forked from wazuh/wazuh-docker
Merge 4.14.3 into main
This commit is contained in:
Carlos Bordon
+2
-20
@@ -7,7 +7,7 @@
|
||||
|
||||
In this repository you will find the containers to run:
|
||||
|
||||
* Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS
|
||||
* Wazuh manager: it runs the Wazuh manager, and Wazuh API
|
||||
* Wazuh dashboard: provides a web user interface to browse through alert data and allows you to visualize the agents configuration and status.
|
||||
* Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
|
||||
* Wazuh agent: This container contains the Wazuh agent services. Current functionality is limited.
|
||||
@@ -43,43 +43,25 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
|
||||
│ │ └── Dockerfile
|
||||
│ ├── wazuh-dashboard
|
||||
│ │ ├── config
|
||||
│ │ │ ├── check_repository.sh
|
||||
│ │ │ ├── config.sh
|
||||
│ │ │ ├── config.yml
|
||||
│ │ │ ├── entrypoint.sh
|
||||
│ │ │ ├── wazuh_app_config.sh
|
||||
│ │ │ └── wazuh.yml
|
||||
│ │ │ ├── wazuh_dashboard_config.sh
|
||||
│ │ └── Dockerfile
|
||||
│ ├── wazuh-indexer
|
||||
│ │ ├── config
|
||||
│ │ │ ├── action_groups.yml
|
||||
│ │ │ ├── check_repository.sh
|
||||
│ │ │ ├── config.sh
|
||||
│ │ │ ├── config.yml
|
||||
│ │ │ ├── entrypoint.sh
|
||||
│ │ │ ├── internal_users.yml
|
||||
│ │ │ ├── opensearch.yml
|
||||
│ │ │ ├── roles_mapping.yml
|
||||
│ │ │ ├── roles.yml
|
||||
│ │ │ └── securityadmin.sh
|
||||
│ │ └── Dockerfile
|
||||
│ └── wazuh-manager
|
||||
│ ├── config
|
||||
│ │ ├── check_repository.sh
|
||||
│ │ ├── create_user.py
|
||||
│ │ ├── etc
|
||||
│ │ │ ├── cont-init.d
|
||||
│ │ │ │ ├── 0-wazuh-init
|
||||
│ │ │ │ ├── 1-config-filebeat
|
||||
│ │ │ │ └── 2-manager
|
||||
│ │ │ └── services.d
|
||||
│ │ │ ├── filebeat
|
||||
│ │ │ │ ├── finish
|
||||
│ │ │ │ └── run
|
||||
│ │ │ └── ossec-logs
|
||||
│ │ │ └── run
|
||||
│ │ ├── filebeat_module.sh
|
||||
│ │ ├── filebeat.yml
|
||||
│ │ ├── permanent_data.env
|
||||
│ │ └── permanent_data.sh
|
||||
│ └── Dockerfile
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
- [Setup Environment](dev/setup.md)
|
||||
- [Build Image](dev/build-image.md)
|
||||
- [Run Tests](dev/run-tests.md)
|
||||
- [Workflow Usage](dev/workflow-usage.md)
|
||||
|
||||
# Reference Manual
|
||||
|
||||
|
||||
+24
-16
@@ -1,32 +1,40 @@
|
||||
# Wazuh Docker Image Builder
|
||||
|
||||
The creation of the images for the Wazuh stack deployment in Docker is done with the build-images.yml script
|
||||
|
||||
To execute the process, the following must be executed in the root of the wazuh-docker repository:
|
||||
|
||||
```
|
||||
$ build-docker-images/build-images.sh
|
||||
```
|
||||
The creation of the images for the Wazuh stack deployment in Docker is done with the `build-docker-images/build-images.sh` script
|
||||
|
||||
This script initializes the environment variables needed to build each of the images.
|
||||
|
||||
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
|
||||
To execute it, make sure to be in the `build-docker-images` directory:
|
||||
|
||||
```
|
||||
$ build-docker-images/build-images.sh -v 4.14.3
|
||||
```bash
|
||||
cd build-docker-images
|
||||
```
|
||||
|
||||
To get all the available script options use the -h or --help option:
|
||||
Then execute:
|
||||
|
||||
```bash
|
||||
./build-images.sh
|
||||
```
|
||||
$ build-docker-images/build-images.sh -h
|
||||
|
||||
Usage: build-docker-images/build-images.sh [OPTIONS]
|
||||
The script also allows to build images from other versions of Wazuh by using the `-v` or `--version` argument:
|
||||
|
||||
```bash
|
||||
./build-images.sh -v 5.0.0
|
||||
```
|
||||
|
||||
To get all the available script options use the `-h` or `--help` option:
|
||||
|
||||
```bash
|
||||
./build-images.sh -h
|
||||
|
||||
Usage: build-images.sh [OPTIONS]
|
||||
|
||||
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default.
|
||||
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.5.
|
||||
-r, --revision <rev> [Optional] Package revision. By default 1
|
||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.3.
|
||||
-ref, --reference <ref> [Optional] Set the Wazuh reference to build development images. By default, the latest stable release.
|
||||
-rg, --registry <reg> [Optional] Set the Docker registry to push the images.
|
||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
|
||||
-m, --multiarch [Optional] Enable multi-architecture builds.
|
||||
-h, --help Show this help.
|
||||
|
||||
```
|
||||
```
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Development Guide - Introduction
|
||||
|
||||
Welcome to the Development Guide for Wazuh-docker version 4.14.3. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
|
||||
Welcome to the Development Guide for Wazuh-docker version 5.0.0 This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
|
||||
|
||||
## Purpose of This Guide
|
||||
|
||||
|
||||
@@ -2,6 +2,8 @@
|
||||
|
||||
This repository includes automated tests designed to validate the correct deployment of Wazuh using Docker. These tests are executed on every pull request (PR) to ensure the integrity and stability of the system when changes are introduced.
|
||||
|
||||
Check more information on the [Workflow usage](workflow-usage.md) page.
|
||||
|
||||
## Purpose
|
||||
|
||||
The main objective of the tests is to verify that the Wazuh Docker environment can be successfully deployed and that all its core components (Wazuh Manager, Indexer, Dashboard, and Agents) operate as expected after any modification in the codebase.
|
||||
|
||||
+3
-3
@@ -1,6 +1,6 @@
|
||||
# Development Guide - Setup Environment
|
||||
|
||||
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.14.3). A proper setup is crucial for building images, running tests, and contributing effectively.
|
||||
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 5.0.0). A proper setup is crucial for building images, running tests, and contributing effectively.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
@@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements:
|
||||
Follow these steps to prepare your development environment:
|
||||
|
||||
1. **Clone the Repository**:
|
||||
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.14.3`.
|
||||
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `5.0.0`.
|
||||
|
||||
```bash
|
||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||
cd wazuh-docker
|
||||
git checkout v4.14.3
|
||||
git checkout v5.0.0
|
||||
```
|
||||
|
||||
2. **Verify Docker Installation**:
|
||||
|
||||
@@ -0,0 +1,61 @@
|
||||
# Workflow usage
|
||||
|
||||
The Procedure_push_docker_images.yml workflow builds and pushes multi-architecture Docker images (amd64/arm64) of Wazuh core components (Indexer, Manager, Dashboard, and Agent) to container registries.
|
||||
|
||||
## Input Parameters
|
||||
|
||||
| Parameter | Description | Default | Required |
|
||||
|-----------|-------------|---------|----------|
|
||||
| `image_tag` | Docker image version tag | `5.0.0` | Yes |
|
||||
| `docker_reference` | Branch/tag to build from | - | Yes |
|
||||
| `revision` | Package revision number | `1` | Yes |
|
||||
| `reference` | Dev reference (for pre-release builds) | `latest` | No |
|
||||
| `id` | Workflow run identifier | - | No |
|
||||
| `dev` | Enable development mode (adds `-dev` suffix) | `false`/`true` | No |
|
||||
|
||||
## Development vs Production Mode
|
||||
|
||||
**Development Mode** (`dev: true`):
|
||||
|
||||
- Pushes to AWS ECR (Elastic Container Registry)
|
||||
- Uses pre-signed S3 URLs for packages
|
||||
- Generates dynamic `artifact_urls.yml` from S3 bucket
|
||||
- Adds development reference to image tags
|
||||
- Authenticates via AWS IAM role
|
||||
|
||||
**Production Mode** (`dev: false`):
|
||||
|
||||
- Pushes to Docker Hub
|
||||
- Uses public package repositories
|
||||
- Authenticates with Docker Hub credentials
|
||||
- Supports version stages (rc, beta, etc.)
|
||||
|
||||
## Build Process
|
||||
|
||||
1. **Artifact Resolution**:
|
||||
- Dev mode: Creates pre-signed URLs for all Wazuh packages from S3
|
||||
- Prod mode: Uses packages from public repositories
|
||||
|
||||
2. **Multi-architecture Build**:
|
||||
- Uses Docker Buildx with QEMU for cross-platform builds
|
||||
- Builds for `linux/amd64` and `linux/arm64`
|
||||
- Leverages `build-images.yml` for build configuration
|
||||
|
||||
3. **Image Publishing**:
|
||||
- Tags images appropriately based on mode
|
||||
- Pushes to the configured registry
|
||||
- Generates .env file with build metadata
|
||||
|
||||
## Log Collection Feature
|
||||
|
||||
When tests fail, the workflows automatically collect and display relevant logs to help diagnose issues quickly.
|
||||
|
||||
This is implemented via two scripts, executed depending on the test setup:
|
||||
Single-node: `single-node-log-check.sh`
|
||||
Multi-node: `multi-node-log-check.sh`
|
||||
|
||||
Capabilities include:
|
||||
|
||||
- Collects ERROR, WARNING, and CRITICAL messages from all nodes.
|
||||
- Automatically gathers logs on test failures for faster debugging.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Description
|
||||
|
||||
This section provides a detailed description of Wazuh-docker (version 4.14.3), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
|
||||
This section provides a detailed description of Wazuh-docker (version 5.0.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
|
||||
|
||||
## What is Wazuh?
|
||||
|
||||
@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi
|
||||
|
||||
## Core Components in Wazuh-Docker
|
||||
|
||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.14.3:
|
||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 5.0.0:
|
||||
|
||||
1. **Wazuh Manager**:
|
||||
- The central component that collects and analyzes data from deployed Wazuh agents.
|
||||
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
|
||||
2. **Wazuh Indexer**:
|
||||
- A highly scalable, full-text search and analytics engine.
|
||||
- Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
|
||||
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.14.3, this is typically an OpenSearch-based component.
|
||||
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 5.0.0, this is typically an OpenSearch-based component.
|
||||
|
||||
3. **Wazuh Dashboard**:
|
||||
- A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Introduction
|
||||
|
||||
Welcome to the Reference Manual for Wazuh-Docker, version 4.14.3. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
|
||||
Welcome to the Reference Manual for Wazuh-Docker, version 5.0.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
|
||||
|
||||
## Purpose of This Manual
|
||||
|
||||
@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
|
||||
- If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
|
||||
- For specific terms or concepts, consult the [Glossary](glossary.md).
|
||||
|
||||
This manual refers to version 4.14.3 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
|
||||
This manual refers to version 5.0.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
### 1. Wazuh Manager Configuration
|
||||
|
||||
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, integrations, clustering, and more.
|
||||
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
|
||||
* **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) .
|
||||
|
||||
### 2. Wazuh Indexer Configuration
|
||||
@@ -29,4 +29,4 @@
|
||||
```
|
||||
|
||||
|
||||
Consult the official Wazuh documentation for version 4.14.3 for detailed information on all possible configuration parameters for each component.
|
||||
Consult the official Wazuh documentation for version 5.0.0 for detailed information on all possible configuration parameters for each component.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Configuration
|
||||
|
||||
This section details how to configure your Wazuh-Docker deployment (version 4.14.3). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
|
||||
This section details how to configure your Wazuh-Docker deployment (version 5.0.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
|
||||
|
||||
## Overview of Configuration Methods
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Deployment
|
||||
|
||||
This section provides detailed instructions for deploying Wazuh-Docker (version 4.14.3) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
|
||||
This section provides detailed instructions for deploying Wazuh-Docker (version 5.0.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
|
||||
|
||||
## Overview of Deployment Options
|
||||
|
||||
@@ -22,13 +22,13 @@ Wazuh-Docker offers flexibility in how you can deploy the Wazuh stack. The prima
|
||||
|
||||
Ensure you have:
|
||||
|
||||
- Met all the [System Requirements](ref/getting-started/requirements.md).
|
||||
- Met all the [System Requirements](../requirements.md).
|
||||
- Installed Docker and Docker Compose on your host(s).
|
||||
- Cloned the `wazuh-docker` repository (version `4.14.3`) or downloaded the necessary deployment files.
|
||||
- Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files.
|
||||
```bash
|
||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||
git clone https://github.com/wazuh/wazuh-docker.git
|
||||
cd wazuh-docker
|
||||
git checkout v4.14.3
|
||||
git checkout v5.0.0
|
||||
```
|
||||
- Made a backup of any existing Wazuh data if you are migrating or upgrading.
|
||||
|
||||
|
||||
@@ -2,31 +2,74 @@
|
||||
|
||||
## Deploying Wazuh Docker in a Multi-Node Configuration
|
||||
|
||||
This deployment utilizes the `multi-node/docker-compose.yml` file, which defines a cluster setup with two Wazuh manager containers, three Wazuh indexer containers, and one Wazuh dashboard container. Follow these steps to deploy this configuration:
|
||||
This deployment utilizes the `multi-node/docker-compose.yml` file, which defines a cluster setup with two Wazuh Manager, three Wazuh Indexer, and one Wazuh Dashboard containers. Follow these steps to deploy this configuration:
|
||||
|
||||
1. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
||||
|
||||
```bash
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
|
||||
**Note:** This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the `/etc/sysctl.conf` file, add `vm.max_map_count=262144`, and then apply the change with `sudo sysctl -p`.
|
||||
|
||||
2. Navigate to the `multi-node` directory within your repository:
|
||||
|
||||
1. Navigate to the `multi-node` directory within your repository:
|
||||
```bash
|
||||
cd multi-node
|
||||
```
|
||||
|
||||
2. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
||||
```bash
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
**Note:** This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the `/etc/sysctl.conf` file, add `vm.max_map_count=262144`, and then apply the change with `sudo sysctl -p`.
|
||||
3. Download the certificate creation script and config.yml file:
|
||||
|
||||
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
|
||||
```bash
|
||||
docker compose -f generate-indexer-certs.yml run --rm generator
|
||||
curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh
|
||||
curl -sO https://packages.wazuh.com/5.0/config.yml
|
||||
```
|
||||
|
||||
4. Start the Wazuh environment using `docker compose`:
|
||||
4. Edit the `config.yml` file with the configuration of the Wazuh components to be deployed
|
||||
|
||||
```bash
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: wazuh1.indexer
|
||||
ip: wazuh1.indexer
|
||||
- name: wazuh2.indexer
|
||||
ip: wazuh2.indexer
|
||||
- name: wazuh3.indexer
|
||||
ip: wazuh3.indexer
|
||||
|
||||
# Wazuh server nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
server:
|
||||
- name: wazuh.master
|
||||
ip: wazuh.master
|
||||
node_type: master
|
||||
- name: wazuh.worker
|
||||
ip: wazuh.worker
|
||||
node_type: worker
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
```
|
||||
|
||||
5. Run the certificate creation script:
|
||||
|
||||
```bash
|
||||
bash ./wazuh-certs-tool.sh -A
|
||||
```
|
||||
|
||||
6. Start the Wazuh environment using `docker compose`:
|
||||
|
||||
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
|
||||
|
||||
```bash
|
||||
docker compose up
|
||||
```
|
||||
|
||||
* To run in the background (detached mode, allowing the containers to run independently of your terminal):
|
||||
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
@@ -2,34 +2,68 @@
|
||||
|
||||
## Deploying Wazuh Docker in a Single-Node Configuration
|
||||
|
||||
This deployment uses the `single-node/docker-compose.yml` file, which defines a setup with one Wazuh manager container, one Wazuh indexer container, and one Wazuh dashboard container. Follow these steps to deploy it:
|
||||
This deployment uses the `single-node/docker-compose.yml` file, which defines a setup with one Wazuh Manager, one Wazuh Indexer, and one Wazuh Dashboard container. Follow these steps to deploy it:
|
||||
|
||||
1. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
||||
|
||||
```bash
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
|
||||
**Note:** This change is temporary and will revert upon reboot. To make it permanent, you'll need to edit the `/etc/sysctl.conf` file and add `vm.max_map_count=262144`, then apply with `sudo sysctl -p`.
|
||||
|
||||
2. Navigate to the `single-node` directory within your repository:
|
||||
|
||||
1. Navigate to the `single-node` directory within your repository:
|
||||
```bash
|
||||
cd single-node
|
||||
```
|
||||
|
||||
2. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
||||
```bash
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
**Note:** This change is temporary and will revert upon reboot. To make it permanent, you'll need to edit the `/etc/sysctl.conf` file and add `vm.max_map_count=262144`, then apply with `sudo sysctl -p`.
|
||||
3. Download the certificate creation script and `config.yml` file:
|
||||
|
||||
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
|
||||
```bash
|
||||
docker compose -f generate-indexer-certs.yml run --rm generator
|
||||
curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh
|
||||
curl -sO https://packages.wazuh.com/5.0/config.yml
|
||||
```
|
||||
|
||||
4. Start the Wazuh environment using `docker compose`:
|
||||
4. Edit the config.yml file with the configuration of the Wazuh components to be deployed
|
||||
|
||||
```bash
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: wazuh.indexer
|
||||
ip: wazuh.indexer
|
||||
|
||||
# Wazuh server nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
server:
|
||||
- name: wazuh.manager
|
||||
ip: wazuh.manager
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
```
|
||||
|
||||
5. Run the certificate creation script:
|
||||
|
||||
```bash
|
||||
bash ./wazuh-certs-tool.sh -A
|
||||
```
|
||||
|
||||
5. Start the Wazuh environment using `docker compose`:
|
||||
|
||||
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
|
||||
|
||||
```bash
|
||||
docker compose up
|
||||
```
|
||||
|
||||
* To run in the background (detached mode, allowing the containers to run independently of your terminal):
|
||||
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
Please allow some time for the environment to initialize, especially on the first run. It can take approximately a minute or two (depending on your host's resources) as the Wazuh Indexer starts up and generates the necessary indexes and index patterns.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Getting Started
|
||||
|
||||
This section guides you through the initial steps to get your Wazuh-docker (version 4.14.3) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
|
||||
This section guides you through the initial steps to get your Wazuh-docker (version 5.0.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
|
||||
Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.
|
||||
|
||||
2. **Obtain Wazuh-docker Configuration**:
|
||||
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.14.3.
|
||||
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 5.0.0.
|
||||
```bash
|
||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||
cd wazuh-docker
|
||||
git checkout v4.14.3
|
||||
git checkout v5.0.0
|
||||
# Navigate to the specific docker-compose directory, e.g., single-node or multi-node
|
||||
# cd docker-compose/single-node/ (example path)
|
||||
```
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Requirements
|
||||
|
||||
Before deploying Wazuh-Docker (version 4.14.3), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
|
||||
Before deploying Wazuh-Docker (version 5.0.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
|
||||
|
||||
## Host System Requirements
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Glossary
|
||||
|
||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.14.3).
|
||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 5.0.0).
|
||||
|
||||
---
|
||||
|
||||
@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
|
||||
|
||||
**D**
|
||||
|
||||
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.14.3, this is typically OpenSearch Dashboards.
|
||||
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 5.0.0, this is typically OpenSearch Dashboards.
|
||||
- **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
|
||||
- **Docker**: An open platform for developing, shipping, and running applications inside containers.
|
||||
- **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
|
||||
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
|
||||
|
||||
**I**
|
||||
|
||||
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.14.3, this is typically OpenSearch.
|
||||
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 5.0.0, this is typically OpenSearch.
|
||||
|
||||
**L**
|
||||
|
||||
|
||||
Reference in New Issue
Block a user