forked from wazuh/wazuh-docker
Merge 4.14.3 into main
This commit is contained in:
Carlos Bordon
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Description
|
||||
|
||||
This section provides a detailed description of Wazuh-docker (version 4.14.3), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
|
||||
This section provides a detailed description of Wazuh-docker (version 5.0.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
|
||||
|
||||
## What is Wazuh?
|
||||
|
||||
@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi
|
||||
|
||||
## Core Components in Wazuh-Docker
|
||||
|
||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.14.3:
|
||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 5.0.0:
|
||||
|
||||
1. **Wazuh Manager**:
|
||||
- The central component that collects and analyzes data from deployed Wazuh agents.
|
||||
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
|
||||
2. **Wazuh Indexer**:
|
||||
- A highly scalable, full-text search and analytics engine.
|
||||
- Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
|
||||
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.14.3, this is typically an OpenSearch-based component.
|
||||
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 5.0.0, this is typically an OpenSearch-based component.
|
||||
|
||||
3. **Wazuh Dashboard**:
|
||||
- A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Introduction
|
||||
|
||||
Welcome to the Reference Manual for Wazuh-Docker, version 4.14.3. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
|
||||
Welcome to the Reference Manual for Wazuh-Docker, version 5.0.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
|
||||
|
||||
## Purpose of This Manual
|
||||
|
||||
@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
|
||||
- If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
|
||||
- For specific terms or concepts, consult the [Glossary](glossary.md).
|
||||
|
||||
This manual refers to version 4.14.3 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
|
||||
This manual refers to version 5.0.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
### 1. Wazuh Manager Configuration
|
||||
|
||||
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, integrations, clustering, and more.
|
||||
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
|
||||
* **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) .
|
||||
|
||||
### 2. Wazuh Indexer Configuration
|
||||
@@ -29,4 +29,4 @@
|
||||
```
|
||||
|
||||
|
||||
Consult the official Wazuh documentation for version 4.14.3 for detailed information on all possible configuration parameters for each component.
|
||||
Consult the official Wazuh documentation for version 5.0.0 for detailed information on all possible configuration parameters for each component.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Configuration
|
||||
|
||||
This section details how to configure your Wazuh-Docker deployment (version 4.14.3). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
|
||||
This section details how to configure your Wazuh-Docker deployment (version 5.0.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
|
||||
|
||||
## Overview of Configuration Methods
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Deployment
|
||||
|
||||
This section provides detailed instructions for deploying Wazuh-Docker (version 4.14.3) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
|
||||
This section provides detailed instructions for deploying Wazuh-Docker (version 5.0.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
|
||||
|
||||
## Overview of Deployment Options
|
||||
|
||||
@@ -22,13 +22,13 @@ Wazuh-Docker offers flexibility in how you can deploy the Wazuh stack. The prima
|
||||
|
||||
Ensure you have:
|
||||
|
||||
- Met all the [System Requirements](ref/getting-started/requirements.md).
|
||||
- Met all the [System Requirements](../requirements.md).
|
||||
- Installed Docker and Docker Compose on your host(s).
|
||||
- Cloned the `wazuh-docker` repository (version `4.14.3`) or downloaded the necessary deployment files.
|
||||
- Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files.
|
||||
```bash
|
||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||
git clone https://github.com/wazuh/wazuh-docker.git
|
||||
cd wazuh-docker
|
||||
git checkout v4.14.3
|
||||
git checkout v5.0.0
|
||||
```
|
||||
- Made a backup of any existing Wazuh data if you are migrating or upgrading.
|
||||
|
||||
|
||||
@@ -2,31 +2,74 @@
|
||||
|
||||
## Deploying Wazuh Docker in a Multi-Node Configuration
|
||||
|
||||
This deployment utilizes the `multi-node/docker-compose.yml` file, which defines a cluster setup with two Wazuh manager containers, three Wazuh indexer containers, and one Wazuh dashboard container. Follow these steps to deploy this configuration:
|
||||
This deployment utilizes the `multi-node/docker-compose.yml` file, which defines a cluster setup with two Wazuh Manager, three Wazuh Indexer, and one Wazuh Dashboard containers. Follow these steps to deploy this configuration:
|
||||
|
||||
1. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
||||
|
||||
```bash
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
|
||||
**Note:** This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the `/etc/sysctl.conf` file, add `vm.max_map_count=262144`, and then apply the change with `sudo sysctl -p`.
|
||||
|
||||
2. Navigate to the `multi-node` directory within your repository:
|
||||
|
||||
1. Navigate to the `multi-node` directory within your repository:
|
||||
```bash
|
||||
cd multi-node
|
||||
```
|
||||
|
||||
2. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
||||
```bash
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
**Note:** This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the `/etc/sysctl.conf` file, add `vm.max_map_count=262144`, and then apply the change with `sudo sysctl -p`.
|
||||
3. Download the certificate creation script and config.yml file:
|
||||
|
||||
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
|
||||
```bash
|
||||
docker compose -f generate-indexer-certs.yml run --rm generator
|
||||
curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh
|
||||
curl -sO https://packages.wazuh.com/5.0/config.yml
|
||||
```
|
||||
|
||||
4. Start the Wazuh environment using `docker compose`:
|
||||
4. Edit the `config.yml` file with the configuration of the Wazuh components to be deployed
|
||||
|
||||
```bash
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: wazuh1.indexer
|
||||
ip: wazuh1.indexer
|
||||
- name: wazuh2.indexer
|
||||
ip: wazuh2.indexer
|
||||
- name: wazuh3.indexer
|
||||
ip: wazuh3.indexer
|
||||
|
||||
# Wazuh server nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
server:
|
||||
- name: wazuh.master
|
||||
ip: wazuh.master
|
||||
node_type: master
|
||||
- name: wazuh.worker
|
||||
ip: wazuh.worker
|
||||
node_type: worker
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
```
|
||||
|
||||
5. Run the certificate creation script:
|
||||
|
||||
```bash
|
||||
bash ./wazuh-certs-tool.sh -A
|
||||
```
|
||||
|
||||
6. Start the Wazuh environment using `docker compose`:
|
||||
|
||||
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
|
||||
|
||||
```bash
|
||||
docker compose up
|
||||
```
|
||||
|
||||
* To run in the background (detached mode, allowing the containers to run independently of your terminal):
|
||||
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
@@ -2,34 +2,68 @@
|
||||
|
||||
## Deploying Wazuh Docker in a Single-Node Configuration
|
||||
|
||||
This deployment uses the `single-node/docker-compose.yml` file, which defines a setup with one Wazuh manager container, one Wazuh indexer container, and one Wazuh dashboard container. Follow these steps to deploy it:
|
||||
This deployment uses the `single-node/docker-compose.yml` file, which defines a setup with one Wazuh Manager, one Wazuh Indexer, and one Wazuh Dashboard container. Follow these steps to deploy it:
|
||||
|
||||
1. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
||||
|
||||
```bash
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
|
||||
**Note:** This change is temporary and will revert upon reboot. To make it permanent, you'll need to edit the `/etc/sysctl.conf` file and add `vm.max_map_count=262144`, then apply with `sudo sysctl -p`.
|
||||
|
||||
2. Navigate to the `single-node` directory within your repository:
|
||||
|
||||
1. Navigate to the `single-node` directory within your repository:
|
||||
```bash
|
||||
cd single-node
|
||||
```
|
||||
|
||||
2. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
||||
```bash
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
**Note:** This change is temporary and will revert upon reboot. To make it permanent, you'll need to edit the `/etc/sysctl.conf` file and add `vm.max_map_count=262144`, then apply with `sudo sysctl -p`.
|
||||
3. Download the certificate creation script and `config.yml` file:
|
||||
|
||||
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
|
||||
```bash
|
||||
docker compose -f generate-indexer-certs.yml run --rm generator
|
||||
curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh
|
||||
curl -sO https://packages.wazuh.com/5.0/config.yml
|
||||
```
|
||||
|
||||
4. Start the Wazuh environment using `docker compose`:
|
||||
4. Edit the config.yml file with the configuration of the Wazuh components to be deployed
|
||||
|
||||
```bash
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: wazuh.indexer
|
||||
ip: wazuh.indexer
|
||||
|
||||
# Wazuh server nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
server:
|
||||
- name: wazuh.manager
|
||||
ip: wazuh.manager
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
```
|
||||
|
||||
5. Run the certificate creation script:
|
||||
|
||||
```bash
|
||||
bash ./wazuh-certs-tool.sh -A
|
||||
```
|
||||
|
||||
5. Start the Wazuh environment using `docker compose`:
|
||||
|
||||
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
|
||||
|
||||
```bash
|
||||
docker compose up
|
||||
```
|
||||
|
||||
* To run in the background (detached mode, allowing the containers to run independently of your terminal):
|
||||
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
Please allow some time for the environment to initialize, especially on the first run. It can take approximately a minute or two (depending on your host's resources) as the Wazuh Indexer starts up and generates the necessary indexes and index patterns.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Getting Started
|
||||
|
||||
This section guides you through the initial steps to get your Wazuh-docker (version 4.14.3) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
|
||||
This section guides you through the initial steps to get your Wazuh-docker (version 5.0.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
|
||||
Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.
|
||||
|
||||
2. **Obtain Wazuh-docker Configuration**:
|
||||
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.14.3.
|
||||
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 5.0.0.
|
||||
```bash
|
||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||
cd wazuh-docker
|
||||
git checkout v4.14.3
|
||||
git checkout v5.0.0
|
||||
# Navigate to the specific docker-compose directory, e.g., single-node or multi-node
|
||||
# cd docker-compose/single-node/ (example path)
|
||||
```
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Requirements
|
||||
|
||||
Before deploying Wazuh-Docker (version 4.14.3), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
|
||||
Before deploying Wazuh-Docker (version 5.0.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
|
||||
|
||||
## Host System Requirements
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Glossary
|
||||
|
||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.14.3).
|
||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 5.0.0).
|
||||
|
||||
---
|
||||
|
||||
@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
|
||||
|
||||
**D**
|
||||
|
||||
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.14.3, this is typically OpenSearch Dashboards.
|
||||
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 5.0.0, this is typically OpenSearch Dashboards.
|
||||
- **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
|
||||
- **Docker**: An open platform for developing, shipping, and running applications inside containers.
|
||||
- **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
|
||||
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
|
||||
|
||||
**I**
|
||||
|
||||
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.14.3, this is typically OpenSearch.
|
||||
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 5.0.0, this is typically OpenSearch.
|
||||
|
||||
**L**
|
||||
|
||||
|
||||
Reference in New Issue
Block a user