From 8a051b67b05c5d38564fba93ed241811d8f9fbb8 Mon Sep 17 00:00:00 2001 From: Florian Braun Date: Thu, 8 Feb 2018 10:57:35 +0100 Subject: [PATCH 1/4] Removed Proxy in docker-compose.yml The new Kibana container will be designed to run completely local. no need for proxy anymore --- docker-compose.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 8dac501d..e250617a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -78,8 +78,6 @@ services: - wazuh entrypoint: /wait-for-it.sh elasticsearch # environment: -# - http_proxy=yourproxy -# - https_proxy=yourproxy # - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-3.1.0-6.1.2.zip" nginx: image: wazuh/wazuh-nginx From 74dd541bd8726fc284e01f3e57937b3737bcb2e2 Mon Sep 17 00:00:00 2001 From: Florian Braun Date: Thu, 8 Feb 2018 11:18:32 +0100 Subject: [PATCH 2/4] Cleanup Kibana Kibana also does not need the environment for downloading the plugin as it is already installed in the image --- docker-compose.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index e250617a..08e28d51 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -77,8 +77,6 @@ services: - elasticsearch:elasticsearch - wazuh entrypoint: /wait-for-it.sh elasticsearch -# environment: -# - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-3.1.0-6.1.2.zip" nginx: image: wazuh/wazuh-nginx hostname: nginx From 2b3f71aa100f3e5a2f96e66e1eb6dc9ae5306840 Mon Sep 17 00:00:00 2001 From: Florian Braun Date: Thu, 8 Feb 2018 11:20:48 +0100 Subject: [PATCH 3/4] Buildin all dependencies into the Container We Download and install all external dependencys in our container. So no network intreraction will be required by Kibana on launch of the container. This also saves time on launch as the plugin only has to be installed on container build. So with this dockerfile all stuff is in the image and does not need downloads on deploy. --- kibana/Dockerfile | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kibana/Dockerfile b/kibana/Dockerfile index e276a7ea..7fdb7bd4 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -6,4 +6,16 @@ COPY ./config/kibana.yml /usr/share/kibana/config/kibana.yml COPY config/wait-for-it.sh /wait-for-it.sh +ADD https://packages.wazuh.com/wazuhapp/wazuhapp-3.1.0_6.1.2.zip /tmp + +ADD https://raw.githubusercontent.com/wazuh/wazuh/3.1/extensions/elasticsearch/wazuh-elastic6-template-alerts.json /usr/share/kibana/config + +ADD https://raw.githubusercontent.com/wazuh/wazuh/3.1/extensions/elasticsearch/wazuh-elastic6-template-monitoring.json /usr/share/kibana/config + +ADD https://raw.githubusercontent.com/wazuh/wazuh/3.1/extensions/elasticsearch/alert_sample.json /usr/share/kibana/config + +RUN /usr/share/kibana/bin/kibana-plugin install file:///tmp/wazuhapp-3.1.0_6.1.2.zip + +RUN rm -rf /tmp/* + RUN chmod 755 /wait-for-it.sh From 716667be46ee4e17cec2bd1889c754b92b2dda38 Mon Sep 17 00:00:00 2001 From: Florian Braun Date: Thu, 8 Feb 2018 11:22:38 +0100 Subject: [PATCH 4/4] Adoptions and Cleanup for new Dockerfile So i cleaned this up so that the plugin install is gone now as it is done on container image build. Also the image includes the Templates and Sample alerts so i adopted the script to deliver the files via the local files that are included in the container. --- kibana/config/wait-for-it.sh | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/kibana/config/wait-for-it.sh b/kibana/config/wait-for-it.sh index 9c5942f4..cee0d7be 100644 --- a/kibana/config/wait-for-it.sh +++ b/kibana/config/wait-for-it.sh @@ -5,7 +5,6 @@ set -e host="$1" shift cmd="kibana" -WAZUH_KIBANA_PLUGIN_URL=${WAZUH_KIBANA_PLUGIN_URL:-https://packages.wazuh.com/wazuhapp/wazuhapp-3.1.0_6.1.2.zip} until curl -XGET $host:9200; do >&2 echo "Elastic is unavailable - sleeping" @@ -16,26 +15,18 @@ done sleep 5 #Insert default templates -curl https://raw.githubusercontent.com/wazuh/wazuh/3.1/extensions/elasticsearch/wazuh-elastic6-template-alerts.json | curl -XPUT 'http://elasticsearch:9200/_template/wazuh' -H 'Content-Type: application/json' -d @- +cat /usr/share/kibana/config/wazuh-elastic6-template-alerts.json | curl -XPUT 'http://elasticsearch:9200/_template/wazuh' -H 'Content-Type: application/json' -d @- sleep 5 #Insert default templates -curl https://raw.githubusercontent.com/wazuh/wazuh/3.1/extensions/elasticsearch/wazuh-elastic6-template-monitoring.json | curl -XPUT 'http://elasticsearch:9200/_template/wazuh-agent' -H 'Content-Type: application/json' -d @- +cat /usr/share/kibana/config/wazuh-elastic6-template-monitoring.json | curl -XPUT 'http://elasticsearch:9200/_template/wazuh-agent' -H 'Content-Type: application/json' -d @- #Insert sample alert: sleep 5 -curl https://raw.githubusercontent.com/wazuh/wazuh/3.1/extensions/elasticsearch/alert_sample.json | curl -XPUT "http://elasticsearch:9200/wazuh-alerts-3.x-"`date +%Y.%m.%d`"/wazuh/sample" -H 'Content-Type: application/json' -d @- - -if /usr/share/kibana/bin/kibana-plugin list | grep wazuh; then - echo "Wazuh APP already installed" -else - /usr/share/kibana/bin/kibana-plugin install ${WAZUH_KIBANA_PLUGIN_URL} -fi - -sleep 30 +cat /usr/share/kibana/config/alert_sample.json | curl -XPUT "http://elasticsearch:9200/wazuh-alerts-3.x-"`date +%Y.%m.%d`"/wazuh/sample" -H 'Content-Type: application/json' -d @- +sleep 5 echo "Setting API credentials into Wazuh APP" - CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET http://$host:9200/.wazuh/wazuh-configuration/1513629884013) if [ "x$CONFIG_CODE" = "x404" ]; then curl -s -XPOST http://$host:9200/.wazuh/wazuh-configuration/1513629884013 -H 'Content-Type: application/json' -d'