From d8b186aa52e77ea0de36716ba3b165dd5bc59346 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 18 Aug 2020 16:29:55 +0200
Subject: [PATCH 01/50] Add wazuh image using filebeat-oss

---
 wazuh-opendistro/Dockerfile                   |  59 +++++
 .../config/etc/cont-init.d/0-wazuh-init       | 232 ++++++++++++++++++
 .../config/etc/cont-init.d/1-config-filebeat  |  29 +++
 .../config/etc/cont-init.d/2-manager          |   3 +
 .../config/etc/services.d/api/finish          |   6 +
 .../config/etc/services.d/api/run             |   4 +
 .../config/etc/services.d/filebeat/finish     |   6 +
 .../config/etc/services.d/filebeat/run        |   4 +
 wazuh-opendistro/config/filebeat.yml          |  21 ++
 wazuh-opendistro/config/permanent_data.env    |  74 ++++++
 wazuh-opendistro/config/permanent_data.sh     |  40 +++
 wazuh-opendistro/config/wazuh.repo            |   7 +
 12 files changed, 485 insertions(+)
 create mode 100644 wazuh-opendistro/Dockerfile
 create mode 100644 wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
 create mode 100644 wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
 create mode 100644 wazuh-opendistro/config/etc/cont-init.d/2-manager
 create mode 100644 wazuh-opendistro/config/etc/services.d/api/finish
 create mode 100644 wazuh-opendistro/config/etc/services.d/api/run
 create mode 100644 wazuh-opendistro/config/etc/services.d/filebeat/finish
 create mode 100644 wazuh-opendistro/config/etc/services.d/filebeat/run
 create mode 100644 wazuh-opendistro/config/filebeat.yml
 create mode 100644 wazuh-opendistro/config/permanent_data.env
 create mode 100644 wazuh-opendistro/config/permanent_data.sh
 create mode 100644 wazuh-opendistro/config/wazuh.repo

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
new file mode 100644
index 00000000..1add03c0
--- /dev/null
+++ b/wazuh-opendistro/Dockerfile
@@ -0,0 +1,59 @@
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+FROM centos:7
+
+ARG FILEBEAT_VERSION=7.8.0
+ARG WAZUH_VERSION=3.13.1-1
+ARG TEMPLATE_VERSION="v3.13.1"
+ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
+
+ENV API_USER="foo" \
+   API_PASS="bar"
+
+
+# Set repositories.
+RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
+
+COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo
+
+RUN yum --enablerepo=updates clean metadata && \
+  yum -y install openssl which && yum -y install wazuh-manager-${WAZUH_VERSION} -y && \
+  curl --silent --location https://rpm.nodesource.com/setup_10.x | bash - && \
+  yum -y install nodejs && yum -y install wazuh-api-${WAZUH_VERSION} && \
+  sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
+  yum clean all && rm -rf /var/cache/yum
+
+RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm &&\
+  rpm -i filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm
+
+RUN curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/${TEMPLATE_VERSION}/extensions/elasticsearch/7.x/wazuh-template.json &&\
+  chmod go+r /etc/filebeat/wazuh-template.json
+
+RUN curl -s https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
+
+ARG S6_VERSION="v2.0.0.1"
+RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
+    -o /tmp/s6-overlay-amd64.tar.gz && \
+    tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
+    tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \
+    rm  /tmp/s6-overlay-amd64.tar.gz
+
+COPY config/filebeat.yml /etc/filebeat/
+
+RUN chmod go-w /etc/filebeat/filebeat.yml
+
+ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
+RUN chmod go-w /etc/filebeat/wazuh-template.json
+
+COPY config/etc/ /etc/
+
+# Prepare permanent data
+# Sync calls are due to https://github.com/docker/docker/issues/9547
+COPY config/permanent_data.env config/permanent_data.sh /
+RUN chmod 755 /permanent_data.sh && \
+    sync && /permanent_data.sh && \
+    sync && rm /permanent_data.sh
+
+# Services ports
+EXPOSE 55000/tcp 1514/udp 1515/tcp 514/udp 1516/tcp
+
+ENTRYPOINT [ "/init" ]
diff --git a/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init b/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
new file mode 100644
index 00000000..b0cbd001
--- /dev/null
+++ b/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
@@ -0,0 +1,232 @@
+#!/usr/bin/with-contenv bash
+# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+# Variables
+source /permanent_data.env
+
+WAZUH_INSTALL_PATH=/var/ossec
+WAZUH_CONFIG_MOUNT=/wazuh-config-mount
+AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
+API_GENERATE_CERTS=${API_GENERATE_CERTS:-true}
+
+
+##############################################################################
+# Aux functions
+##############################################################################
+print() {
+  echo -e $1
+}
+
+error_and_exit() {
+  echo "Error executing command: '$1'."
+  echo 'Exiting.'
+  exit 1
+}
+
+exec_cmd() {
+  eval $1 > /dev/null 2>&1 || error_and_exit "$1"
+}
+
+exec_cmd_stdout() {
+  eval $1 2>&1 || error_and_exit "$1"
+}
+
+
+##############################################################################
+# Edit configuration
+##############################################################################
+
+edit_configuration() { # $1 -> setting,  $2 -> value
+  sed -i "s/^config.$1\s=.*/config.$1 = \"$2\";/g" "${WAZUH_INSTALL_PATH}/api/configuration/config.js" || error_and_exit "sed (editing configuration)"
+}
+
+##############################################################################
+# This function will attempt to mount every directory in PERMANENT_DATA 
+# into the respective path. 
+# If the path is empty means permanent data volume is also empty, so a backup  
+# will be copied into it. Otherwise it will not be copied because there is  
+# already data inside the volume for the specified path.
+##############################################################################
+
+mount_permanent_data() {
+  for permanent_dir in "${PERMANENT_DATA[@]}"; do
+    # Check if the path is not empty
+    if find ${permanent_dir} -mindepth 1 | read; then
+      print "The path ${permanent_dir} is already mounted"
+    else
+      print "Installing ${permanent_dir}"
+      exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent${permanent_dir}/. ${permanent_dir}"
+    fi
+  done
+}
+
+##############################################################################
+# This function will replace from the permanent data volume every file 
+# contained in PERMANENT_DATA_EXCP
+# Some files as 'internal_options.conf' are saved as permanent data, but 
+# they must be updated to work properly if wazuh version is changed.
+##############################################################################
+
+apply_exclusion_data() {
+  for exclusion_file in "${PERMANENT_DATA_EXCP[@]}"; do
+    if [  -e ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file}  ]
+    then
+      DIR=$(dirname "${exclusion_file}")
+      if [ ! -e ${DIR}  ]
+      then
+        mkdir -p ${DIR}
+      fi
+      
+      print "Updating ${exclusion_file}"
+      exec_cmd "cp -p ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file} ${exclusion_file}"
+    fi
+  done
+}
+
+##############################################################################
+# This function will delete from the permanent data volume every file 
+# contained in PERMANENT_DATA_DEL
+##############################################################################
+
+remove_data_files() {
+  for del_file in "${PERMANENT_DATA_DEL[@]}"; do
+    if [ -e ${del_file} ]
+    then 
+      print "Removing ${del_file}"
+      exec_cmd "rm ${del_file}"
+    fi
+  done
+}
+
+##############################################################################
+# Create certificates: Manager
+##############################################################################
+
+create_ossec_key_cert() {
+  print "Creating ossec-authd key and cert"
+  exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096"
+  exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
+}
+
+##############################################################################
+# Create certificates: API
+##############################################################################
+
+create_api_key_cert() {
+  print "Enabling Wazuh API HTTPS"
+  edit_configuration "https" "yes"
+  print "Create Wazuh API key and cert"
+  exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key 4096"
+  exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/"
+
+  # Granting proper permissions 
+  chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key
+  chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt
+}
+
+##############################################################################
+# Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect
+# destination files permissions
+#
+# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at
+# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will
+# replace the ossec.conf file in /var/ossec/data/etc with yours.
+##############################################################################
+
+mount_files() {
+  if [ -e "$WAZUH_CONFIG_MOUNT" ]
+  then
+    print "Identified Wazuh configuration files to mount..."
+    exec_cmd_stdout "cp --verbose -r $WAZUH_CONFIG_MOUNT/* $WAZUH_INSTALL_PATH"
+  else
+    print "No Wazuh configuration files to mount..."
+  fi
+}
+
+##############################################################################
+# Stop OSSEC
+##############################################################################
+
+function ossec_shutdown(){
+  ${WAZUH_INSTALL_PATH}/bin/ossec-control stop;
+}
+
+##############################################################################
+# Interpret any passed arguments (via docker command to this entrypoint) as
+# paths or commands, and execute them. 
+#
+# This can be useful for actions that need to be run before the services are
+# started, such as "/var/ossec/bin/ossec-control enable agentless".
+##############################################################################
+
+docker_custom_args() {
+  for CUSTOM_COMMAND in "$@"
+  do
+    echo "Executing command \`${CUSTOM_COMMAND}\`"
+    exec_cmd_stdout "${CUSTOM_COMMAND}"
+  done
+}
+
+##############################################################################
+# Change Wazuh API user credentials.
+##############################################################################
+
+change_api_user_credentials() {
+  pushd /var/ossec/api/configuration/auth/
+  echo "Change Wazuh API user credentials"
+  change_user="node htpasswd -b -c user $API_USER $API_PASS"
+  eval $change_user
+  popd
+}
+
+
+##############################################################################
+# Main function
+##############################################################################
+
+main() {
+  # Mount permanent data  (i.e. ossec.conf)
+  mount_permanent_data
+
+  # Restore files stored in permanent data that are not permanent  (i.e. internal_options.conf)
+  apply_exclusion_data
+
+  # Remove some files in permanent_data (i.e. .template.db)
+  remove_data_files
+
+  # Generate ossec-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
+  if [ $AUTO_ENROLLMENT_ENABLED == true ]
+  then
+    if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
+    then
+      create_ossec_key_cert
+    fi
+  fi
+
+  # Generate API certs if API_GENERATE_CERTS is true and does not exist
+  if [ $API_GENERATE_CERTS == true ]
+  then
+    if [ ! -e ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt ]
+    then
+      create_api_key_cert
+    fi
+  fi
+
+  # Mount selected files (WAZUH_CONFIG_MOUNT) to container
+  mount_files
+
+  # Trap exit signals and do a proper shutdown
+  trap "ossec_shutdown; exit" SIGINT SIGTERM
+
+  # Execute custom args
+  docker_custom_args
+
+  # Change API user credentials
+  change_api_user_credentials
+
+  # Delete temporary data folder
+  rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
+
+}
+
+main
diff --git a/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat b/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
new file mode 100644
index 00000000..2f744915
--- /dev/null
+++ b/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
@@ -0,0 +1,29 @@
+#!/usr/bin/with-contenv bash
+# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+set -e
+
+if [ "$ELASTICSEARCH_URL" != "" ]; then
+  >&2 echo "Customize Elasticsearch ouput IP"
+  sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
+fi
+
+# Configure filebeat.yml security settings
+
+if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
+  >&2 echo "Configuring Certificate Authorities."
+  sed -i 's|#ssl.certificate_authorities:|'ssl.certificate_authorities:\ [\"$SSL_CERTIFICATE_AUTHORITIES\"]'|g' /etc/filebeat/filebeat.yml
+fi
+
+if [ "$USERNAME" != "" ]; then
+  >&2 echo "Configuring username."
+  sed -i 's|#username:|'username:\ \"$USERNAME\"'|g' /etc/filebeat/filebeat.yml
+fi
+
+if [ "$PASSWORD" != "" ]; then
+  >&2 echo "Configuring password."
+  sed -i 's|#password:|'password:\ \"$PASSWORD\"'|g' /etc/filebeat/filebeat.yml
+fi
+
+chmod go-w /etc/filebeat/filebeat.yml || true
+chown root: /etc/filebeat/filebeat.yml || true
diff --git a/wazuh-opendistro/config/etc/cont-init.d/2-manager b/wazuh-opendistro/config/etc/cont-init.d/2-manager
new file mode 100644
index 00000000..e548e8b1
--- /dev/null
+++ b/wazuh-opendistro/config/etc/cont-init.d/2-manager
@@ -0,0 +1,3 @@
+#!/usr/bin/with-contenv bash
+
+/var/ossec/bin/ossec-control start 
diff --git a/wazuh-opendistro/config/etc/services.d/api/finish b/wazuh-opendistro/config/etc/services.d/api/finish
new file mode 100644
index 00000000..38d744d1
--- /dev/null
+++ b/wazuh-opendistro/config/etc/services.d/api/finish
@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+echo >&2 "API exited. code=${1}"
+
+# terminate other services to exit from the container
+exec s6-svscanctl -t /var/run/s6/services
+
diff --git a/wazuh-opendistro/config/etc/services.d/api/run b/wazuh-opendistro/config/etc/services.d/api/run
new file mode 100644
index 00000000..e6e3e831
--- /dev/null
+++ b/wazuh-opendistro/config/etc/services.d/api/run
@@ -0,0 +1,4 @@
+#!/usr/bin/with-contenv sh
+echo >&2 "starting API"
+
+exec /bin/node /var/ossec/api/app.js
diff --git a/wazuh-opendistro/config/etc/services.d/filebeat/finish b/wazuh-opendistro/config/etc/services.d/filebeat/finish
new file mode 100644
index 00000000..8813eb67
--- /dev/null
+++ b/wazuh-opendistro/config/etc/services.d/filebeat/finish
@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+echo >&2 "Filebeat exited. code=${1}"
+
+# terminate other services to exit from the container
+exec s6-svscanctl -t /var/run/s6/services
+
diff --git a/wazuh-opendistro/config/etc/services.d/filebeat/run b/wazuh-opendistro/config/etc/services.d/filebeat/run
new file mode 100644
index 00000000..706ee5af
--- /dev/null
+++ b/wazuh-opendistro/config/etc/services.d/filebeat/run
@@ -0,0 +1,4 @@
+#!/usr/bin/with-contenv sh
+echo >&2 "starting Filebeat"
+
+exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
diff --git a/wazuh-opendistro/config/filebeat.yml b/wazuh-opendistro/config/filebeat.yml
new file mode 100644
index 00000000..0d04bac8
--- /dev/null
+++ b/wazuh-opendistro/config/filebeat.yml
@@ -0,0 +1,21 @@
+
+# Wazuh - Filebeat configuration file
+filebeat.modules:
+  - module: wazuh
+    alerts:
+      enabled: true
+    archives:
+      enabled: false
+
+setup.template.json.enabled: true
+setup.template.json.path: '/etc/filebeat/wazuh-template.json'
+setup.template.json.name: 'wazuh'
+setup.template.overwrite: true
+setup.ilm.enabled: false
+output.elasticsearch:
+  hosts: ['http://elasticsearch:9200']
+  #ssl.certificate_authorities:
+  #ssl.certificate:
+  #ssl.key:
+  #username:
+  #password:
diff --git a/wazuh-opendistro/config/permanent_data.env b/wazuh-opendistro/config/permanent_data.env
new file mode 100644
index 00000000..ca461d63
--- /dev/null
+++ b/wazuh-opendistro/config/permanent_data.env
@@ -0,0 +1,74 @@
+# Permanent data mounted in volumes
+i=0
+PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
+PERMANENT_DATA[((i++))]="/var/ossec/etc"
+PERMANENT_DATA[((i++))]="/var/ossec/logs"
+PERMANENT_DATA[((i++))]="/var/ossec/queue"
+PERMANENT_DATA[((i++))]="/var/ossec/agentless"
+PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
+PERMANENT_DATA[((i++))]="/var/ossec/integrations"
+PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin"
+PERMANENT_DATA[((i++))]="/var/ossec/wodles"
+PERMANENT_DATA[((i++))]="/etc/filebeat"
+export PERMANENT_DATA
+
+# Files mounted in a volume that should not be permanent
+i=0
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_oval.xsl"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_xccdf.xsl"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-redhat-6-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-redhat-7-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-centos-6-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-centos-7-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-fedora-24-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-rhel-6-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-rhel-7-ds.xml"
+export PERMANENT_DATA_EXCP
+
+# Files mounted in a volume that should be deleted 
+i=0
+PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db"
+export PERMANENT_DATA_DEL
diff --git a/wazuh-opendistro/config/permanent_data.sh b/wazuh-opendistro/config/permanent_data.sh
new file mode 100644
index 00000000..7dfaa647
--- /dev/null
+++ b/wazuh-opendistro/config/permanent_data.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+# Variables
+source /permanent_data.env
+
+WAZUH_INSTALL_PATH=/var/ossec
+DATA_TMP_PATH=${WAZUH_INSTALL_PATH}/data_tmp
+mkdir ${DATA_TMP_PATH}
+
+# Move exclusion files to EXCLUSION_PATH
+EXCLUSION_PATH=${DATA_TMP_PATH}/exclusion
+mkdir ${EXCLUSION_PATH}
+
+for exclusion_file in "${PERMANENT_DATA_EXCP[@]}"; do
+  # Create the directory for the exclusion file if it does not exist
+  DIR=$(dirname "${exclusion_file}")
+  if [ ! -e ${EXCLUSION_PATH}/${DIR}  ]
+  then
+    mkdir -p ${EXCLUSION_PATH}/${DIR}
+  fi
+
+  mv ${exclusion_file} ${EXCLUSION_PATH}/${exclusion_file}
+done
+
+# Move permanent files to PERMANENT_PATH
+PERMANENT_PATH=${DATA_TMP_PATH}/permanent
+mkdir ${PERMANENT_PATH}
+
+for permanent_dir in "${PERMANENT_DATA[@]}"; do
+  # Create the directory for the permanent file if it does not exist
+  DIR=$(dirname "${permanent_dir}")
+  if [ ! -e ${PERMANENT_PATH}${DIR}  ]
+  then
+    mkdir -p ${PERMANENT_PATH}${DIR}
+  fi
+  
+  mv ${permanent_dir} ${PERMANENT_PATH}${permanent_dir}
+
+done
diff --git a/wazuh-opendistro/config/wazuh.repo b/wazuh-opendistro/config/wazuh.repo
new file mode 100644
index 00000000..ae462c62
--- /dev/null
+++ b/wazuh-opendistro/config/wazuh.repo
@@ -0,0 +1,7 @@
+[wazuh_repo]
+gpgcheck=1
+gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+enabled=1
+name=Wazuh repository
+baseurl=https://packages.wazuh.com/3.x/yum/
+protect=1

From 9e87c1b597e31192beb08181e262f3073d87b13d Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 18 Aug 2020 17:04:12 +0200
Subject: [PATCH 02/50] Add initial support for kibana-opendistro

---
 kibana-opendistro/Dockerfile                 | 60 ++++++++++++++++
 kibana-opendistro/config/entrypoint.sh       | 53 ++++++++++++++
 kibana-opendistro/config/kibana_settings.sh  | 76 ++++++++++++++++++++
 kibana-opendistro/config/wazuh_app_config.sh | 67 +++++++++++++++++
 kibana-opendistro/config/welcome_wazuh.sh    | 24 +++++++
 5 files changed, 280 insertions(+)
 create mode 100644 kibana-opendistro/Dockerfile
 create mode 100644 kibana-opendistro/config/entrypoint.sh
 create mode 100644 kibana-opendistro/config/kibana_settings.sh
 create mode 100644 kibana-opendistro/config/wazuh_app_config.sh
 create mode 100644 kibana-opendistro/config/welcome_wazuh.sh

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
new file mode 100644
index 00000000..4b4ba99f
--- /dev/null
+++ b/kibana-opendistro/Dockerfile
@@ -0,0 +1,60 @@
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+FROM amazon/opendistro-for-elasticsearch-kibana:1.9.0
+USER kibana
+ARG ELASTIC_VERSION=7.8.0
+ARG WAZUH_VERSION=3.13.1
+ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
+
+WORKDIR /usr/share/kibana
+RUN ./bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip
+
+WORKDIR /
+USER root
+COPY config/entrypoint.sh ./entrypoint.sh
+RUN chmod 755 ./entrypoint.sh
+
+ENV PATTERN="" \
+    CHECKS_PATTERN="" \
+    CHECKS_TEMPLATE="" \
+    CHECKS_API="" \
+    CHECKS_SETUP="" \
+    EXTENSIONS_PCI="" \
+    EXTENSIONS_GDPR="" \
+    EXTENSIONS_AUDIT="" \
+    EXTENSIONS_OSCAP="" \
+    EXTENSIONS_CISCAT="" \
+    EXTENSIONS_AWS="" \
+    EXTENSIONS_VIRUSTOTAL="" \
+    EXTENSIONS_OSQUERY="" \
+    APP_TIMEOUT="" \
+    WAZUH_SHARDS="" \
+    WAZUH_REPLICAS="" \
+    WAZUH_VERSION_SHARDS="" \
+    WAZUH_VERSION_REPLICAS="" \
+    IP_SELECTOR="" \
+    IP_IGNORE="" \
+    WAZUH_MONITORING_ENABLED="" \
+    WAZUH_MONITORING_FREQUENCY="" \
+    WAZUH_MONITORING_SHARDS="" \
+    WAZUH_MONITORING_REPLICAS="" \
+    ADMIN_PRIVILEGES=""
+
+ARG CHANGE_WELCOME="false"
+
+COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
+
+RUN chmod +x ./wazuh_app_config.sh
+
+COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
+
+RUN chmod +x ./kibana_settings.sh
+
+COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
+
+RUN chmod +x ./welcome_wazuh.sh
+
+RUN ./welcome_wazuh.sh
+USER kibana
+RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
+
+ENTRYPOINT ./entrypoint.sh
diff --git a/kibana-opendistro/config/entrypoint.sh b/kibana-opendistro/config/entrypoint.sh
new file mode 100644
index 00000000..79039afc
--- /dev/null
+++ b/kibana-opendistro/config/entrypoint.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+set -e
+
+##############################################################################
+# Waiting for elasticsearch
+##############################################################################
+
+if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
+  el_url="http://elasticsearch:9200"
+else
+  el_url="${ELASTICSEARCH_URL}"
+fi
+
+auth=""
+
+until curl -XGET $el_url ${auth}; do
+  >&2 echo "Elastic is unavailable - sleeping"
+  sleep 5
+done
+
+sleep 2
+
+>&2 echo "Elasticsearch is up."
+
+
+##############################################################################
+# Waiting for wazuh alerts template
+##############################################################################
+
+strlen=0
+
+while [[ $strlen -eq 0 ]]
+do
+  template=$(curl $el_url/_cat/templates/wazuh -s)
+  strlen=${#template}
+  >&2 echo "Wazuh alerts template not loaded - sleeping."
+  sleep 2
+done
+
+sleep 2
+
+>&2 echo "Wazuh alerts template is loaded."
+
+
+./wazuh_app_config.sh
+
+sleep 5
+
+./kibana_settings.sh &
+
+/usr/local/bin/kibana-docker
diff --git a/kibana-opendistro/config/kibana_settings.sh b/kibana-opendistro/config/kibana_settings.sh
new file mode 100644
index 00000000..0f624725
--- /dev/null
+++ b/kibana-opendistro/config/kibana_settings.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+WAZUH_MAJOR=3
+
+##############################################################################
+# Wait for the Kibana API to start. It is necessary to do it in this container
+# because the others are running Elastic Stack and we can not interrupt them.
+#
+# The following actions are performed:
+#
+# Add the wazuh alerts index as default.
+# Set the Discover time interval to 24 hours instead of 15 minutes.
+# Do not ask user to help providing usage statistics to Elastic.
+##############################################################################
+
+##############################################################################
+# Customize elasticsearch ip
+##############################################################################
+if [ "$ELASTICSEARCH_KIBANA_IP" != "" ]; then
+  sed -i "s:#elasticsearch.hosts:elasticsearch.hosts:g" /usr/share/kibana/config/kibana.yml
+  sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_KIBANA_IP'|g' /usr/share/kibana/config/kibana.yml
+fi
+
+# If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate.
+if [ "$KIBANA_INDEX" != "" ]; then
+  if grep -q 'kibana.index' /usr/share/kibana/config/kibana.yml; then
+    sed -i '/kibana.index/d' /usr/share/kibana/config/kibana.yml
+  fi
+    echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
+fi
+
+if [ "$KIBANA_IP" != "" ]; then
+  kibana_ip="$KIBANA_IP"
+else
+  kibana_ip="kibana"
+fi
+
+# Add auth headers if required
+if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
+    curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
+fi
+
+while [[ "$(curl $curl_auth -XGET -I  -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
+  echo "Waiting for Kibana API. Sleeping 5 seconds"
+  sleep 5
+done
+
+# Prepare index selection.
+echo "Kibana API is running"
+
+default_index="/tmp/default_index.json"
+
+cat > ${default_index} << EOF
+{
+  "changes": {
+    "defaultIndex": "wazuh-alerts-${WAZUH_MAJOR}.x-*"
+  }
+}
+EOF
+
+sleep 5
+# Add the wazuh alerts index as default.
+curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
+rm -f ${default_index}
+
+sleep 5
+# Configuring Kibana TimePicker.
+curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
+'{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-24h\",\n  \"to\": \"now\",\n  \"mode\": \"quick\"}"}}'
+
+sleep 5
+# Do not ask user to help providing usage statistics to Elastic
+curl -POST "http://$kibana_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
+
+echo "End settings"
diff --git a/kibana-opendistro/config/wazuh_app_config.sh b/kibana-opendistro/config/wazuh_app_config.sh
new file mode 100644
index 00000000..6d9f05eb
--- /dev/null
+++ b/kibana-opendistro/config/wazuh_app_config.sh
@@ -0,0 +1,67 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+wazuh_url="${WAZUH_API_URL:-https://wazuh}"
+wazuh_port="${API_PORT:-55000}"
+api_user="${API_USER:-foo}"
+api_password="${API_PASS:-bar}"
+
+kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
+mkdir -p /usr/share/kibana/optimize/wazuh/config/
+touch $kibana_config_file
+
+declare -A CONFIG_MAP=(
+  [pattern]=$PATTERN
+  [checks.pattern]=$CHECKS_PATTERN
+  [checks.template]=$CHECKS_TEMPLATE
+  [checks.api]=$CHECKS_API
+  [checks.setup]=$CHECKS_SETUP
+  [extensions.pci]=$EXTENSIONS_PCI
+  [extensions.gdpr]=$EXTENSIONS_GDPR
+  [extensions.audit]=$EXTENSIONS_AUDIT
+  [extensions.oscap]=$EXTENSIONS_OSCAP
+  [extensions.ciscat]=$EXTENSIONS_CISCAT
+  [extensions.aws]=$EXTENSIONS_AWS
+  [extensions.virustotal]=$EXTENSIONS_VIRUSTOTAL
+  [extensions.osquery]=$EXTENSIONS_OSQUERY
+  [timeout]=$APP_TIMEOUT
+  [wazuh.shards]=$WAZUH_SHARDS
+  [wazuh.replicas]=$WAZUH_REPLICAS
+  [wazuh-version.shards]=$WAZUH_VERSION_SHARDS
+  [wazuh-version.replicas]=$WAZUH_VERSION_REPLICAS
+  [ip.selector]=$IP_SELECTOR
+  [ip.ignore]=$IP_IGNORE
+  [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
+  [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
+  [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
+  [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
+  [admin]=$ADMIN_PRIVILEGES
+)
+
+for i in "${!CONFIG_MAP[@]}"
+do
+    if [ "${CONFIG_MAP[$i]}" != "" ]; then
+        sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
+    fi
+done
+
+# remove default API entry (new in 3.11.0_7.5.1)
+sed -ie '/- default:/,+4d' $kibana_config_file
+
+CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth})
+
+grep -q 1513629884013 $kibana_config_file
+_config_exists=$?
+
+if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then
+cat << EOF > $kibana_config_file
+hosts:
+  - 1513629884013:
+      url: $wazuh_url
+      port: $wazuh_port
+      user: $api_user
+      password: $api_password
+EOF
+else
+  echo "Wazuh APP already configured"
+fi
diff --git a/kibana-opendistro/config/welcome_wazuh.sh b/kibana-opendistro/config/welcome_wazuh.sh
new file mode 100644
index 00000000..98306871
--- /dev/null
+++ b/kibana-opendistro/config/welcome_wazuh.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+if [[ $CHANGE_WELCOME == "true" ]]
+then
+
+    rm -rf ./optimize/bundles
+
+    kibana_path="/usr/share/kibana"
+    # Set Wazuh app as the default landing page
+    echo "Set Wazuh app as the default landing page"
+    echo "server.defaultRoute: /app/wazuh" >> /usr/share/kibana/config/kibana.yml
+
+    # Redirect Kibana welcome screen to Discover
+    echo "Redirect Kibana welcome screen to Discover"
+    sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
+    sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
+
+    # Redirect Kibana welcome screen to Discover
+    echo "Hide undesired links"
+    sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/rollup/public/crud_app/index.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/license_management/public/management_section.js
+fi
+

From 09a6e9bc1d3e74909a99923876b9a23993976c2b Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 18 Aug 2020 17:04:58 +0200
Subject: [PATCH 03/50] Switch to opendistro images

---
 docker-compose.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index cd8f90ff..e548edb7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,8 @@ version: '3.7'
 
 services:
   wazuh:
-    build: wazuh
+    build: wazuh-opendistro/
+    image: wazuh-opendistro
     hostname: wazuh-manager
     restart: always
     ports:
@@ -25,24 +26,23 @@ services:
       - filebeat_var:/var/lib/filebeat
 
   elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.8.0
+    image: amazon/opendistro-for-elasticsearch:1.9.0
     hostname: elasticsearch
     restart: always
     ports:
       - "9200:9200"
     environment:
-      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
-      - bootstrap.memory_lock=true
       - discovery.type=single-node
+      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+      - bootstrap.memory_lock=true
     ulimits:
       memlock:
         soft: -1
         hard: -1
-    volumes:
-      - ./elastic_conf/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
 
   kibana:
-    build: kibana
+    build: kibana-opendistro/
+    image: wazuh-kibana-opendistro
     hostname: kibana
     restart: always
     depends_on:

From 746cffc5496942c19ebefebbdc56b96c73a08ac7 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 19 Aug 2020 16:19:27 +0200
Subject: [PATCH 04/50] Update compose

---
 docker-compose.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index e548edb7..893e2b8f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -33,8 +33,12 @@ services:
       - "9200:9200"
     environment:
       - discovery.type=single-node
+      - cluster.name=wazuh-cluster
+      - network.host=0.0.0.0
       - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
       - bootstrap.memory_lock=true
+    volumes:
+      - ./elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
     ulimits:
       memlock:
         soft: -1
@@ -45,6 +49,10 @@ services:
     image: wazuh-kibana-opendistro
     hostname: kibana
     restart: always
+    environment:
+      - ELASTICSEARCH_USERNAME=admin
+      - ELASTICSEARCH_PASSWORD=SecretPass
+      - ELASTICSEARCH_KIBANA_IP="https://elasticsearch:9200"
     depends_on:
       - elasticsearch
     links:

From 95473050615074346100c05ae2ad64624c6d6a95 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 19 Aug 2020 16:19:49 +0200
Subject: [PATCH 05/50] Add custom welcome

---
 .../custom_welcome/security-login.style.css   | 118 ++++++++++++++++++
 .../config/custom_welcome/template.js.hbs     | 112 +++++++++++++++++
 .../custom_welcome/wazuh_logo_circle.svg      |   1 +
 .../config/custom_welcome/wazuh_wazuh_bg.svg  |   1 +
 4 files changed, 232 insertions(+)
 create mode 100644 kibana-opendistro/config/custom_welcome/security-login.style.css
 create mode 100644 kibana-opendistro/config/custom_welcome/template.js.hbs
 create mode 100644 kibana-opendistro/config/custom_welcome/wazuh_logo_circle.svg
 create mode 100644 kibana-opendistro/config/custom_welcome/wazuh_wazuh_bg.svg

diff --git a/kibana-opendistro/config/custom_welcome/security-login.style.css b/kibana-opendistro/config/custom_welcome/security-login.style.css
new file mode 100644
index 00000000..6648df2b
--- /dev/null
+++ b/kibana-opendistro/config/custom_welcome/security-login.style.css
@@ -0,0 +1,118 @@
+#security-login-app .content {
+  background: url(./wazuh_wazuh_bg.svg) !important;
+  width: 100% !important;
+  height: 100% !important;
+  background-size: cover !important;
+}
+
+.app-wrapper {
+  left: 0;
+}
+
+.global-nav.is-global-nav-open+.app-wrapper {
+  left: 0;
+}
+
+.btn-default {
+  background-color: #00a9e5!important;
+  border-color: #00a0e5!important;
+  color: #ffffff;
+  padding: 8px;
+}
+
+.btn-default:hover {
+  background-color: #00a9e5!important;
+  border-color: #00a0e5!important;
+  color: #ffffff;
+}
+
+.brand-image-container {
+  text-align: center;
+}
+
+.brand-image {
+  display: none;
+}
+
+.login-wrapper {
+  position: absolute;
+  width: 430px;
+  top: 55px;
+  border-radius: 1px;
+  padding: 1em;
+}
+
+.login-wrapper .login-title {
+  text-align: center;
+  padding-bottom: 10px;
+  color: #ffffff !important;
+  font-size: 35px !important;
+  font-weight: 300;
+}
+
+.login-wrapper .login-subtitle {
+  text-align: center;
+  padding-bottom: 15px;
+  color: #ffffff !important;
+  font-size: 16px !important;
+}
+
+.login-wrapper .login-form {
+  padding: 16px;
+  box-shadow: 0 2px 2px -1px rgba(152, 162, 179, 0.3), 0 1px 5px -2px rgba(152, 162, 179, 0.3);
+  background-color: #FFF;
+  border: 1px solid #D3DAE6;
+  border-radius: 4px;
+  -webkit-box-flex: 1;
+  -ms-flex-positive: 1;
+  flex-grow: 1;
+  margin-top: 32px;
+}
+
+.login-wrapper .login-form .input-group {
+  margin-bottom: 1em;
+}
+
+.login-wrapper .login-form .kuiTextInput {
+  cursor: initial;
+}
+
+.login-wrapper .login-form .kuiTextInput:invalid:not(.ng-touched) {
+  border-color: #D9D9D9;
+}
+
+.login-wrapper .login-form .kuiTextInput.has-error {
+  border-color: #A30000;
+}
+
+.login-wrapper .login-form .btn-login {
+  width: 100%;
+}
+
+.login-wrapper .error-message {
+  color: #b4251d;
+  font-size: 14px;
+  margin-top: 16px;
+  margin-bottom: 0;
+  background-color: #f8e9e9;
+  padding: 8px;
+  font-weight: 400;
+  border-left: 2px solid #BD271E;
+}
+
+.loginWelcome__logo {
+  display: inline-block;
+  width: 80px;
+  height: 80px;
+  line-height: 80px;
+  text-align: center;
+  background-color: #FFF;
+  border-radius: 100%;
+  padding: 16px;
+  box-shadow: 0 6px 12px -1px rgba(152, 162, 179, 0.2), 0 4px 4px -1px rgba(152, 162, 179, 0.2), 0 2px 2px 0 rgba(152, 162, 179, 0.2);
+  margin-bottom: 32px;
+}
+
+.loginWelcome__logo {
+  background: url(./wazuh_logo_circle.svg) center center no-repeat !important;
+}
\ No newline at end of file
diff --git a/kibana-opendistro/config/custom_welcome/template.js.hbs b/kibana-opendistro/config/custom_welcome/template.js.hbs
new file mode 100644
index 00000000..54255bca
--- /dev/null
+++ b/kibana-opendistro/config/custom_welcome/template.js.hbs
@@ -0,0 +1,112 @@
+var kbnCsp = JSON.parse(document.querySelector('kbn-csp').getAttribute('data'));
+window.__kbnStrictCsp__ = kbnCsp.strictCsp;
+window.__kbnDarkMode__ = {{darkMode}};
+window.__kbnPublicPath__ = {{publicPathMap}};
+
+if (window.__kbnStrictCsp__ && window.__kbnCspNotEnforced__) {
+  var legacyBrowserError = document.getElementById('kbn_legacy_browser_error');
+  legacyBrowserError.style.display = 'flex';
+} else {
+  if (!window.__kbnCspNotEnforced__ && window.console) {
+    window.console.log("^ A single error about an inline script not firing due to content security policy is expected!");
+  }
+  var loadingMessage = document.getElementById('kbn_loading_message');
+  loadingMessage.style.display = 'flex';
+
+  window.onload = function () {
+      //WAZUH 
+      var interval = setInterval(() => {  
+        var title = document.getElementsByClassName('login-title');
+        if ((title || []).length) {
+          clearInterval(interval);
+          title[0].textContent = "Welcome to Wazuh";
+          var subtitle = document.getElementsByClassName('login-subtitle');
+          subtitle[0].textContent = "The Open Source Security Platform";
+          var logo = document.getElementsByClassName('brand-image-container');
+          $(logo).append('<span class="loginWelcome__logo"></span>');
+        } 
+      })  
+    //
+    
+    function failure() {
+      // make subsequent calls to failure() noop
+      failure = function () {};
+
+      var err = document.createElement('h1');
+      err.style['color'] = 'white';
+      err.style['font-family'] = 'monospace';
+      err.style['text-align'] = 'center';
+      err.style['background'] = '#F44336';
+      err.style['padding'] = '25px';
+      err.innerText = document.querySelector('[data-error-message]').dataset.errorMessage;
+
+      document.body.innerHTML = err.outerHTML;
+    }
+
+var stylesheetTarget = document.querySelector('head meta[name="add-styles-here"]')
+    function loadStyleSheet(url, cb) {
+      var dom = document.createElement('link');
+      dom.rel = 'stylesheet';
+      dom.type = 'text/css';
+      dom.href = url;
+      dom.addEventListener('error', failure);
+      dom.addEventListener('load', cb);
+      document.head.insertBefore(dom, stylesheetTarget);
+    }
+
+    var scriptsTarget = document.querySelector('head meta[name="add-scripts-here"]')
+    function loadScript(url, cb) {
+      var dom = document.createElement('script');
+      {{!-- NOTE: async = false is used to trigger async-download/ordered-execution as outlined here: https://www.html5rocks.com/en/tutorials/speed/script-loading/ --}}
+      dom.async = false;
+      dom.src = url;
+      dom.addEventListener('error', failure);
+      dom.addEventListener('load', cb);
+      document.head.insertBefore(dom, scriptsTarget);
+    }
+
+    function load(urls, cb) {
+      var pending = urls.length;
+      urls.forEach(function (url) {
+        var innerCb = function () {
+          pending = pending - 1;
+          if (pending === 0 && typeof cb === 'function') {
+            cb();
+          }
+        }
+
+        if (typeof url !== 'string') {
+          load(url, innerCb);
+        } else if (url.slice(-4) === '.css') {
+          loadStyleSheet(url, innerCb);
+        } else {
+          loadScript(url, innerCb);
+        }
+      });
+    }
+
+    load([
+      {{#each jsDependencyPaths}}
+        '{{this}}',
+      {{/each}}
+    ], function () {
+      {{#unless legacyBundlePath}}
+        if (!__kbnBundles__ || !__kbnBundles__['entry/core'] || typeof __kbnBundles__['entry/core'].__kbnBootstrap__ !== 'function') {
+          console.error('entry/core bundle did not load correctly');
+          failure();
+        } else {
+          __kbnBundles__['entry/core'].__kbnBootstrap__()
+        }
+      {{/unless}}
+
+      load([
+        {{#if legacyBundlePath}}
+          '{{legacyBundlePath}}',
+        {{/if}}
+        {{#each styleSheetPaths}}
+          '{{this}}',
+        {{/each}}
+      ]);
+    });
+  }
+}
\ No newline at end of file
diff --git a/kibana-opendistro/config/custom_welcome/wazuh_logo_circle.svg b/kibana-opendistro/config/custom_welcome/wazuh_logo_circle.svg
new file mode 100644
index 00000000..45a61d74
--- /dev/null
+++ b/kibana-opendistro/config/custom_welcome/wazuh_logo_circle.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 84.67 84.67"><defs><style>.a{fill:#fff;}.b{fill:#00a9e5;}</style></defs><title>wazuh_logo_circle</title><circle class="a" cx="42.34" cy="42.34" r="42.34"/><path class="b" d="M58.13,9.2,50,26.32H35.07L26.16,9.2,20,31l-8.53,9.72,19.18,17.6,7.47,17.21h8.53l7-16.91L73.24,40.83l-8.73-9.57ZM48.58,55.13a1.79,1.79,0,0,1-.74.62,2.49,2.49,0,0,1-1,.2,2.52,2.52,0,0,1-1-.2,1.84,1.84,0,0,1-.71-.62l-2.88-4.36-2.9,4.36a1.87,1.87,0,0,1-.72.62,2.48,2.48,0,0,1-.95.2,1.94,1.94,0,0,1-1.7-.82L21.3,41.37h4.09L37.87,52.3l2.49-3.89h3.93L47,52.3,59.63,40.9h3.74Z"/></svg>
\ No newline at end of file
diff --git a/kibana-opendistro/config/custom_welcome/wazuh_wazuh_bg.svg b/kibana-opendistro/config/custom_welcome/wazuh_wazuh_bg.svg
new file mode 100644
index 00000000..0c49c5c6
--- /dev/null
+++ b/kibana-opendistro/config/custom_welcome/wazuh_wazuh_bg.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1419.47 772.47"><defs><style>.a,.aa,.ab,.ac,.ad,.ae,.af,.ag,.ah,.ai,.aj,.ak,.al,.am,.an,.ao,.ap,.aq,.ar,.as,.at,.au,.av,.aw,.ax,.ay,.az,.ba,.bb,.bc,.bd,.be,.bf,.bg,.bh,.bi,.bj,.bk,.bl,.bm,.bn,.bo,.bp,.bq,.br,.bs,.bt,.bu,.bv,.bw,.bx,.by,.bz,.ca,.cb,.cc,.cd,.ce,.cf,.cg,.ch,.ci,.cj,.ck,.cm,.g,.h,.i,.j,.k,.l,.m,.n,.o,.p,.q,.r,.s,.t,.u,.v,.w,.x,.y,.z{fill:none;}.b{isolation:isolate;}.c{clip-path:url(#a);}.d{fill:#00a9e5;}.e{clip-path:url(#b);}.f{mix-blend-mode:soft-light;}.aa,.ab,.ac,.ad,.ae,.af,.ag,.ah,.ai,.aj,.ak,.al,.am,.an,.ao,.ap,.aq,.ar,.as,.at,.au,.av,.aw,.ax,.ay,.az,.ba,.bb,.bc,.bd,.be,.bf,.bg,.bh,.bi,.bj,.bk,.bl,.bm,.bn,.bo,.bp,.bq,.br,.bs,.bt,.bu,.bv,.bw,.bx,.by,.bz,.ca,.cb,.cc,.cd,.ce,.cf,.cg,.ch,.ci,.cj,.ck,.g,.h,.i,.j,.k,.l,.m,.n,.o,.p,.q,.r,.s,.t,.u,.v,.w,.x,.y,.z{stroke:#f4f4f4;}.aa,.ab,.ac,.ad,.ae,.af,.ag,.ah,.ai,.aj,.ak,.al,.am,.an,.ao,.ap,.aq,.ar,.as,.at,.au,.av,.aw,.ax,.ay,.az,.ba,.bb,.bc,.bd,.be,.bf,.bg,.bh,.bi,.bj,.bk,.bl,.bm,.bn,.bo,.bp,.bq,.br,.bs,.bt,.bu,.bv,.bw,.bx,.by,.bz,.ca,.cb,.cc,.cd,.ce,.cf,.cg,.ch,.ci,.cj,.ck,.cm,.g,.h,.i,.j,.k,.l,.m,.n,.o,.p,.q,.r,.s,.t,.u,.v,.w,.x,.y,.z{stroke-miterlimit:10;}.g{stroke-width:0.54px;}.h{stroke-width:0.54px;}.aw,.h{opacity:0.98;}.i{stroke-width:0.53px;}.ax,.i{opacity:0.95;}.j{stroke-width:0.52px;}.ay,.j{opacity:0.93;}.k{stroke-width:0.52px;}.az,.k{opacity:0.9;}.l{stroke-width:0.51px;}.ba,.l{opacity:0.88;}.m{stroke-width:0.5px;}.bb,.m{opacity:0.85;}.n{stroke-width:0.5px;}.bc,.n{opacity:0.83;}.o{stroke-width:0.49px;}.bd,.o{opacity:0.8;}.p{stroke-width:0.48px;}.be,.p{opacity:0.78;}.q{stroke-width:0.48px;}.bf,.q{opacity:0.76;}.r{stroke-width:0.47px;}.bg,.r{opacity:0.73;}.s{stroke-width:0.46px;}.bh,.s{opacity:0.71;}.t{stroke-width:0.46px;}.bi,.t{opacity:0.68;}.u{stroke-width:0.45px;}.bj,.u{opacity:0.66;}.v{stroke-width:0.44px;}.bk,.v{opacity:0.63;}.w{stroke-width:0.44px;}.bl,.w{opacity:0.61;}.x{stroke-width:0.43px;}.bm,.x{opacity:0.59;}.y{stroke-width:0.42px;}.bn,.y{opacity:0.56;}.z{stroke-width:0.42px;}.bo,.z{opacity:0.54;}.aa{stroke-width:0.41px;}.aa,.bp{opacity:0.51;}.ab{stroke-width:0.4px;}.ab,.bq{opacity:0.49;}.ac{stroke-width:0.4px;}.ac,.br{opacity:0.46;}.ad{stroke-width:0.39px;}.ad,.bs{opacity:0.44;}.ae{stroke-width:0.38px;}.ae,.bt{opacity:0.41;}.af{stroke-width:0.38px;}.af,.bu{opacity:0.39;}.ag{stroke-width:0.37px;}.ag,.bv{opacity:0.37;}.ah{stroke-width:0.36px;}.ah,.bw{opacity:0.34;}.ai{stroke-width:0.36px;}.ai,.bx{opacity:0.32;}.aj{stroke-width:0.35px;}.aj,.by{opacity:0.29;}.ak{stroke-width:0.34px;}.ak,.bz{opacity:0.27;}.al{stroke-width:0.34px;}.al,.ca{opacity:0.24;}.am{stroke-width:0.33px;}.am,.cb{opacity:0.22;}.an{stroke-width:0.32px;}.an,.cc{opacity:0.2;}.ao{stroke-width:0.32px;}.ao,.cd{opacity:0.17;}.ap{stroke-width:0.31px;}.ap,.ce{opacity:0.15;}.aq{stroke-width:0.3px;}.aq,.cf{opacity:0.12;}.ar{stroke-width:0.3px;}.ar,.cg{opacity:0.1;}.as{stroke-width:0.29px;}.as,.ch{opacity:0.07;}.at{stroke-width:0.28px;}.at,.ci{opacity:0.05;}.au{stroke-width:0.28px;}.au,.cj{opacity:0.02;}.av{stroke-width:0.27px;}.av,.ck{opacity:0;}.aw{stroke-width:0.54px;}.ax{stroke-width:0.53px;}.ay{stroke-width:0.52px;}.az{stroke-width:0.52px;}.ba{stroke-width:0.51px;}.bb{stroke-width:0.51px;}.bc{stroke-width:0.5px;}.bd{stroke-width:0.49px;}.be{stroke-width:0.49px;}.bf{stroke-width:0.48px;}.bg{stroke-width:0.48px;}.bh{stroke-width:0.47px;}.bi{stroke-width:0.46px;}.bj{stroke-width:0.46px;}.bk{stroke-width:0.45px;}.bl{stroke-width:0.45px;}.bm{stroke-width:0.44px;}.bn{stroke-width:0.43px;}.bo{stroke-width:0.43px;}.bp{stroke-width:0.42px;}.bq{stroke-width:0.42px;}.br{stroke-width:0.41px;}.bs{stroke-width:0.4px;}.bt{stroke-width:0.4px;}.bu{stroke-width:0.39px;}.bv{stroke-width:0.38px;}.bw{stroke-width:0.38px;}.bx{stroke-width:0.37px;}.by{stroke-width:0.37px;}.bz{stroke-width:0.36px;}.ca{stroke-width:0.35px;}.cb{stroke-width:0.35px;}.cc{stroke-width:0.34px;}.cd{stroke-width:0.34px;}.ce{stroke-width:0.33px;}.cf{stroke-width:0.32px;}.cg{stroke-width:0.32px;}.ch{stroke-width:0.31px;}.ci{stroke-width:0.31px;}.cj{stroke-width:0.3px;}.ck{stroke-width:0.29px;}.cl{opacity:0.17;}.cm{stroke:#fff;stroke-width:0.74px;}.cn{fill:#fff;}.co,.eh,.ei{opacity:0.8;}.cp,.cr,.ct,.cv,.cx,.cz,.db,.dd,.df,.dh,.dj,.dl,.dn,.dp,.dr,.dt,.dv,.dx,.dz,.eb{mix-blend-mode:screen;}.cp{fill:url(#c);}.cq,.cs,.cu,.cw,.cy,.da,.dc,.de,.dg,.di,.dk,.dm,.do,.dq,.ds,.du,.dw,.dy,.ea,.ec{mix-blend-mode:color-dodge;}.cq{fill:url(#d);}.cr{fill:url(#e);}.cs{fill:url(#f);}.ct{fill:url(#g);}.cu{fill:url(#h);}.cv{fill:url(#i);}.cw{fill:url(#j);}.cx{fill:url(#k);}.cy{fill:url(#l);}.cz{fill:url(#m);}.da{fill:url(#n);}.db{fill:url(#o);}.dc{fill:url(#p);}.dd{fill:url(#q);}.de{fill:url(#r);}.df{fill:url(#s);}.dg{fill:url(#t);}.dh{fill:url(#u);}.di{fill:url(#v);}.dj{fill:url(#w);}.dk{fill:url(#x);}.dl{fill:url(#y);}.dm{fill:url(#z);}.dn{fill:url(#aa);}.do{fill:url(#ab);}.dp{fill:url(#ac);}.dq{fill:url(#ad);}.dr{fill:url(#ae);}.ds{fill:url(#af);}.dt{fill:url(#ag);}.du{fill:url(#ah);}.dv{fill:url(#ai);}.dw{fill:url(#aj);}.dx{fill:url(#ak);}.dy{fill:url(#al);}.dz{fill:url(#am);}.ea{fill:url(#an);}.eb{fill:url(#ao);}.ec{fill:url(#ap);}.ed{opacity:0.25;}.ee{fill:#b0cbd2;}.ef{fill:#e8eff2;}.eg{fill:#d8e5e9;}.eh{fill:#89b1bc;}.ei{fill:#6197a6;}</style><clipPath id="a"><rect class="a" x="-27.9" y="-39.87" width="1467.49" height="843.88"/></clipPath><clipPath id="b"><rect class="a" x="-219.2" y="-62.06" width="1720.98" height="896.58" transform="translate(233.72 -241.71) rotate(25.95)"/></clipPath><radialGradient id="c" cx="1884.22" cy="1498.1" r="17.91" gradientTransform="translate(-964.4 -1807.57) rotate(25.95)" gradientUnits="userSpaceOnUse"><stop offset="0.01" stop-color="#1ea5c8"/><stop offset="0.09" stop-color="#4ab7d3" stop-opacity="0.8"/><stop offset="0.19" stop-color="#7acade" stop-opacity="0.59"/><stop offset="0.3" stop-color="#a3dae8" stop-opacity="0.41"/><stop offset="0.42" stop-color="#c4e8f1" stop-opacity="0.26"/><stop offset="0.54" stop-color="#def2f7" stop-opacity="0.15"/><stop offset="0.67" stop-color="#f1f9fc" stop-opacity="0.06"/><stop offset="0.81" stop-color="#fcfefe" stop-opacity="0.02"/><stop offset="1" stop-color="#fff" stop-opacity="0"/></radialGradient><radialGradient id="d" cx="1884.22" cy="1498.1" r="11.11" xlink:href="#c"/><radialGradient id="e" cx="2620.44" cy="1037.11" r="17.91" gradientTransform="translate(1974.94 -2348.63) rotate(90)" xlink:href="#c"/><radialGradient id="f" cx="2620.44" cy="1037.11" r="11.11" xlink:href="#c"/><radialGradient id="g" cx="2806.04" cy="1219.29" r="17.91" gradientTransform="translate(-97.03 -2329.49) rotate(45)" xlink:href="#c"/><radialGradient id="h" cx="2806.04" cy="1219.28" r="11.11" xlink:href="#c"/><radialGradient id="i" cx="1983.98" cy="1183.27" r="17.91" gradientTransform="translate(-264.59 -2114.91) rotate(45)" xlink:href="#c"/><radialGradient id="j" cx="1983.98" cy="1183.27" r="11.11" xlink:href="#c"/><radialGradient id="k" cx="1745.86" cy="1318.42" r="10.22" xlink:href="#c"/><radialGradient id="l" cx="1745.86" cy="1318.42" r="6.35" xlink:href="#c"/><radialGradient id="m" cx="2250.91" cy="1139.25" r="8.3" gradientTransform="translate(1700.12 -2048.99) rotate(90)" xlink:href="#c"/><radialGradient id="n" cx="2250.91" cy="1139.25" r="5.15" xlink:href="#c"/><radialGradient id="o" cx="2600.98" cy="1425.75" r="5.81" xlink:href="#c"/><radialGradient id="p" cx="2600.98" cy="1425.75" r="3.61" xlink:href="#c"/><radialGradient id="q" cx="2830.72" cy="797.95" r="5.81" xlink:href="#c"/><radialGradient id="r" cx="2830.72" cy="797.95" r="3.61" xlink:href="#c"/><radialGradient id="s" cx="2919.86" cy="1210.25" r="5.81" xlink:href="#c"/><radialGradient id="t" cx="2919.86" cy="1210.25" r="3.61" xlink:href="#c"/><radialGradient id="u" cx="2799.21" cy="1160.43" r="8.3" xlink:href="#c"/><radialGradient id="v" cx="2799.21" cy="1160.43" r="5.15" xlink:href="#c"/><radialGradient id="w" cx="1792.74" cy="1241.39" r="8.3" xlink:href="#c"/><radialGradient id="x" cx="1792.74" cy="1241.39" r="5.15" xlink:href="#c"/><radialGradient id="y" cx="2551.01" cy="1137.07" r="3.94" xlink:href="#c"/><radialGradient id="z" cx="2551.01" cy="1137.07" r="2.45" xlink:href="#c"/><radialGradient id="aa" cx="2032.97" cy="1302.89" r="3.94" xlink:href="#c"/><radialGradient id="ab" cx="2032.97" cy="1302.89" r="2.45" xlink:href="#c"/><radialGradient id="ac" cx="1892.22" cy="1283.79" r="3.94" xlink:href="#c"/><radialGradient id="ad" cx="1892.22" cy="1283.79" r="2.45" xlink:href="#c"/><radialGradient id="ae" cx="2695.65" cy="1372.23" r="3.94" xlink:href="#c"/><radialGradient id="af" cx="2695.65" cy="1372.23" r="2.45" xlink:href="#c"/><radialGradient id="ag" cx="2160.9" cy="1500.49" r="3.94" xlink:href="#c"/><radialGradient id="ah" cx="2160.9" cy="1500.49" r="2.45" xlink:href="#c"/><radialGradient id="ai" cx="2501.37" cy="1047.08" r="3.94" xlink:href="#c"/><radialGradient id="aj" cx="2501.37" cy="1047.08" r="2.45" xlink:href="#c"/><radialGradient id="ak" cx="2361.82" cy="1367.2" r="3.94" xlink:href="#c"/><radialGradient id="al" cx="2361.82" cy="1367.2" r="2.45" xlink:href="#c"/><radialGradient id="am" cx="1984.39" cy="1521.62" r="3.94" xlink:href="#c"/><radialGradient id="an" cx="1984.39" cy="1521.62" r="2.45" xlink:href="#c"/><radialGradient id="ao" cx="2875.85" cy="848.65" r="3.94" xlink:href="#c"/><radialGradient id="ap" cx="2875.85" cy="848.65" r="2.45" xlink:href="#c"/></defs><title>wazuh_wazuh_bg</title><g class="b"><g class="c"><rect class="d" x="-27.9" y="-39.87" width="1467.49" height="843.88"/><g class="e"><g class="f"><path class="g" d="M-139-118s173-10,389.5,95.39S428.54,309.76,701.82,442.78s484.12-155.95,851.48,22.87"/><path class="h" d="M-140.68-114.64S36.21-132.73,252.75-27.33,425,317,698.27,450.06s483.21-154,850.56,24.77"/><path class="i" d="M-142.31-111.29S38.51-137.46,255.05-32.06s166.4,356.38,439.68,489.41S1177,305.19,1544.36,484"/><path class="j" d="M-143.94-107.94S40.81-142.18,257.35-36.78,417.9,331.61,691.18,464.63s481.36-150.26,848.72,28.55"/><path class="k" d="M-145.57-104.59S43.11-146.91,259.65-41.51s154.71,380.4,428,513.42,480.43-148.36,847.79,30.45"/><path class="l" d="M-147.21-101.24S45.42-151.63,262-46.23,410.81,346.18,684.09,479.2,1163.6,332.73,1531,511.54"/><path class="m" d="M-148.84-97.89S47.72-156.36,264.25-51s143,404.42,416.29,537.44,478.6-144.57,846,34.24"/><path class="n" d="M-150.47-94.53S50-161.08,266.55-55.69,403.72,360.75,677,493.77s477.67-142.69,845,36.13"/><path class="o" d="M-152.1-91.18s204.42-74.63,421,30.77S400.17,368,673.45,501.05s476.75-140.79,844.11,38"/><path class="p" d="M-153.73-87.83S54.62-170.54,271.15-65.14,396.63,375.32,669.91,508.34s475.82-138.9,843.18,39.92"/><path class="q" d="M-155.36-84.48S56.92-175.26,273.45-69.86,393.08,382.6,666.36,515.62s474.91-137,842.26,41.81"/><path class="r" d="M-157-81.13S59.22-180,275.75-74.59s113.79,464.47,387.06,597.5,474-135.11,841.35,43.7"/><path class="s" d="M-158.62-77.78S61.52-184.71,278.05-79.31,386,397.17,659.27,530.19s473.06-133.21,840.42,45.6"/><path class="t" d="M-160.25-74.43s224.07-115,440.6-9.61S382.44,404.45,655.72,537.47s472.14-131.32,839.5,47.5"/><path class="u" d="M-161.89-71.08s228-123.08,444.54-17.69S378.9,411.74,652.18,544.76s471.22-129.43,838.57,49.39"/><path class="v" d="M-163.52-67.73S68.42-198.89,285-93.49,375.35,419,648.63,552s470.3-127.53,837.65,51.29"/><path class="w" d="M-165.15-64.38S70.72-203.62,287.25-98.22s84.56,524.53,357.84,657.55,469.37-125.64,836.73,53.17"/><path class="x" d="M-166.78-61S73-208.34,289.55-102.94s78.71,536.53,352,669.55S1110,442.87,1477.35,621.68"/><path class="y" d="M-168.41-57.68s243.73-155.39,460.26-50S364.72,440.88,638,573.9s467.53-121.85,834.89,57"/><path class="z" d="M-170-54.32S77.62-217.79,294.15-112.4s67,560.56,340.3,693.58,466.61-119.95,834,58.86"/><path class="aa" d="M-171.67-51S79.92-222.52,296.45-117.12,357.62,455.45,630.9,588.47,1096.59,470.4,1464,649.22"/><path class="ab" d="M-173.3-47.62S82.22-227.25,298.75-121.85s55.33,584.58,328.61,717.6,464.76-116.17,832.12,62.65"/><path class="ac" d="M-174.93-44.27s259.45-187.7,476-82.3S350.53,470,623.81,603s463.84-114.27,831.2,64.55"/><path class="ad" d="M-176.56-40.92S86.82-236.7,303.35-131.3,347,477.3,620.26,610.32s462.93-112.38,830.28,66.43"/><path class="ae" d="M-178.2-37.57S89.12-241.42,305.65-136s37.79,620.6,311.07,753.62,462-110.48,829.36,68.33"/><path class="af" d="M-179.83-34.22S91.42-246.15,308-140.75,339.9,491.87,613.17,624.89s461.08-108.59,828.44,70.22"/><path class="ag" d="M-181.46-30.87s275.18-220,491.71-114.61,26.1,644.63,299.38,777.65,460.15-106.7,827.51,72.12"/><path class="ah" d="M-183.09-27.52S96-255.6,312.55-150.2,332.8,506.44,606.08,639.46s459.24-104.81,826.59,74"/><path class="ai" d="M-184.72-24.17s283-236.16,499.57-130.76,14.41,668.65,287.69,801.67,458.31-102.91,825.66,75.91"/><path class="aj" d="M-186.35-20.82S100.62-265,317.16-159.65,325.71,521,599,654s457.39-101,824.75,77.79"/><path class="ak" d="M-188-17.46s290.9-252.32,507.44-146.92,2.71,692.67,276,825.69,456.47-99.12,823.83,79.69"/><path class="al" d="M-189.61-14.11s294.83-260.39,511.37-155S318.62,535.57,591.9,668.6s455.54-97.23,822.9,81.58"/><path class="am" d="M-191.24-10.76s298.76-268.47,515.3-163.07-9,716.69,264.29,849.71,454.63-95.33,822,83.48"/><path class="an" d="M-192.88-7.41S109.82-284,326.36-178.56s-14.83,728.7,258.45,861.72,453.7-93.44,821.06,85.38"/><path class="ao" d="M-194.51-4.06S112.12-288.68,328.66-183.28,308,557.43,581.26,690.45,1034,598.9,1401.4,777.72"/><path class="ap" d="M-196.14-.71S114.43-293.41,331-188,304.44,564.71,577.72,697.73s451.85-89.65,819.21,89.17"/><path class="aq" d="M-197.77,2.64s314.5-300.77,531-195.37S300.89,572,574.17,705s450.94-87.76,818.29,91.05"/><path class="ar" d="M-199.4,6S119-302.86,335.56-197.46,297.35,579.28,570.62,712.3s450-85.86,817.38,93"/><path class="as" d="M-201,9.34S121.33-307.58,337.86-202.19,293.8,586.57,567.08,719.59s449.09-84,816.45,94.84"/><path class="at" d="M-202.66,12.69s326.29-325,542.82-219.6S290.25,593.85,563.53,726.87s448.17-82.08,815.53,96.74"/><path class="au" d="M-204.29,16S125.93-317,342.46-211.64,286.71,601.14,560,734.16s447.24-80.19,814.6,98.63"/><path class="av" d="M-205.92,19.39S128.23-321.76,344.76-216.36s-61.6,824.78,211.68,957.8S1002.77,663.15,1370.12,842"/></g><g class="f"><path class="g" d="M1496.37,665.14S1397.55,522.83,1181,417.43,857.37,384.11,584.09,251.09,360.37-127.95-7-306.77"/><path class="h" d="M1494.74,668.49s-101.61-153.66-318.14-259S852.65,393.79,579.38,260.77,355.9-118.77-11.45-297.59"/><path class="i" d="M1493.11,671.84s-104.4-165-320.93-270.4-324.24,2-597.52-131-223.22-380-590.58-558.86"/><path class="j" d="M1491.48,675.19s-107.19-176.35-323.72-281.75S843.23,413.15,570,280.13,347-100.42-20.39-279.23"/><path class="k" d="M1489.85,678.54s-110-187.7-326.51-293.1-324.82,37.39-598.1-95.63S342.5-91.24-24.86-270"/><path class="l" d="M1488.22,681.89s-112.77-199-329.3-304.44-325.11,55.06-598.39-78S338-82.06-29.33-260.87"/><path class="m" d="M1486.59,685.24S1371,474.85,1154.5,369.45s-325.4,72.74-598.68-60.28S333.56-72.88-33.79-251.7"/><path class="n" d="M1485,688.59s-118.35-221.74-334.88-327.14-325.69,90.42-599-42.61S329.1-63.7-38.26-242.52"/><path class="o" d="M1483.32,691.94s-121.13-233.08-337.66-338.48-326,108.08-599.26-24.94S324.63-54.52-42.73-233.34"/><path class="p" d="M1481.69,695.3s-123.91-244.44-340.45-349.84S815,471.22,541.68,338.2,320.16-45.35-47.2-224.16"/><path class="q" d="M1480.06,698.65s-126.7-255.79-343.24-361.19S810.25,480.9,537,347.88,315.69-36.17-51.66-215"/><path class="r" d="M1478.43,702s-129.49-267.13-346-372.53S805.54,490.58,532.26,357.56,311.23-27-56.13-205.8"/><path class="s" d="M1476.8,705.35S1344.52,426.87,1128,321.47,800.83,500.26,527.55,367.24,306.76-17.81-60.6-196.62"/><path class="t" d="M1475.17,708.7s-135.07-289.83-351.6-395.23S796.12,509.94,522.84,376.92,302.29-8.63-65.07-187.45"/><path class="u" d="M1473.54,712.05s-137.86-301.17-354.39-406.57-327.75,214.14-601,81.12S297.82.55-69.53-178.27"/><path class="v" d="M1471.91,715.4s-140.65-312.52-357.18-417.92-328,231.82-601.31,98.8S293.36,9.73-74-169.09"/><path class="w" d="M1470.28,718.75s-143.44-323.87-360-429.27S782,539,508.7,406,288.89,18.9-78.47-159.91"/><path class="x" d="M1468.64,722.1s-146.22-335.22-362.75-440.61S777.27,548.66,504,415.64,284.42,28.08-82.94-150.73"/><path class="y" d="M1467,725.45s-149-346.56-365.54-452S772.56,558.34,499.28,425.32,280,37.26-87.41-141.55"/><path class="z" d="M1465.38,728.8s-151.8-357.91-368.33-463.31S767.85,568,494.57,435,275.48,46.44-91.87-132.38"/><path class="aa" d="M1463.75,732.15S1309.16,362.89,1092.63,257.5,763.14,577.7,489.86,444.68,271,55.62-96.34-123.2"/><path class="ab" d="M1462.12,735.51s-157.38-380.61-373.91-486S758.42,587.38,485.15,454.35,266.55,64.8-100.81-114"/><path class="ac" d="M1460.49,738.86s-160.17-392-376.7-497.36S753.71,597.05,480.43,464,262.08,74-105.28-104.84"/><path class="ad" d="M1458.86,742.21s-163-403.31-379.49-508.7S749,606.73,475.72,473.71,257.61,83.15-109.74-95.66"/><path class="ae" d="M1457.23,745.56s-165.75-414.65-382.28-520S744.29,616.41,471,483.39,253.15,92.33-114.21-86.48"/><path class="af" d="M1455.6,748.91s-168.54-426-385.07-531.4S739.58,626.09,466.3,493.07,248.68,101.51-118.68-77.3"/><path class="ag" d="M1454,752.26s-171.32-437.35-387.85-542.75S734.87,635.77,461.59,502.75,244.21,110.69-123.15-68.13"/><path class="ah" d="M1452.33,755.61s-174.11-448.69-390.64-554.09S730.16,645.45,456.88,512.43,239.74,119.87-127.61-58.95"/><path class="ai" d="M1450.7,759s-176.9-460-393.43-565.44S725.44,655.13,452.17,522.11,235.27,129.05-132.08-49.77"/><path class="aj" d="M1449.07,762.31s-179.69-471.39-396.22-576.79S720.73,664.81,447.45,531.79s-216.64-393.57-584-572.38"/><path class="ak" d="M1447.44,765.66s-182.48-482.73-399-588.13S716,674.49,442.74,541.47,226.34,147.4-141-31.41"/><path class="al" d="M1445.81,769S1260.54,274.93,1044,169.53,711.31,684.17,438,551.15,221.87,156.58-145.49-22.23"/><path class="am" d="M1444.18,772.37s-188.06-505.44-404.59-610.84-333,532.32-606.27,399.3S217.4,165.76-149.95-13.06"/><path class="an" d="M1442.55,775.72S1251.7,258.94,1035.17,153.54s-333.28,550-606.56,417S212.94,174.94-154.42-3.88"/><path class="ao" d="M1440.92,779.07s-193.64-528.13-410.17-633.53S697.18,713.21,423.9,580.18,208.47,184.12-158.89,5.3"/><path class="ap" d="M1439.29,782.42s-196.42-539.48-413-644.88S692.46,722.89,419.19,589.86,204,193.3-163.36,14.48"/><path class="aq" d="M1437.65,785.77S1238.45,235,1021.91,129.55s-334.16,603-607.44,470S199.53,202.47-167.82,23.66"/><path class="ar" d="M1436,789.12S1234,227,1017.49,121.55,683,742.24,409.76,609.22s-214.69-397.57-582-576.38"/><path class="as" d="M1434.39,792.47S1229.61,219,1013.07,113.55s-334.74,638.37-608,505.35S190.6,220.83-176.76,42"/><path class="at" d="M1432.76,795.82S1225.19,211,1008.66,105.56s-335,656-608.32,523S186.13,230-181.23,51.19"/><path class="au" d="M1431.13,799.17S1220.77,203,1004.24,97.56,668.91,771.28,395.63,638.26,181.66,239.19-185.7,60.37"/><path class="av" d="M1429.5,802.52S1216.35,195,999.82,89.56,664.19,781,390.92,647.94,177.19,248.37-190.16,69.55"/></g><g class="f"><path class="g" d="M-365.37-41.13s121.81,153.49,375,276.72,370.13,56,689.64,211.47,279.54,406.22,709,615.28"/><path class="aw" d="M-363.74-44.48S-238,120.91,15.15,244.14,384.44,281.86,704,437.38s279.3,406.72,708.8,615.78"/><path class="ax" d="M-362.11-47.83S-232.45,129.46,20.71,252.69s368.44,19.49,687.95,175S987.71,834.92,1417.21,1044"/><path class="ay" d="M-360.48-51.18S-226.9,138,26.26,261.24,393.86,262.5,713.37,418s278.81,407.72,708.31,616.78"/><path class="az" d="M-358.85-54.54s137.51,201.1,390.67,324.33,366.76-17,686.26,138.55,278.57,408.22,708.07,617.28"/><path class="ba" d="M-357.22-57.89s141.44,213,394.6,336.23,365.91-35.2,685.41,120.32,278.33,408.72,707.83,617.79"/><path class="bb" d="M-355.59-61.24s145.36,224.9,398.52,348.13S408,233.46,727.5,389s278.08,409.22,707.58,618.29"/><path class="bc" d="M-354-64.59s149.29,236.8,402.45,360,364.22-71.66,683.73,83.87S1010.05,789,1439.55,998.09"/><path class="bd" d="M-352.32-67.94S-199.11,180.76,54.05,304s363.37-89.89,682.88,65.64S1014.52,779.85,1444,988.91"/><path class="be" d="M-350.69-71.29S-193.56,189.31,59.6,312.54s362.53-108.12,682,47.41S1019,770.67,1448.49,979.73"/><path class="bf" d="M-349.06-74.64S-188,197.86,65.16,321.09s361.69-126.34,681.19,29.18S1023.46,761.49,1453,970.55"/><path class="bg" d="M-347.43-78s165,284.4,418.15,407.63,360.84-144.57,680.34,10.95,276.86,411.72,706.36,620.79"/><path class="bh" d="M-345.8-81.34S-176.89,215,76.27,338.19s360-162.8,679.5-7.28,276.62,412.22,706.12,621.29"/><path class="bi" d="M-344.17-84.69s172.84,308.21,426,431.43,359.15-181,678.65-25.51S1036.86,734,1466.36,943"/><path class="bj" d="M-342.54-88S-165.78,232.07,87.38,355.29,445.69,156,765.2,311.55s276.13,413.23,705.63,622.29"/><path class="bk" d="M-340.91-91.4s180.69,332,433.85,455.24,357.46-217.49,677-62,275.88,413.73,705.38,622.79"/><path class="bl" d="M-339.28-94.75S-154.66,249.17,98.5,372.39s356.61-235.72,676.12-80.2,275.64,414.23,705.14,623.29"/><path class="bm" d="M-337.64-98.1s188.53,355.82,441.69,479S459.83,127,779.33,282.51s275.4,414.73,704.9,623.79"/><path class="bn" d="M-336-101.45s192.46,367.72,445.62,490.94S464.54,117.31,784,272.83s275.16,415.23,704.66,624.3"/><path class="bo" d="M-334.38-104.8S-138,274.82,115.17,398,469.25,107.63,788.75,263.15,1063.67,678.88,1493.16,888"/><path class="bp" d="M-332.75-108.15s200.31,391.52,453.47,514.74S474,98,793.47,253.47s274.66,416.24,704.16,625.3"/><path class="bq" d="M-331.12-111.5s204.24,403.42,457.4,526.64S478.67,88.27,798.18,243.8,1072.6,660.53,1502.1,869.59"/><path class="br" d="M-329.49-114.85s208.17,415.32,461.33,538.54S483.38,78.59,802.89,234.12s274.18,417.23,703.68,626.29"/><path class="bs" d="M-327.86-118.2S-115.77,309,137.39,432.24,488.09,68.91,807.6,224.44,1081.54,642.17,1511,851.23"/><path class="bt" d="M-326.23-121.55s216,439.12,469.18,562.34,349.86-381.55,669.36-226S1086,633,1515.5,842.06"/><path class="bu" d="M-324.6-124.9s219.94,451,473.1,574.25S497.52,49.56,817,205.08s273.45,418.73,703,627.8"/><path class="bv" d="M-323-128.25s223.86,462.92,477,586.15,348.17-418,667.67-262.5,273.21,419.24,702.71,628.3"/><path class="bw" d="M-321.33-131.61s227.79,474.83,481,598.06S506.94,30.2,826.45,185.72s273,419.74,702.46,628.8"/><path class="bx" d="M-319.7-135S-88,351.77,165.17,475s346.48-454.48,666-299,272.71,420.24,702.21,629.3"/><path class="by" d="M-318.07-138.31s235.64,498.63,488.8,621.86S516.36,10.84,835.87,166.36s272.47,420.74,702,629.8"/><path class="bz" d="M-316.44-141.66S-76.87,368.87,176.29,492.1,521.07,1.16,840.58,156.68,1112.81,577.92,1542.31,787"/><path class="ca" d="M-314.81-145S-71.32,377.42,181.84,500.65,525.79-8.52,845.29,147s272,421.74,701.49,630.81"/><path class="cb" d="M-313.18-148.36S-65.76,386,187.4,509.2,530.5-18.2,850,137.32s271.75,422.24,701.24,631.31"/><path class="cc" d="M-311.55-151.71S-60.2,394.52,193,517.75,535.21-27.88,854.71,127.64s271.5,422.75,701,631.81"/><path class="cd" d="M-309.92-155.06S-54.65,403.07,198.51,526.3,539.92-37.56,859.43,118s271.25,423.25,700.75,632.31"/><path class="ce" d="M-308.29-158.41s259.2,570,512.36,693.26S544.63-47.24,864.14,108.29s271,423.74,700.51,632.8"/><path class="cf" d="M-306.65-161.76S-43.54,420.17,209.62,543.4,549.34-56.92,868.85,98.61s270.77,424.24,700.27,633.3"/><path class="cg" d="M-305-165.11S-38,428.72,215.18,552,554.06-66.6,873.56,88.93s270.52,424.74,700,633.81"/><path class="ch" d="M-303.39-168.47s271,605.74,524.13,729,338-636.77,657.53-481.25,270.28,425.24,699.78,634.31"/><path class="ci" d="M-301.76-171.82S-26.87,445.82,226.29,569.05,563.48-85.95,883,69.57s270,425.75,699.54,634.81"/><path class="cj" d="M-300.13-175.17s278.82,629.54,532,752.77S568.19-95.63,887.7,59.89,1157.49,486.14,1587,695.2"/><path class="ck" d="M-298.5-178.52S-15.75,462.92,237.41,586.15s335.49-691.46,655-535.94S1162,477,1591.45,686"/></g><g class="cl"><polyline class="cm" points="1362.63 512.46 1363.61 263.91 1613.09 395.54 1362.63 512.25 1537.03 656.49 1257.15 591 1412.78 761.48 1242.71 864.55 1537.45 877.32 1464.31 709.82 1793.76 767.07 1537.03 656.49 1464.31 709.82"/><polygon class="cm" points="1036.81 649.28 1257.03 591 1242.58 864.55 1036.81 649.28"/><line class="cm" x1="1183.21" y1="496.31" x2="1074.54" y2="389.46"/><line class="cm" x1="1257.03" y1="591" x2="1362.51" y2="512.24"/><polyline class="cm" points="1612.96 395.54 1560.83 548.23 1362.51 512.25 1183.21 496.31 1257.03 591 1464.18 709.82 1412.66 761.48 1537.33 877.32 1812.95 860.4 1464.18 709.82"/><polyline class="cm" points="979.68 808.52 1036.81 649.28 935.04 646.5"/><polyline class="cm" points="891 545.84 1024.33 517.7 1257.03 591"/><polyline class="cm" points="939.15 270.93 1122.16 222.65 1363.48 263.91"/><path class="cn" d="M944.07,273a5.31,5.31,0,1,1-2.45-7.1A5.32,5.32,0,0,1,944.07,273Z"/><path class="cn" d="M1079.42,391.64a5.32,5.32,0,1,1-2.46-7.1A5.32,5.32,0,0,1,1079.42,391.64Z"/><circle class="cn" cx="891.29" cy="545.25" r="5.31"/><path class="cn" d="M940.81,649.85a5.32,5.32,0,1,1-2.45-7.11A5.32,5.32,0,0,1,940.81,649.85Z"/><path class="cn" d="M1041.22,652.93a5.32,5.32,0,1,1-2.46-7.1A5.33,5.33,0,0,1,1041.22,652.93Z"/><path class="cn" d="M1417.61,763a5.31,5.31,0,1,1-2.45-7.1A5.32,5.32,0,0,1,1417.61,763Z"/><circle class="cn" cx="1363.26" cy="512.08" r="5.31"/><path class="cn" d="M1189.11,499.68a5.31,5.31,0,1,1-2.45-7.1A5.3,5.3,0,0,1,1189.11,499.68Z"/><path class="cn" d="M1262,593.49a5.31,5.31,0,1,1-2.45-7.1A5.3,5.3,0,0,1,1262,593.49Z"/><circle class="cn" cx="1024.62" cy="517.1" r="5.31"/><path class="cn" d="M1368.54,265.13a5.31,5.31,0,1,1-2.45-7.1A5.3,5.3,0,0,1,1368.54,265.13Z"/><path class="cn" d="M1127.83,224.67a5.32,5.32,0,1,1-2.46-7.1A5.32,5.32,0,0,1,1127.83,224.67Z"/></g><g class="cl"><polyline class="cm" points="-146.37 -222.54 -145.4 -470.79 104.09 -339.15 -146.37 -222.45 28.03 -78.21 -251.85 -143.7 -96.22 26.78 -266.3 129.85 28.45 142.63 -44.69 -24.88 284.76 32.37 28.03 -78.21 -44.69 -24.88"/><polyline class="cm" points="27.97 142.63 161.07 280.56 -19.97 305.15 -266.78 129.85 -249.09 206.81 -529.68 73.83"/><polyline class="cm" points="103.6 -339.15 51.46 -186.47 -146.85 -222.45 -326.15 -238.38 -252.34 -143.7 -45.18 -24.88 -96.7 26.78 27.97 142.63 303.59 125.71 -45.18 -24.88"/><polyline class="cm" points="-544.15 198.79 -449.39 340.92 -268.14 405.51 14.7 640.67"/><polyline class="cm" points="-69.07 415.27 -254.32 303.79 76.13 363.92"/><path class="cn" d="M33,144.61a5.31,5.31,0,1,1-2.45-7.1A5.3,5.3,0,0,1,33,144.61Z"/><circle class="cn" cx="301.73" cy="125.34" r="5.31"/><path class="cn" d="M292.16,35.39a5.32,5.32,0,1,1-2.45-7.1A5.32,5.32,0,0,1,292.16,35.39Z"/><circle class="cn" cx="74.71" cy="364.15" r="5.31"/><circle class="cn" cx="160.25" cy="281.72" r="5.31"/><path class="cn" d="M19.49,644.48a5.31,5.31,0,1,1-2.45-7.1A5.3,5.3,0,0,1,19.49,644.48Z"/><polyline class="cm" points="74.71 364.15 -19.97 305.15 27.97 142.63"/></g><g class="co"><circle class="cp" cx="74.11" cy="364.09" r="17.91"/><path class="cq" d="M84.1,369A11.11,11.11,0,1,1,79,354.09,11.11,11.11,0,0,1,84.1,369Z"/></g><g class="co"><circle class="cr" cx="937.83" cy="271.81" r="17.91" transform="translate(282.98 996.09) rotate(-64.05)"/><path class="cs" d="M947.82,276.68a11.11,11.11,0,1,1-5.13-14.86A11.1,11.1,0,0,1,947.82,276.68Z"/></g><g class="co"><circle class="ct" cx="1024.98" cy="516.84" r="17.91" transform="translate(-112.55 362.75) rotate(-19.05)"/><path class="cu" d="M1035,521.7a11.11,11.11,0,1,1-5.13-14.85A11.11,11.11,0,0,1,1035,521.7Z"/></g><g class="co"><circle class="cv" cx="301.59" cy="124.67" r="17.91" transform="matrix(0.95, -0.33, 0.33, 0.95, -24.17, 105.24)"/><path class="cw" d="M311.59,129.53a11.12,11.12,0,1,1-5.13-14.86A11.12,11.12,0,0,1,311.59,129.53Z"/></g><g class="co"><path class="cx" d="M37.53,146.44a10.22,10.22,0,1,1-4.72-13.67A10.22,10.22,0,0,1,37.53,146.44Z"/><path class="cy" d="M34,144.75a6.35,6.35,0,1,1-2.92-8.49A6.33,6.33,0,0,1,34,144.75Z"/></g><g class="co"><circle class="cz" cx="560.86" cy="201.92" r="8.3" transform="translate(133.84 617.84) rotate(-64.05)"/><path class="da" d="M565.5,204.17a5.15,5.15,0,1,1-2.38-6.89A5.15,5.15,0,0,1,565.5,204.17Z"/></g><g class="co"><path class="db" d="M755.46,615.27a5.81,5.81,0,1,1-2.68-7.77A5.81,5.81,0,0,1,755.46,615.27Z"/><path class="dc" d="M753.48,614.31a3.61,3.61,0,1,1-1.66-4.82A3.6,3.6,0,0,1,753.48,614.31Z"/></g><g class="co"><path class="dd" d="M1236.8,151.35a5.82,5.82,0,1,1-2.69-7.77A5.82,5.82,0,0,1,1236.8,151.35Z"/><path class="de" d="M1234.81,150.38a3.6,3.6,0,1,1-1.66-4.82A3.61,3.61,0,0,1,1234.81,150.38Z"/></g><g class="co"><path class="df" d="M1136.5,561.08a5.82,5.82,0,1,1-2.69-7.77A5.81,5.81,0,0,1,1136.5,561.08Z"/><path class="dg" d="M1134.51,560.11a3.6,3.6,0,1,1-1.66-4.82A3.6,3.6,0,0,1,1134.51,560.11Z"/></g><g class="co"><circle class="dh" cx="1044.59" cy="460.93" r="8.3"/><path class="di" d="M1049.23,463.18a5.15,5.15,0,1,1-2.38-6.88A5.15,5.15,0,0,1,1049.23,463.18Z"/></g><g class="co"><circle class="dj" cx="104.2" cy="93.23" r="8.3"/><path class="dk" d="M108.84,95.49a5.15,5.15,0,1,1-2.38-6.89A5.16,5.16,0,0,1,108.84,95.49Z"/></g><g class="co"><path class="dl" d="M835.2,333a3.94,3.94,0,1,1-1.82-5.27A3.94,3.94,0,0,1,835.2,333Z"/><circle class="dm" cx="831.66" cy="331.3" r="2.45"/></g><g class="co"><path class="dn" d="M296.84,255.39a3.94,3.94,0,1,1-1.82-5.27A3.93,3.93,0,0,1,296.84,255.39Z"/><circle class="do" cx="293.29" cy="253.67" r="2.45"/></g><g class="co"><path class="dp" d="M178.64,176.62a3.94,3.94,0,1,1-1.82-5.28A3.94,3.94,0,0,1,178.64,176.62Z"/><circle class="dq" cx="175.09" cy="174.89" r="2.45"/></g><g class="co"><path class="dr" d="M862.33,607.77a3.95,3.95,0,1,1-1.82-5.27A4,4,0,0,1,862.33,607.77Z"/><circle class="ds" cx="858.78" cy="606.04" r="2.45"/></g><g class="co"><path class="dt" d="M325.38,489.05a3.94,3.94,0,1,1-1.82-5.27A3.94,3.94,0,0,1,325.38,489.05Z"/><path class="du" d="M324,488.39a2.45,2.45,0,1,1-1.13-3.27A2.44,2.44,0,0,1,324,488.39Z"/></g><g class="co"><path class="dv" d="M830,230.39a3.95,3.95,0,1,1-1.83-5.28A4,4,0,0,1,830,230.39Z"/><path class="dw" d="M828.61,229.73a2.45,2.45,0,1,1-1.13-3.27A2.44,2.44,0,0,1,828.61,229.73Z"/></g><g class="co"><path class="dx" d="M564.37,457.15a3.94,3.94,0,1,1-1.82-5.28A4,4,0,0,1,564.37,457.15Z"/><circle class="dy" cx="560.82" cy="455.42" r="2.45"/></g><g class="co"><path class="dz" d="M157.43,430.8a3.94,3.94,0,1,1-1.82-5.27A3.94,3.94,0,0,1,157.43,430.8Z"/><circle class="ea" cx="153.88" cy="429.07" r="2.45"/></g><g class="co"><path class="eb" d="M1253.5,215.87a3.94,3.94,0,1,1-1.82-5.28A3.94,3.94,0,0,1,1253.5,215.87Z"/><path class="ec" d="M1252.16,215.21a2.45,2.45,0,1,1-1.13-3.27A2.44,2.44,0,0,1,1252.16,215.21Z"/></g></g><g class="ed"><polygon class="cn" points="54.33 448.23 -3.16 613.98 -132.99 646.05 -23.75 674.43 74.64 638.96 183.11 472.25 54.33 448.23"/><polygon class="ee" points="-59.86 530.34 -132.99 646.05 -3.16 613.98 54.33 448.23 -59.86 530.34"/><polygon class="ef" points="372.61 476.46 449.11 599.84 595.45 654.5 540.27 472.56 372.61 476.46"/><polygon class="eg" points="74.64 638.96 242.44 597 183.11 472.25 74.64 638.96"/><polygon class="eh" points="183.11 472.25 372.61 476.46 424.44 546.43 545.71 755.64 377.5 694.52 242.44 597 183.11 472.25"/><polygon class="cn" points="74.64 638.96 242.44 597 377.5 694.52 545.71 755.64 446.04 886.79 311.87 847.57 253.49 750.67 174.16 686.1 74.64 638.96"/><polygon class="ei" points="545.25 756.08 532.39 859.3 494.18 890.11 445.12 887.65 545.25 756.08"/><polygon class="ee" points="545.2 757.02 645.56 708.43 636.45 802.67 552.5 862.2 532.3 861.19 545.2 757.02"/><polygon class="eg" points="595.45 654.5 645.59 707.95 545.25 756.06 455.59 600.17 595.45 654.5"/><polygon class="ef" points="183.11 472.25 375.42 394.05 372.61 476.46 183.11 472.25"/><polygon class="cn" points="375.42 394.05 540.27 472.56 372.61 476.46 375.42 394.05"/><polygon class="eg" points="253.49 750.67 174.16 686.1 74.64 638.96 -23.75 674.43 -18.85 835.21 172.71 889.79 311.87 847.57 253.49 750.67"/></g><g class="ed"><polygon class="eh" points="1329.21 -281.89 1543.75 -262.7 1597.2 -179.43 1718.79 67 1532.72 -15.09 1387 -135.93 1329.21 -281.89"/><polygon class="cn" points="1193.55 -101.11 1387 -135.93 1532.72 -15.09 1718.79 67 1595.82 208.12 1446.67 153.46 1387.84 39.15 1302.81 -40.1 1193.55 -101.11"/><polygon class="ei" points="790.71 -72.4 853.82 47.43 894.5 52.21 894.5 52.21 790.71 -72.4"/><polygon class="ei" points="894.71 50.45 1009.68 199.46 1398.96 280.22 1545.28 262.4 1446.67 153.46 1285.67 190.74 968.47 69.71 894.71 50.45"/><polygon class="eh" points="957.59 -108.86 894.71 50.45 1072.63 114.3 1079.3 -68.37 957.59 -108.86"/><polygon class="ee" points="893.98 -182.49 790.91 -74.16 894.71 50.45 957.59 -108.86 893.98 -182.49"/><polygon class="eg" points="1387.84 39.15 1302.81 -40.1 1193.55 -101.11 1079.3 -68.37 1072.63 114.3 1285.67 190.74 1446.67 153.46 1387.84 39.15"/></g></g></g></svg>
\ No newline at end of file

From 5079a68fb051e353fe964dadc0d2b72946843e58 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 19 Aug 2020 16:20:44 +0200
Subject: [PATCH 06/50] Copy custom welcome files

---
 kibana-opendistro/Dockerfile | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
index 4b4ba99f..7dd86ede 100644
--- a/kibana-opendistro/Dockerfile
+++ b/kibana-opendistro/Dockerfile
@@ -39,21 +39,18 @@ ENV PATTERN="" \
     WAZUH_MONITORING_REPLICAS="" \
     ADMIN_PRIVILEGES=""
 
-ARG CHANGE_WELCOME="false"
-
 COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
-
 RUN chmod +x ./wazuh_app_config.sh
 
 COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
-
 RUN chmod +x ./kibana_settings.sh
 
+COPY ./config/custom_welcome /tmp/custom_welcome
 COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
-
 RUN chmod +x ./welcome_wazuh.sh
-
+ARG CHANGE_WELCOME="false"
 RUN ./welcome_wazuh.sh
+
 USER kibana
 RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
 

From 9dc2c0f82a84f0f44dec525288d54ed4b86d9819 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 20 Aug 2020 17:02:00 +0200
Subject: [PATCH 07/50] Add extra ssl settings

---
 wazuh-opendistro/config/filebeat.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/wazuh-opendistro/config/filebeat.yml b/wazuh-opendistro/config/filebeat.yml
index 0d04bac8..8a627bf9 100644
--- a/wazuh-opendistro/config/filebeat.yml
+++ b/wazuh-opendistro/config/filebeat.yml
@@ -13,9 +13,10 @@ setup.template.json.name: 'wazuh'
 setup.template.overwrite: true
 setup.ilm.enabled: false
 output.elasticsearch:
-  hosts: ['http://elasticsearch:9200']
+  hosts: ['https://elasticsearch:9200']
+  #username:
+  #password:
+  #ssl.verification_mode:
   #ssl.certificate_authorities:
   #ssl.certificate:
   #ssl.key:
-  #username:
-  #password:

From 727560b2d1d19e00e8cfffc347dc5713bd935a3a Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 20 Aug 2020 17:02:28 +0200
Subject: [PATCH 08/50] Fix logic to setup filebeat.yml

---
 .../config/etc/cont-init.d/1-config-filebeat  | 28 +++++++++++--------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat b/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
index 2f744915..dae9947f 100644
--- a/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
+++ b/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
@@ -5,25 +5,31 @@ set -e
 
 if [ "$ELASTICSEARCH_URL" != "" ]; then
   >&2 echo "Customize Elasticsearch ouput IP"
-  sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
+  sed -i "s|hosts:.*|hosts: ['$ELASTICSEARCH_URL']|g" /etc/filebeat/filebeat.yml
 fi
 
 # Configure filebeat.yml security settings
 
+if [ "$ELASTIC_USERNAME" != "" ]; then
+  >&2 echo "Configuring username."
+  sed -i "s|#username:.*|username: '$ELASTIC_USERNAME'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$ELASTIC_PASSWORD" != "" ]; then
+  >&2 echo "Configuring password."
+  sed -i "s|#password:.*|password: '$ELASTIC_PASSWORD'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
+  >&2 echo "Configuring SSL verification mode."
+  sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode: $FILEBEAT_SSL_VERIFICATION_MODE|g" /etc/filebeat/filebeat.yml
+fi
+
 if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
   >&2 echo "Configuring Certificate Authorities."
-  sed -i 's|#ssl.certificate_authorities:|'ssl.certificate_authorities:\ [\"$SSL_CERTIFICATE_AUTHORITIES\"]'|g' /etc/filebeat/filebeat.yml
+  sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
 fi
 
-if [ "$USERNAME" != "" ]; then
-  >&2 echo "Configuring username."
-  sed -i 's|#username:|'username:\ \"$USERNAME\"'|g' /etc/filebeat/filebeat.yml
-fi
-
-if [ "$PASSWORD" != "" ]; then
-  >&2 echo "Configuring password."
-  sed -i 's|#password:|'password:\ \"$PASSWORD\"'|g' /etc/filebeat/filebeat.yml
-fi
 
 chmod go-w /etc/filebeat/filebeat.yml || true
 chown root: /etc/filebeat/filebeat.yml || true

From c1bcdaf5fb9da13e08190b99f9b02dd58e0bb766 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 20 Aug 2020 17:11:07 +0200
Subject: [PATCH 09/50] Update filebeat config vars

---
 docker-compose.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 893e2b8f..e6f23646 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,6 +12,11 @@ services:
       - "1515:1515"
       - "514:514/udp"
       - "55000:55000"
+    environment:
+      - ELASTICSEARCH_URL=https://elasticsearch:9200
+      - ELASTIC_USERNAME=admin
+      - ELASTIC_PASSWORD=admin
+      - FILEBEAT_SSL_VERIFICATION_MODE=none
     volumes:
       - ossec_api_configuration:/var/ossec/api/configuration
       - ossec_etc:/var/ossec/etc
@@ -37,8 +42,6 @@ services:
       - network.host=0.0.0.0
       - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
       - bootstrap.memory_lock=true
-    volumes:
-      - ./elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
     ulimits:
       memlock:
         soft: -1

From 8af39e3a568920ab3bfa0c2cf956ddfdb9720363 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 20 Aug 2020 19:01:30 +0200
Subject: [PATCH 10/50] Export variables to share with sub-shell

---
 kibana-opendistro/config/entrypoint.sh | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/kibana-opendistro/config/entrypoint.sh b/kibana-opendistro/config/entrypoint.sh
index 79039afc..cca7c3da 100644
--- a/kibana-opendistro/config/entrypoint.sh
+++ b/kibana-opendistro/config/entrypoint.sh
@@ -7,13 +7,23 @@ set -e
 # Waiting for elasticsearch
 ##############################################################################
 
-if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
-  el_url="http://elasticsearch:9200"
+if [ "x${ELASTICSEARCH_URL}" == "x" ]; then
+  if [[ ${ENABLED_SECURITY} == "false" ]]; then
+    export el_url="http://elasticsearch:9200"
+  else
+    export el_url="https://elasticsearch:9200"
+  fi
 else
-  el_url="${ELASTICSEARCH_URL}"
+  export el_url="${ELASTICSEARCH_URL}"
 fi
 
-auth=""
+if [[ ${ENABLED_SECURITY} == "false" || "x${ELASTICSEARCH_USERNAME}" == "x" || "x${ELASTICSEARCH_PASSWORD}" == "x" ]]; then
+  auth=""
+  # remove security plugin from kibana if elasticsearch is not using it either
+  /usr/share/kibana/bin/kibana-plugin remove opendistro_security
+else
+  export auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} -k"
+fi
 
 until curl -XGET $el_url ${auth}; do
   >&2 echo "Elastic is unavailable - sleeping"
@@ -33,7 +43,7 @@ strlen=0
 
 while [[ $strlen -eq 0 ]]
 do
-  template=$(curl $el_url/_cat/templates/wazuh -s)
+  template=$(curl ${auth} $el_url/_cat/templates/wazuh -s)
   strlen=${#template}
   >&2 echo "Wazuh alerts template not loaded - sleeping."
   sleep 2

From b1e0f9b35e0b9d3a1e300901192aa615a3a1b802 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 20 Aug 2020 19:02:04 +0200
Subject: [PATCH 11/50] Move auth

---
 kibana-opendistro/config/wazuh_app_config.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kibana-opendistro/config/wazuh_app_config.sh b/kibana-opendistro/config/wazuh_app_config.sh
index 6d9f05eb..ec16a336 100644
--- a/kibana-opendistro/config/wazuh_app_config.sh
+++ b/kibana-opendistro/config/wazuh_app_config.sh
@@ -48,7 +48,7 @@ done
 # remove default API entry (new in 3.11.0_7.5.1)
 sed -ie '/- default:/,+4d' $kibana_config_file
 
-CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth})
+CONFIG_CODE=$(curl ${auth} -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013)
 
 grep -q 1513629884013 $kibana_config_file
 _config_exists=$?

From 6e82f67a9d4e361e47c5a9c9e3b236c59afdd13f Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 21 Aug 2020 15:39:45 +0200
Subject: [PATCH 12/50] Use default password

---
 docker-compose.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index e6f23646..fa2690cc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -54,8 +54,7 @@ services:
     restart: always
     environment:
       - ELASTICSEARCH_USERNAME=admin
-      - ELASTICSEARCH_PASSWORD=SecretPass
-      - ELASTICSEARCH_KIBANA_IP="https://elasticsearch:9200"
+      - ELASTICSEARCH_PASSWORD=admin
     depends_on:
       - elasticsearch
     links:

From 0c6114698615da12dd6abb7d4245d5be728700a7 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 21 Aug 2020 15:40:35 +0200
Subject: [PATCH 13/50] Customize login styles

---
 kibana-opendistro/config/welcome_wazuh.sh | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/kibana-opendistro/config/welcome_wazuh.sh b/kibana-opendistro/config/welcome_wazuh.sh
index 98306871..46aaddfa 100644
--- a/kibana-opendistro/config/welcome_wazuh.sh
+++ b/kibana-opendistro/config/welcome_wazuh.sh
@@ -3,22 +3,12 @@
 
 if [[ $CHANGE_WELCOME == "true" ]]
 then
-
-    rm -rf ./optimize/bundles
-
-    kibana_path="/usr/share/kibana"
-    # Set Wazuh app as the default landing page
     echo "Set Wazuh app as the default landing page"
     echo "server.defaultRoute: /app/wazuh" >> /usr/share/kibana/config/kibana.yml
 
-    # Redirect Kibana welcome screen to Discover
-    echo "Redirect Kibana welcome screen to Discover"
-    sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
-    sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
-
-    # Redirect Kibana welcome screen to Discover
-    echo "Hide undesired links"
-    sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/rollup/public/crud_app/index.js
-    sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/license_management/public/management_section.js
+    echo "Set custom welcome styles"
+    cp -f /tmp/custom_welcome/template.js.hbs /usr/share/kibana/src/legacy/ui/ui_render/bootstrap/template.js.hbs
+    cp -f /tmp/custom_welcome/security-login.style.css /usr/share/kibana/optimize/bundles/security-login.style.css
+    cp -f /tmp/custom_welcome/*svg /usr/share/kibana/optimize/bundles/
 fi
 

From e93e67ed6e81feaa699d32c25f7688ba9de786bc Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 21 Aug 2020 15:41:08 +0200
Subject: [PATCH 14/50] Add auth to kibana_settings

---
 kibana-opendistro/config/kibana_settings.sh | 28 +++++++--------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/kibana-opendistro/config/kibana_settings.sh b/kibana-opendistro/config/kibana_settings.sh
index 0f624725..514727a6 100644
--- a/kibana-opendistro/config/kibana_settings.sh
+++ b/kibana-opendistro/config/kibana_settings.sh
@@ -17,10 +17,9 @@ WAZUH_MAJOR=3
 ##############################################################################
 # Customize elasticsearch ip
 ##############################################################################
-if [ "$ELASTICSEARCH_KIBANA_IP" != "" ]; then
-  sed -i "s:#elasticsearch.hosts:elasticsearch.hosts:g" /usr/share/kibana/config/kibana.yml
-  sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_KIBANA_IP'|g' /usr/share/kibana/config/kibana.yml
-fi
+sed -i "s|elasticsearch.hosts:.*|elasticsearch.hosts: $el_url|g" /usr/share/kibana/config/kibana.yml
+# disable multitenancy
+sed -i "s|opendistro_security.multitenancy.enabled:.*|opendistro_security.multitenancy.enabled: false|g" /usr/share/kibana/config/kibana.yml
 
 # If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate.
 if [ "$KIBANA_INDEX" != "" ]; then
@@ -31,17 +30,12 @@ if [ "$KIBANA_INDEX" != "" ]; then
 fi
 
 if [ "$KIBANA_IP" != "" ]; then
-  kibana_ip="$KIBANA_IP"
+  kibana_url="$KIBANA_IP"
 else
-  kibana_ip="kibana"
+  kibana_url="kibana"
 fi
 
-# Add auth headers if required
-if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
-    curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
-fi
-
-while [[ "$(curl $curl_auth -XGET -I  -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
+while [[ "$(curl -XGET -I  -s -o /dev/null -w '%{http_code}' $kibana_url:5601/login)" != "200" ]]; do
   echo "Waiting for Kibana API. Sleeping 5 seconds"
   sleep 5
 done
@@ -61,16 +55,12 @@ EOF
 
 sleep 5
 # Add the wazuh alerts index as default.
-curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
+curl ${auth} -POST $kibana_url:5601/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
 rm -f ${default_index}
 
 sleep 5
 # Configuring Kibana TimePicker.
-curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
-'{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-24h\",\n  \"to\": \"now\",\n  \"mode\": \"quick\"}"}}'
-
-sleep 5
-# Do not ask user to help providing usage statistics to Elastic
-curl -POST "http://$kibana_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
+curl ${auth} -POST "http://$kibana_url:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
+'{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-12h\",\n  \"to\": \"now\",\n  \"mode\": \"quick\"}"}}'
 
 echo "End settings"

From 81aeac1570520f9cede1b08f307796fb4c3090ed Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 21 Aug 2020 15:42:08 +0200
Subject: [PATCH 15/50] Customize welcome after kibana optimize

---
 kibana-opendistro/Dockerfile | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
index 7dd86ede..3694dbcf 100644
--- a/kibana-opendistro/Dockerfile
+++ b/kibana-opendistro/Dockerfile
@@ -45,13 +45,13 @@ RUN chmod +x ./wazuh_app_config.sh
 COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
 RUN chmod +x ./kibana_settings.sh
 
-COPY ./config/custom_welcome /tmp/custom_welcome
-COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
-RUN chmod +x ./welcome_wazuh.sh
-ARG CHANGE_WELCOME="false"
-RUN ./welcome_wazuh.sh
-
 USER kibana
 RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
 
+COPY ./config/custom_welcome /tmp/custom_welcome
+COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
+RUN chmod +x ./welcome_wazuh.sh
+ARG CHANGE_WELCOME="true"
+RUN ./welcome_wazuh.sh
+
 ENTRYPOINT ./entrypoint.sh

From 131115c2384df82b22f2803b01aed93dc56b7c57 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 21 Aug 2020 16:03:45 +0200
Subject: [PATCH 16/50] Make sure kibana starts after config changes

---
 kibana-opendistro/config/entrypoint.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kibana-opendistro/config/entrypoint.sh b/kibana-opendistro/config/entrypoint.sh
index cca7c3da..f2c017f1 100644
--- a/kibana-opendistro/config/entrypoint.sh
+++ b/kibana-opendistro/config/entrypoint.sh
@@ -60,4 +60,6 @@ sleep 5
 
 ./kibana_settings.sh &
 
+sleep 2
+
 /usr/local/bin/kibana-docker

From 3f0e908a2b92d5f0c86f1249eea67e1913c57298 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 24 Aug 2020 15:38:04 +0200
Subject: [PATCH 17/50] Use API new default user

---
 kibana-opendistro/config/wazuh_app_config.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kibana-opendistro/config/wazuh_app_config.sh b/kibana-opendistro/config/wazuh_app_config.sh
index ec16a336..afa3d71d 100644
--- a/kibana-opendistro/config/wazuh_app_config.sh
+++ b/kibana-opendistro/config/wazuh_app_config.sh
@@ -3,8 +3,8 @@
 
 wazuh_url="${WAZUH_API_URL:-https://wazuh}"
 wazuh_port="${API_PORT:-55000}"
-api_user="${API_USER:-foo}"
-api_password="${API_PASS:-bar}"
+api_user="${API_USER:-wazuh}"
+api_password="${API_PASS:-wazuh}"
 
 kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
 mkdir -p /usr/share/kibana/optimize/wazuh/config/

From 65327f8032e029908bd4c3fd25bdf4b584f164e8 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 24 Aug 2020 15:38:24 +0200
Subject: [PATCH 18/50] Install wazuhapp 4

---
 kibana-opendistro/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
index 3694dbcf..3f72a444 100644
--- a/kibana-opendistro/Dockerfile
+++ b/kibana-opendistro/Dockerfile
@@ -6,7 +6,7 @@ ARG WAZUH_VERSION=3.13.1
 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
 
 WORKDIR /usr/share/kibana
-RUN ./bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip
+RUN ./bin/kibana-plugin install https://s3-us-west-1.amazonaws.com/packages-dev.wazuh.com/staging/ui/kibana/wazuhapp-4.0.0_7.8.0_0.0.0.todelete.zip
 
 WORKDIR /
 USER root

From 4de5401144daa3e37a549447501b119d47d91f98 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 24 Aug 2020 15:39:03 +0200
Subject: [PATCH 19/50] Remove wazuh-api s6-overlay calls

---
 wazuh-opendistro/config/etc/services.d/api/finish | 6 ------
 wazuh-opendistro/config/etc/services.d/api/run    | 4 ----
 2 files changed, 10 deletions(-)
 delete mode 100644 wazuh-opendistro/config/etc/services.d/api/finish
 delete mode 100644 wazuh-opendistro/config/etc/services.d/api/run

diff --git a/wazuh-opendistro/config/etc/services.d/api/finish b/wazuh-opendistro/config/etc/services.d/api/finish
deleted file mode 100644
index 38d744d1..00000000
--- a/wazuh-opendistro/config/etc/services.d/api/finish
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env sh
-echo >&2 "API exited. code=${1}"
-
-# terminate other services to exit from the container
-exec s6-svscanctl -t /var/run/s6/services
-
diff --git a/wazuh-opendistro/config/etc/services.d/api/run b/wazuh-opendistro/config/etc/services.d/api/run
deleted file mode 100644
index e6e3e831..00000000
--- a/wazuh-opendistro/config/etc/services.d/api/run
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/usr/bin/with-contenv sh
-echo >&2 "starting API"
-
-exec /bin/node /var/ossec/api/app.js

From e7acb70b6f2cd6515c84b6f1389f0bbf77a98a33 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 24 Aug 2020 15:39:36 +0200
Subject: [PATCH 20/50] Install wazuh-manager v4 from staging

---
 wazuh-opendistro/Dockerfile | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index 1add03c0..f8173987 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -2,7 +2,7 @@
 FROM centos:7
 
 ARG FILEBEAT_VERSION=7.8.0
-ARG WAZUH_VERSION=3.13.1-1
+ARG WAZUH_VERSION=4.0.0-1
 ARG TEMPLATE_VERSION="v3.13.1"
 ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
 
@@ -13,14 +13,15 @@ ENV API_USER="foo" \
 # Set repositories.
 RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
 
-COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo
+# COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo
 
 RUN yum --enablerepo=updates clean metadata && \
-  yum -y install openssl which && yum -y install wazuh-manager-${WAZUH_VERSION} -y && \
-  curl --silent --location https://rpm.nodesource.com/setup_10.x | bash - && \
-  yum -y install nodejs && yum -y install wazuh-api-${WAZUH_VERSION} && \
-  sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
+  curl --fail --silent https://s3-us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.0/rpm/var/wazuh-manager-4.0.0-braulio.test.x86_64.rpm \
+  -o wazuh-manager.rpm && \
+  yum -y install openssl which && yum -y install wazuh-manager.rpm -y && \
   yum clean all && rm -rf /var/cache/yum
+  # sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
+
 
 RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm &&\
   rpm -i filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm

From da14494144e1a9f2f24bfe1787c8cd2b47f3c3c2 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 24 Aug 2020 16:21:16 +0200
Subject: [PATCH 21/50] Use staging repo

---
 wazuh-opendistro/config/wazuh.repo | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wazuh-opendistro/config/wazuh.repo b/wazuh-opendistro/config/wazuh.repo
index ae462c62..8be8a18e 100644
--- a/wazuh-opendistro/config/wazuh.repo
+++ b/wazuh-opendistro/config/wazuh.repo
@@ -3,5 +3,5 @@ gpgcheck=1
 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
 enabled=1
 name=Wazuh repository
-baseurl=https://packages.wazuh.com/3.x/yum/
+baseurl=https://packages-dev.wazuh.com/staging/yum/
 protect=1

From 139ac79463d1d9b34bdc7d569526262d5afe2255 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 24 Aug 2020 16:28:04 +0200
Subject: [PATCH 22/50] Parametrize version

---
 wazuh-opendistro/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index f8173987..80ae4a76 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -2,7 +2,7 @@
 FROM centos:7
 
 ARG FILEBEAT_VERSION=7.8.0
-ARG WAZUH_VERSION=4.0.0-1
+ARG WAZUH_VERSION=4.0.0-braulio.test
 ARG TEMPLATE_VERSION="v3.13.1"
 ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
 
@@ -16,7 +16,7 @@ RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
 # COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo
 
 RUN yum --enablerepo=updates clean metadata && \
-  curl --fail --silent https://s3-us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.0/rpm/var/wazuh-manager-4.0.0-braulio.test.x86_64.rpm \
+  curl --fail --silent https://s3-us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.0/rpm/var/wazuh-manager-${WAZUH_VERSION}.x86_64.rpm \
   -o wazuh-manager.rpm && \
   yum -y install openssl which && yum -y install wazuh-manager.rpm -y && \
   yum clean all && rm -rf /var/cache/yum

From 5bb1127cf23357533efd7b52d934b279d9fa57e3 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 24 Aug 2020 16:57:38 +0200
Subject: [PATCH 23/50] Update username param

---
 kibana-opendistro/config/wazuh_app_config.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kibana-opendistro/config/wazuh_app_config.sh b/kibana-opendistro/config/wazuh_app_config.sh
index afa3d71d..db1d8f82 100644
--- a/kibana-opendistro/config/wazuh_app_config.sh
+++ b/kibana-opendistro/config/wazuh_app_config.sh
@@ -59,7 +59,7 @@ hosts:
   - 1513629884013:
       url: $wazuh_url
       port: $wazuh_port
-      user: $api_user
+      username: $api_user
       password: $api_password
 EOF
 else

From eb089e80116d98776c1154577b73aea326d11d81 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 25 Aug 2020 13:07:18 +0200
Subject: [PATCH 24/50] Switch to new filebeat module and template

---
 wazuh-opendistro/Dockerfile | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index 80ae4a76..25788066 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -3,8 +3,8 @@ FROM centos:7
 
 ARG FILEBEAT_VERSION=7.8.0
 ARG WAZUH_VERSION=4.0.0-braulio.test
-ARG TEMPLATE_VERSION="v3.13.1"
-ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
+ARG TEMPLATE_VERSION="develop"
+ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz"
 
 ENV API_USER="foo" \
    API_PASS="bar"
@@ -26,10 +26,7 @@ RUN yum --enablerepo=updates clean metadata && \
 RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm &&\
   rpm -i filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm
 
-RUN curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/${TEMPLATE_VERSION}/extensions/elasticsearch/7.x/wazuh-template.json &&\
-  chmod go+r /etc/filebeat/wazuh-template.json
-
-RUN curl -s https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
+RUN curl -s https://packages-dev.wazuh.com/utils/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
 
 ARG S6_VERSION="v2.0.0.1"
 RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \

From 325c191b68ec7d028fb0ed089263b774495dde7c Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 25 Aug 2020 13:30:31 +0200
Subject: [PATCH 25/50] Bump to recent package

---
 wazuh-opendistro/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index 25788066..7fd4787a 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -2,7 +2,7 @@
 FROM centos:7
 
 ARG FILEBEAT_VERSION=7.8.0
-ARG WAZUH_VERSION=4.0.0-braulio.test
+ARG WAZUH_VERSION=4.0.0-c6test
 ARG TEMPLATE_VERSION="develop"
 ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz"
 
@@ -16,7 +16,7 @@ RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
 # COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo
 
 RUN yum --enablerepo=updates clean metadata && \
-  curl --fail --silent https://s3-us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.0/rpm/var/wazuh-manager-${WAZUH_VERSION}.x86_64.rpm \
+  curl --fail --silent https://packages-dev.wazuh.com/warehouse/test/4.0/rpm/var/wazuh-manager-${WAZUH_VERSION}.x86_64.rpm \
   -o wazuh-manager.rpm && \
   yum -y install openssl which && yum -y install wazuh-manager.rpm -y && \
   yum clean all && rm -rf /var/cache/yum

From d7133df0f3022756c08553b670e64edfdf25ba6a Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 25 Aug 2020 13:40:24 +0200
Subject: [PATCH 26/50] Clean downloaded package

---
 wazuh-opendistro/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index 7fd4787a..f17b6d21 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -18,7 +18,7 @@ RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
 RUN yum --enablerepo=updates clean metadata && \
   curl --fail --silent https://packages-dev.wazuh.com/warehouse/test/4.0/rpm/var/wazuh-manager-${WAZUH_VERSION}.x86_64.rpm \
   -o wazuh-manager.rpm && \
-  yum -y install openssl which && yum -y install wazuh-manager.rpm -y && \
+  yum -y install openssl which && yum -y install wazuh-manager.rpm -y && rm -f wazuh-manager.rpm \
   yum clean all && rm -rf /var/cache/yum
   # sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
 

From 248b769688f422c01baacb02ebd4e69d170ff726 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 25 Aug 2020 14:30:27 +0200
Subject: [PATCH 27/50] Remove API tweaks

---
 .../config/etc/cont-init.d/0-wazuh-init       | 70 +++----------------
 1 file changed, 10 insertions(+), 60 deletions(-)

diff --git a/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init b/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
index b0cbd001..f3fbd1a4 100644
--- a/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
+++ b/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
@@ -7,7 +7,6 @@ source /permanent_data.env
 WAZUH_INSTALL_PATH=/var/ossec
 WAZUH_CONFIG_MOUNT=/wazuh-config-mount
 AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
-API_GENERATE_CERTS=${API_GENERATE_CERTS:-true}
 
 
 ##############################################################################
@@ -33,18 +32,10 @@ exec_cmd_stdout() {
 
 
 ##############################################################################
-# Edit configuration
-##############################################################################
-
-edit_configuration() { # $1 -> setting,  $2 -> value
-  sed -i "s/^config.$1\s=.*/config.$1 = \"$2\";/g" "${WAZUH_INSTALL_PATH}/api/configuration/config.js" || error_and_exit "sed (editing configuration)"
-}
-
-##############################################################################
-# This function will attempt to mount every directory in PERMANENT_DATA 
-# into the respective path. 
-# If the path is empty means permanent data volume is also empty, so a backup  
-# will be copied into it. Otherwise it will not be copied because there is  
+# This function will attempt to mount every directory in PERMANENT_DATA
+# into the respective path.
+# If the path is empty means permanent data volume is also empty, so a backup
+# will be copied into it. Otherwise it will not be copied because there is
 # already data inside the volume for the specified path.
 ##############################################################################
 
@@ -61,9 +52,9 @@ mount_permanent_data() {
 }
 
 ##############################################################################
-# This function will replace from the permanent data volume every file 
+# This function will replace from the permanent data volume every file
 # contained in PERMANENT_DATA_EXCP
-# Some files as 'internal_options.conf' are saved as permanent data, but 
+# Some files as 'internal_options.conf' are saved as permanent data, but
 # they must be updated to work properly if wazuh version is changed.
 ##############################################################################
 
@@ -76,7 +67,7 @@ apply_exclusion_data() {
       then
         mkdir -p ${DIR}
       fi
-      
+
       print "Updating ${exclusion_file}"
       exec_cmd "cp -p ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file} ${exclusion_file}"
     fi
@@ -84,14 +75,14 @@ apply_exclusion_data() {
 }
 
 ##############################################################################
-# This function will delete from the permanent data volume every file 
+# This function will delete from the permanent data volume every file
 # contained in PERMANENT_DATA_DEL
 ##############################################################################
 
 remove_data_files() {
   for del_file in "${PERMANENT_DATA_DEL[@]}"; do
     if [ -e ${del_file} ]
-    then 
+    then
       print "Removing ${del_file}"
       exec_cmd "rm ${del_file}"
     fi
@@ -108,22 +99,6 @@ create_ossec_key_cert() {
   exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
 }
 
-##############################################################################
-# Create certificates: API
-##############################################################################
-
-create_api_key_cert() {
-  print "Enabling Wazuh API HTTPS"
-  edit_configuration "https" "yes"
-  print "Create Wazuh API key and cert"
-  exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key 4096"
-  exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/"
-
-  # Granting proper permissions 
-  chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key
-  chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt
-}
-
 ##############################################################################
 # Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect
 # destination files permissions
@@ -153,7 +128,7 @@ function ossec_shutdown(){
 
 ##############################################################################
 # Interpret any passed arguments (via docker command to this entrypoint) as
-# paths or commands, and execute them. 
+# paths or commands, and execute them.
 #
 # This can be useful for actions that need to be run before the services are
 # started, such as "/var/ossec/bin/ossec-control enable agentless".
@@ -167,19 +142,6 @@ docker_custom_args() {
   done
 }
 
-##############################################################################
-# Change Wazuh API user credentials.
-##############################################################################
-
-change_api_user_credentials() {
-  pushd /var/ossec/api/configuration/auth/
-  echo "Change Wazuh API user credentials"
-  change_user="node htpasswd -b -c user $API_USER $API_PASS"
-  eval $change_user
-  popd
-}
-
-
 ##############################################################################
 # Main function
 ##############################################################################
@@ -203,15 +165,6 @@ main() {
     fi
   fi
 
-  # Generate API certs if API_GENERATE_CERTS is true and does not exist
-  if [ $API_GENERATE_CERTS == true ]
-  then
-    if [ ! -e ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt ]
-    then
-      create_api_key_cert
-    fi
-  fi
-
   # Mount selected files (WAZUH_CONFIG_MOUNT) to container
   mount_files
 
@@ -221,9 +174,6 @@ main() {
   # Execute custom args
   docker_custom_args
 
-  # Change API user credentials
-  change_api_user_credentials
-
   # Delete temporary data folder
   rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
 

From 7badd1bdec38d178ba407f6196f2f3e6145140f9 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 25 Aug 2020 14:30:50 +0200
Subject: [PATCH 28/50] Fix package cleanup

---
 wazuh-opendistro/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index f17b6d21..b81723c6 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -18,7 +18,7 @@ RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
 RUN yum --enablerepo=updates clean metadata && \
   curl --fail --silent https://packages-dev.wazuh.com/warehouse/test/4.0/rpm/var/wazuh-manager-${WAZUH_VERSION}.x86_64.rpm \
   -o wazuh-manager.rpm && \
-  yum -y install openssl which && yum -y install wazuh-manager.rpm -y && rm -f wazuh-manager.rpm \
+  yum -y install openssl which && yum -y install wazuh-manager.rpm -y && rm -f wazuh-manager.rpm && \
   yum clean all && rm -rf /var/cache/yum
   # sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
 

From 1608474bdffd37dd9b2417c006b4146dc9d39225 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 25 Aug 2020 14:36:49 +0200
Subject: [PATCH 29/50] Update wodles

---
 wazuh-opendistro/config/permanent_data.env | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/wazuh-opendistro/config/permanent_data.env b/wazuh-opendistro/config/permanent_data.env
index ca461d63..9c2556d8 100644
--- a/wazuh-opendistro/config/permanent_data.env
+++ b/wazuh-opendistro/config/permanent_data.env
@@ -55,20 +55,13 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_oval.xsl"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_xccdf.xsl"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-redhat-6-ds.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-redhat-7-ds.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-centos-6-ds.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-centos-7-ds.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-fedora-24-ds.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-rhel-6-ds.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-rhel-7-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
 export PERMANENT_DATA_EXCP
 
-# Files mounted in a volume that should be deleted 
+# Files mounted in a volume that should be deleted
 i=0
 PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db"
 export PERMANENT_DATA_DEL

From bbabf9bb3b7945cc046141fb9029775d20479ea1 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 25 Aug 2020 15:09:49 +0200
Subject: [PATCH 30/50] Bump default index to 4

---
 kibana-opendistro/config/kibana_settings.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kibana-opendistro/config/kibana_settings.sh b/kibana-opendistro/config/kibana_settings.sh
index 514727a6..c3239f25 100644
--- a/kibana-opendistro/config/kibana_settings.sh
+++ b/kibana-opendistro/config/kibana_settings.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
 
-WAZUH_MAJOR=3
+WAZUH_MAJOR=4
 
 ##############################################################################
 # Wait for the Kibana API to start. It is necessary to do it in this container

From 274342e24dca43b5d09202d05d59e07f1f3449b5 Mon Sep 17 00:00:00 2001
From: manuasir <manuel.jimenez@wazuh.com>
Date: Tue, 25 Aug 2020 16:47:11 +0200
Subject: [PATCH 31/50] Disabled basic auth

---
 nginx_conf/kibana-web.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nginx_conf/kibana-web.conf b/nginx_conf/kibana-web.conf
index b3821747..9ac5b667 100644
--- a/nginx_conf/kibana-web.conf
+++ b/nginx_conf/kibana-web.conf
@@ -10,11 +10,11 @@ server {
     ssl_certificate /etc/nginx/conf.d/ssl/kibana-access.pem;
     ssl_certificate_key /etc/nginx/conf.d/ssl/kibana-access.key;
     location / {
-        auth_basic "Restricted Access";
-        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
+    #    auth_basic "Restricted Access";
+    #    auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
         proxy_pass http://kibana:5601/;
         proxy_buffer_size          128k;
         proxy_buffers              4 256k;
         proxy_busy_buffers_size    256k;
     }
-} 
+}

From 033600101233eee46f22b5f39defbdc3108072a4 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 25 Aug 2020 17:03:33 +0200
Subject: [PATCH 32/50] Remove KIBANA_IP variable

---
 kibana-opendistro/config/kibana_settings.sh | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/kibana-opendistro/config/kibana_settings.sh b/kibana-opendistro/config/kibana_settings.sh
index c3239f25..d536e24f 100644
--- a/kibana-opendistro/config/kibana_settings.sh
+++ b/kibana-opendistro/config/kibana_settings.sh
@@ -29,13 +29,7 @@ if [ "$KIBANA_INDEX" != "" ]; then
     echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
 fi
 
-if [ "$KIBANA_IP" != "" ]; then
-  kibana_url="$KIBANA_IP"
-else
-  kibana_url="kibana"
-fi
-
-while [[ "$(curl -XGET -I  -s -o /dev/null -w '%{http_code}' $kibana_url:5601/login)" != "200" ]]; do
+while [[ "$(curl -XGET -I  -s -o /dev/null -w '%{http_code}' https://127.0.0.1/login)" != "200" ]]; do
   echo "Waiting for Kibana API. Sleeping 5 seconds"
   sleep 5
 done
@@ -55,12 +49,12 @@ EOF
 
 sleep 5
 # Add the wazuh alerts index as default.
-curl ${auth} -POST $kibana_url:5601/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
+curl ${auth} -POST https://127.0.0.1/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
 rm -f ${default_index}
 
 sleep 5
 # Configuring Kibana TimePicker.
-curl ${auth} -POST "http://$kibana_url:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
+curl ${auth} -POST "https://127.0.0.1/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
 '{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-12h\",\n  \"to\": \"now\",\n  \"mode\": \"quick\"}"}}'
 
 echo "End settings"

From a9ee1f7e2901df6792389ec7e32160aebf5c4e0a Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 26 Aug 2020 13:18:01 +0200
Subject: [PATCH 33/50] Update staging app

---
 kibana-opendistro/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
index 3f72a444..a897acdc 100644
--- a/kibana-opendistro/Dockerfile
+++ b/kibana-opendistro/Dockerfile
@@ -6,7 +6,7 @@ ARG WAZUH_VERSION=3.13.1
 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
 
 WORKDIR /usr/share/kibana
-RUN ./bin/kibana-plugin install https://s3-us-west-1.amazonaws.com/packages-dev.wazuh.com/staging/ui/kibana/wazuhapp-4.0.0_7.8.0_0.0.0.todelete.zip
+RUN ./bin/kibana-plugin install https://packages-dev.wazuh.com/warehouse/test/4.0/ui/kibana/wazuhapp-4.0.0_7.8.0_0.0.0.todelete.zip
 
 WORKDIR /
 USER root

From 3deb80d6a099d25f8c3fdf6507aa01e41212b3d0 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 26 Aug 2020 15:29:06 +0200
Subject: [PATCH 34/50] Add temporary fix for node dependencies

---
 kibana-opendistro/Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
index a897acdc..0f4605a8 100644
--- a/kibana-opendistro/Dockerfile
+++ b/kibana-opendistro/Dockerfile
@@ -7,6 +7,8 @@ ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
 
 WORKDIR /usr/share/kibana
 RUN ./bin/kibana-plugin install https://packages-dev.wazuh.com/warehouse/test/4.0/ui/kibana/wazuhapp-4.0.0_7.8.0_0.0.0.todelete.zip
+RUN cp -Rf ./plugins/wazuh/node_modules/brace ./node_modules/
+RUN rm -Rf plugins/wazuh/node_modules/brace
 
 WORKDIR /
 USER root

From a24fd2fbce1997038cff365fc95fce80e5796eff Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 26 Aug 2020 15:29:53 +0200
Subject: [PATCH 35/50] Add SSL_CERTIFICATE and SSL_KEY support to
 config-filebeat

---
 .../config/etc/cont-init.d/1-config-filebeat           | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat b/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
index dae9947f..04be44bb 100644
--- a/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
+++ b/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
@@ -30,6 +30,16 @@ if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
   sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
 fi
 
+if [ "$SSL_CERTIFICATE" != "" ]; then
+  >&2 echo "Configuring SSL Certificate."
+  sed -i "s|#ssl.certificate:.*|ssl.certificate: ['$SSL_CERTIFICATE']|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_KEY" != "" ]; then
+  >&2 echo "Configuring SSL Key."
+  sed -i "s|#ssl.key:.*|ssl.key: ['$SSL_KEY']|g" /etc/filebeat/filebeat.yml
+fi
+
 
 chmod go-w /etc/filebeat/filebeat.yml || true
 chown root: /etc/filebeat/filebeat.yml || true

From 6ebc52467bdad89548197327c774ab4603c2e243 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 26 Aug 2020 16:27:10 +0200
Subject: [PATCH 36/50] Optimize Docker layer caching

---
 kibana-opendistro/Dockerfile | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
index 0f4605a8..8d066505 100644
--- a/kibana-opendistro/Dockerfile
+++ b/kibana-opendistro/Dockerfile
@@ -41,12 +41,6 @@ ENV PATTERN="" \
     WAZUH_MONITORING_REPLICAS="" \
     ADMIN_PRIVILEGES=""
 
-COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
-RUN chmod +x ./wazuh_app_config.sh
-
-COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
-RUN chmod +x ./kibana_settings.sh
-
 USER kibana
 RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
 
@@ -56,4 +50,10 @@ RUN chmod +x ./welcome_wazuh.sh
 ARG CHANGE_WELCOME="true"
 RUN ./welcome_wazuh.sh
 
+COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
+RUN chmod +x ./wazuh_app_config.sh
+
+COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
+RUN chmod +x ./kibana_settings.sh
+
 ENTRYPOINT ./entrypoint.sh

From 68a02f1f388bf4a3cfcdaa98a48ef6871dfba3e3 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 26 Aug 2020 16:27:47 +0200
Subject: [PATCH 37/50] Switch back to port 5601 on kibana

---
 kibana-opendistro/config/kibana_settings.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kibana-opendistro/config/kibana_settings.sh b/kibana-opendistro/config/kibana_settings.sh
index d536e24f..63535605 100644
--- a/kibana-opendistro/config/kibana_settings.sh
+++ b/kibana-opendistro/config/kibana_settings.sh
@@ -29,7 +29,7 @@ if [ "$KIBANA_INDEX" != "" ]; then
     echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
 fi
 
-while [[ "$(curl -XGET -I  -s -o /dev/null -w '%{http_code}' https://127.0.0.1/login)" != "200" ]]; do
+while [[ "$(curl -XGET -I  -s -o /dev/null -w '%{http_code}' http://127.0.0.1:5601/login)" != "200" ]]; do
   echo "Waiting for Kibana API. Sleeping 5 seconds"
   sleep 5
 done
@@ -49,12 +49,12 @@ EOF
 
 sleep 5
 # Add the wazuh alerts index as default.
-curl ${auth} -POST https://127.0.0.1/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
+curl ${auth} -POST http://127.0.0.1:5601/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
 rm -f ${default_index}
 
 sleep 5
 # Configuring Kibana TimePicker.
-curl ${auth} -POST "https://127.0.0.1/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
+curl ${auth} -POST "http://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
 '{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-12h\",\n  \"to\": \"now\",\n  \"mode\": \"quick\"}"}}'
 
 echo "End settings"

From 98273c1e27d2789a82d7204f9523ca232eb079a8 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 28 Aug 2020 14:36:55 +0200
Subject: [PATCH 38/50] Enable HTTPS for status checks

---
 kibana-opendistro/config/kibana_settings.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kibana-opendistro/config/kibana_settings.sh b/kibana-opendistro/config/kibana_settings.sh
index 63535605..19cae116 100644
--- a/kibana-opendistro/config/kibana_settings.sh
+++ b/kibana-opendistro/config/kibana_settings.sh
@@ -29,7 +29,7 @@ if [ "$KIBANA_INDEX" != "" ]; then
     echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
 fi
 
-while [[ "$(curl -XGET -I  -s -o /dev/null -w '%{http_code}' http://127.0.0.1:5601/login)" != "200" ]]; do
+while [[ "$(curl -XGET -I  -s -o /dev/null -w '%{http_code}' -k https://127.0.0.1:5601/login)" != "200" ]]; do
   echo "Waiting for Kibana API. Sleeping 5 seconds"
   sleep 5
 done
@@ -49,12 +49,12 @@ EOF
 
 sleep 5
 # Add the wazuh alerts index as default.
-curl ${auth} -POST http://127.0.0.1:5601/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
+curl ${auth} -POST -k https://127.0.0.1:5601/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
 rm -f ${default_index}
 
 sleep 5
 # Configuring Kibana TimePicker.
-curl ${auth} -POST "http://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
+curl ${auth} -POST -k "https://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
 '{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-12h\",\n  \"to\": \"now\",\n  \"mode\": \"quick\"}"}}'
 
 echo "End settings"

From 8fb7110af5f76b91caf78175625a98b80593fa45 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 28 Aug 2020 14:37:21 +0200
Subject: [PATCH 39/50] Enable SSL on Kibana by default

Nginx container was disabled but left commented as an example
---
 docker-compose.yml | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index fa2690cc..3e17716e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -52,28 +52,34 @@ services:
     image: wazuh-kibana-opendistro
     hostname: kibana
     restart: always
+    ports:
+      - 443:5601
     environment:
       - ELASTICSEARCH_USERNAME=admin
       - ELASTICSEARCH_PASSWORD=admin
+      - SERVER_SSL_ENABLED=true
+      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert
+      - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key
+
     depends_on:
       - elasticsearch
     links:
       - elasticsearch:elasticsearch
       - wazuh:wazuh
 
-  nginx:
-    image: nginx:stable
-    hostname: nginx
-    restart: always
-    ports:
-      - "80:80"
-      - "443:443"
-    depends_on:
-      - kibana
-    links:
-      - kibana:kibana
-    volumes:
-      - ./nginx_conf:/etc/nginx/conf.d:ro
+  # nginx:
+  #   image: nginx:stable
+  #   hostname: nginx
+  #   restart: always
+  #   ports:
+  #     - "80:80"
+  #     - "443:443"
+  #   depends_on:
+  #     - kibana
+  #   links:
+  #     - kibana:kibana
+  #   volumes:
+  #     - ./nginx_conf:/etc/nginx/conf.d:ro
 
 volumes:
   ossec_api_configuration:

From 8657266ffda68f56dcde588ff24f150ea63a7d12 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 1 Sep 2020 17:23:49 +0200
Subject: [PATCH 40/50] Bump package version

---
 wazuh-opendistro/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index b81723c6..672ec2d6 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -2,7 +2,7 @@
 FROM centos:7
 
 ARG FILEBEAT_VERSION=7.8.0
-ARG WAZUH_VERSION=4.0.0-c6test
+ARG WAZUH_VERSION=4.0.0-0.0.0.developtestingaugust
 ARG TEMPLATE_VERSION="develop"
 ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz"
 

From e45c0f3c4df4493d25a02704597ee129689e2c18 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 2 Sep 2020 10:07:56 +0200
Subject: [PATCH 41/50] Switch 1514 to TCP

---
 docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 3e17716e..3545d480 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,7 @@ services:
     hostname: wazuh-manager
     restart: always
     ports:
-      - "1514:1514/udp"
+      - "1514:1514"
       - "1515:1515"
       - "514:514/udp"
       - "55000:55000"

From 32cd19f344180657bde135b31d7e61b9793d6975 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 3 Sep 2020 12:55:59 +0200
Subject: [PATCH 42/50] Enable pre-release package

---
 wazuh-opendistro/Dockerfile        | 11 ++++-------
 wazuh-opendistro/config/wazuh.repo |  2 +-
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index 672ec2d6..1bab9f3c 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -2,7 +2,7 @@
 FROM centos:7
 
 ARG FILEBEAT_VERSION=7.8.0
-ARG WAZUH_VERSION=4.0.0-0.0.0.developtestingaugust
+ARG WAZUH_VERSION=4.0.0-1
 ARG TEMPLATE_VERSION="develop"
 ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz"
 
@@ -13,15 +13,12 @@ ENV API_USER="foo" \
 # Set repositories.
 RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
 
-# COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo
+COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo
 
 RUN yum --enablerepo=updates clean metadata && \
-  curl --fail --silent https://packages-dev.wazuh.com/warehouse/test/4.0/rpm/var/wazuh-manager-${WAZUH_VERSION}.x86_64.rpm \
-  -o wazuh-manager.rpm && \
-  yum -y install openssl which && yum -y install wazuh-manager.rpm -y && rm -f wazuh-manager.rpm && \
+  yum -y install openssl which && yum -y install wazuh-manager-${WAZUH_VERSION} -y && \
+  sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
   yum clean all && rm -rf /var/cache/yum
-  # sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
-
 
 RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm &&\
   rpm -i filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm
diff --git a/wazuh-opendistro/config/wazuh.repo b/wazuh-opendistro/config/wazuh.repo
index 8be8a18e..15e1b822 100644
--- a/wazuh-opendistro/config/wazuh.repo
+++ b/wazuh-opendistro/config/wazuh.repo
@@ -3,5 +3,5 @@ gpgcheck=1
 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
 enabled=1
 name=Wazuh repository
-baseurl=https://packages-dev.wazuh.com/staging/yum/
+baseurl=https://packages-dev.wazuh.com/pre-release/yum/
 protect=1

From b6cc7d20bbf2f612039e39d9d43776e1ad49e679 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 3 Sep 2020 12:56:14 +0200
Subject: [PATCH 43/50] Use latest app version from pre-release

---
 kibana-opendistro/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
index 8d066505..530316a6 100644
--- a/kibana-opendistro/Dockerfile
+++ b/kibana-opendistro/Dockerfile
@@ -2,11 +2,11 @@
 FROM amazon/opendistro-for-elasticsearch-kibana:1.9.0
 USER kibana
 ARG ELASTIC_VERSION=7.8.0
-ARG WAZUH_VERSION=3.13.1
+ARG WAZUH_VERSION=4.0.0
 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
 
 WORKDIR /usr/share/kibana
-RUN ./bin/kibana-plugin install https://packages-dev.wazuh.com/warehouse/test/4.0/ui/kibana/wazuhapp-4.0.0_7.8.0_0.0.0.todelete.zip
+RUN ./bin/kibana-plugin install https://packages-dev.wazuh.com/pre-release/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip
 RUN cp -Rf ./plugins/wazuh/node_modules/brace ./node_modules/
 RUN rm -Rf plugins/wazuh/node_modules/brace
 

From e598cc7712b37c4db232ce84191f284ca813287c Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 3 Sep 2020 17:12:15 +0200
Subject: [PATCH 44/50] Remove temporary brace fix

---
 kibana-opendistro/Dockerfile | 2 --
 1 file changed, 2 deletions(-)

diff --git a/kibana-opendistro/Dockerfile b/kibana-opendistro/Dockerfile
index 530316a6..82631ca2 100644
--- a/kibana-opendistro/Dockerfile
+++ b/kibana-opendistro/Dockerfile
@@ -7,8 +7,6 @@ ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
 
 WORKDIR /usr/share/kibana
 RUN ./bin/kibana-plugin install https://packages-dev.wazuh.com/pre-release/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip
-RUN cp -Rf ./plugins/wazuh/node_modules/brace ./node_modules/
-RUN rm -Rf plugins/wazuh/node_modules/brace
 
 WORKDIR /
 USER root

From 37ba48d56d552099da39668e1e70422efd317edd Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 16 Sep 2020 17:59:54 +0200
Subject: [PATCH 45/50] Update ulimits

---
 docker-compose.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 3545d480..c7a846db 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -46,6 +46,9 @@ services:
       memlock:
         soft: -1
         hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
 
   kibana:
     build: kibana-opendistro/

From 3d7807d27b59d701d9d43cf1ed214aa461b38def Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 16 Sep 2020 18:00:36 +0200
Subject: [PATCH 46/50] Update expose instruction to use TCP for logging

---
 wazuh-opendistro/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wazuh-opendistro/Dockerfile b/wazuh-opendistro/Dockerfile
index 1bab9f3c..dd76e266 100644
--- a/wazuh-opendistro/Dockerfile
+++ b/wazuh-opendistro/Dockerfile
@@ -49,6 +49,6 @@ RUN chmod 755 /permanent_data.sh && \
     sync && rm /permanent_data.sh
 
 # Services ports
-EXPOSE 55000/tcp 1514/udp 1515/tcp 514/udp 1516/tcp
+EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp
 
 ENTRYPOINT [ "/init" ]

From ac0c85bb64b44973711a405d466dd29a1fd87b23 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 16 Sep 2020 18:01:19 +0200
Subject: [PATCH 47/50] Fix filebeat.yml format

---
 wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat b/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
index 04be44bb..ce033aa5 100644
--- a/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
+++ b/wazuh-opendistro/config/etc/cont-init.d/1-config-filebeat
@@ -32,12 +32,12 @@ fi
 
 if [ "$SSL_CERTIFICATE" != "" ]; then
   >&2 echo "Configuring SSL Certificate."
-  sed -i "s|#ssl.certificate:.*|ssl.certificate: ['$SSL_CERTIFICATE']|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
 fi
 
 if [ "$SSL_KEY" != "" ]; then
   >&2 echo "Configuring SSL Key."
-  sed -i "s|#ssl.key:.*|ssl.key: ['$SSL_KEY']|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
 fi
 
 

From a2e780525112f340a3f05a8c2084859a7777d3af Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 16 Sep 2020 18:08:38 +0200
Subject: [PATCH 48/50] Remove deprecated nginx section

---
 docker-compose.yml | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index c7a846db..4e859267 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -70,20 +70,6 @@ services:
       - elasticsearch:elasticsearch
       - wazuh:wazuh
 
-  # nginx:
-  #   image: nginx:stable
-  #   hostname: nginx
-  #   restart: always
-  #   ports:
-  #     - "80:80"
-  #     - "443:443"
-  #   depends_on:
-  #     - kibana
-  #   links:
-  #     - kibana:kibana
-  #   volumes:
-  #     - ./nginx_conf:/etc/nginx/conf.d:ro
-
 volumes:
   ossec_api_configuration:
   ossec_etc:

From ee26db692b27bd9ecde2f7f44d8f600bfed189b6 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 24 Sep 2020 11:32:51 +0200
Subject: [PATCH 49/50] Remove legacy code to run cmd on entrypoint

---
 .../config/etc/cont-init.d/0-wazuh-init       | 20 +------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init b/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
index f3fbd1a4..1aa78f65 100644
--- a/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
+++ b/wazuh-opendistro/config/etc/cont-init.d/0-wazuh-init
@@ -126,21 +126,6 @@ function ossec_shutdown(){
   ${WAZUH_INSTALL_PATH}/bin/ossec-control stop;
 }
 
-##############################################################################
-# Interpret any passed arguments (via docker command to this entrypoint) as
-# paths or commands, and execute them.
-#
-# This can be useful for actions that need to be run before the services are
-# started, such as "/var/ossec/bin/ossec-control enable agentless".
-##############################################################################
-
-docker_custom_args() {
-  for CUSTOM_COMMAND in "$@"
-  do
-    echo "Executing command \`${CUSTOM_COMMAND}\`"
-    exec_cmd_stdout "${CUSTOM_COMMAND}"
-  done
-}
 
 ##############################################################################
 # Main function
@@ -169,10 +154,7 @@ main() {
   mount_files
 
   # Trap exit signals and do a proper shutdown
-  trap "ossec_shutdown; exit" SIGINT SIGTERM
-
-  # Execute custom args
-  docker_custom_args
+  trap "ossec_shutdown; exit" SIGINT SIGTERM  
 
   # Delete temporary data folder
   rm -rf ${WAZUH_INSTALL_PATH}/data_tmp

From 960105b776c31647799cac3d732b74d87d2ca8c4 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 24 Sep 2020 12:55:46 +0200
Subject: [PATCH 50/50] Remove extra space

---
 wazuh-opendistro/config/etc/cont-init.d/2-manager | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wazuh-opendistro/config/etc/cont-init.d/2-manager b/wazuh-opendistro/config/etc/cont-init.d/2-manager
index e548e8b1..6ce02ae2 100644
--- a/wazuh-opendistro/config/etc/cont-init.d/2-manager
+++ b/wazuh-opendistro/config/etc/cont-init.d/2-manager
@@ -1,3 +1,3 @@
 #!/usr/bin/with-contenv bash
 
-/var/ossec/bin/ossec-control start 
+/var/ossec/bin/ossec-control start