuh-cron ----------------------------------
-#
-# Customize the index prefix of predefined jobs
-# This change is not retroactive, if you change it new indexes will be created
-# cron.prefix: test
-#
-# ------------------------------ wazuh-statistics -------------------------------
-#
-# Custom setting to enable/disable statistics tasks.
-#cron.statistics.status: true
-#
-# Enter the ID of the APIs you want to save data from, leave this empty to run
-# the task on all configured APIs
-#cron.statistics.apis: []
-#
-# Define the frequency of task execution using cron schedule expressions
-#cron.statistics.interval: 0 0 * * * *
-#
-# Define the name of the index in which the documents are to be saved.
-#cron.statistics.index.name: statistics
-#
-# Define the interval in which the index will be created
-#cron.statistics.index.creation: w
-#
-# ------------------------------- App privileges --------------------------------
-#admin: true
-#
-# ---------------------------- Hide manager alerts ------------------------------
-# Hide the alerts of the manager in all dashboards and discover
-#hideManagerAlerts: false
-#
-# ------------------------------- App logging level -----------------------------
-# Set the logging level for the Wazuh App log files.
-# Default value: info
-# Allowed values: info, debug
-#logs.level: info
-#
-# -------------------------------- Enrollment DNS -------------------------------
-# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment.
-# Default value: ''
-#enrollment.dns: ''
-#
-#-------------------------------- API entries -----------------------------------
-#The following configuration is the default structure to define an API entry.
-#
-#hosts:
-#  - <id>:
-#     url: http(s)://<url>
-#     port: <port>
-#     username: <username>
-#     password: <password>
-

kibana-odfe/config/wazuh_app_config.sh

@@ -1,62 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-
-wazuh_url="${WAZUH_API_URL:-https://wazuh}"
-wazuh_port="${API_PORT:-55000}"
-api_username="${API_USERNAME:-wazuh-wui}"
-api_password="${API_PASSWORD:-wazuh-wui}"
-
-kibana_config_file="/usr/share/kibana/data/wazuh/config/wazuh.yml"
-
-declare -A CONFIG_MAP=(
-  [pattern]=$PATTERN
-  [checks.pattern]=$CHECKS_PATTERN
-  [checks.template]=$CHECKS_TEMPLATE
-  [checks.api]=$CHECKS_API
-  [checks.setup]=$CHECKS_SETUP
-  [extensions.pci]=$EXTENSIONS_PCI
-  [extensions.gdpr]=$EXTENSIONS_GDPR
-  [extensions.hipaa]=$EXTENSIONS_HIPAA
-  [extensions.nist]=$EXTENSIONS_NIST
-  [extensions.tsc]=$EXTENSIONS_TSC
-  [extensions.audit]=$EXTENSIONS_AUDIT
-  [extensions.oscap]=$EXTENSIONS_OSCAP
-  [extensions.ciscat]=$EXTENSIONS_CISCAT
-  [extensions.aws]=$EXTENSIONS_AWS
-  [extensions.gcp]=$EXTENSIONS_GCP
-  [extensions.virustotal]=$EXTENSIONS_VIRUSTOTAL
-  [extensions.osquery]=$EXTENSIONS_OSQUERY
-  [extensions.docker]=$EXTENSIONS_DOCKER
-  [timeout]=$APP_TIMEOUT
-  [api.selector]=$API_SELECTOR
-  [ip.selector]=$IP_SELECTOR
-  [ip.ignore]=$IP_IGNORE
-  [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
-  [wazuh.monitoring.creation]=$WAZUH_MONITORING_CREATION
-  [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
-  [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
-  [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
-  [admin]=$ADMIN_PRIVILEGES
-)
-
-for i in "${!CONFIG_MAP[@]}"
-do
-    if [ "${CONFIG_MAP[$i]}" != "" ]; then
-        sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
-    fi
-done
-
-CONFIG_CODE=$(curl ${auth} -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013)
-
-if [[ "x$CONFIG_CODE" != "x200" ]] && ! grep -q 1513629884013 $kibana_config_file ; then
-cat << EOF >> $kibana_config_file
-hosts:
-  - 1513629884013:
-      url: $wazuh_url
-      port: $wazuh_port
-      username: $api_username
-      password: $api_password
-EOF
-else
-  echo "Wazuh APP already configured"
-fi

kibana-odfe/config/welcome_wazuh.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-
-if [[ $CHANGE_WELCOME == "true" ]]
-then
-    echo "Set Wazuh app as the default landing page"
-    echo "server.defaultRoute: /app/wazuh?security_tenant=global" >> /usr/share/kibana/config/kibana.yml
-
-    echo "Set custom welcome styles"
-    cp -f /tmp/custom_welcome/template.js.hbs /usr/share/kibana/src/legacy/ui/ui_render/bootstrap/template.js.hbs
-    cp -f /tmp/custom_welcome/light_theme.style.css /usr/share/kibana/src/core/server/core_app/assets/legacy_light_theme.css
-    cp -f /tmp/custom_welcome/*svg /usr/share/kibana/src/core/server/core_app/assets/
-fi
-

kibana/Dockerfile

@@ -1,64 +0,0 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-FROM docker.elastic.co/kibana/kibana:7.10.2
-USER kibana
-ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.3.0
-ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
-
-WORKDIR /usr/share/kibana
-RUN ./bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip
-
-ENV PATTERN="" \
-    CHECKS_PATTERN="" \
-    CHECKS_TEMPLATE="" \
-    CHECKS_API="" \
-    CHECKS_SETUP="" \
-    EXTENSIONS_PCI="" \
-    EXTENSIONS_GDPR="" \
-    EXTENSIONS_HIPAA="" \
-    EXTENSIONS_NIST="" \
-    EXTENSIONS_TSC="" \
-    EXTENSIONS_AUDIT="" \
-    EXTENSIONS_OSCAP="" \
-    EXTENSIONS_CISCAT="" \
-    EXTENSIONS_AWS="" \
-    EXTENSIONS_GCP="" \
-    EXTENSIONS_VIRUSTOTAL="" \
-    EXTENSIONS_OSQUERY="" \
-    EXTENSIONS_DOCKER="" \
-    APP_TIMEOUT="" \
-    API_SELECTOR="" \
-    IP_SELECTOR="" \
-    IP_IGNORE="" \
-    WAZUH_MONITORING_ENABLED="" \
-    WAZUH_MONITORING_FREQUENCY="" \
-    WAZUH_MONITORING_SHARDS="" \
-    WAZUH_MONITORING_REPLICAS="" \
-    ADMIN_PRIVILEGES="" \
-    XPACK_CANVAS="true" \
-    XPACK_LOGS="true"   \
-    XPACK_INFRA="true"  \
-    XPACK_ML="true" \
-    XPACK_DEVTOOLS="true"   \
-    XPACK_MONITORING="true" \
-    XPACK_APM="true"
-
-WORKDIR /
-USER kibana
-
-COPY --chown=kibana:kibana config/entrypoint.sh ./entrypoint.sh
-RUN chmod 755 ./entrypoint.sh
-
-RUN printf "\nserver.defaultRoute: /app/wazuh\n" >> /usr/share/kibana/config/kibana.yml
-
-COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/data/wazuh/config/wazuh.yml
-COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
-RUN chmod +x ./wazuh_app_config.sh
-
-COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
-RUN chmod +x ./kibana_settings.sh
-
-COPY --chown=kibana:kibana ./config/xpack_config.sh ./
-RUN chmod +x ./xpack_config.sh
-
-ENTRYPOINT ./entrypoint.sh

kibana/config/entrypoint.sh

@@ -1,60 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-
-set -e
-
-##############################################################################
-# Waiting for elasticsearch
-##############################################################################
-
-if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
-  export el_url="http://elasticsearch:9200"
-else
-  export el_url="${ELASTICSEARCH_URL}"
-fi
-
-if [[ ${ENABLED_SECURITY} == "false" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then
-  export auth=""
-else
-  export auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} -k"
-fi
-
-until curl -XGET $el_url ${auth}; do
-  >&2 echo "Elastic is unavailable - sleeping"
-  sleep 5
-done
-
-sleep 2
-
->&2 echo "Elasticsearch is up."
-
-
-##############################################################################
-# Waiting for wazuh alerts template
-##############################################################################
-
-strlen=0
-
-while [[ $strlen -eq 0 ]]
-do
-  template=$(curl ${auth} $el_url/_cat/templates/wazuh -s)
-  strlen=${#template}
-  >&2 echo "Wazuh alerts template not loaded - sleeping."
-  sleep 2
-done
-
-sleep 2
-
->&2 echo "Wazuh alerts template is loaded."
-
-./xpack_config.sh
-
-./wazuh_app_config.sh
-
-sleep 5
-
-./kibana_settings.sh &
-
-sleep 2
-
-/usr/local/bin/kibana-docker

kibana/config/kibana_settings.sh

@@ -1,79 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-
-WAZUH_MAJOR=4
-
-##############################################################################
-# Wait for the Kibana API to start. It is necessary to do it in this container
-# because the others are running Elastic Stack and we can not interrupt them.
-#
-# The following actions are performed:
-#
-# Add the wazuh alerts index as default.
-# Set the Discover time interval to 24 hours instead of 15 minutes.
-# Do not ask user to help providing usage statistics to Elastic.
-##############################################################################
-
-##############################################################################
-# Customize elasticsearch ip
-##############################################################################
-sed -i "s|elasticsearch.hosts:.*|elasticsearch.hosts: $el_url|g" /usr/share/kibana/config/kibana.yml
-
-# If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate.
-if [ "$KIBANA_INDEX" != "" ]; then
-  if grep -q 'kibana.index' /usr/share/kibana/config/kibana.yml; then
-    sed -i '/kibana.index/d' /usr/share/kibana/config/kibana.yml
-  fi
-    echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
-fi
-
-kibana_proto="http"
-
-if [ "$XPACK_SECURITY_ENABLED" != "" ]; then
-  kibana_proto="https"
-  if grep -q 'xpack.security.enabled' /usr/share/kibana/config/kibana.yml; then
-    sed -i '/xpack.security.enabled/d' /usr/share/kibana/config/kibana.yml
-  fi
-    echo "xpack.security.enabled: $XPACK_SECURITY_ENABLED" >> /usr/share/kibana/config/kibana.yml
-fi
-
-# Add auth headers if required
-if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
-    curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
-fi
-
-while [[ "$(curl $curl_auth -XGET -I  -s -o /dev/null -w ''%{http_code}'' -k $kibana_proto://127.0.0.1:5601/status)" != "200" ]]; do
-  echo "Waiting for Kibana API. Sleeping 5 seconds"
-  sleep 5
-done
-
-
-
-# Prepare index selection.
-echo "Kibana API is running"
-
-default_index="/tmp/default_index.json"
-
-cat > ${default_index} << EOF
-{
-  "changes": {
-    "defaultIndex": "wazuh-alerts-${WAZUH_MAJOR}.x-*"
-  }
-}
-EOF
-
-sleep 5
-# Add the wazuh alerts index as default.
-curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
-rm -f ${default_index}
-
-sleep 5
-# Configuring Kibana TimePicker.
-curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
-'{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-12h\",\n  \"to\": \"now\"}"}}'
-
-sleep 5
-# Do not ask user to help providing usage statistics to Elastic
-curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
-
-echo "End settings"

kibana/config/wazuh.yml

@@ -1,162 +0,0 @@
----
-#
-# Wazuh app - App configuration file
-# Copyright (C) 2015-2021 Wazuh, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Find more information about this on the LICENSE file.
-#
-# ======================== Wazuh app configuration file ========================
-#
-# Please check the documentation for more information on configuration options:
-# https://documentation.wazuh.com/current/installation-guide/index.html
-#
-# Also, you can check our repository:
-# https://github.com/wazuh/wazuh-kibana-app
-#
-# ------------------------------- Index patterns -------------------------------
-#
-# Default index pattern to use.
-#pattern: wazuh-alerts-*
-#
-# ----------------------------------- Checks -----------------------------------
-#
-# Defines which checks must to be consider by the healthcheck
-# step once the Wazuh app starts. Values must to be true or false.
-#checks.pattern : true
-#checks.template: true
-#checks.api     : true
-#checks.setup   : true
-#checks.metaFields: true
-#
-# --------------------------------- Extensions ---------------------------------
-#
-# Defines which extensions should be activated when you add a new API entry.
-# You can change them after Wazuh app starts.
-# Values must to be true or false.
-#extensions.pci       : true
-#extensions.gdpr      : true
-#extensions.hipaa     : true
-#extensions.nist      : true
-#extensions.tsc       : true
-#extensions.audit     : true
-#extensions.oscap     : false
-#extensions.ciscat    : false
-#extensions.aws       : false
-#extensions.gcp       : false
-#extensions.virustotal: false
-#extensions.osquery   : false
-#extensions.docker    : false
-#
-# ---------------------------------- Time out ----------------------------------
-#
-# Defines maximum timeout to be used on the Wazuh app requests.
-# It will be ignored if it is bellow 1500.
-# It means milliseconds before we consider a request as failed.
-# Default: 20000
-#timeout: 20000
-#
-# -------------------------------- API selector --------------------------------
-#
-# Defines if the user is allowed to change the selected
-# API directly from the Wazuh app top menu.
-# Default: true
-#api.selector: true
-#
-# --------------------------- Index pattern selector ---------------------------
-#
-# Defines if the user is allowed to change the selected
-# index pattern directly from the Wazuh app top menu.
-# Default: true
-#ip.selector: true
-#
-# List of index patterns to be ignored
-#ip.ignore: []
-#
-# -------------------------------- X-Pack RBAC ---------------------------------
-#
-# Custom setting to enable/disable built-in X-Pack RBAC security capabilities.
-# Default: enabled
-#xpack.rbac.enabled: true
-#
-# ------------------------------ wazuh-monitoring ------------------------------
-#
-# Custom setting to enable/disable wazuh-monitoring indices.
-# Values: true, false, worker
-# If worker is given as value, the app will show the Agents status
-# visualization but won't insert data on wazuh-monitoring indices.
-# Default: true
-#wazuh.monitoring.enabled: true
-#
-# Custom setting to set the frequency for wazuh-monitoring indices cron task.
-# Default: 900 (s)
-#wazuh.monitoring.frequency: 900
-#
-# Configure wazuh-monitoring-* indices shards and replicas.
-#wazuh.monitoring.shards: 2
-#wazuh.monitoring.replicas: 0
-#
-# Configure wazuh-monitoring-* indices custom creation interval.
-# Values: h (hourly), d (daily), w (weekly), m (monthly)
-# Default: d
-#wazuh.monitoring.creation: d
-#
-# Default index pattern to use for Wazuh monitoring
-#wazuh.monitoring.pattern: wazuh-monitoring-*
-#
-# --------------------------------- wazuh-cron ----------------------------------
-#
-# Customize the index prefix of predefined jobs
-# This change is not retroactive, if you change it new indexes will be created
-# cron.prefix: test
-#
-# ------------------------------ wazuh-statistics -------------------------------
-#
-# Custom setting to enable/disable statistics tasks.
-#cron.statistics.status: true
-#
-# Enter the ID of the APIs you want to save data from, leave this empty to run
-# the task on all configured APIs
-#cron.statistics.apis: []
-#
-# Define the frequency of task execution using cron schedule expressions
-#cron.statistics.interval: 0 0 * * * *
-#
-# Define the name of the index in which the documents are to be saved.
-#cron.statistics.index.name: statistics
-#
-# Define the interval in which the index will be created
-#cron.statistics.index.creation: w
-#
-# ------------------------------- App privileges --------------------------------
-#admin: true
-#
-# ---------------------------- Hide manager alerts ------------------------------
-# Hide the alerts of the manager in all dashboards and discover
-#hideManagerAlerts: false
-#
-# ------------------------------- App logging level -----------------------------
-# Set the logging level for the Wazuh App log files.
-# Default value: info
-# Allowed values: info, debug
-#logs.level: info
-#
-# -------------------------------- Enrollment DNS -------------------------------
-# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment.
-# Default value: ''
-#enrollment.dns: ''
-#
-#-------------------------------- API entries -----------------------------------
-#The following configuration is the default structure to define an API entry.
-#
-#hosts:
-#  - <id>:
-#     url: http(s)://<url>
-#     port: <port>
-#     username: <username>
-#     password: <password>
-

kibana/config/wazuh_app_config.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-
-wazuh_url="${WAZUH_API_URL:-https://wazuh}"
-wazuh_port="${API_PORT:-55000}"
-api_username="${API_USERNAME:-wazuh-wui}"
-api_password="${API_PASSWORD:-wazuh-wui}"
-
-kibana_config_file="/usr/share/kibana/data/wazuh/config/wazuh.yml"
-
-declare -A CONFIG_MAP=(
-  [pattern]=$PATTERN
-  [checks.pattern]=$CHECKS_PATTERN
-  [checks.template]=$CHECKS_TEMPLATE
-  [checks.api]=$CHECKS_API
-  [checks.setup]=$CHECKS_SETUP
-  [extensions.pci]=$EXTENSIONS_PCI
-  [extensions.gdpr]=$EXTENSIONS_GDPR
-  [extensions.hipaa]=$EXTENSIONS_HIPAA
-  [extensions.nist]=$EXTENSIONS_NIST
-  [extensions.tsc]=$EXTENSIONS_TSC
-  [extensions.audit]=$EXTENSIONS_AUDIT
-  [extensions.oscap]=$EXTENSIONS_OSCAP
-  [extensions.ciscat]=$EXTENSIONS_CISCAT
-  [extensions.aws]=$EXTENSIONS_AWS
-  [extensions.gcp]=$EXTENSIONS_GCP
-  [extensions.virustotal]=$EXTENSIONS_VIRUSTOTAL
-  [extensions.osquery]=$EXTENSIONS_OSQUERY
-  [extensions.docker]=$EXTENSIONS_DOCKER
-  [timeout]=$APP_TIMEOUT
-  [api.selector]=$API_SELECTOR
-  [ip.selector]=$IP_SELECTOR
-  [ip.ignore]=$IP_IGNORE
-  [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
-  [wazuh.monitoring.creation]=$WAZUH_MONITORING_CREATION
-  [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
-  [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
-  [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
-  [admin]=$ADMIN_PRIVILEGES
-)
-
-for i in "${!CONFIG_MAP[@]}"
-do
-    if [ "${CONFIG_MAP[$i]}" != "" ]; then
-        sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
-    fi
-done
-
-CONFIG_CODE=$(curl ${auth} -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013)
-
-grep -q 1513629884013 $kibana_config_file
-_config_exists=$?
-
-if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then
-cat << EOF >> $kibana_config_file
-hosts:
-  - 1513629884013:
-      url: $wazuh_url
-      port: $wazuh_port
-      username: $api_username
-      password: $api_password
-EOF
-else
-  echo "Wazuh APP already configured"
-fi

kibana/config/xpack_config.sh

@@ -1,35 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-
-kibana_config_file="/usr/share/kibana/config/kibana.yml"
-if grep -Fq  "#xpack features" "$kibana_config_file";
-then
-  declare -A CONFIG_MAP=(
-    [xpack.apm.ui.enabled]=$XPACK_APM
-    [xpack.grokdebugger.enabled]=$XPACK_DEVTOOLS
-    [xpack.searchprofiler.enabled]=$XPACK_DEVTOOLS
-    [xpack.ml.enabled]=$XPACK_ML
-    [xpack.canvas.enabled]=$XPACK_CANVAS
-    [xpack.infra.enabled]=$XPACK_INFRA
-    [xpack.monitoring.enabled]=$XPACK_MONITORING
-    [console.enabled]=$XPACK_DEVTOOLS
-  )
-  for i in "${!CONFIG_MAP[@]}"
-  do
-    if [ "${CONFIG_MAP[$i]}" != "" ]; then
-      sed -i 's/.'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
-    fi
-  done
-else
-  echo "
-#xpack features
-xpack.apm.ui.enabled: $XPACK_APM
-xpack.grokdebugger.enabled: $XPACK_DEVTOOLS
-xpack.searchprofiler.enabled: $XPACK_DEVTOOLS
-xpack.ml.enabled: $XPACK_ML
-xpack.canvas.enabled: $XPACK_CANVAS
-xpack.infra.enabled: $XPACK_INFRA
-xpack.monitoring.enabled: $XPACK_MONITORING
-console.enabled: $XPACK_DEVTOOLS
-" >> $kibana_config_file
-fi

production-cluster.yml

@@ -2,18 +2,18 @@
 version: '3.7'
 
 services:
-  wazuh-master:
+  wazuh.master:
-    image: wazuh/wazuh-odfe:4.3.0
+    image: wazuh/wazuh-manager:4.3.0
-    hostname: wazuh-master
+    hostname: wazuh.master
     restart: always
     ports:
       - "1515:1515"
       - "514:514/udp"
       - "55000:55000"
     environment:
-      - ELASTICSEARCH_URL=https://elasticsearch:9200
+      - INDEXER_URL=https://wazuh1.indexer:9200
-      - ELASTIC_USERNAME=admin
+      - INDEXER_USERNAME=admin
-      - ELASTIC_PASSWORD=SecretPassword
+      - INDEXER_PASSWORD=SecretPassword
       - FILEBEAT_SSL_VERIFICATION_MODE=full
       - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
       - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
@@ -32,19 +32,19 @@ services:
       - ossec-wodles:/var/ossec/wodles
       - filebeat-etc:/etc/filebeat
       - filebeat-var:/var/lib/filebeat
-      - ./production_cluster/ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
-      - ./production_cluster/ssl_certs/filebeat.pem:/etc/ssl/filebeat.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem
-      - ./production_cluster/ssl_certs/filebeat.key:/etc/ssl/filebeat.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key
       - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
 
-  wazuh-worker:
+  wazuh.worker:
-    image: wazuh/wazuh-odfe:4.3.0
+    image: wazuh/wazuh-manager:4.3.0
-    hostname: wazuh-worker
+    hostname: wazuh.worker
     restart: always
     environment:
-      - ELASTICSEARCH_URL=https://elasticsearch:9200
+      - INDEXER_URL=https://wazuh1.indexer:9200
-      - ELASTIC_USERNAME=admin
+      - INDEXER_USERNAME=admin
-      - ELASTIC_PASSWORD=SecretPassword
+      - INDEXER_PASSWORD=SecretPassword
       - FILEBEAT_SSL_VERIFICATION_MODE=full
       - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
       - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
@@ -61,19 +61,20 @@ services:
       - worker-ossec-wodles:/var/ossec/wodles
       - worker-filebeat-etc:/etc/filebeat
       - worker-filebeat-var:/var/lib/filebeat
-      - ./production_cluster/ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
-      - ./production_cluster/ssl_certs/filebeat.pem:/etc/ssl/filebeat.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem
-      - ./production_cluster/ssl_certs/filebeat.key:/etc/ssl/filebeat.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key
       - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
 
-  elasticsearch:
+  wazuh1.indexer:
-    image: amazon/opendistro-for-elasticsearch:1.13.2
+    image: wazuh/wazuh-indexer:4.3.0
-    hostname: elasticsearch
+    hostname: wazuh1.indexer
     restart: always
     ports:
       - "9200:9200"
     environment:
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
+      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
+      - "bootstrap.memory_lock=true"
     ulimits:
       memlock:
         soft: -1
@@ -82,21 +83,22 @@ services:
         soft: 65536
         hard: 65536
     volumes:
-      - elastic-data-1:/usr/share/elasticsearch/data
+      - wazuh-indexer-data-1:/var/lib/wazuh-indexer
-      - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
-      - ./production_cluster/ssl_certs/node1.key:/usr/share/elasticsearch/config/node1.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key
-      - ./production_cluster/ssl_certs/node1.pem:/usr/share/elasticsearch/config/node1.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem
-      - ./production_cluster/ssl_certs/admin.pem:/usr/share/elasticsearch/config/admin.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem
-      - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem
-      - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml
+      - ./production_cluster/wazuh-indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
-      - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
+      - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
-  elasticsearch-2:
+  wazuh2.indexer:
-    image: amazon/opendistro-for-elasticsearch:1.13.2
+    image: wazuh/wazuh-indexer:4.3.0
-    hostname: elasticsearch-2
+    hostname: wazuh2.indexer
     restart: always
     environment:
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
+      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
+      - "bootstrap.memory_lock=true"
     ulimits:
       memlock:
         soft: -1
@@ -105,19 +107,20 @@ services:
         soft: 65536
         hard: 65536
     volumes:
-      - elastic-data-2:/usr/share/elasticsearch/data
+      - wazuh-indexer-data-2:/var/lib/wazuh-indexer
-      - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
-      - ./production_cluster/ssl_certs/node2.key:/usr/share/elasticsearch/config/node2.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key
-      - ./production_cluster/ssl_certs/node2.pem:/usr/share/elasticsearch/config/node2.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem
-      - ./production_cluster/elastic_opendistro/elasticsearch-node2.yml:/usr/share/elasticsearch/config/elasticsearch.yml
+      - ./production_cluster/wazuh-indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
-      - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
+      - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
-  
+
-  elasticsearch-3:
+  wazuh3.indexer:
-    image: amazon/opendistro-for-elasticsearch:1.13.2
+    image: wazuh/wazuh-indexer:4.3.0
-    hostname: elasticsearch-3
+    hostname: wazuh3.indexer
     restart: always
     environment:
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
+      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
+      - "bootstrap.memory_lock=true"
     ulimits:
       memlock:
         soft: -1
@@ -126,37 +129,33 @@ services:
         soft: 65536
         hard: 65536
     volumes:
-      - elastic-data-3:/usr/share/elasticsearch/data
+      - wazuh-indexer-data-3:/var/lib/wazuh-indexer
-      - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
-      - ./production_cluster/ssl_certs/node3.key:/usr/share/elasticsearch/config/node3.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key
-      - ./production_cluster/ssl_certs/node3.pem:/usr/share/elasticsearch/config/node3.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem
-      - ./production_cluster/elastic_opendistro/elasticsearch-node3.yml:/usr/share/elasticsearch/config/elasticsearch.yml
+      - ./production_cluster/wazuh-indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
-      - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
+      - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
- 
+
-  kibana:
+  wazuh.dashboard:
-    image: wazuh/wazuh-kibana-odfe:4.3.0
+    image: wazuh/wazuh-dashboard:4.3.0
-    hostname: kibana
+    hostname: wazuh.dashboard
     restart: always
-    ports:
-      - 5601:5601
     environment:
-      - ELASTICSEARCH_USERNAME=admin
+      - OPENSEARCH_HOSTS="https://wazuh1.indexer:9200"
-      - ELASTICSEARCH_PASSWORD=SecretPassword
+      - WAZUH_API_URL="https://wazuh.master"
-      - SERVER_SSL_ENABLED=true
-      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/cert.pem
-      - SERVER_SSL_KEY=/usr/share/kibana/config/key.pem
-      - WAZUH_API_URL="https://wazuh-master"
       - API_USERNAME=acme-user
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
-      - ./production_cluster/kibana_ssl/cert.pem:/usr/share/kibana/config/cert.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
-      - ./production_cluster/kibana_ssl/key.pem:/usr/share/kibana/config/key.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
-
+      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
+      - ./production_cluster/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/opensearch_dashboards.yml
+      - ./production_cluster/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
     depends_on:
-      - elasticsearch
+      - wazuh1.indexer
     links:
-      - elasticsearch:elasticsearch
+      - wazuh1.indexer:wazuh1.indexer
-      - wazuh-master:wazuh-master
+      - wazuh.master:wazuh.master
 
   nginx:
     image: nginx:stable
@@ -167,13 +166,13 @@ services:
       - "443:443"
       - "1514:1514"
     depends_on:
-      - wazuh-master
+      - wazuh.master
-      - wazuh-worker
+      - wazuh.worker
-      - kibana
+      - wazuh.dashboard
     links:
-      - wazuh-master:wazuh-master
+      - wazuh.master:wazuh.master
-      - wazuh-worker:wazuh-worker
+      - wazuh.worker:wazuh.worker
-      - kibana:kibana
+      - wazuh.dashboard:wazuh.dashboard
     volumes:
       - ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       - ./production_cluster/nginx/ssl:/etc/nginx/ssl:ro
@@ -201,6 +200,6 @@ volumes:
   worker-ossec-wodles:
   worker-filebeat-etc:
   worker-filebeat-var:
-  elastic-data-1:
+  wazuh-indexer-data-1:
-  elastic-data-2:
+  wazuh-indexer-data-2:
-  elastic-data-3:
+  wazuh-indexer-data-3:

production_cluster/elastic_opendistro/elasticsearch-node1.yml

@@ -1,31 +0,0 @@
-network.host: 0.0.0.0
-cluster.name: wazuh-cluster
-node.name: elasticsearch
-discovery.seed_hosts: elasticsearch,elasticsearch-2,elasticsearch-3
-cluster.initial_master_nodes: elasticsearch,elasticsearch-2,elasticsearch-3
-bootstrap.memory_lock: true
-
-opendistro_security.ssl.transport.pemcert_filepath: node1.pem
-opendistro_security.ssl.transport.pemkey_filepath: node1.key
-opendistro_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
-opendistro_security.ssl.transport.enforce_hostname_verification: false
-opendistro_security.ssl.transport.resolve_hostname: false
-opendistro_security.ssl.http.enabled: true
-opendistro_security.ssl.http.pemcert_filepath: node1.pem
-opendistro_security.ssl.http.pemkey_filepath: node1.key
-opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem
-opendistro_security.allow_default_init_securityindex: true
-opendistro_security.nodes_dn:
-    - 'CN=node1,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com']
-opendistro_security.audit.type: internal_elasticsearch
-opendistro_security.enable_snapshot_restore_privilege: true
-opendistro_security.check_snapshot_restore_write_privileges: true
-opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
-cluster.routing.allocation.disk.threshold_enabled: false
-#opendistro_security.audit.config.disabled_rest_categories: NONE
-#opendistro_security.audit.config.disabled_transport_categories: NONE
-opendistro_security.audit.log_request_body: false

production_cluster/elastic_opendistro/elasticsearch-node2.yml

@@ -1,31 +0,0 @@
-network.host: 0.0.0.0
-cluster.name: wazuh-cluster
-node.name: elasticsearch-2
-discovery.seed_hosts: elasticsearch,elasticsearch-2,elasticsearch-3
-cluster.initial_master_nodes: elasticsearch,elasticsearch-2,elasticsearch-3
-bootstrap.memory_lock: true
-
-opendistro_security.ssl.transport.pemcert_filepath: node2.pem
-opendistro_security.ssl.transport.pemkey_filepath: node2.key
-opendistro_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
-opendistro_security.ssl.transport.enforce_hostname_verification: false
-opendistro_security.ssl.transport.resolve_hostname: false
-opendistro_security.ssl.http.enabled: true
-opendistro_security.ssl.http.pemcert_filepath: node2.pem
-opendistro_security.ssl.http.pemkey_filepath: node2.key
-opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem
-opendistro_security.allow_default_init_securityindex: true
-opendistro_security.nodes_dn:
-    - 'CN=node1,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com']
-opendistro_security.audit.type: internal_elasticsearch
-opendistro_security.enable_snapshot_restore_privilege: true
-opendistro_security.check_snapshot_restore_write_privileges: true
-opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
-cluster.routing.allocation.disk.threshold_enabled: false
-#opendistro_security.audit.config.disabled_rest_categories: NONE
-#opendistro_security.audit.config.disabled_transport_categories: NONE
-opendistro_security.audit.log_request_body: false

production_cluster/elastic_opendistro/elasticsearch-node3.yml

@@ -1,31 +0,0 @@
-network.host: 0.0.0.0
-cluster.name: wazuh-cluster
-node.name: elasticsearch-3
-discovery.seed_hosts: elasticsearch,elasticsearch-2,elasticsearch-3
-cluster.initial_master_nodes: elasticsearch,elasticsearch-2,elasticsearch-3
-bootstrap.memory_lock: true
-
-opendistro_security.ssl.transport.pemcert_filepath: node3.pem
-opendistro_security.ssl.transport.pemkey_filepath: node3.key
-opendistro_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
-opendistro_security.ssl.transport.enforce_hostname_verification: false
-opendistro_security.ssl.transport.resolve_hostname: false
-opendistro_security.ssl.http.enabled: true
-opendistro_security.ssl.http.pemcert_filepath: node3.pem
-opendistro_security.ssl.http.pemkey_filepath: node3.key
-opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem
-opendistro_security.allow_default_init_securityindex: true
-opendistro_security.nodes_dn:
-    - 'CN=node1,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-    - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com'
-opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com']
-opendistro_security.audit.type: internal_elasticsearch
-opendistro_security.enable_snapshot_restore_privilege: true
-opendistro_security.check_snapshot_restore_write_privileges: true
-opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
-cluster.routing.allocation.disk.threshold_enabled: false
-#opendistro_security.audit.config.disabled_rest_categories: NONE
-#opendistro_security.audit.config.disabled_transport_categories: NONE
-opendistro_security.audit.log_request_body: false

production_cluster/kibana_ssl/generate-self-signed-cert.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-cd $DIR
-
-if [ -s key.pem ]
-then
-    echo "Certificate already exists"
-    exit
-else
-    openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem
-    chown -R 1000:1000 *.pem
-fi

production_cluster/nginx/nginx.conf

@@ -28,7 +28,7 @@ http {
     server_tokens off;
     gzip  on;
 
-    # kibana UI
+    # Dashboard UI
     server {
         listen 80;
         listen [::]:80;
@@ -41,7 +41,7 @@ http {
         ssl_certificate /etc/nginx/ssl/cert.pem;
         ssl_certificate_key /etc/nginx/ssl/key.pem;
         location / {
-            proxy_pass https://kibana:5601/;
+            proxy_pass https://wazuh.dashboard:443/;
             proxy_ssl_verify off;
             proxy_buffer_size          128k;
             proxy_buffers              4 256k;
@@ -57,11 +57,11 @@ http {
 stream {
     upstream mycluster {
         hash $remote_addr consistent;
-        server wazuh-master:1514;
+        server wazuh.master:1514;
-        server wazuh-worker:1514;
+        server wazuh.worker:1514;
     }
     server {
         listen 1514;
         proxy_pass mycluster;
     }
-}
+}

production_cluster/nginx/ssl/generate-self-signed-cert.sh

@@ -9,4 +9,4 @@ then
     exit
 else
     openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem
-fi
+fi

production_cluster/ssl_certs/certs.yml

@@ -1,35 +0,0 @@
-ca:
-   root:
-      dn: CN=root-ca,OU=CA,O=Example\, Inc.,DC=example,DC=com
-      pkPassword: none
-      keysize: 2048
-      file: root-ca.pem 
-   intermediate:
-      dn: CN=intermediate,OU=CA,O=Example\, Inc.,DC=example,DC=com
-      keysize: 2048
-      validityDays: 3650  
-      pkPassword: intermediate-ca-password
-      file: intermediate-ca.pem
-
-nodes:
-  - name: node1
-    dn: CN=node1,OU=Ops,O=Example\, Inc.,DC=example,DC=com
-    dns: 
-      - elasticsearch
-  - name: node2
-    dn: CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com
-    dns: 
-      - elasticsearch-2
-  - name: node3
-    dn: CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com
-    dns: 
-      - elasticsearch-3
-  - name: filebeat
-    dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com
-    dns: 
-      - wazuh
-
-clients:
-  - name: admin
-    dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com
-    admin: true

production_cluster/wazuh-indexer/wazuh1.indexer.yml

@@ -0,0 +1,41 @@
+network.host: wazuh1.indexer
+node.name: wazuh1.indexer
+cluster.initial_master_nodes:
+        - wazuh1.indexer
+        - wazuh2.indexer
+        - wazuh3.indexer
+cluster.name: "wazuh-cluster"
+discovery.seed_hosts:
+        - wazuh1.indexer
+        - wazuh2.indexer
+        - wazuh3.indexer
+node.max_local_storage_nodes: "3"
+path.data: /var/lib/wazuh-indexer
+path.logs: /var/log/wazuh-indexer
+plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh1.indexer.pem
+plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh1.indexer.key
+plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh1.indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh1.indexer.key
+plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.audit.type: internal_opensearch
+plugins.security.authcz.admin_dn:
+- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.nodes_dn:
+- "CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.restapi.roles_enabled:
+- "all_access"
+- "security_rest_api_access"
+plugins.security.allow_default_init_securityindex: true
+cluster.routing.allocation.disk.threshold_enabled: false
+opendistro_security.audit.config.disabled_rest_categories: NONE
+opendistro_security.audit.config.disabled_transport_categories: NONE
+compatibility.override_main_response_version: true

production_cluster/wazuh-indexer/wazuh2.indexer.yml

@@ -0,0 +1,41 @@
+network.host: wazuh2.indexer
+node.name: wazuh2.indexer
+cluster.initial_master_nodes:
+        - wazuh1.indexer
+        - wazuh2.indexer
+        - wazuh3.indexer
+cluster.name: "wazuh-cluster"
+discovery.seed_hosts:
+        - wazuh1.indexer
+        - wazuh2.indexer
+        - wazuh3.indexer
+node.max_local_storage_nodes: "3"
+path.data: /var/lib/wazuh-indexer
+path.logs: /var/log/wazuh-indexer
+plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh2.indexer.pem
+plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh2.indexer.key
+plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh2.indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh2.indexer.key
+plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.audit.type: internal_opensearch
+plugins.security.authcz.admin_dn:
+- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.nodes_dn:
+- "CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.restapi.roles_enabled:
+- "all_access"
+- "security_rest_api_access"
+plugins.security.allow_default_init_securityindex: true
+cluster.routing.allocation.disk.threshold_enabled: false
+opendistro_security.audit.config.disabled_rest_categories: NONE
+opendistro_security.audit.config.disabled_transport_categories: NONE
+compatibility.override_main_response_version: true

production_cluster/wazuh-indexer/wazuh3.indexer.yml

@@ -0,0 +1,41 @@
+network.host: wazuh3.indexer
+node.name: wazuh3.indexer
+cluster.initial_master_nodes:
+        - wazuh1.indexer
+        - wazuh2.indexer
+        - wazuh3.indexer
+cluster.name: "wazuh-cluster"
+discovery.seed_hosts:
+        - wazuh1.indexer
+        - wazuh2.indexer
+        - wazuh3.indexer
+node.max_local_storage_nodes: "3"
+path.data: /var/lib/wazuh-indexer
+path.logs: /var/log/wazuh-indexer
+plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh3.indexer.pem
+plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh3.indexer.key
+plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh3.indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh3.indexer.key
+plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.audit.type: internal_opensearch
+plugins.security.authcz.admin_dn:
+- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.nodes_dn:
+- "CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+- "CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.restapi.roles_enabled:
+- "all_access"
+- "security_rest_api_access"
+plugins.security.allow_default_init_securityindex: true
+cluster.routing.allocation.disk.threshold_enabled: false
+opendistro_security.audit.config.disabled_rest_categories: NONE
+opendistro_security.audit.config.disabled_transport_categories: NONE
+compatibility.override_main_response_version: true

production_cluster/wazuh_cluster/wazuh_manager.conf

@@ -91,7 +91,6 @@
   <vulnerability-detector>
     <enabled>no</enabled>
     <interval>5m</interval>
-    <ignore_time>6h</ignore_time>
     <run_on_start>yes</run_on_start>
 
     <!-- Ubuntu OS vulnerabilities -->

production_cluster/wazuh_cluster/wazuh_worker.conf

@@ -91,7 +91,6 @@
   <vulnerability-detector>
     <enabled>no</enabled>
     <interval>5m</interval>
-    <ignore_time>6h</ignore_time>
     <run_on_start>yes</run_on_start>
 
     <!-- Ubuntu OS vulnerabilities -->

production_cluster/wazuh_dashboard/opensearch_dashboards.yml

@@ -0,0 +1,12 @@
+server.host: 0.0.0.0
+server.port: 443
+opensearch.hosts: https://wazuh1.indexer:9200
+opensearch.ssl.verificationMode: certificate
+opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
+opensearch_security.multitenancy.enabled: false
+opensearch_security.readonly_mode.roles: ["kibana_read_only"]
+server.ssl.enabled: true
+server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
+server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
+opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
+uiSettings.overrides.defaultRoute: /app/wazuh?security_tenant=global

production_cluster/wazuh_dashboard/wazuh.yml

@@ -0,0 +1,7 @@
+hosts:
+  - 1513629884013:
+      url: "https://wazuh.master"
+      port: 55000
+      username: acme-user
+      password: MyS3cr37P450r.*-
+      run_as: false

production_cluster/wazuh_indexer_ssl_certs/certs.yml

@@ -0,0 +1,24 @@
+nodes:
+  # Wazuh indexer server nodes
+  indexer:
+    name: wazuh1.indexer
+    ip: wazuh1.indexer
+    name: wazuh2.indexer
+    ip: wazuh2.indexer
+    name: wazuh3.indexer
+    ip: wazuh3.indexer
+
+  # Wazuh server nodes
+  # Use node_type only with more than one Wazuh manager
+  server:
+    name: wazuh.master
+    ip: wazuh.master
+    node_type: master
+    name: wazuh.worker
+    ip: wazuh.worker
+    node_type: worker
+
+  # Wazuh dashboard node
+  dashboard:
+    name: wazuh.dashboard
+    ip: wazuh.dashboard

wazuh-dashboard/Dockerfile

@@ -0,0 +1,92 @@
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+FROM ubuntu:focal AS builder
+
+ARG WAZUH_VERSION=4.3.0
+ARG INSTALL_DIR=/usr/share/wazuh-dashboard
+
+# Update and install dependencies
+RUN apt-get update && apt install curl libcap2-bin xz-utils -y
+
+# Create Install dir
+RUN mkdir -p $INSTALL_DIR
+
+# Download and extract Wazuh dashboard base
+RUN curl -o wazuh-dashboard-base.tar.xz https://packages.wazuh.com/stack/dashboard/base/wazuh-dashboard-base-$WAZUH_VERSION-linux-x64.tar.xz && \
+    tar -xf wazuh-dashboard-base.tar.xz --directory  $INSTALL_DIR --strip-components=1
+
+# Download and extract demo certificates
+RUN curl -O https://packages.wazuh.com/stack/demo-certs.tar.gz && \
+    tar -xf demo-certs.tar.gz && rm -f demo-certs.tar.gz
+
+# Create certs dir
+RUN mkdir -p $INSTALL_DIR/config/certs
+
+# Copy Wazuh dashboard demo certs to install config dir
+RUN cp certs/demo-dashboard.pem $INSTALL_DIR/config/certs/demo-dashboard.pem && \ 
+    cp certs/demo-dashboard-key.pem $INSTALL_DIR/config/certs/demo-dashboard-key.pem && \
+    cp certs/root-ca.pem $INSTALL_DIR/config/certs/root-ca.pem
+
+RUN chmod 640 $INSTALL_DIR/config/certs/*
+
+# Create and configure Wazuh dashboard keystore
+RUN $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
+    echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
+    echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
+
+# Install Wazuh App 
+RUN $INSTALL_DIR/bin/opensearch-dashboards-plugin install https://packages.wazuh.com/4.x/ui/dashboard/wazuh-$WAZUH_VERSION.zip --allow-root
+
+# Copy and set permissions to config files
+COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/
+COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/
+RUN chown 101:101 $INSTALL_DIR/config/opensearch_dashboards.yml && chmod 664 $INSTALL_DIR/config/opensearch_dashboards.yml
+
+# Create and set permissions to data directories
+RUN mkdir -p $INSTALL_DIR/data/wazuh && chown -R 101:101 $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
+RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chown -R 101:101 $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
+RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
+
+################################################################################
+# Build stage 1 (the current Wazuh dashboard image):
+#
+# Copy wazuh-dashboard from stage 0
+# Add entrypoint
+# Add wazuh_app_config
+################################################################################
+FROM ubuntu:focal
+
+# Set environment variables
+ENV USER="wazuh-dashboard" \
+    GROUP="wazuh-dashboard" \
+    NAME="wazuh-dashboard" \
+    INSTALL_DIR="/usr/share/wazuh-dashboard"
+
+# Create wazuh-dashboard user and group
+RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
+RUN useradd --system \
+            --uid 1000 \
+            --no-create-home \
+            --home-dir $INSTALL_DIR \
+            --gid $GROUP \
+            --shell /sbin/nologin \
+            --comment "$USER user" \
+            $USER
+
+# Copy and set permissions to scripts
+COPY config/entrypoint.sh /
+COPY config/wazuh_app_config.sh /
+RUN chmod 700 /entrypoint.sh
+RUN chmod 700 /wazuh_app_config.sh
+RUN chown 1000:1000 /*.sh
+
+# Copy Install dir from builder to current image
+COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
+
+# Set workdir and user
+WORKDIR $INSTALL_DIR
+USER wazuh-dashboard
+
+# Services ports
+EXPOSE 443
+
+ENTRYPOINT [ "/entrypoint.sh" ]

wazuh-dashboard/config/entrypoint.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+
+##############################################################################
+# Start Wazuh dashboard
+##############################################################################
+
+/wazuh_app_config.sh
+
+/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml

wazuh-dashboard/config/opensearch_dashboards.yml

@@ -0,0 +1,14 @@
+server.host: 0.0.0.0
+server.port: 443
+opensearch.hosts: https://wazuh1.indexer:9200
+opensearch.ssl.verificationMode: none
+opensearch.requestHeadersWhitelist: [ authorization,securitytenant ]
+opensearch_security.multitenancy.enabled: true
+opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]
+opensearch_security.readonly_mode.roles: ["kibana_read_only"]
+server.ssl.enabled: true
+server.ssl.key: "/usr/share/wazuh-dashboard/config/certs/demo-dashboard-key.pem"
+server.ssl.certificate: "/usr/share/wazuh-dashboard/config/certs/demo-dashboard.pem"
+opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/config/certs/root-ca.pem"]
+uiSettings.overrides.defaultRoute: /app/wazuh?security_tenant=global
+

wazuh-dashboard/config/wazuh.yml

@@ -0,0 +1,7 @@
+hosts:
+  - default:
+     url: https://wazuh.manager
+     port: 55000
+     username: wazuh-wui
+     password: wazuh-wui
+     run_as: false

wazuh-dashboard/config/wazuh_app_config.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+
+wazuh_url="${WAZUH_API_URL:-https://wazuh}"
+wazuh_port="${API_PORT:-55000}"
+api_username="${API_USERNAME:-wazuh-wui}"
+api_password="${API_PASSWORD:-wazuh-wui}"
+api_run_as="${RUN_AS:-false}"
+
+dashboard_config_file="/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml"
+
+grep -q 1513629884013 $dashboard_config_file
+_config_exists=$?
+
+if [[ $_config_exists -ne 0 ]]; then
+cat << EOF > $dashboard_config_file
+hosts:
+  - 1513629884013:
+      url: $wazuh_url
+      port: $wazuh_port
+      username: $api_username
+      password: $api_password
+      run_as: $api_run_as
+EOF
+else
+  echo "Wazuh APP already configured"
+fi
+

wazuh-indexer/Dockerfile

@@ -0,0 +1,72 @@
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+FROM ubuntu:focal AS builder
+
+RUN apt-get update -y && apt-get install curl openssl xz-utils -y
+
+COPY config/opensearch.yml /
+
+COPY config/config.sh .
+
+COPY config/config.yml /
+
+COPY config/internal_users.yml /
+
+COPY config/roles_mapping.yml /
+
+COPY config/roles.yml /
+
+RUN bash config.sh
+
+################################################################################
+# Build stage 1 (the actual Wazuh indexer image):
+#
+# Copy wazuh-indexer from stage 0
+# Add entrypoint
+################################################################################
+FROM ubuntu:focal
+
+ENV USER="wazuh-indexer" \
+    GROUP="wazuh-indexer" \
+    NAME="wazuh-indexer" \
+    INSTALL_DIR="/usr/share/wazuh-indexer"
+
+RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
+
+RUN useradd --system \
+            --uid 1000 \
+            --no-create-home \
+            --home-dir $INSTALL_DIR \
+            --gid $GROUP \
+            --shell /sbin/nologin \
+            --comment "$USER user" \
+            $USER
+
+WORKDIR $INSTALL_DIR
+
+COPY config/entrypoint.sh /
+
+COPY config/securityadmin.sh /
+
+RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh
+
+RUN chown 1000:1000 /*.sh
+
+COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
+COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
+COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
+COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
+
+
+RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
+    mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
+    mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
+    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
+
+USER wazuh-indexer
+
+# Services ports
+EXPOSE 9200
+
+ENTRYPOINT ["/entrypoint.sh"]
+# Dummy overridable parameter parsed by entrypoint
+CMD ["opensearchwrapper"]

wazuh-indexer/config/config.sh

@@ -0,0 +1,103 @@
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# This has to be exported to make some magic below work.
+export DH_OPTIONS
+
+export NAME=wazuh-indexer
+export TARGET_DIR=${CURDIR}/debian/${NAME}
+
+# Package build options
+export USER=${NAME}
+export GROUP=${NAME}
+export VERSION=4.3.0
+export LOG_DIR=/var/log/${NAME}
+export LIB_DIR=/var/lib/${NAME}
+export PID_DIR=/run/${NAME}
+export INSTALLATION_DIR=/usr/share/${NAME}
+export CONFIG_DIR=${INSTALLATION_DIR}/config
+export BASE_DIR=${NAME}-*
+export INDEXER_FILE=wazuh-indexer-base.tar.xz
+export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
+export REPO_DIR=/unattended_installer
+
+
+rm -rf ${INSTALLATION_DIR}/
+
+curl -o ${INDEXER_FILE} https://packages.wazuh.com/stack/indexer/base/${BASE_FILE}
+tar -xf ${INDEXER_FILE}
+
+## TOOLS
+
+## Variables
+CERT_TOOL=wazuh-certs-tool.sh
+PASSWORD_TOOL=wazuh-passwords-tool.sh
+PACKAGES_URL=https://packages.wazuh.com/4.3/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/
+
+## Check if the cert tool exists in S3 buckets
+CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+
+## If cert tool exists in some bucket, download it, if not exit 1
+if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
+  curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL
+  echo "Cert tool exists in Packages bucket"
+elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
+  curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL
+  echo "Cert tool exists in Packages-dev bucket"
+else
+  echo "Cert tool does not exist in any bucket"
+  exit 1
+fi
+
+
+## Check if the password tool exists in S3 buckets
+PASSWORD_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$PASSWORD_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+PASSWORD_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$PASSWORD_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+
+## If password tool exists in some bucket, download it, if not exit 1
+if [ "$PASSWORD_TOOL_PACKAGES" = "200" ]; then
+  curl -o $PASSWORD_TOOL $PACKAGES_URL$PASSWORD_TOOL
+  echo "Password tool exists in Packages bucket"
+elif [ "$PASSWORD_TOOL_PACKAGES_DEV" = "200" ]; then
+  curl -o $PASSWORD_TOOL $PACKAGES_DEV_URL$PASSWORD_TOOL
+  echo "Password tool exists in Packages-dev bucket"
+else
+  echo "Password tool does not exist in any bucket"
+  exit 1
+fi
+
+chmod 755 $CERT_TOOL && bash /$CERT_TOOL
+
+# copy to target
+mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}
+mkdir -p ${TARGET_DIR}${CONFIG_DIR}
+mkdir -p ${TARGET_DIR}${LIB_DIR}
+mkdir -p ${TARGET_DIR}${LOG_DIR}
+mkdir -p ${TARGET_DIR}/etc/init.d
+mkdir -p ${TARGET_DIR}/etc/default
+mkdir -p ${TARGET_DIR}/usr/lib/tmpfiles.d
+mkdir -p ${TARGET_DIR}/usr/lib/sysctl.d
+mkdir -p ${TARGET_DIR}/usr/lib/systemd/system
+# Move configuration files for wazuh-indexer
+mv -f ${BASE_DIR}/etc/init.d/${NAME} ${TARGET_DIR}/etc/init.d/${NAME}
+mv -f ${BASE_DIR}/etc/wazuh-indexer/* ${TARGET_DIR}${CONFIG_DIR}
+mv -f ${BASE_DIR}/etc/sysconfig/${NAME} ${TARGET_DIR}/etc/default/
+mv -f ${BASE_DIR}/usr/lib/tmpfiles.d/* ${TARGET_DIR}/usr/lib/tmpfiles.d/
+mv -f ${BASE_DIR}/usr/lib/sysctl.d/* ${TARGET_DIR}/usr/lib/sysctl.d/
+mv -f ${BASE_DIR}/usr/lib/systemd/system/* ${TARGET_DIR}/usr/lib/systemd/system/
+rm -rf ${BASE_DIR}/etc
+rm -rf ${BASE_DIR}/usr
+# Copy installation files to final location
+cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR}
+# Copy the security tools
+cp /$CERT_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
+cp /$PASSWORD_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
+# Copy Wazuh's config files for the security plugin
+cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
+cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
+cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
+cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR}
+# Copy Wazuh indexer's demo certificates
+cp -pr /certs/* ${TARGET_DIR}${CONFIG_DIR}
+
+

wazuh-indexer/config/config.yml

@@ -0,0 +1,5 @@
+nodes:
+  # Wazuh indexer server nodes
+  indexer:
+    name: demo.indexer
+    ip: demo.indexer

wazuh-indexer/config/entrypoint.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+set -e
+
+umask 0002
+
+export USER=wazuh-indexer
+export INSTALLATION_DIR=/usr/share/wazuh-indexer
+export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config
+export JAVA_HOME=${INSTALLATION_DIR}/jdk
+export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
+export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
+export CERT="${OPENSEARCH_PATH_CONF}/admin.pem"
+export KEY="${OPENSEARCH_PATH_CONF}/admin-key.pem"
+
+run_as_other_user_if_needed() {
+  if [[ "$(id -u)" == "0" ]]; then
+    # If running as root, drop to specified UID and run command
+    exec chroot --userspec=1000:0 / "${@}"
+  else
+    # Either we are running in Openshift with random uid and are a member of the root group
+    # or with a custom --user
+    exec "${@}"
+  fi
+}
+
+# Allow user specify custom CMD, maybe bin/opensearch itself
+# for example to directly specify `-E` style parameters for opensearch on k8s
+# or simply to run /bin/bash to check the image
+if [[ "$1" != "opensearchwrapper" ]]; then
+  if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then
+    # Rewrite CMD args to replace $1 with `opensearch` explicitly,
+    # Without this, user could specify `opensearch -E x.y=z` but
+    # `bin/opensearch -E x.y=z` would not work.
+    set -- "opensearch" "${@:2}"
+    # Use chroot to switch to UID 1000 / GID 0
+    exec chroot --userspec=1000:0 / "$@"
+  else
+    # User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
+    exec "$@"
+  fi
+fi
+
+# Allow environment variables to be set by creating a file with the
+# contents, and setting an environment variable with the suffix _FILE to
+# point to it. This can be used to provide secrets to a container, without
+# the values being specified explicitly when running the container.
+#
+# This is also sourced in opensearch-env, and is only needed here
+# as well because we use INDEXER_PASSWORD below. Sourcing this script
+# is idempotent.
+source /usr/share/wazuh-indexer/bin/opensearch-env-from-file
+
+if [[ -f bin/opensearch-users ]]; then
+  # Check for the INDEXER_PASSWORD environment variable to set the
+  # bootstrap password for Security.
+  #
+  # This is only required for the first node in a cluster with Security
+  # enabled, but we have no way of knowing which node we are yet. We'll just
+  # honor the variable if it's present.
+  if [[ -n "$INDEXER_PASSWORD" ]]; then
+    [[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
+    if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then
+      # keystore is unencrypted
+      if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then
+        (run_as_other_user_if_needed echo "$INDEXER_PASSWORD" | opensearch-keystore add -x 'bootstrap.password')
+      fi
+    else
+      # keystore requires password
+      if ! (run_as_other_user_if_needed echo "$KEYSTORE_PASSWORD" \
+          | opensearch-keystore list | grep -q '^bootstrap.password$') ; then
+        COMMANDS="$(printf "%s\n%s" "$KEYSTORE_PASSWORD" "$INDEXER_PASSWORD")"
+        (run_as_other_user_if_needed echo "$COMMANDS" | opensearch-keystore add -x 'bootstrap.password')
+      fi
+    fi
+  fi
+fi
+
+if [[ "$(id -u)" == "0" ]]; then
+  # If requested and running as root, mutate the ownership of bind-mounts
+  if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
+    chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs}
+  fi
+fi
+
+
+if [[ "$DISCOVERY" == "single-node" ]]; then
+  # run securityadmin.sh for single node with CACERT, CERT and KEY parameter
+  nohup /securityadmin.sh &
+fi
+
+run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"

wazuh-indexer/config/internal_users.yml

@@ -0,0 +1,74 @@
+---
+# This is the internal user database
+# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
+
+_meta:
+  type: "internalusers"
+  config_version: 2
+
+# Define your internal users here
+
+## Demo users
+
+admin:
+  hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
+  reserved: true
+  backend_roles:
+  - "admin"
+  description: "Demo admin user"
+
+kibanaserver:
+  hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
+  reserved: true
+  description: "Demo kibanaserver user"
+
+kibanaro:
+  hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
+  reserved: false
+  backend_roles:
+  - "kibanauser"
+  - "readall"
+  attributes:
+    attribute1: "value1"
+    attribute2: "value2"
+    attribute3: "value3"
+  description: "Demo kibanaro user"
+
+logstash:
+  hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
+  reserved: false
+  backend_roles:
+  - "logstash"
+  description: "Demo logstash user"
+
+readall:
+  hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
+  reserved: false
+  backend_roles:
+  - "readall"
+  description: "Demo readall user"
+
+snapshotrestore:
+  hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
+  reserved: false
+  backend_roles:
+  - "snapshotrestore"
+  description: "Demo snapshotrestore user"
+
+wazuh_admin:
+  hash: "$2y$12$d2awHiOYvZjI88VfsDON.u6buoBol0gYPJEgdG1ArKVE0OMxViFfu"
+  reserved: true
+  hidden: false
+  backend_roles: []
+  attributes: {}
+  opendistro_security_roles: []
+  static: false
+  
+wazuh_user:
+  hash: "$2y$12$BQixeoQdRubZdVf/7sq1suHwiVRnSst1.lPI2M0.GPZms4bq2D9vO"
+  reserved: true
+  hidden: false
+  backend_roles: []
+  attributes: {}
+  opendistro_security_roles: []
+  static: false  

wazuh-indexer/config/opensearch.yml

@@ -0,0 +1,27 @@
+network.host: "0.0.0.0"
+node.name: "wazuh1.indexer"
+path.data: /var/lib/wazuh-indexer
+path.logs: /var/log/wazuh-indexer
+discovery.type: single-node
+compatibility.override_main_response_version: true
+plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/demo.indexer.pem
+plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/demo.indexer-key.pem
+plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/demo.indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/demo.indexer-key.pem
+plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.audit.type: internal_opensearch
+plugins.security.authcz.admin_dn:
+- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.nodes_dn:
+- "CN=demo.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.restapi.roles_enabled:
+- "all_access"
+- "security_rest_api_access"
+plugins.security.system_indices.enabled: true
+plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]

wazuh-indexer/config/roles.yml

@@ -0,0 +1,163 @@
+_meta:
+  type: "roles"
+  config_version: 2
+
+# Restrict users so they can only view visualization and dashboards on kibana
+kibana_read_only:
+  reserved: true
+
+# The security REST API access role is used to assign specific users access to change the security settings through the REST API.
+security_rest_api_access:
+  reserved: true
+
+# Allows users to view monitors, destinations and alerts
+alerting_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/alerting/alerts/get'
+    - 'cluster:admin/opendistro/alerting/destination/get'
+    - 'cluster:admin/opendistro/alerting/monitor/get'
+    - 'cluster:admin/opendistro/alerting/monitor/search'
+
+# Allows users to view and acknowledge alerts
+alerting_ack_alerts:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/alerting/alerts/*'
+
+# Allows users to use all alerting functionality
+alerting_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster_monitor'
+    - 'cluster:admin/opendistro/alerting/*'
+  index_permissions:
+    - index_patterns:
+        - '*'
+      allowed_actions:
+        - 'indices_monitor'
+        - 'indices:admin/aliases/get'
+        - 'indices:admin/mappings/get'
+
+# Allow users to read Anomaly Detection detectors and results
+anomaly_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/ad/detector/info'
+    - 'cluster:admin/opendistro/ad/detector/search'
+    - 'cluster:admin/opendistro/ad/detectors/get'
+    - 'cluster:admin/opendistro/ad/result/search'
+    - 'cluster:admin/opendistro/ad/tasks/search'
+
+# Allows users to use all Anomaly Detection functionality
+anomaly_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster_monitor'
+    - 'cluster:admin/opendistro/ad/*'
+  index_permissions:
+    - index_patterns:
+        - '*'
+      allowed_actions:
+        - 'indices_monitor'
+        - 'indices:admin/aliases/get'
+        - 'indices:admin/mappings/get'
+
+# Allows users to read Notebooks
+notebooks_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/notebooks/list'
+    - 'cluster:admin/opendistro/notebooks/get'
+
+# Allows users to all Notebooks functionality
+notebooks_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/notebooks/create'
+    - 'cluster:admin/opendistro/notebooks/update'
+    - 'cluster:admin/opendistro/notebooks/delete'
+    - 'cluster:admin/opendistro/notebooks/get'
+    - 'cluster:admin/opendistro/notebooks/list'
+
+# Allows users to read and download Reports
+reports_instances_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/reports/instance/list'
+    - 'cluster:admin/opendistro/reports/instance/get'
+    - 'cluster:admin/opendistro/reports/menu/download'
+
+# Allows users to read and download Reports and Report-definitions
+reports_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/reports/definition/get'
+    - 'cluster:admin/opendistro/reports/definition/list'
+    - 'cluster:admin/opendistro/reports/instance/list'
+    - 'cluster:admin/opendistro/reports/instance/get'
+    - 'cluster:admin/opendistro/reports/menu/download'
+
+# Allows users to all Reports functionality
+reports_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/reports/definition/create'
+    - 'cluster:admin/opendistro/reports/definition/update'
+    - 'cluster:admin/opendistro/reports/definition/on_demand'
+    - 'cluster:admin/opendistro/reports/definition/delete'
+    - 'cluster:admin/opendistro/reports/definition/get'
+    - 'cluster:admin/opendistro/reports/definition/list'
+    - 'cluster:admin/opendistro/reports/instance/list'
+    - 'cluster:admin/opendistro/reports/instance/get'
+    - 'cluster:admin/opendistro/reports/menu/download'
+
+# Allows users to use all asynchronous-search functionality
+asynchronous_search_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/asynchronous_search/*'
+  index_permissions:
+    - index_patterns:
+        - '*'
+      allowed_actions:
+        - 'indices:data/read/search*'
+
+# Allows users to read stored asynchronous-search results
+asynchronous_search_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/asynchronous_search/get'
+
+wazuh_ui_user:
+  reserved: true
+  hidden: false
+  cluster_permissions: []
+  index_permissions:
+  - index_patterns:
+    - "wazuh-*"
+    dls: ""
+    fls: []
+    masked_fields: []
+    allowed_actions:
+    - "read"
+  tenant_permissions: []
+  static: false        
+
+wazuh_ui_admin:
+  reserved: true
+  hidden: false
+  cluster_permissions: []
+  index_permissions:
+  - index_patterns:
+    - "wazuh-*"
+    dls: ""
+    fls: []
+    masked_fields: []
+    allowed_actions:
+    - "read"
+    - "delete"
+    - "manage"
+    - "index"
+  tenant_permissions: []
+  static: false  

wazuh-indexer/config/roles_mapping.yml

@@ -0,0 +1,71 @@
+---
+# In this file users, backendroles and hosts can be mapped to Open Distro Security roles.
+# Permissions for Opendistro roles are configured in roles.yml
+
+_meta:
+  type: "rolesmapping"
+  config_version: 2
+
+# Define your roles mapping here
+
+## Demo roles mapping
+
+all_access:
+  reserved: false
+  backend_roles:
+  - "admin"
+  description: "Maps admin to all_access"
+
+own_index:
+  reserved: false
+  users:
+  - "*"
+  description: "Allow full access to an index named like the username"
+
+logstash:
+  reserved: false
+  backend_roles:
+  - "logstash"
+
+kibana_user:
+  reserved: false
+  backend_roles:
+  - "kibanauser"
+  users:
+  - "wazuh_user"
+  - "wazuh_admin"    
+  description: "Maps kibanauser to kibana_user"
+
+readall:
+  reserved: false
+  backend_roles:
+  - "readall"
+
+manage_snapshots:
+  reserved: false
+  backend_roles:
+  - "snapshotrestore"
+
+kibana_server:
+  reserved: true
+  users:
+  - "kibanaserver"
+
+wazuh_ui_admin:
+  reserved: true
+  hidden: false
+  backend_roles: []
+  hosts: []
+  users:
+  - "wazuh_admin"
+  - "kibanaserver"
+  and_backend_roles: []
+
+wazuh_ui_user:
+  reserved: true
+  hidden: false
+  backend_roles: []
+  hosts: []
+  users:
+  - "wazuh_user"
+  and_backend_roles: []

wazuh-indexer/config/securityadmin.sh

@@ -0,0 +1,3 @@
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+sleep 30
+bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9300 -icl

wazuh-manager/Dockerfile

@@ -14,11 +14,11 @@ COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo
 
 RUN yum --enablerepo=updates clean metadata && \
   yum upgrade -y && \
-  yum -y install openssl which expect openssh-clients && yum -y install wazuh-manager-${WAZUH_VERSION} -y && \
+  yum -y install openssl which expect openssh-clients && yum install wazuh-manager-${WAZUH_VERSION} -y && \
   sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
   yum clean all && rm -rf /var/cache/yum
 
-RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\
+RUN curl -L -O https://packages.wazuh.com/4.x/yum/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\
   rpm -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm
 
 RUN curl -s https://packages.wazuh.com/4.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
@@ -40,7 +40,7 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e
 RUN chmod go-w /etc/filebeat/wazuh-template.json
 
 COPY config/etc/ /etc/
-COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py
+COPY --chown=root:1000 config/create_user.py /var/ossec/framework/scripts/create_user.py
 
 # Prepare permanent data
 # Sync calls are due to https://github.com/docker/docker/issues/9547

wazuh-manager/config/etc/cont-init.d/1-config-filebeat

@@ -3,21 +3,21 @@
 
 set -e
 
-if [ "$ELASTICSEARCH_URL" != "" ]; then
+if [ "$INDEXER_URL" != "" ]; then
   >&2 echo "Customize Elasticsearch ouput IP"
-  sed -i "s|hosts:.*|hosts: ['$ELASTICSEARCH_URL']|g" /etc/filebeat/filebeat.yml
+  sed -i "s|hosts:.*|hosts: ['$INDEXER_URL']|g" /etc/filebeat/filebeat.yml
 fi
 
 # Configure filebeat.yml security settings
 
-if [ "$ELASTIC_USERNAME" != "" ]; then
+if [ "$INDEXER_USERNAME" != "" ]; then
   >&2 echo "Configuring username."
-  sed -i "s|#username:.*|username: '$ELASTIC_USERNAME'|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
 fi
 
-if [ "$ELASTIC_PASSWORD" != "" ]; then
+if [ "$INDEXER_PASSWORD" != "" ]; then
   >&2 echo "Configuring password."
-  sed -i "s|#password:.*|password: '$ELASTIC_PASSWORD'|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
 fi
 
 if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then

wazuh-manager/config/filebeat.yml

@@ -13,7 +13,7 @@ setup.template.json.name: 'wazuh'
 setup.template.overwrite: true
 setup.ilm.enabled: false
 output.elasticsearch:
-  hosts: ['https://elasticsearch:9200']
+  hosts: ['https://wazuh1.indexer:9200']
   #username:
   #password:
   #ssl.verification_mode:

wazuh-manager/config/permanent_data.env

@@ -59,7 +59,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
 export PERMANENT_DATA_EXCP
 
 # Files mounted in a volume that should be deleted

xpack-compose.yml

@@ -1,185 +0,0 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-version: '3.7'
-
-services:
-  wazuh:
-    image: wazuh/wazuh:4.3.0
-    hostname: wazuh-manager
-    restart: always
-    ports:
-      - "1514:1514"
-      - "1515:1515"
-      - "514:514/udp"
-      - "55000:55000"
-    environment:
-      - ELASTICSEARCH_URL=https://elasticsearch:9200
-      - ELASTIC_USERNAME=elastic
-      - ELASTIC_PASSWORD=SecretPassword
-      - FILEBEAT_SSL_VERIFICATION_MODE=none
-      - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/ca.crt
-      - SSL_CERTIFICATE=/etc/ssl/wazuh.crt
-      - SSL_KEY=/etc/ssl/wazuh.key
-    volumes:
-      - ossec_api_configuration:/var/ossec/api/configuration
-      - ossec_etc:/var/ossec/etc
-      - ossec_logs:/var/ossec/logs
-      - ossec_queue:/var/ossec/queue
-      - ossec_var_multigroups:/var/ossec/var/multigroups
-      - ossec_integrations:/var/ossec/integrations
-      - ossec_active_response:/var/ossec/active-response/bin
-      - ossec_agentless:/var/ossec/agentless
-      - ossec_wodles:/var/ossec/wodles
-      - filebeat_etc:/etc/filebeat
-      - filebeat_var:/var/lib/filebeat
-      - ./xpack/ca/ca.crt:/etc/ssl/ca.crt
-      - ./xpack/wazuh/wazuh.crt:/etc/ssl/wazuh.crt
-      - ./xpack/wazuh/wazuh.key:/etc/ssl/wazuh.key
-
-
-  elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
-    hostname: elasticsearch
-    restart: always
-    ports:
-      - "9200:9200"
-    environment:
-      - cluster.name=wazuh-cluster
-      - node.name=elasticsearch
-      - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
-      - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
-      - ELASTIC_PASSWORD=SecretPassword
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
-      - bootstrap.memory_lock=true
-      - xpack.license.self_generated.type=basic
-      - xpack.security.enabled=true
-      - xpack.security.http.ssl.enabled=true
-      - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-      - xpack.security.transport.ssl.enabled=true
-      - xpack.security.transport.ssl.verification_mode=certificate
-      - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-    volumes:
-      - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
-      - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key
-      - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt
-
-  elasticsearch2:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
-    hostname: elasticsearch2
-    restart: always
-    environment:
-      - cluster.name=wazuh-cluster
-      - node.name=elasticsearch2
-      - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
-      - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
-      - ELASTIC_PASSWORD=SecretPassword
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
-      - bootstrap.memory_lock=true
-      - xpack.license.self_generated.type=basic
-      - xpack.security.enabled=true
-      - xpack.security.http.ssl.enabled=true
-      - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-      - xpack.security.transport.ssl.enabled=true
-      - xpack.security.transport.ssl.verification_mode=certificate
-      - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-    volumes:
-      - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
-      - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key
-      - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt
-
-  elasticsearch3:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
-    hostname: elasticsearch3
-    restart: always
-    environment:
-      - cluster.name=wazuh-cluster
-      - node.name=elasticsearch3
-      - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
-      - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
-      - ELASTIC_PASSWORD=SecretPassword
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
-      - bootstrap.memory_lock=true
-      - xpack.license.self_generated.type=basic
-      - xpack.security.enabled=true
-      - xpack.security.http.ssl.enabled=true
-      - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-      - xpack.security.transport.ssl.enabled=true
-      - xpack.security.transport.ssl.verification_mode=certificate
-      - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-    volumes:
-      - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
-      - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key
-      - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt
-
-
-  kibana:
-    image: wazuh/wazuh-kibana:4.3.0
-    hostname: kibana
-    restart: always
-    ports:
-      - 443:5601
-    environment:
-      - SERVERNAME=localhost
-      - ELASTICSEARCH_USERNAME=elastic
-      - ELASTICSEARCH_PASSWORD=SecretPassword
-      - ELASTICSEARCH_URL=https://elasticsearch:9200
-      - ELASTICSEARCH_HOSTS=https://elasticsearch:9200
-      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/ca.crt
-      - SERVER_SSL_ENABLED=true
-      - XPACK_SECURITY_ENABLED=true
-      - SERVER_SSL_KEY=/usr/share/kibana/config/kibana.key
-      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/kibana.crt
-    volumes:
-      - ./xpack/ca/ca.crt:/usr/share/kibana/config/ca.crt
-      - ./xpack/kibana/kibana.key:/usr/share/kibana/config/kibana.key
-      - ./xpack/kibana/kibana.crt:/usr/share/kibana/config/kibana.crt
-    depends_on:
-      - elasticsearch
-    links:
-      - elasticsearch:elasticsearch
-      - wazuh:wazuh
-
-volumes:
-  ossec_api_configuration:
-  ossec_etc:
-  ossec_logs:
-  ossec_queue:
-  ossec_var_multigroups:
-  ossec_integrations:
-  ossec_active_response:
-  ossec_agentless:
-  ossec_wodles:
-  filebeat_etc:
-  filebeat_var:

xpack-from-sources.yml

@@ -1,192 +0,0 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-version: '3.7'
-
-services:
-  wazuh:
-    build:
-      context: wazuh-odfe/
-      args:
-        - FILEBEAT_CHANNEL=filebeat
-        - FILEBEAT_VERSION=7.11.2
-    image: wazuh/wazuh:4.3.0
-    hostname: wazuh-manager
-    restart: always
-    ports:
-      - "1514:1514"
-      - "1515:1515"
-      - "514:514/udp"
-      - "55000:55000"
-    environment:
-      - ELASTICSEARCH_URL=https://elasticsearch:9200
-      - ELASTIC_USERNAME=elastic
-      - ELASTIC_PASSWORD=SecretPassword
-      - FILEBEAT_SSL_VERIFICATION_MODE=none
-      - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/ca.crt
-      - SSL_CERTIFICATE=/etc/ssl/wazuh.crt
-      - SSL_KEY=/etc/ssl/wazuh.key
-    volumes:
-      - ossec_api_configuration:/var/ossec/api/configuration
-      - ossec_etc:/var/ossec/etc
-      - ossec_logs:/var/ossec/logs
-      - ossec_queue:/var/ossec/queue
-      - ossec_var_multigroups:/var/ossec/var/multigroups
-      - ossec_integrations:/var/ossec/integrations
-      - ossec_active_response:/var/ossec/active-response/bin
-      - ossec_agentless:/var/ossec/agentless
-      - ossec_wodles:/var/ossec/wodles
-      - filebeat_etc:/etc/filebeat
-      - filebeat_var:/var/lib/filebeat
-      - ./xpack/ca/ca.crt:/etc/ssl/ca.crt
-      - ./xpack/wazuh/wazuh.crt:/etc/ssl/wazuh.crt
-      - ./xpack/wazuh/wazuh.key:/etc/ssl/wazuh.key
-
-
-  elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2
-    hostname: elasticsearch
-    restart: always
-    ports:
-      - "9200:9200"
-    environment:
-      - cluster.name=wazuh-cluster
-      - node.name=elasticsearch
-      - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
-      - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
-      - ELASTIC_PASSWORD=SecretPassword
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
-      - bootstrap.memory_lock=true
-      - xpack.license.self_generated.type=basic
-      - xpack.security.enabled=true
-      - xpack.security.http.ssl.enabled=true
-      - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-      - xpack.security.transport.ssl.enabled=true
-      - xpack.security.transport.ssl.verification_mode=certificate
-      - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-    volumes:
-      - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
-      - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key
-      - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt
-
-  elasticsearch2:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2
-    hostname: elasticsearch2
-    restart: always
-    environment:
-      - cluster.name=wazuh-cluster
-      - node.name=elasticsearch2
-      - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
-      - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
-      - ELASTIC_PASSWORD=SecretPassword
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
-      - bootstrap.memory_lock=true
-      - xpack.license.self_generated.type=basic
-      - xpack.security.enabled=true
-      - xpack.security.http.ssl.enabled=true
-      - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-      - xpack.security.transport.ssl.enabled=true
-      - xpack.security.transport.ssl.verification_mode=certificate
-      - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-    volumes:
-      - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
-      - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key
-      - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt
-
-  elasticsearch3:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2
-    hostname: elasticsearch3
-    restart: always
-    environment:
-      - cluster.name=wazuh-cluster
-      - node.name=elasticsearch3
-      - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
-      - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
-      - ELASTIC_PASSWORD=SecretPassword
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
-      - bootstrap.memory_lock=true
-      - xpack.license.self_generated.type=basic
-      - xpack.security.enabled=true
-      - xpack.security.http.ssl.enabled=true
-      - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-      - xpack.security.transport.ssl.enabled=true
-      - xpack.security.transport.ssl.verification_mode=certificate
-      - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
-      - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
-      - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-    volumes:
-      - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
-      - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key
-      - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt
-
-
-
-  kibana:
-    build: kibana/
-    image: wazuh/wazuh-kibana:4.3.0
-    hostname: kibana
-    restart: always
-    ports:
-      - 443:5601
-    environment:
-      - SERVERNAME=localhost
-      - ELASTICSEARCH_USERNAME=elastic
-      - ELASTICSEARCH_PASSWORD=SecretPassword
-      - ELASTICSEARCH_URL=https://elasticsearch:9200
-      - ELASTICSEARCH_HOSTS=https://elasticsearch:9200
-      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/ca.crt
-      - SERVER_SSL_ENABLED=true
-      - XPACK_SECURITY_ENABLED=true
-      - SERVER_SSL_KEY=/usr/share/kibana/config/kibana.key
-      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/kibana.crt
-    volumes:
-      - ./xpack/ca/ca.crt:/usr/share/kibana/config/ca.crt
-      - ./xpack/kibana/kibana.key:/usr/share/kibana/config/kibana.key
-      - ./xpack/kibana/kibana.crt:/usr/share/kibana/config/kibana.crt
-    depends_on:
-      - elasticsearch
-    links:
-      - elasticsearch:elasticsearch
-      - wazuh:wazuh
-
-volumes:
-  ossec_api_configuration:
-  ossec_etc:
-  ossec_logs:
-  ossec_queue:
-  ossec_var_multigroups:
-  ossec_integrations:
-  ossec_active_response:
-  ossec_agentless:
-  ossec_wodles:
-  filebeat_etc:
-  filebeat_var:

xpack/instances.yml

@@ -1,35 +0,0 @@
-instances:
-  - name: elasticsearch
-    dns:
-      - elasticsearch
-      - localhost
-    ip:
-      - 127.0.0.1
-
-  - name: elasticsearch2
-    dns:
-      - elasticsearch2
-      - localhost
-    ip:
-      - 127.0.0.1
-
-  - name: elasticsearch3
-    dns:
-      - elasticsearch3
-      - localhost
-    ip:
-      - 127.0.0.1
-
-  - name: kibana
-    dns:
-      - kibana
-      - localhost
-    ip:
-      - 127.0.0.1
-
-  - name: wazuh
-    dns:
-      - wazuh
-      - localhost
-    ip:
-      - 127.0.0.1