diff --git a/docs/.gitignore b/docs/.gitignore new file mode 100644 index 00000000..7585238e --- /dev/null +++ b/docs/.gitignore @@ -0,0 +1 @@ +book diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 00000000..3e32ea9c --- /dev/null +++ b/docs/README.md @@ -0,0 +1,260 @@ +# Wazuh containers for Docker + +[![Slack](https://img.shields.io/badge/slack-join-blue.svg)](https://wazuh.com/community/join-us-on-slack/) +[![Email](https://img.shields.io/badge/email-join-blue.svg)](https://groups.google.com/forum/#!forum/wazuh) +[![Documentation](https://img.shields.io/badge/docs-view-green.svg)](https://documentation.wazuh.com) +[![Documentation](https://img.shields.io/badge/web-view-green.svg)](https://wazuh.com) + +In this repository you will find the containers to run: + +* Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS +* Wazuh dashboard: provides a web user interface to browse through alert data and allows you to visualize the agents configuration and status. +* Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** + +The folder `build-docker-images` contains a README explaining how to build the Wazuh images and the necessary assets. +The folder `indexer-certs-creator` contains a README explaining how to create the certificates creator tool and the necessary assets. +The folder `single-node` contains a README explaining how to run a Wazuh environment with one Wazuh manager, one Wazuh indexer, and one Wazuh dashboard. +The folder `multi-node` contains a README explaining how to run a Wazuh environment with two Wazuh managers, three Wazuh indexers, and one Wazuh dashboard. + +## Documentation + +* [Wazuh full documentation](http://documentation.wazuh.com) +* [Wazuh documentation for Docker](https://documentation.wazuh.com/current/docker/index.html) +* [Docker Hub](https://hub.docker.com/u/wazuh) + + +### Setup SSL certificate + +Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed). + +Documentation on how to provide these two can be found at [Wazuh Docker Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). + + +## Environment Variables + +Default values are included when available. + +### Wazuh +``` +API_USERNAME="wazuh-wui" # Wazuh API username +API_PASSWORD="MyS3cr37P450r.*-" # Wazuh API password - Must comply with requirements + # (8+ length, uppercase, lowercase, special chars) + +INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL +INDEXER_USERNAME=admin # Wazuh indexer Username +INDEXER_PASSWORD=SecretPassword # Wazuh indexer Password +FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) +SSL_CERTIFICATE_AUTHORITIES="" # Path of Filebeat SSL CA +SSL_CERTIFICATE="" # Path of Filebeat SSL Certificate +SSL_KEY="" # Path of Filebeat SSL Key +``` + +### Dashboard +``` +PATTERN="wazuh-alerts-*" # Default index pattern to use + +CHECKS_PATTERN=true # Defines which checks must be considered by the healthcheck +CHECKS_TEMPLATE=true # step once the Wazuh app starts. Values must be true or false +CHECKS_API=true +CHECKS_SETUP=true + +APP_TIMEOUT=20000 # Defines maximum timeout to be used on the Wazuh app requests + +API_SELECTOR=true Defines if the user is allowed to change the selected API directly from the Wazuh app top menu +IP_SELECTOR=true # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu +IP_IGNORE="[]" # List of index patterns to be ignored + +DASHBOARD_USERNAME=kibanaserver # Custom user saved in the dashboard keystore +DASHBOARD_PASSWORD=kibanaserver # Custom password saved in the dashboard keystore +WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-monitoring indices +WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task +WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas +WAZUH_MONITORING_REPLICAS=0 ## +``` + +## Directory structure + + ├── build-docker-images + │   ├── build-images.sh + │   ├── build-images.yml + │   ├── README.md + │   ├── wazuh-agent + │   │   ├── config + │   │   │   ├── check_repository.sh + │   │   │   └── etc + │   │   │   ├── cont-init.d + │   │   │   │   ├── 0-wazuh-init + │   │   │   │   └── 1-agent + │   │   │   └── services.d + │   │   │   └── ossec-logs + │   │   │   └── run + │   │   └── Dockerfile + │   ├── wazuh-dashboard + │   │   ├── config + │   │   │   ├── check_repository.sh + │   │   │   ├── config.sh + │   │   │   ├── config.yml + │   │   │   ├── entrypoint.sh + │   │   │   ├── wazuh_app_config.sh + │   │   │   └── wazuh.yml + │   │   └── Dockerfile + │   ├── wazuh-indexer + │   │   ├── config + │   │   │   ├── action_groups.yml + │   │   │   ├── check_repository.sh + │   │   │   ├── config.sh + │   │   │   ├── config.yml + │   │   │   ├── entrypoint.sh + │   │   │   ├── internal_users.yml + │   │   │   ├── opensearch.yml + │   │   │   ├── roles_mapping.yml + │   │   │   ├── roles.yml + │   │   │   └── securityadmin.sh + │   │   └── Dockerfile + │   └── wazuh-manager + │   ├── config + │   │   ├── check_repository.sh + │   │   ├── create_user.py + │   │   ├── etc + │   │   │   ├── cont-init.d + │   │   │   │   ├── 0-wazuh-init + │   │   │   │   ├── 1-config-filebeat + │   │   │   │   └── 2-manager + │   │   │   └── services.d + │   │   │   ├── filebeat + │   │   │   │   ├── finish + │   │   │   │   └── run + │   │   │   └── ossec-logs + │   │   │   └── run + │   │   ├── filebeat_module.sh + │   │   ├── filebeat.yml + │   │   ├── permanent_data.env + │   │   └── permanent_data.sh + │   └── Dockerfile + ├── CHANGELOG.md + ├── docs + │   ├── book.toml + │   ├── build.sh + │   ├── dev + │   │   ├── build-image.md + │   │   ├── README.md + │   │   ├── run-tests.md + │   │   └── setup.md + │   ├── README.md + │   ├── ref + │   │   ├── backup-restore.md + │   │   ├── configuration + │   │   │   ├── configuration-files.md + │   │   │   ├── environment-variables.md + │   │   │   └── README.md + │   │   ├── getting-started + │   │   │   ├── installation.md + │   │   │   ├── README.md + │   │   │   └── requirements.md + │   │   ├── glossary.md + │   │   ├── Introduction + │   │   │   ├── compatibility.md + │   │   │   ├── description.md + │   │   │   └── README.md + │   │   ├── performance.md + │   │   ├── README.md + │   │   ├── security.md + │   │   ├── uninstall.md + │   │   └── upgrade.md + │   ├── server.sh + │   └── SUMMARY.md + ├── indexer-certs-creator + │   ├── config + │   │   └── entrypoint.sh + │   ├── Dockerfile + │   └── README.md + ├── LICENSE + ├── multi-node + │   ├── config + │   │   ├── certs.yml + │   │   ├── nginx + │   │   │   └── nginx.conf + │   │   ├── wazuh_cluster + │   │   │   ├── wazuh_manager.conf + │   │   │   └── wazuh_worker.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   └── wazuh_indexer + │   │   ├── internal_users.yml + │   │   ├── wazuh1.indexer.yml + │   │   ├── wazuh2.indexer.yml + │   │   └── wazuh3.indexer.yml + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   ├── Migration-to-Wazuh-4.4.md + │   ├── README.md + │   └── volume-migrator.sh + ├── README.md + ├── SECURITY.md + ├── single-node + │   ├── config + │   │   ├── certs.yml + │   │   ├── wazuh_cluster + │   │   │   └── wazuh_manager.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   ├── wazuh_indexer + │   │   │   ├── internal_users.yml + │   │   │   └── wazuh.indexer.yml + │   │   └── wazuh_indexer_ssl_certs [error opening dir] + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   └── README.md + ├── VERSION.json + └── wazuh-agent + ├── config + │   └── wazuh-agent-conf + └── docker-compose.yml + +## Branches + +* `main` branch contains the latest code, be aware of possible bugs on this branch. + +## Compatibility Matrix + +| Wazuh version | ODFE | XPACK | +|---------------|---------|--------| +| v4.3.0+ | | | +| v4.2.7 | 1.13.2 | 7.11.2 | +| v4.2.6 | 1.13.2 | 7.11.2 | +| v4.2.5 | 1.13.2 | 7.11.2 | +| v4.2.4 | 1.13.2 | 7.11.2 | +| v4.2.3 | 1.13.2 | 7.11.2 | +| v4.2.2 | 1.13.2 | 7.11.2 | +| v4.2.1 | 1.13.2 | 7.11.2 | +| v4.2.0 | 1.13.2 | 7.10.2 | +| v4.1.5 | 1.13.2 | 7.10.2 | +| v4.1.4 | 1.12.0 | 7.10.2 | +| v4.1.3 | 1.12.0 | 7.10.2 | +| v4.1.2 | 1.12.0 | 7.10.2 | +| v4.1.1 | 1.12.0 | 7.10.2 | +| v4.1.0 | 1.12.0 | 7.10.2 | +| v4.0.4 | 1.11.0 | | +| v4.0.3 | 1.11.0 | | +| v4.0.2 | 1.11.0 | | +| v4.0.1 | 1.11.0 | | +| v4.0.0 | 1.10.1 | | + +## Credits and Thank you + +These Docker containers are based on: + +* "deviantony" dockerfiles which can be found at [https://github.com/deviantony/docker-elk](https://github.com/deviantony/docker-elk) +* "xetus-oss" dockerfiles, which can be found at [https://github.com/xetus-oss/docker-ossec-server](https://github.com/xetus-oss/docker-ossec-server) + +We thank them and everyone else who has contributed to this project. + +## License and copyright + +Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) + +## Web references + +[Wazuh website](http://wazuh.com) \ No newline at end of file diff --git a/docs/SUMMARY.md b/docs/SUMMARY.md new file mode 100644 index 00000000..37807166 --- /dev/null +++ b/docs/SUMMARY.md @@ -0,0 +1,29 @@ +# Summary + +- [Introduction](README.md) + +# Development Guide + +- [Introduction](dev/README.md) +- [Setup Environment](dev/setup.md) +- [Build Image](dev/build-image.md) +- [Run Tests](dev/run-tests.md) + +# Reference Manual + +- [Reference](ref/README.md) +- [Introduction](ref/Introduction/README.md) + - [Description](ref/Introduction/description.md) + - [Compatibility](ref/Introduction/compatibility.md) +- [Getting Started](ref/getting-started/README.md) + - [Requirements](ref/getting-started/requirements.md) + - [Installation](ref/getting-started/installation.md) +- [Configuration](ref/configuration/README.md) + - [CEnvironment Variabless](ref/configuration/environment-variables.md) + - [Configuration files](ref/configuration/configuration-files.md) +- [Upgrade](ref/upgrade.md) +- [Uninstall](ref/uninstall.md) +- [Back Up and Restore](ref/backup-restore.md) +- [Security](ref/security.md) +- [Performance](ref/performance.md) +- [Glossary](ref/glossary.md) \ No newline at end of file diff --git a/docs/book.toml b/docs/book.toml new file mode 100644 index 00000000..d9b94462 --- /dev/null +++ b/docs/book.toml @@ -0,0 +1,7 @@ +[book] +title = "Wazuh Docker Documentation" +description = "Technical documentation for Wazuh Docker deployment." +authors = ["Victor Erenu"] +multilingual = false +src = "." +language = "en" \ No newline at end of file diff --git a/docs/build.sh b/docs/build.sh new file mode 100755 index 00000000..e031edfc --- /dev/null +++ b/docs/build.sh @@ -0,0 +1,3 @@ +#! /bin/sh + +mdbook build \ No newline at end of file diff --git a/docs/dev/README.md b/docs/dev/README.md new file mode 100644 index 00000000..14c0f7aa --- /dev/null +++ b/docs/dev/README.md @@ -0,0 +1,2 @@ +# Development documentation + diff --git a/docs/dev/build-image.md b/docs/dev/build-image.md new file mode 100644 index 00000000..d04dc0dc --- /dev/null +++ b/docs/dev/build-image.md @@ -0,0 +1 @@ +# Build Image diff --git a/docs/dev/run-tests.md b/docs/dev/run-tests.md new file mode 100644 index 00000000..7dce2402 --- /dev/null +++ b/docs/dev/run-tests.md @@ -0,0 +1 @@ +# How to run the tests. diff --git a/docs/dev/setup.md b/docs/dev/setup.md new file mode 100644 index 00000000..f5baeef0 --- /dev/null +++ b/docs/dev/setup.md @@ -0,0 +1,3 @@ +# Set up the toolchain. + +# Set up editor/debugger. \ No newline at end of file diff --git a/docs/ref/Introduction/README.md b/docs/ref/Introduction/README.md new file mode 100644 index 00000000..dc648ce6 --- /dev/null +++ b/docs/ref/Introduction/README.md @@ -0,0 +1 @@ +# Introduction. \ No newline at end of file diff --git a/docs/ref/Introduction/compatibility.md b/docs/ref/Introduction/compatibility.md new file mode 100644 index 00000000..4399fdf7 --- /dev/null +++ b/docs/ref/Introduction/compatibility.md @@ -0,0 +1 @@ +# Compatibility. \ No newline at end of file diff --git a/docs/ref/Introduction/description.md b/docs/ref/Introduction/description.md new file mode 100644 index 00000000..7234fb04 --- /dev/null +++ b/docs/ref/Introduction/description.md @@ -0,0 +1 @@ +# Description. \ No newline at end of file diff --git a/docs/ref/README.md b/docs/ref/README.md new file mode 100644 index 00000000..8847bd5a --- /dev/null +++ b/docs/ref/README.md @@ -0,0 +1,7 @@ +# Introduction + +## Description + +## Architecture + +## Compatibility \ No newline at end of file diff --git a/docs/ref/backup-restore.md b/docs/ref/backup-restore.md new file mode 100644 index 00000000..d2f033ad --- /dev/null +++ b/docs/ref/backup-restore.md @@ -0,0 +1 @@ +# Back Up and Restore diff --git a/docs/ref/configuration/README.md b/docs/ref/configuration/README.md new file mode 100644 index 00000000..af4abbfe --- /dev/null +++ b/docs/ref/configuration/README.md @@ -0,0 +1 @@ +# Configuration \ No newline at end of file diff --git a/docs/ref/configuration/configuration-files.md b/docs/ref/configuration/configuration-files.md new file mode 100644 index 00000000..af8ac432 --- /dev/null +++ b/docs/ref/configuration/configuration-files.md @@ -0,0 +1 @@ +# Configuration files \ No newline at end of file diff --git a/docs/ref/configuration/environment-variables.md b/docs/ref/configuration/environment-variables.md new file mode 100644 index 00000000..be8e682f --- /dev/null +++ b/docs/ref/configuration/environment-variables.md @@ -0,0 +1 @@ +# Environment Variables \ No newline at end of file diff --git a/docs/ref/getting-started/README.md b/docs/ref/getting-started/README.md new file mode 100644 index 00000000..bad55622 --- /dev/null +++ b/docs/ref/getting-started/README.md @@ -0,0 +1 @@ +# Getting Started diff --git a/docs/ref/getting-started/installation.md b/docs/ref/getting-started/installation.md new file mode 100644 index 00000000..25267fe2 --- /dev/null +++ b/docs/ref/getting-started/installation.md @@ -0,0 +1 @@ +# Installation diff --git a/docs/ref/getting-started/requirements.md b/docs/ref/getting-started/requirements.md new file mode 100644 index 00000000..1fa9034a --- /dev/null +++ b/docs/ref/getting-started/requirements.md @@ -0,0 +1 @@ +# Requirements diff --git a/docs/ref/glossary.md b/docs/ref/glossary.md new file mode 100644 index 00000000..ca3c8276 --- /dev/null +++ b/docs/ref/glossary.md @@ -0,0 +1 @@ +# Glossary diff --git a/docs/ref/performance.md b/docs/ref/performance.md new file mode 100644 index 00000000..6babb314 --- /dev/null +++ b/docs/ref/performance.md @@ -0,0 +1 @@ +# Performance diff --git a/docs/ref/security.md b/docs/ref/security.md new file mode 100644 index 00000000..8dbb2f9b --- /dev/null +++ b/docs/ref/security.md @@ -0,0 +1 @@ +# Security diff --git a/docs/ref/uninstall.md b/docs/ref/uninstall.md new file mode 100644 index 00000000..316df265 --- /dev/null +++ b/docs/ref/uninstall.md @@ -0,0 +1 @@ +# Uninstall diff --git a/docs/ref/upgrade.md b/docs/ref/upgrade.md new file mode 100644 index 00000000..dab017fb --- /dev/null +++ b/docs/ref/upgrade.md @@ -0,0 +1 @@ +# Upgrade diff --git a/docs/server.sh b/docs/server.sh new file mode 100755 index 00000000..8de52373 --- /dev/null +++ b/docs/server.sh @@ -0,0 +1,3 @@ +#! /bin/sh + +mdbook serve \ No newline at end of file