From 6e7e8525bb5a1cad57d6766201b27e95e6feff75 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Mon, 4 Mar 2024 07:51:00 -0300
Subject: [PATCH 01/14] modify uid and giufor indexer and dashboard user and
 file permissions

---
 build-docker-images/wazuh-dashboard/Dockerfile | 18 +++++++++---------
 build-docker-images/wazuh-indexer/Dockerfile   | 18 +++++++++---------
 .../wazuh-indexer/config/entrypoint.sh         |  4 ++--
 indexer-certs-creator/config/entrypoint.sh     | 12 +-----------
 multi-node/docker-compose.yml                  |  4 ++--
 single-node/docker-compose.yml                 |  2 +-
 6 files changed, 24 insertions(+), 34 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 71b2d0e5..7568e5ec 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -28,12 +28,12 @@ RUN bash /install_wazuh_app.sh
 # Copy and set permissions to config files
 COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/
 COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/
-RUN chown 101:101 $INSTALL_DIR/config/opensearch_dashboards.yml && chmod 664 $INSTALL_DIR/config/opensearch_dashboards.yml
+RUN chmod 664 $INSTALL_DIR/config/opensearch_dashboards.yml
 
 # Create and set permissions to data directories
-RUN mkdir -p $INSTALL_DIR/data/wazuh && chown -R 101:101 $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
-RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chown -R 101:101 $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
-RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
+RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
+RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
+RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
 
 ################################################################################
 # Build stage 1 (the current Wazuh dashboard image):
@@ -84,9 +84,9 @@ ENV PATTERN="" \
 RUN yum install shadow-utils -y
 
 # Create wazuh-dashboard user and group
-RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
+RUN getent group $GROUP || groupadd -r -g 999 $GROUP
 RUN useradd --system \
-            --uid 1000 \
+            --uid 999 \
             --no-create-home \
             --home-dir $INSTALL_DIR \
             --gid $GROUP \
@@ -99,14 +99,14 @@ COPY config/entrypoint.sh /
 COPY config/wazuh_app_config.sh /
 RUN chmod 700 /entrypoint.sh
 RUN chmod 700 /wazuh_app_config.sh
-RUN chown 1000:1000 /*.sh
+RUN chown 999:999 /*.sh
 
 # Copy Install dir from builder to current image
-COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
+COPY --from=builder --chown=999:999 $INSTALL_DIR $INSTALL_DIR
 
 # Create custom directory
 RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
-RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
+RUN chown 999:999 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
 
 # Set workdir and user
 WORKDIR $INSTALL_DIR
diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile
index bdce9fff..bb7d6dae 100644
--- a/build-docker-images/wazuh-indexer/Dockerfile
+++ b/build-docker-images/wazuh-indexer/Dockerfile
@@ -38,10 +38,10 @@ ENV USER="wazuh-indexer" \
 
 RUN yum install curl-minimal shadow-utils findutils hostname -y
 
-RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
+RUN getent group $GROUP || groupadd -r -g 999 $GROUP
 
 RUN useradd --system \
-            --uid 1000 \
+            --uid 999 \
             --no-create-home \
             --home-dir $INSTALL_DIR \
             --gid $GROUP \
@@ -57,19 +57,19 @@ COPY config/securityadmin.sh /
 
 RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh
 
-RUN chown 1000:1000 /*.sh
+RUN chown 999:999 /*.sh
 
-COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
+COPY --from=builder --chown=999:999 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
 
-RUN chown -R 1000:1000 /usr/share/wazuh-indexer
+RUN chown -R 999:999 /usr/share/wazuh-indexer
 
-RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
-    mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
-    mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
-    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
+RUN mkdir -p /var/lib/wazuh-indexer && chown 999:999 /var/lib/wazuh-indexer && \
+    mkdir -p /usr/share/wazuh-indexer/logs && chown 999:999 /usr/share/wazuh-indexer/logs && \
+    mkdir -p /run/wazuh-indexer && chown 999:999 /run/wazuh-indexer && \
+    mkdir -p /var/log/wazuh-indexer && chown 999:999 /var/log/wazuh-indexer && \
     chmod 700 /usr/share/wazuh-indexer && \
     chmod 600 /usr/share/wazuh-indexer/jvm.options && \
     chmod 600 /usr/share/wazuh-indexer/opensearch.yml
diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh
index 2acb4aa0..ba244d4d 100644
--- a/build-docker-images/wazuh-indexer/config/entrypoint.sh
+++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh
@@ -34,7 +34,7 @@ if [[ "$1" != "opensearchwrapper" ]]; then
     # `bin/opensearch -E x.y=z` would not work.
     set -- "opensearch" "${@:2}"
     # Use chroot to switch to UID 1000 / GID 0
-    exec chroot --userspec=1000:0 / "$@"
+    exec chroot --userspec=999:0 / "$@"
   else
     # User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
     exec "$@"
@@ -79,7 +79,7 @@ fi
 if [[ "$(id -u)" == "0" ]]; then
   # If requested and running as root, mutate the ownership of bind-mounts
   if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
-    chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs}
+    chown -R 999:0 /usr/share/wazuh-indexer/{data,logs}
   fi
 fi
 
diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh
index d3e0534e..948fefa1 100644
--- a/indexer-certs-creator/config/entrypoint.sh
+++ b/indexer-certs-creator/config/entrypoint.sh
@@ -47,15 +47,5 @@ echo "Changing certificate permissions"
 chmod -R 500 /certificates
 chmod -R 400 /certificates/*
 echo "Setting UID indexer and dashboard"
-chown 1000:1000 /certificates/*
-echo "Setting UID for wazuh manager and worker"
-cp /certificates/root-ca.pem /certificates/root-ca-manager.pem
-cp /certificates/root-ca.key /certificates/root-ca-manager.key
-chown 101:101 /certificates/root-ca-manager.pem
-chown 101:101 /certificates/root-ca-manager.key
+chown 999:999 /certificates/*
 
-for i in ${node_names[@]};
-do
-  chown 101:101 "/certificates/${i}.pem"
-  chown 101:101 "/certificates/${i}-key.pem"
-done
diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index a72fd4f5..ac81cb63 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -39,7 +39,7 @@ services:
       - master-wazuh-wodles:/var/ossec/wodles
       - master-filebeat-etc:/etc/filebeat
       - master-filebeat-var:/var/lib/filebeat
-      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
+      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
@@ -75,7 +75,7 @@ services:
       - worker-wazuh-wodles:/var/ossec/wodles
       - worker-filebeat-etc:/etc/filebeat
       - worker-filebeat-var:/var/lib/filebeat
-      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
+      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key
       - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 55e2261e..9e4d56fd 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -40,7 +40,7 @@ services:
       - wazuh_wodles:/var/ossec/wodles
       - filebeat_etc:/etc/filebeat
       - filebeat_var:/var/lib/filebeat
-      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
+      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

From a826212051957f5ce70f1083b9663b86202781e1 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Mon, 4 Mar 2024 12:14:20 -0300
Subject: [PATCH 02/14] add upgrade functions into entrypoints

---
 build-docker-images/wazuh-dashboard/config/entrypoint.sh | 7 +++++++
 build-docker-images/wazuh-indexer/config/entrypoint.sh   | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
index 290f9fa8..2ec1285d 100644
--- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh
+++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
@@ -5,6 +5,11 @@ INSTALL_DIR=/usr/share/wazuh-dashboard
 DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}"
 DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
 
+set_correct_permOwner() {
+  find / -group 1000 -exec chown :999 {} +;
+  find / -user 1000 -exec chown 999 {} +;
+}
+
 # Create and configure Wazuh dashboard keystore
 
 yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
@@ -15,6 +20,8 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o
 # Start Wazuh dashboard
 ##############################################################################
 
+set_correct_permOwner
+
 /wazuh_app_config.sh $WAZUH_UI_REVISION
 
 /usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
\ No newline at end of file
diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh
index ba244d4d..48a9bef3 100644
--- a/build-docker-images/wazuh-indexer/config/entrypoint.sh
+++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh
@@ -24,6 +24,11 @@ run_as_other_user_if_needed() {
   fi
 }
 
+set_correct_permOwner() {
+  find / -group 1000 -exec chown :999 {} +;
+  find / -user 1000 -exec chown 999 {} +;
+}
+
 # Allow user specify custom CMD, maybe bin/opensearch itself
 # for example to directly specify `-E` style parameters for opensearch on k8s
 # or simply to run /bin/bash to check the image
@@ -90,4 +95,6 @@ fi
 #  touch "/var/lib/wazuh-indexer/.flag"
 #fi
 
+set_correct_permOwner
+
 run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
\ No newline at end of file

From a7330464715c5d82bcfbe22d685bd766e9114ac2 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Tue, 5 Mar 2024 10:08:25 -0300
Subject: [PATCH 03/14] change cert creator version

---
 multi-node/generate-indexer-certs.yml  | 2 +-
 single-node/generate-indexer-certs.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/multi-node/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml
index a3398661..dbf2b079 100644
--- a/multi-node/generate-indexer-certs.yml
+++ b/multi-node/generate-indexer-certs.yml
@@ -3,7 +3,7 @@ version: '3'
 
 services:
   generator:
-    image: wazuh/wazuh-certs-generator:0.0.1
+    image: wazuh/wazuh-certs-generator:0.0.2
     hostname: wazuh-certs-generator
     volumes:
       - ./config/wazuh_indexer_ssl_certs/:/certificates/
diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml
index d10151fd..3e0eb6fd 100644
--- a/single-node/generate-indexer-certs.yml
+++ b/single-node/generate-indexer-certs.yml
@@ -3,7 +3,7 @@ version: '3'
 
 services:
   generator:
-    image: wazuh/wazuh-certs-generator:0.0.1
+    image: wazuh/wazuh-certs-generator:0.0.2
     hostname: wazuh-certs-generator
     volumes:
       - ./config/wazuh_indexer_ssl_certs/:/certificates/

From b4af946000d772461c9660eb208342c0c34dae2e Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Tue, 5 Mar 2024 11:41:43 -0300
Subject: [PATCH 04/14] delete chmod for upgrade

---
 build-docker-images/build-images.sh                        | 2 +-
 build-docker-images/wazuh-dashboard/config/entrypoint.sh   | 7 -------
 build-docker-images/wazuh-indexer/config/entrypoint.sh     | 7 -------
 .../wazuh-manager/config/check_repository.sh               | 2 +-
 4 files changed, 2 insertions(+), 16 deletions(-)

diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh
index a0383362..d43a8244 100755
--- a/build-docker-images/build-images.sh
+++ b/build-docker-images/build-images.sh
@@ -1,7 +1,7 @@
 WAZUH_IMAGE_VERSION=4.8.0
 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
 WAZUH_TAG_REVISION=1
-WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
+WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
 IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
 
 # Wazuh package generator
diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
index 2ec1285d..290f9fa8 100644
--- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh
+++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
@@ -5,11 +5,6 @@ INSTALL_DIR=/usr/share/wazuh-dashboard
 DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}"
 DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
 
-set_correct_permOwner() {
-  find / -group 1000 -exec chown :999 {} +;
-  find / -user 1000 -exec chown 999 {} +;
-}
-
 # Create and configure Wazuh dashboard keystore
 
 yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
@@ -20,8 +15,6 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o
 # Start Wazuh dashboard
 ##############################################################################
 
-set_correct_permOwner
-
 /wazuh_app_config.sh $WAZUH_UI_REVISION
 
 /usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
\ No newline at end of file
diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh
index 48a9bef3..ba244d4d 100644
--- a/build-docker-images/wazuh-indexer/config/entrypoint.sh
+++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh
@@ -24,11 +24,6 @@ run_as_other_user_if_needed() {
   fi
 }
 
-set_correct_permOwner() {
-  find / -group 1000 -exec chown :999 {} +;
-  find / -user 1000 -exec chown 999 {} +;
-}
-
 # Allow user specify custom CMD, maybe bin/opensearch itself
 # for example to directly specify `-E` style parameters for opensearch on k8s
 # or simply to run /bin/bash to check the image
@@ -95,6 +90,4 @@ fi
 #  touch "/var/lib/wazuh-indexer/.flag"
 #fi
 
-set_correct_permOwner
-
 run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
\ No newline at end of file
diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh
index 6c3748c5..5323ec81 100644
--- a/build-docker-images/wazuh-manager/config/check_repository.sh
+++ b/build-docker-images/wazuh-manager/config/check_repository.sh
@@ -2,7 +2,7 @@
 APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
 GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
-WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
+WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
 MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
 MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
 MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)

From 73650d79b3e17fbec0dba3ffb960c6f58296bd02 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Wed, 6 Mar 2024 06:24:26 -0300
Subject: [PATCH 05/14] add exceptions

---
 build-docker-images/wazuh-manager/config/permanent_data.env | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env
index 1ca3a42e..5439b89b 100644
--- a/build-docker-images/wazuh-manager/config/permanent_data.env
+++ b/build-docker-images/wazuh-manager/config/permanent_data.env
@@ -79,12 +79,14 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_message_proc
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_queue.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/orm.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py"
 export PERMANENT_DATA_EXCP
 
 # Files mounted in a volume that should be deleted

From 387727d496ae4df003377a5ef173233fa70a42e6 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Mon, 11 Mar 2024 10:05:53 -0300
Subject: [PATCH 06/14] rollback uid and gid for Wazuh indexer and dashboard
 owner

---
 build-docker-images/wazuh-dashboard/Dockerfile | 10 +++++-----
 build-docker-images/wazuh-indexer/Dockerfile   | 18 +++++++++---------
 .../wazuh-indexer/config/entrypoint.sh         |  4 ++--
 indexer-certs-creator/config/entrypoint.sh     | 13 ++++++++++++-
 4 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 7568e5ec..14267326 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -84,9 +84,9 @@ ENV PATTERN="" \
 RUN yum install shadow-utils -y
 
 # Create wazuh-dashboard user and group
-RUN getent group $GROUP || groupadd -r -g 999 $GROUP
+RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
 RUN useradd --system \
-            --uid 999 \
+            --uid 1000 \
             --no-create-home \
             --home-dir $INSTALL_DIR \
             --gid $GROUP \
@@ -99,14 +99,14 @@ COPY config/entrypoint.sh /
 COPY config/wazuh_app_config.sh /
 RUN chmod 700 /entrypoint.sh
 RUN chmod 700 /wazuh_app_config.sh
-RUN chown 999:999 /*.sh
+RUN chown 1000:1000 /*.sh
 
 # Copy Install dir from builder to current image
-COPY --from=builder --chown=999:999 $INSTALL_DIR $INSTALL_DIR
+COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
 
 # Create custom directory
 RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
-RUN chown 999:999 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
+RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
 
 # Set workdir and user
 WORKDIR $INSTALL_DIR
diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile
index bb7d6dae..bdce9fff 100644
--- a/build-docker-images/wazuh-indexer/Dockerfile
+++ b/build-docker-images/wazuh-indexer/Dockerfile
@@ -38,10 +38,10 @@ ENV USER="wazuh-indexer" \
 
 RUN yum install curl-minimal shadow-utils findutils hostname -y
 
-RUN getent group $GROUP || groupadd -r -g 999 $GROUP
+RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
 
 RUN useradd --system \
-            --uid 999 \
+            --uid 1000 \
             --no-create-home \
             --home-dir $INSTALL_DIR \
             --gid $GROUP \
@@ -57,19 +57,19 @@ COPY config/securityadmin.sh /
 
 RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh
 
-RUN chown 999:999 /*.sh
+RUN chown 1000:1000 /*.sh
 
-COPY --from=builder --chown=999:999 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
+COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
 
-RUN chown -R 999:999 /usr/share/wazuh-indexer
+RUN chown -R 1000:1000 /usr/share/wazuh-indexer
 
-RUN mkdir -p /var/lib/wazuh-indexer && chown 999:999 /var/lib/wazuh-indexer && \
-    mkdir -p /usr/share/wazuh-indexer/logs && chown 999:999 /usr/share/wazuh-indexer/logs && \
-    mkdir -p /run/wazuh-indexer && chown 999:999 /run/wazuh-indexer && \
-    mkdir -p /var/log/wazuh-indexer && chown 999:999 /var/log/wazuh-indexer && \
+RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
+    mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
+    mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
+    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
     chmod 700 /usr/share/wazuh-indexer && \
     chmod 600 /usr/share/wazuh-indexer/jvm.options && \
     chmod 600 /usr/share/wazuh-indexer/opensearch.yml
diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh
index ba244d4d..2acb4aa0 100644
--- a/build-docker-images/wazuh-indexer/config/entrypoint.sh
+++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh
@@ -34,7 +34,7 @@ if [[ "$1" != "opensearchwrapper" ]]; then
     # `bin/opensearch -E x.y=z` would not work.
     set -- "opensearch" "${@:2}"
     # Use chroot to switch to UID 1000 / GID 0
-    exec chroot --userspec=999:0 / "$@"
+    exec chroot --userspec=1000:0 / "$@"
   else
     # User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
     exec "$@"
@@ -79,7 +79,7 @@ fi
 if [[ "$(id -u)" == "0" ]]; then
   # If requested and running as root, mutate the ownership of bind-mounts
   if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
-    chown -R 999:0 /usr/share/wazuh-indexer/{data,logs}
+    chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs}
   fi
 fi
 
diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh
index 948fefa1..c2dd3e1d 100644
--- a/indexer-certs-creator/config/entrypoint.sh
+++ b/indexer-certs-creator/config/entrypoint.sh
@@ -47,5 +47,16 @@ echo "Changing certificate permissions"
 chmod -R 500 /certificates
 chmod -R 400 /certificates/*
 echo "Setting UID indexer and dashboard"
-chown 999:999 /certificates/*
+chown 1000:1000 /certificates/*
+echo "Setting UID for wazuh manager and worker"
+cp /certificates/root-ca.pem /certificates/root-ca-manager.pem
+cp /certificates/root-ca.key /certificates/root-ca-manager.key
+chown 999:999 /certificates/root-ca-manager.pem
+chown 999:999 /certificates/root-ca-manager.key
+
+for i in ${node_names[@]};
+do
+  chown 999:999 "/certificates/${i}.pem"
+  chown 999:999 "/certificates/${i}-key.pem"
+done
 

From 031db43568e95e4579e71eb4397e66b3b4fa3d28 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Mon, 11 Mar 2024 10:17:49 -0300
Subject: [PATCH 07/14] rollback root-ca filename

---
 multi-node/docker-compose.yml  | 4 ++--
 single-node/docker-compose.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index ac81cb63..a72fd4f5 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -39,7 +39,7 @@ services:
       - master-wazuh-wodles:/var/ossec/wodles
       - master-filebeat-etc:/etc/filebeat
       - master-filebeat-var:/var/lib/filebeat
-      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
+      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
@@ -75,7 +75,7 @@ services:
       - worker-wazuh-wodles:/var/ossec/wodles
       - worker-filebeat-etc:/etc/filebeat
       - worker-filebeat-var:/var/lib/filebeat
-      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
+      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key
       - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 9e4d56fd..55e2261e 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -40,7 +40,7 @@ services:
       - wazuh_wodles:/var/ossec/wodles
       - filebeat_etc:/etc/filebeat
       - filebeat_var:/var/lib/filebeat
-      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
+      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
       - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

From 89f3b0d600d8890a9917b5d1053a1ebdd4a4e555 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= <david.correa@wazuh.com>
Date: Tue, 12 Mar 2024 11:01:41 +0100
Subject: [PATCH 08/14] Bumped version to 40806

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index f68b7535..fd46cee1 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
 WAZUH-DOCKER_VERSION="4.8.0"
-REVISION="40805"
+REVISION="40806"

From 02ee94f312ecc7d79d643397545b06b3f8086d57 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Wed, 13 Mar 2024 11:58:52 -0300
Subject: [PATCH 09/14] update al2024 version

---
 build-docker-images/wazuh-dashboard/Dockerfile | 4 ++--
 build-docker-images/wazuh-indexer/Dockerfile   | 4 ++--
 build-docker-images/wazuh-manager/Dockerfile   | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 14267326..e2e0bfd7 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -1,5 +1,5 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-FROM amazonlinux:2023.3.20240219.0 AS builder
+FROM amazonlinux:2023.3.20240304.0 AS builder
 
 ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
@@ -42,7 +42,7 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazu
 # Add entrypoint
 # Add wazuh_app_config
 ################################################################################
-FROM amazonlinux:2023.3.20240219.0
+FROM amazonlinux:2023.3.20240304.0
 
 # Set environment variables
 ENV USER="wazuh-dashboard" \
diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile
index bdce9fff..bd579225 100644
--- a/build-docker-images/wazuh-indexer/Dockerfile
+++ b/build-docker-images/wazuh-indexer/Dockerfile
@@ -1,5 +1,5 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-FROM amazonlinux:2023.3.20240219.0 AS builder
+FROM amazonlinux:2023.3.20240304.0 AS builder
 
 ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
@@ -29,7 +29,7 @@ RUN bash config.sh
 # Add entrypoint
 
 ################################################################################
-FROM amazonlinux:2023.3.20240219.0
+FROM amazonlinux:2023.3.20240304.0
 
 ENV USER="wazuh-indexer" \
     GROUP="wazuh-indexer" \
diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile
index 42dea261..70ccd447 100644
--- a/build-docker-images/wazuh-manager/Dockerfile
+++ b/build-docker-images/wazuh-manager/Dockerfile
@@ -1,5 +1,5 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-FROM amazonlinux:2023.3.20240219.0
+FROM amazonlinux:2023.3.20240304.0
 
 RUN rm /bin/sh && ln -s /bin/bash /bin/sh
 

From a8754c54bcda3d57186fdbcd2c03f872be7a925c Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 15 Mar 2024 11:29:46 -0300
Subject: [PATCH 10/14] update query about Wazuh manager cont names

---
 indexer-certs-creator/config/entrypoint.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh
index c2dd3e1d..5d5e5d6c 100644
--- a/indexer-certs-creator/config/entrypoint.sh
+++ b/indexer-certs-creator/config/entrypoint.sh
@@ -38,7 +38,7 @@ chmod 700 /$CERT_TOOL
 
 ## Execute cert tool and parsin cert.yml to set UID permissions
 source /$CERT_TOOL -A
-nodes_server=$( cert_parseYaml /config.yml | grep nodes_server__name | sed 's/nodes_server__name=//' )
+nodes_server=$( cert_parseYaml /config.yml | grep -E "nodes[_]+server[_]+[0-9]+=" | sed -e 's/nodes__server__[0-9]=//' | sed 's/"//g' )
 node_names=($nodes_server)
 
 echo "Moving created certificates to the destination directory"

From 219843dbb859b3919c76737aaa67560130684138 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= <david.correa@wazuh.com>
Date: Tue, 19 Mar 2024 11:32:06 +0100
Subject: [PATCH 11/14] Fixed references to 4.8 version

---
 build-docker-images/wazuh-dashboard/config/config.sh | 4 ++--
 build-docker-images/wazuh-indexer/config/config.sh   | 4 ++--
 indexer-certs-creator/config/entrypoint.sh           | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh
index 79306721..3f5dd902 100644
--- a/build-docker-images/wazuh-dashboard/config/config.sh
+++ b/build-docker-images/wazuh-dashboard/config/config.sh
@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
 
 ## Variables
 CERT_TOOL=wazuh-certs-tool.sh
-PACKAGES_URL=https://packages.wazuh.com/4.8/
-PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/
+PACKAGES_URL=https://packages.wazuh.com/4.9/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.9/
 
 ## Check if the cert tool exists in S3 buckets
 CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh
index 2768f157..67e66fd7 100644
--- a/build-docker-images/wazuh-indexer/config/config.sh
+++ b/build-docker-images/wazuh-indexer/config/config.sh
@@ -53,8 +53,8 @@ tar -xf ${INDEXER_FILE}
 ## Variables
 CERT_TOOL=wazuh-certs-tool.sh
 PASSWORD_TOOL=wazuh-passwords-tool.sh
-PACKAGES_URL=https://packages.wazuh.com/4.8/
-PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/
+PACKAGES_URL=https://packages.wazuh.com/4.9/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.9/
 
 ## Check if the cert tool exists in S3 buckets
 CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh
index d3e0534e..01dd3428 100644
--- a/indexer-certs-creator/config/entrypoint.sh
+++ b/indexer-certs-creator/config/entrypoint.sh
@@ -8,8 +8,8 @@
 ## Variables
 CERT_TOOL=wazuh-certs-tool.sh
 PASSWORD_TOOL=wazuh-passwords-tool.sh
-PACKAGES_URL=https://packages.wazuh.com/4.8/
-PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/
+PACKAGES_URL=https://packages.wazuh.com/4.9/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.9/
 
 ## Check if the cert tool exists in S3 buckets
 CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')

From 866ee4887125a35c417fbfc4dc56bfb96cf0df70 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Thu, 21 Mar 2024 07:00:57 -0300
Subject: [PATCH 12/14] delete syslog and dpkg log configuration

---
 multi-node/config/wazuh_cluster/wazuh_manager.conf | 5 -----
 multi-node/config/wazuh_cluster/wazuh_worker.conf  | 5 -----
 2 files changed, 10 deletions(-)

diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf
index 92e5662f..61d4721f 100644
--- a/multi-node/config/wazuh_cluster/wazuh_manager.conf
+++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf
@@ -307,9 +307,4 @@
     <location>/var/ossec/logs/active-responses.log</location>
   </localfile>
 
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/log/dpkg.log</location>
-  </localfile>
-
 </ossec_config>
diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf
index b49aa071..d1caecc9 100644
--- a/multi-node/config/wazuh_cluster/wazuh_worker.conf
+++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf
@@ -307,9 +307,4 @@
     <location>/var/ossec/logs/active-responses.log</location>
   </localfile>
 
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/log/dpkg.log</location>
-  </localfile>
-
 </ossec_config>

From e03cfde3bc0268e635344899c3930679f767e785 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 22 Mar 2024 08:47:32 -0300
Subject: [PATCH 13/14] delete create_user.py script

---
 .../wazuh-manager/config/etc/cont-init.d/2-manager               | 1 +
 1 file changed, 1 insertion(+)

diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager
index 0bd90fd6..9e9aa995 100644
--- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager
+++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager
@@ -93,6 +93,7 @@ EOF
     if /var/ossec/framework/python/bin/python3  /var/ossec/framework/scripts/create_user.py; then
       # remove json if exit code is 0
       rm /var/ossec/api/configuration/admin.json
+      rm /var/ossec/framework/scripts/create_user.py
     else
       echored "There was an error configuring the API user"
       # terminate container to avoid unpredictable behavior

From cbdc152dda8d196770df1049ea61aaed4b1dd194 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Wed, 27 Mar 2024 14:25:31 -0300
Subject: [PATCH 14/14] clean disk and change way to wait Cluster start

---
 .github/workflows/push.yml | 50 +++++++++++++++++++++++++-------------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index f292275c..0444cba7 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -128,7 +128,7 @@ jobs:
       run: |
        sleep 120
        docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
-       if [[ $docs -gt 100 ]]; then
+       if [[ $docs -gt 0 ]]; then
         echo "wazuh-alerts index documents: ${docs}"
        else
         echo "wazuh-alerts index documents: ${docs}"
@@ -139,7 +139,7 @@ jobs:
       run: |
        qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
        templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
-       if [[ $qty_templates -eq 3 ]]; then
+       if [[ $qty_templates -gt 3 ]]; then
         echo "wazuh templates:"
         echo "${templates}"
        else
@@ -162,10 +162,6 @@ jobs:
       env:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
-    - name: Check errors in ossec.log
-      run: ./.github/single-node-log-check.sh
-
-
     - name: Check filebeat output
       run: ./.github/single-node-filebeat-check.sh
 
@@ -179,8 +175,8 @@ jobs:
         exit 1
        fi
 
-    - name: Stop single node stack
-      run: docker-compose -f single-node/docker-compose.yml down
+    - name: Check errors in ossec.log
+      run: ./.github/single-node-log-check.sh
 
   check-multi-node:
     runs-on: ubuntu-latest
@@ -193,6 +189,14 @@ jobs:
     - name: Create enviroment variables
       run: cat .env > $GITHUB_ENV
 
+    - name: free disk space
+      run: |
+        sudo swapoff -a
+        sudo rm -f /swapfile
+        sudo apt clean
+        docker rmi $(docker image ls -aq)
+        df -h
+
     - name: Retrieve saved Wazuh dashboard Docker image
       uses: actions/download-artifact@v3
       with:
@@ -213,6 +217,7 @@ jobs:
         docker load --input ./wazuh-manager.tar
         docker load --input ./wazuh-indexer.tar
         docker load --input ./wazuh-dashboard.tar
+        rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar
 
     - name: Create multi node certficates
       run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator
@@ -222,7 +227,13 @@ jobs:
 
     - name: Check Wazuh indexer start
       run: |
-       sleep 120
+       until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`  -eq 1 ]]
+       do
+         echo 'Waiting for Wazuh indexer start'
+         free -m
+         df -h
+         sleep 10
+       done
        status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
        if [[ $status_green -eq 1 ]]; then
         curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
@@ -251,9 +262,15 @@ jobs:
 
     - name: Check documents into wazuh-alerts index
       run: |
-       sleep 120
+       until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``)  -gt 0 ]]
+       do
+         echo 'Waiting for Wazuh indexer events'
+         free -m
+         df -h
+         sleep 10
+       done
        docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
-       if [[ $docs -gt 100 ]]; then
+       if [[ $docs -gt 1 ]]; then
         echo "wazuh-alerts index documents: ${docs}"
        else
         echo "wazuh-alerts index documents: ${docs}"
@@ -264,7 +281,7 @@ jobs:
       run: |
        qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
        templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`"
-       if [[ $qty_templates -eq 3 ]]; then
+       if [[ $qty_templates -gt 3 ]]; then
         echo "wazuh templates:"
         echo "${templates}"
        else
@@ -294,10 +311,6 @@ jobs:
       env:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
-    - name: Check errors in ossec.log
-      run: ./.github/multi-node-log-check.sh
-
-
     - name: Check filebeat output
       run: ./.github/multi-node-filebeat-check.sh
 
@@ -309,4 +322,7 @@ jobs:
        else
         echo "Wazuh dashboard status: ${status}"
         exit 1
-       fi
\ No newline at end of file
+       fi
+
+    - name: Check errors in ossec.log
+      run: ./.github/multi-node-log-check.sh
\ No newline at end of file