forked from wazuh/wazuh-docker
Add initial support for kibana-opendistro
This commit is contained in:
Manuel Gutierrez
@@ -0,0 +1,60 @@
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
FROM amazon/opendistro-for-elasticsearch-kibana:1.9.0
|
||||
USER kibana
|
||||
ARG ELASTIC_VERSION=7.8.0
|
||||
ARG WAZUH_VERSION=3.13.1
|
||||
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
|
||||
|
||||
WORKDIR /usr/share/kibana
|
||||
RUN ./bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip
|
||||
|
||||
WORKDIR /
|
||||
USER root
|
||||
COPY config/entrypoint.sh ./entrypoint.sh
|
||||
RUN chmod 755 ./entrypoint.sh
|
||||
|
||||
ENV PATTERN="" \
|
||||
CHECKS_PATTERN="" \
|
||||
CHECKS_TEMPLATE="" \
|
||||
CHECKS_API="" \
|
||||
CHECKS_SETUP="" \
|
||||
EXTENSIONS_PCI="" \
|
||||
EXTENSIONS_GDPR="" \
|
||||
EXTENSIONS_AUDIT="" \
|
||||
EXTENSIONS_OSCAP="" \
|
||||
EXTENSIONS_CISCAT="" \
|
||||
EXTENSIONS_AWS="" \
|
||||
EXTENSIONS_VIRUSTOTAL="" \
|
||||
EXTENSIONS_OSQUERY="" \
|
||||
APP_TIMEOUT="" \
|
||||
WAZUH_SHARDS="" \
|
||||
WAZUH_REPLICAS="" \
|
||||
WAZUH_VERSION_SHARDS="" \
|
||||
WAZUH_VERSION_REPLICAS="" \
|
||||
IP_SELECTOR="" \
|
||||
IP_IGNORE="" \
|
||||
WAZUH_MONITORING_ENABLED="" \
|
||||
WAZUH_MONITORING_FREQUENCY="" \
|
||||
WAZUH_MONITORING_SHARDS="" \
|
||||
WAZUH_MONITORING_REPLICAS="" \
|
||||
ADMIN_PRIVILEGES=""
|
||||
|
||||
ARG CHANGE_WELCOME="false"
|
||||
|
||||
COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
|
||||
|
||||
RUN chmod +x ./wazuh_app_config.sh
|
||||
|
||||
COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
|
||||
|
||||
RUN chmod +x ./kibana_settings.sh
|
||||
|
||||
COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
|
||||
|
||||
RUN chmod +x ./welcome_wazuh.sh
|
||||
|
||||
RUN ./welcome_wazuh.sh
|
||||
USER kibana
|
||||
RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
|
||||
|
||||
ENTRYPOINT ./entrypoint.sh
|
||||
@@ -0,0 +1,53 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
|
||||
##############################################################################
|
||||
# Waiting for elasticsearch
|
||||
##############################################################################
|
||||
|
||||
if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
|
||||
el_url="http://elasticsearch:9200"
|
||||
else
|
||||
el_url="${ELASTICSEARCH_URL}"
|
||||
fi
|
||||
|
||||
auth=""
|
||||
|
||||
until curl -XGET $el_url ${auth}; do
|
||||
>&2 echo "Elastic is unavailable - sleeping"
|
||||
sleep 5
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Elasticsearch is up."
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Waiting for wazuh alerts template
|
||||
##############################################################################
|
||||
|
||||
strlen=0
|
||||
|
||||
while [[ $strlen -eq 0 ]]
|
||||
do
|
||||
template=$(curl $el_url/_cat/templates/wazuh -s)
|
||||
strlen=${#template}
|
||||
>&2 echo "Wazuh alerts template not loaded - sleeping."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Wazuh alerts template is loaded."
|
||||
|
||||
|
||||
./wazuh_app_config.sh
|
||||
|
||||
sleep 5
|
||||
|
||||
./kibana_settings.sh &
|
||||
|
||||
/usr/local/bin/kibana-docker
|
||||
@@ -0,0 +1,76 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
WAZUH_MAJOR=3
|
||||
|
||||
##############################################################################
|
||||
# Wait for the Kibana API to start. It is necessary to do it in this container
|
||||
# because the others are running Elastic Stack and we can not interrupt them.
|
||||
#
|
||||
# The following actions are performed:
|
||||
#
|
||||
# Add the wazuh alerts index as default.
|
||||
# Set the Discover time interval to 24 hours instead of 15 minutes.
|
||||
# Do not ask user to help providing usage statistics to Elastic.
|
||||
##############################################################################
|
||||
|
||||
##############################################################################
|
||||
# Customize elasticsearch ip
|
||||
##############################################################################
|
||||
if [ "$ELASTICSEARCH_KIBANA_IP" != "" ]; then
|
||||
sed -i "s:#elasticsearch.hosts:elasticsearch.hosts:g" /usr/share/kibana/config/kibana.yml
|
||||
sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_KIBANA_IP'|g' /usr/share/kibana/config/kibana.yml
|
||||
fi
|
||||
|
||||
# If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate.
|
||||
if [ "$KIBANA_INDEX" != "" ]; then
|
||||
if grep -q 'kibana.index' /usr/share/kibana/config/kibana.yml; then
|
||||
sed -i '/kibana.index/d' /usr/share/kibana/config/kibana.yml
|
||||
fi
|
||||
echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
|
||||
fi
|
||||
|
||||
if [ "$KIBANA_IP" != "" ]; then
|
||||
kibana_ip="$KIBANA_IP"
|
||||
else
|
||||
kibana_ip="kibana"
|
||||
fi
|
||||
|
||||
# Add auth headers if required
|
||||
if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
|
||||
curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
|
||||
fi
|
||||
|
||||
while [[ "$(curl $curl_auth -XGET -I -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
|
||||
echo "Waiting for Kibana API. Sleeping 5 seconds"
|
||||
sleep 5
|
||||
done
|
||||
|
||||
# Prepare index selection.
|
||||
echo "Kibana API is running"
|
||||
|
||||
default_index="/tmp/default_index.json"
|
||||
|
||||
cat > ${default_index} << EOF
|
||||
{
|
||||
"changes": {
|
||||
"defaultIndex": "wazuh-alerts-${WAZUH_MAJOR}.x-*"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
sleep 5
|
||||
# Add the wazuh alerts index as default.
|
||||
curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
|
||||
rm -f ${default_index}
|
||||
|
||||
sleep 5
|
||||
# Configuring Kibana TimePicker.
|
||||
curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
|
||||
'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-24h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}'
|
||||
|
||||
sleep 5
|
||||
# Do not ask user to help providing usage statistics to Elastic
|
||||
curl -POST "http://$kibana_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
|
||||
|
||||
echo "End settings"
|
||||
@@ -0,0 +1,67 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
wazuh_url="${WAZUH_API_URL:-https://wazuh}"
|
||||
wazuh_port="${API_PORT:-55000}"
|
||||
api_user="${API_USER:-foo}"
|
||||
api_password="${API_PASS:-bar}"
|
||||
|
||||
kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
|
||||
mkdir -p /usr/share/kibana/optimize/wazuh/config/
|
||||
touch $kibana_config_file
|
||||
|
||||
declare -A CONFIG_MAP=(
|
||||
[pattern]=$PATTERN
|
||||
[checks.pattern]=$CHECKS_PATTERN
|
||||
[checks.template]=$CHECKS_TEMPLATE
|
||||
[checks.api]=$CHECKS_API
|
||||
[checks.setup]=$CHECKS_SETUP
|
||||
[extensions.pci]=$EXTENSIONS_PCI
|
||||
[extensions.gdpr]=$EXTENSIONS_GDPR
|
||||
[extensions.audit]=$EXTENSIONS_AUDIT
|
||||
[extensions.oscap]=$EXTENSIONS_OSCAP
|
||||
[extensions.ciscat]=$EXTENSIONS_CISCAT
|
||||
[extensions.aws]=$EXTENSIONS_AWS
|
||||
[extensions.virustotal]=$EXTENSIONS_VIRUSTOTAL
|
||||
[extensions.osquery]=$EXTENSIONS_OSQUERY
|
||||
[timeout]=$APP_TIMEOUT
|
||||
[wazuh.shards]=$WAZUH_SHARDS
|
||||
[wazuh.replicas]=$WAZUH_REPLICAS
|
||||
[wazuh-version.shards]=$WAZUH_VERSION_SHARDS
|
||||
[wazuh-version.replicas]=$WAZUH_VERSION_REPLICAS
|
||||
[ip.selector]=$IP_SELECTOR
|
||||
[ip.ignore]=$IP_IGNORE
|
||||
[wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
|
||||
[wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
|
||||
[wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
|
||||
[wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
|
||||
[admin]=$ADMIN_PRIVILEGES
|
||||
)
|
||||
|
||||
for i in "${!CONFIG_MAP[@]}"
|
||||
do
|
||||
if [ "${CONFIG_MAP[$i]}" != "" ]; then
|
||||
sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
|
||||
fi
|
||||
done
|
||||
|
||||
# remove default API entry (new in 3.11.0_7.5.1)
|
||||
sed -ie '/- default:/,+4d' $kibana_config_file
|
||||
|
||||
CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth})
|
||||
|
||||
grep -q 1513629884013 $kibana_config_file
|
||||
_config_exists=$?
|
||||
|
||||
if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then
|
||||
cat << EOF > $kibana_config_file
|
||||
hosts:
|
||||
- 1513629884013:
|
||||
url: $wazuh_url
|
||||
port: $wazuh_port
|
||||
user: $api_user
|
||||
password: $api_password
|
||||
EOF
|
||||
else
|
||||
echo "Wazuh APP already configured"
|
||||
fi
|
||||
@@ -0,0 +1,24 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
if [[ $CHANGE_WELCOME == "true" ]]
|
||||
then
|
||||
|
||||
rm -rf ./optimize/bundles
|
||||
|
||||
kibana_path="/usr/share/kibana"
|
||||
# Set Wazuh app as the default landing page
|
||||
echo "Set Wazuh app as the default landing page"
|
||||
echo "server.defaultRoute: /app/wazuh" >> /usr/share/kibana/config/kibana.yml
|
||||
|
||||
# Redirect Kibana welcome screen to Discover
|
||||
echo "Redirect Kibana welcome screen to Discover"
|
||||
sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
|
||||
sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
|
||||
|
||||
# Redirect Kibana welcome screen to Discover
|
||||
echo "Hide undesired links"
|
||||
sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/rollup/public/crud_app/index.js
|
||||
sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/license_management/public/management_section.js
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user