diff --git a/docker-compose.yml b/docker-compose.yml index 43c62ff4..fe0502e4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -61,6 +61,7 @@ services: - elasticsearch links: - elasticsearch:elasticsearch + - wazuh entrypoint: sh wait-for-it.sh elasticsearch # environment: # - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-2.1.0-5.5.1.zip" diff --git a/kibana/config/kibana.yml b/kibana/config/kibana.yml index 97bfeb6f..993ad7da 100644 --- a/kibana/config/kibana.yml +++ b/kibana/config/kibana.yml @@ -81,7 +81,7 @@ elasticsearch.url: "http://elasticsearch:9200" # logging.silent: false # Set the value of this setting to true to suppress all logging output other than error messages. -# logging.quiet: false +logging.quiet: true # Set the value of this setting to true to log all events, including system usage information # and all requests. diff --git a/kibana/config/wait-for-it.sh b/kibana/config/wait-for-it.sh index 2953b597..af6942a3 100644 --- a/kibana/config/wait-for-it.sh +++ b/kibana/config/wait-for-it.sh @@ -22,4 +22,37 @@ else /usr/share/kibana/bin/kibana-plugin install ${WAZUH_KIBANA_PLUGIN_URL} fi +sleep 30 + +echo "Configuring defaultIndex to wazuh-alerts-*" + +curl -s -XPUT http://$host:9200/.kibana/config/5.5.2 -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null + +sleep 30 + +echo "Setting API credentials into Wazuh APP" + +CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET http://$host:9200/.wazuh/wazuh-configuration/apiconfig) +if [ "x$CONFIG_CODE" = "x404" ]; then + curl -s -XPOST http://$host:9200/.wazuh/wazuh-configuration/apiconfig -H 'Content-Type: application/json' -d' + { + "api_user": "foo", + "api_password": "YmFy", + "url": "http://wazuh", + "api_port": "55000", + "insecure": "true", + "component": "API", + "active": "true", + "manager": "wazuh-manager", + "extensions": { + "oscap": true, + "audit": true, + "pci": true + } + } + ' > /dev/null +else + echo "Wazuh APP already configured" +fi + exec $cmd