yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Upgrade to Wazuh 3.1.0 and Kibabna 6.1.0

Browse Source
This commit is contained in:
José Luis Ruiz Ruiz
2017-12-25 16:40:14 -08:00
parent b8ef822f85
commit 5c7454270e
8 changed files with 59 additions and 667 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kibana/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM docker.elastic.co/kibana/kibana:5.6.4
FROM docker.elastic.co/kibana/kibana:6.1.0
USER root
kibana/config/wait-for-it.sh
+33 -22
View File
@@ -5,7 +5,7 @@ set -e
host="$1"
shift
cmd="kibana"
WAZUH_KIBANA_PLUGIN_URL=${WAZUH_KIBANA_PLUGIN_URL:-https://packages.wazuh.com/wazuhapp/wazuhapp-2.1.1_5.6.4.zip}
WAZUH_KIBANA_PLUGIN_URL=${WAZUH_KIBANA_PLUGIN_URL:-https://packages.wazuh.com/wazuhapp/wazuhapp-3.1.0_6.1.0.zip}
until curl -XGET $host:9200; do
>&2 echo "Elastic is unavailable - sleeping"
@@ -14,6 +14,18 @@ done
>&2 echo "Elastic is up - executing command"
#Insert default templates
curl https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/elasticsearch/wazuh-elastic6-template-alerts.json | curl -XPUT 'http://elasticsearch:9200/_template/wazuh' -H 'Content-Type: application/json' -d @-
sleep 5
curl https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/elasticsearch/wazuh-elastic6-template-monitoring.json | curl -XPUT 'http://elasticsearch:9200/_template/wazuh-agent' -H 'Content-Type: application/json' -d @-
#Insert sample alert:
sleep 5
curl https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/elasticsearch/alert_sample.json | curl -XPUT "http://elasticsearch:9200/wazuh-alerts-3.x-"`date +%Y.%m.%d`"/wazuh/sample" -H 'Content-Type: application/json' -d @-
sleep 5
if /usr/share/kibana/bin/kibana-plugin list | grep wazuh; then
echo "Wazuh APP already installed"
else
@@ -22,31 +34,30 @@ fi
sleep 30
echo "Configuring defaultIndex to wazuh-alerts-*"
curl -s -XPUT http://$host:9200/.kibana/config/5.6.4 -H 'Content-Type: application/json' -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
echo "Setting API credentials into Wazuh APP"
CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET http://$host:9200/.wazuh/wazuh-configuration/apiconfig)
CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET http://$host:9200/.wazuh/wazuh-configuration/1513629884013)
if [ "x$CONFIG_CODE" = "x404" ]; then
curl -s -XPOST http://$host:9200/.wazuh/wazuh-configuration/apiconfig -H 'Content-Type: application/json' -d'
{
"api_user": "foo",
"api_password": "YmFy",
"url": "https://wazuh",
"api_port": "55000",
"insecure": "true",
"component": "API",
"active": "true",
"manager": "wazuh-manager",
"extensions": {
"oscap": true,
"audit": true,
"pci": true
curl -s -XPOST http://$host:9200/.wazuh/wazuh-configuration/1513629884013 -H 'Content-Type: application/json' -d'
{
"api_user": "foo",
"api_password": "YmFy",
"url": "https://wazuh",
"api_port": "55000",
"insecure": "true",
"component": "API",
"cluster_info": {
"manager": "wazuh-manager",
"cluster": "Disabled",
"status": "disabled"
},
"extensions": {
"oscap": true,
"audit": true,
"pci": true
}
}
}
' > /dev/null
' > /dev/null
else
echo "Wazuh APP already configured"
fi