comment out block for testing purposes

Add check (input.dev must be false) for image validation and GH issue notification in push workflow
Enhance script execution of build and improve docs clarity
2025-12-17 12:12:16 -05:00 · 2025-12-17 12:10:46 -05:00 · 2025-12-17 01:37:49 -05:00 · 2025-12-17 01:37:49 -05:00 · 2025-12-17 01:37:49 -05:00 · 2025-12-17 01:37:49 -05:00
65 changed files with 1691 additions and 493 deletions
@@ -1,11 +1,6 @@
-WAZUH_VERSION=main
-WAZUH_IMAGE_VERSION=main
+WAZUH_VERSION=4.14.3
+WAZUH_IMAGE_VERSION=4.14.3
 WAZUH_TAG_REVISION=1
-<<<<<<< HEAD
-FILEBEAT_TEMPLATE_BRANCH=v4.14.0
+FILEBEAT_TEMPLATE_BRANCH=4.14.3
 WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
-=======
->>>>>>> 1e55bb13cadad97053c52747cdb7f57d54eee70b
 WAZUH_UI_REVISION=1
-WAZUH_REGISTRY=docker.io
-IMAGE_TAG=main
@@ -56,7 +56,7 @@ package:
  wazuh-manager:
    installed: true
    versions:
-    - 5.0.0
+    - 4.14.3
 port:
  tcp:1514:
    listening: true
@@ -6,19 +6,19 @@ on:
    inputs:
      image_tag:
        description: 'Docker image tag'
-        default: '5.0.0'
+        default: '4.14.3'
        required: true
      docker_reference:
        description: 'wazuh-docker reference'
        required: true
+      filebeat_module_version:
+        description: 'Filebeat module version'
+        default: '0.4'
+        required: true
      revision:
        description: 'Package revision'
        default: '1'
        required: true
-      reference:
-        description: 'Dev reference'
-        type: string
-        default: latest 
      id:
        description: "ID used to identify the workflow uniquely."
        type: string
@@ -32,22 +32,23 @@ on:
    inputs:
      image_tag:
        description: 'Docker image tag'
-        default: '5.0.0'
+        default: '4.14.3'
        required: true
        type: string
      docker_reference:
        description: 'wazuh-docker reference'
        required: false
        type: string
+      filebeat_module_version:
+        description: 'Filebeat module version'
+        default: '0.4'
+        required: true
+        type: string
      revision:
        description: 'Package revision'
        default: '1'
        required: true
        type: string
-      reference:
-        description: 'Dev reference'
-        type: string
-        default: latest 
      id:
        description: "ID used to identify the workflow uniquely."
        type: string
@@ -69,6 +70,7 @@ jobs:
    env:
      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
      IMAGE_TAG: ${{ inputs.image_tag }}
+      FILEBEAT_MODULE_VERSION: ${{ inputs.filebeat_module_version }}
      REVISION: ${{ inputs.revision }}

    steps:
@@ -88,7 +90,6 @@ jobs:
        echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
        echo "* revision: ${{ inputs.revision }}"
        echo "* dev: ${{ inputs.dev }}"
-        echo "* dev reference: ${{ inputs.reference }}"
        echo "---------------------------------------------"

    - name: Checkout repository
@@ -96,87 +97,147 @@ jobs:
      with:
        ref: ${{ inputs.docker_reference }}

-    - name: free disk space
-      uses: ./.github/free-disk-space
-    
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+    # - name: free disk space
+    #   uses: ./.github/free-disk-space

-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+    # - name: Set up QEMU
+    #   uses: docker/setup-qemu-action@v3

-    - name: Configure aws credentials
-      if: ${{ inputs.dev == true }}
-      uses: aws-actions/configure-aws-credentials@v4
-      with:
-        role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
-        aws-region: "${{ secrets.AWS_REGION }}"
+    # - name: Set up Docker Buildx
+    #   uses: docker/setup-buildx-action@v3

-    - name: Log in to Amazon ECR
-      if: ${{ inputs.dev == true }}
-      uses: aws-actions/amazon-ecr-login@v2
+    # - name: Configure aws credentials
+    #   if: ${{ inputs.dev == true }}
+    #   uses: aws-actions/configure-aws-credentials@v4
+    #   with:
+    #     role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
+    #     aws-region: "${{ secrets.AWS_REGION }}"

-    - name: Log in to Docker Hub
+    # - name: Log in to Amazon ECR
+    #   if: ${{ inputs.dev == true }}
+    #   uses: aws-actions/amazon-ecr-login@v2
+
+    # - name: Log in to Docker Hub
+    #   if: ${{ inputs.dev == false }}
+    #   uses: docker/login-action@v3
+    #   with:
+    #     username: ${{ secrets.DOCKERHUB_USERNAME }}
+    #     password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    # - name: Build Wazuh images
+    #   run: |
+    #     IMAGE_TAG="${{ inputs.image_tag }}"
+    #     FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }}
+    #     REVISION=${{ inputs.revision }}
+
+    #     if [[ "$IMAGE_TAG" == *"-"* ]]; then
+    #       IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
+    #       if [ -z "${tokens[1]}" ]; then
+    #         echo "Invalid image tag: $IMAGE_TAG"
+    #         exit 1
+    #       fi
+    #       DEV_STAGE=${tokens[1]}
+    #       WAZUH_VER=${tokens[0]}
+    #       ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m
+    #     else
+    #       ./build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m
+    #     fi
+
+    #     # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
+    #     ENV_FILE_PATH="../.env"
+
+    #     if [ -f $ENV_FILE_PATH ]; then
+    #       while IFS= read -r line || [ -n "$line" ]; do
+    #         echo "$line" >> $GITHUB_ENV
+    #       done < $ENV_FILE_PATH
+    #     else
+    #       echo "The environment file $ENV_FILE_PATH does not exist!"
+    #       exit 1
+    #     fi
+    #   working-directory: ./build-docker-images
+
+    - name: Image exists validation
      if: ${{ inputs.dev == false }}
-      uses: docker/login-action@v3
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-    - name: Create packages_url.txt file
-      if : ${{ inputs.dev == true }}
+      id: validation
      run: |
-          cat << EOF > packages_url.txt
-          wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_manager_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_indexer_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_indexer_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_indexer_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_indexer_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_dashboard_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_dashboard_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_dashboard_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_dashboard_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)"
-          EOF
-      working-directory: ./build-docker-images
+        IMAGE_TAG=${{ inputs.image_tag }}
+        PURPOSE=""

-    - name: Build Wazuh images
-      run: |
-        if [ "${{ inputs.dev }}" = true ]; then
-          IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}"
-          ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }}
-        else  
-          if [[ "$IMAGE_TAG" == *"-"* ]]; then
-            IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
-            if [ -z "${tokens[1]}" ]; then
-              echo "Invalid image tag: $IMAGE_TAG"
-              exit 1
-            fi
-            DEV_STAGE=${tokens[1]}
-            WAZUH_VER=${tokens[0]}
-            ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -rg $IMAGE_REGISTRY -m
+        if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if docker manifest inspect $IMAGE_REGISTRY/wazuh/wazuh-manager:$IMAGE_TAG > /dev/null 2>&1; then
+            PURPOSE="regeneration"
+            echo "Image wazuh/wazuh-manager:$IMAGE_TAG exists. Setting PURPOSE to 'regeneration'"
          else
-            ./build-images.sh -v $IMAGE_TAG -r $REVISION -rg $IMAGE_REGISTRY -m
+            PURPOSE="new release"
+            echo "Image wazuh/wazuh-manager:$IMAGE_TAG does NOT exist. Setting PURPOSE to 'new release'"
          fi
-        fi
-        # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
-        ENV_FILE_PATH="../.env"
-
-        if [ -f $ENV_FILE_PATH ]; then
-          while IFS= read -r line || [ -n "$line" ]; do
-            echo "$line" >> $GITHUB_ENV
-          done < $ENV_FILE_PATH
+          echo "✅ Release tag: '$IMAGE_TAG'"
+        elif [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)[0-9]+$ ]]; then
+          PURPOSE="new stage"
+          echo "✅ Stage tag: '$IMAGE_TAG'. Setting PURPOSE to 'new stage'"
        else
-          echo "The environment file $ENV_FILE_PATH does not exist!"
-          exit 1
+          echo "❌ No release or stage tag ('$IMAGE_TAG'), the GH issue will not be created"
        fi
-      working-directory: ./build-docker-images
+
+        echo "purpose=$PURPOSE" >> $GITHUB_OUTPUT
+
+    - name: GH issue notification
+      if: ${{ inputs.dev == false && steps.validation.outputs.purpose != '' }}
+      run: |
+        IMAGE_TAG=${{ inputs.image_tag }}
+        GH_TITLE=""
+        GH_MESSAGE=""
+        PURPOSE="${{ steps.validation.outputs.purpose }}"
+
+        ## Setting GH issue title
+        GH_TITLE="Artifactory vulnerabilities update \`v$IMAGE_TAG\`"
+
+        ## Setting GH issue body
+        GH_MESSAGE=$(cat <<- EOF | tr -d '\r' | sed 's/^[[:space:]]*//'
+        ### Description
+        - [ ] Update the [Artifactory vulnerabilities](${{ secrets.NOTIFICATION_SHEET_URL }}) sheet with the \`v$IMAGE_TAG\` vulnerabilities.
+
+        **Purpose**: $PURPOSE
+        >[!NOTE]
+        >To update the \`Tentative Release\` column, follow these steps:
+        https://github.com/wazuh/${{ secrets.NOTIFICATION_REPO }}/issues/2049#issuecomment-2671590268
+        EOF
+        )
+
+        # Print the GH Variables content
+        echo "--- Variable Content ---"
+        echo "$GH_TITLE"
+        echo "------------------------"
+
+        echo "--- Variable Content ---"
+        echo "$GH_MESSAGE"
+        echo "------------------------"
+
+        ## GH issue creation
+        ISSUE_URL=$(gh issue create \
+          -R wazuh/${{ secrets.NOTIFICATION_REPO }} \
+          --title "$GH_TITLE" \
+          --body "$GH_MESSAGE" \
+          --label "level/task" \
+          --label "type/maintenance" \
+          --label "request/operational")
+
+        ## Adding the issue to the team project
+        PROJECT_ITEM_ID=$(gh project item-add \
+          ${{ secrets.NOTIFICATION_PROJECT_NUMBER }} \
+          --url $ISSUE_URL \
+          --owner wazuh \
+          --format json \
+          | jq -r '.id')
+
+          ## Setting Objective
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_OBJECTIVE_ID }} --text  "Security scans"
+          ## Setting Priority
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_OPTION_ID }}
+          ## Setting Size
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_OPTION_ID }}
+          ## Setting Subteam
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_OPTION_ID }}
+
+      env:
+        GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
@@ -2,6 +2,4 @@ single-node/config/wazuh_indexer_ssl_certs/*.pem
 single-node/config/wazuh_indexer_ssl_certs/*.key
 multi-node/config/wazuh_indexer_ssl_certs/*.pem
 multi-node/config/wazuh_indexer_ssl_certs/*.key
-*.log
-build-docker-images/packages_env.txt
-build-docker-images/packages_url.txt
+*.log
@@ -1,7 +1,7 @@
 # Change Log
 All notable changes to this project will be documented in this file.

-## [5.0.0]
+## [4.14.3]

 ### Added

@@ -9,10 +9,7 @@ All notable changes to this project will be documented in this file.

 ### Changed

- Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-puppet/issues/2058))
- Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-puppet/issues/2054))
- Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-puppet/issues/2030))
- Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366))
+- Adapt to multi architecture build ([#2120](https://github.com/wazuh/wazuh-docker/pull/2120))

 ### Fixed

@@ -22,6 +19,26 @@ All notable changes to this project will be documented in this file.

 - None

+## [4.14.2]
+
+### Added
+
+- Code improvements for 4.14.2 ([#2090](https://github.com/wazuh/wazuh-docker/pull/2090))
+- Artifactory vulnerabilities notification ([#2078](https://github.com/wazuh/wazuh-docker/pull/2078))
+
+### Changed
+
+- The location of the remove command for the wazuh-authd certificates has been changed. ([#2094](https://github.com/wazuh/wazuh-docker/pull/2094))
+- Removed sslmanager key from the docker manager image to 4.14.2. ([#2093](https://github.com/wazuh/wazuh-docker/pull/2093))
+
+### Fixed
+
+- Add missing SSL ciphers and protocols and remove outdated ports parameters from opensearch.yml template ([#2104](https://github.com/wazuh/wazuh-docker/pull/2104))
+
+### Deleted
+
+- None
+
 ## [4.14.1]

 ### Added
@@ -18,7 +18,7 @@ The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cyber
 ## Branch Convention

 - `main`: Developing and testing of new features.
- `X.Y.Z`: Version-specific branches (e.g., `5.0.0`, `4.14.0`, etc.).
+- `X.Y.Z`: Version-specific branches (e.g., `4.14.3`, `4.13.0`, etc.).

 ## Documentation

@@ -1,4 +1,4 @@
 {
-    "version": "5.0.0",
+    "version": "4.14.3",
    "stage": "alpha0"
 }
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
 The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:

 ```
-$ build-docker-images/build-images.sh -v 5.0.0
+$ build-docker-images/build-images.sh -v 4.14.3
 ```

 To get all the available script options use the -h or --help option:
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default 0.4.
    -r, --revision <rev>         [Optional] Package revision. By default 1
-    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
+    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 4.14.3.
    -h, --help                   Show this help.

 ```
@@ -1,9 +1,5 @@
-WAZUH_IMAGE_VERSION=main
-IMAGE_TAG=main
-WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
-WAZUH_TAG_REVISION=1
+IMAGE_TAG=4.14.3
 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
-IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
 WAZUH_REGISTRY=docker.io

 # Wazuh package generator
@@ -14,10 +10,10 @@ WAZUH_REGISTRY=docker.io
 # License (version 2) as published by the FSF - Free Software
 # Foundation.

-WAZUH_IMAGE_VERSION="main"
+WAZUH_IMAGE_VERSION="4.14.3"
 WAZUH_TAG_REVISION="1"
 WAZUH_DEV_STAGE=""
-WAZUH_TAG_REFERENCE=""
+FILEBEAT_MODULE_VERSION="0.4"

 # -----------------------------------------------------------------------------

@@ -39,43 +35,52 @@ ctrl_c() {
 build() {

    WAZUH_VERSION="$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')"
-    WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}"
+    FILEBEAT_TEMPLATE_BRANCH="${WAZUH_IMAGE_VERSION}"
+    WAZUH_FILEBEAT_MODULE="wazuh-filebeat-${FILEBEAT_MODULE_VERSION}.tar.gz"
    WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}"

-    # Variables
-    FILE="packages_url.txt"
-
-    if [[ -f "$FILE" ]]; then
-        echo "$FILE exists. Using existing file."
+    if  [ "${WAZUH_DEV_STAGE}" ];then
+        FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}"
+        if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
+            echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
+            clean 1
+        fi
    else
-        TAG="v${WAZUH_VERSION}"
-        REPO="wazuh/wazuh-docker"
-        GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}"
-
-        if curl -fsSL "$GH_URL" >/dev/null 2>&1; then
-            curl -fsSL -o "$FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt"
+        if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then
+            FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}"
+        elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
+            FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}"
        else
-            curl -fsSL -o "$FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt"
+            echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
+            clean 1
        fi
    fi
-    awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $FILE > packages_env.txt
-    
+
+
    echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
    echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
    echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env
+    echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> ../.env
+    echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> ../.env
    echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> ../.env
    echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env
    echo IMAGE_TAG=$IMAGE_TAG >> ../.env

    set -a
    source ../.env
-    source ./packages_env.txt
    set +a

    if  [ "${MULTIARCH}" ];then
-        docker buildx bake --file build-images.yml --push --set *.platform=linux/amd64,linux/arm64 --no-cache|| clean 1
+        docker buildx bake \
+            --file build-images.yml \
+            --push \
+            --set *.platform=linux/amd64,linux/arm64 \
+            --no-cache || clean 1
    else
-        docker buildx bake --file build-images.yml --no-cache|| clean 1
+        docker buildx bake \
+            --file build-images.yml \
+            --load \
+            --no-cache || clean 1
    fi
    return 0
 }
@@ -86,7 +91,8 @@ help() {
    echo
    echo "Usage: $0 [OPTIONS]"
    echo
-    echo "    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default."
+    echo "    -d, --dev <ref>              [Optional] Set the development stage you want to build, example alpha0 or beta1, not used by default."
+    echo "    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default ${FILEBEAT_MODULE_VERSION}."
    echo "    -r, --revision <rev>         [Optional] Package revision. By default ${WAZUH_TAG_REVISION}"
    echo "    -ref, --reference <ref>      [Optional] Set the Wazuh reference to build development images. By default, the latest stable release."
    echo "    -rg, --registry <reg>        [Optional] Set the Docker registry to push the images."
@@ -114,6 +120,14 @@ main() {
                help 1
            fi
            ;;
+        "-f"|"--filebeat-module")
+            if [ -n "${2}" ]; then
+                FILEBEAT_MODULE_VERSION="${2}"
+                shift 2
+            else
+                help 1
+            fi
+            ;;
        "-m"|"--multiarch")
            MULTIARCH="true"
                shift
@@ -6,8 +6,8 @@ services:
      args:
        WAZUH_VERSION: ${WAZUH_VERSION}
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
-        wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm}
-        wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm}
+        FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH}
+        WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE}
    image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG}
    hostname: wazuh.manager
    restart: always
@@ -20,14 +20,19 @@ services:
      - INDEXER_URL=https://wazuh.indexer:9200
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=admin
+      - FILEBEAT_SSL_VERIFICATION_MODE=none
    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
      - wazuh_etc:/var/ossec/etc
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
      - wazuh_var_multigroups:/var/ossec/var/multigroups
+      - wazuh_integrations:/var/ossec/integrations
      - wazuh_active_response:/var/ossec/active-response/bin
+      - wazuh_agentless:/var/ossec/agentless
      - wazuh_wodles:/var/ossec/wodles
+      - filebeat_etc:/etc/filebeat
+      - filebeat_var:/var/lib/filebeat

  wazuh.agent:
    build:
@@ -35,8 +40,6 @@ services:
      args:
        WAZUH_VERSION: ${WAZUH_VERSION}
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
-        wazuh_agent_url_amd64_rpm: ${wazuh_agent_url_x86_64_rpm}
-        wazuh_agent_url_arm64_rpm: ${wazuh_agent_url_aarch64_rpm}
    image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG}
    hostname: wazuh.agent
    restart: always
@@ -47,8 +50,6 @@ services:
      args:
        WAZUH_VERSION: ${WAZUH_VERSION}
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
-        wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm}
-        wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm}
    image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG}
    hostname: wazuh.indexer
    restart: always
@@ -71,8 +72,6 @@ services:
        WAZUH_VERSION: ${WAZUH_VERSION}
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
        WAZUH_UI_REVISION: ${WAZUH_UI_REVISION}
-        wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm}
-        wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm}
    image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG}
    hostname: wazuh.dashboard
    restart: always
@@ -95,6 +94,9 @@ volumes:
  wazuh_logs:
  wazuh_queue:
  wazuh_var_multigroups:
+  wazuh_integrations:
  wazuh_active_response:
+  wazuh_agentless:
  wazuh_wodles:
-
+  filebeat_etc:
+  filebeat_var:
@@ -10,17 +10,18 @@ ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
 ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT'
 ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
 ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
-ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
-ARG TARGETARCH
-ARG wazuh_agent_url_amd64_rpm
-ARG wazuh_agent_url_arm64_rpm
+ARG WAZUH_AGENT_NAME='CHANGEE_AGENT_NAME'

-RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \
-    agent_url="${!URL_VAR}" && \
-    dnf install curl-minimal tar gzip procps -y &&\
-    curl -o /wazuh-agent.rpm "${agent_url}" && \
-    dnf install /wazuh-agent.rpm -y && \
-    dnf clean all && \
+COPY config/check_repository.sh /
+
+RUN yum install curl-minimal tar gzip procps -y &&\
+    yum clean all
+
+RUN chmod 775 /check_repository.sh
+RUN source /check_repository.sh
+
+RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all && \
    sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
    -o /tmp/s6-overlay-amd64.tar.gz && \
@@ -30,4 +31,6 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \

 COPY config/etc/ /etc/

+RUN rm /etc/yum.repos.d/wazuh.repo
+
 ENTRYPOINT [ "/init" ]
@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
@@ -5,27 +5,28 @@ ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
 ARG WAZUH_UI_REVISION
 ARG INSTALL_DIR=/usr/share/wazuh-dashboard
-ARG TARGETARCH
-ARG wazuh_dashboard_url_amd64_rpm
-ARG wazuh_dashboard_url_arm64_rpm

 # Update and install dependencies
-RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \
-    dashboard_url="${!URL_VAR}" && \
-    dnf install curl-minimal libcap openssl -y && \
-    curl -o /wazuh-dashboard.rpm "${dashboard_url}" && \
-    dnf install /wazuh-dashboard.rpm -y && \
-    dnf clean all
+RUN yum install curl-minimal libcap openssl -y
+
+COPY config/check_repository.sh /
+RUN chmod 775 /check_repository.sh && \
+    source /check_repository.sh
+
+RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all

 # Create and set permissions to data directories
 RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
 RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
 RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
+COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/
 RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
 RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node

 # Generate certificates
 COPY config/config.sh .
+COPY config/config.yml /
 RUN bash config.sh

 ################################################################################
@@ -41,8 +42,10 @@ FROM amazonlinux:2023
 ENV USER="wazuh-dashboard" \
    GROUP="wazuh-dashboard" \
    NAME="wazuh-dashboard" \
-    INSTALL_DIR="/usr/share/wazuh-dashboard" \
-    PATTERN="" \
+    INSTALL_DIR="/usr/share/wazuh-dashboard"
+
+# Set Wazuh app variables
+ENV PATTERN="" \
    CHECKS_PATTERN="" \
    CHECKS_TEMPLATE="" \
    CHECKS_API="" \
@@ -56,32 +59,34 @@ ENV USER="wazuh-dashboard" \
    WAZUH_MONITORING_SHARDS="" \
    WAZUH_MONITORING_REPLICAS=""

-# Copy and set permissions to scripts
-COPY config/entrypoint.sh /
-COPY config/wazuh_app_config.sh /
-
 # Update and install dependencies
-RUN yum install shadow-utils -y && \
-    yum clean all && \
-    getent group $GROUP || groupadd -r -g 1000 $GROUP && \
-    useradd --system \
+RUN yum install shadow-utils -y
+
+# Create wazuh-dashboard user and group
+RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
+RUN useradd --system \
            --uid 1000 \
            --no-create-home \
            --home-dir $INSTALL_DIR \
            --gid $GROUP \
            --shell /sbin/nologin \
            --comment "$USER user" \
-            $USER && \
-    chmod 700 /entrypoint.sh && \
-    chmod 700 /wazuh_app_config.sh && \
-    mkdir -p $INSTALL_DIR && \
-    chown 1000:1000 $INSTALL_DIR && \
-    chown 1000:1000 /*.sh && \
-    mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
+            $USER
+
+# Copy and set permissions to scripts
+COPY config/entrypoint.sh /
+COPY config/wazuh_app_config.sh /
+RUN chmod 700 /entrypoint.sh
+RUN chmod 700 /wazuh_app_config.sh
+RUN chown 1000:1000 /*.sh

 # Copy Install dir from builder to current image
 COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR

+# Create custom directory
+RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
+RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
+
 # Set workdir and user
 WORKDIR $INSTALL_DIR
 USER wazuh-dashboard
@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
@@ -9,71 +9,34 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config

 ## Variables
 CERT_TOOL=wazuh-certs-tool.sh
-CERT_CONFIG_FILE=config.yml
-CERT_TOOL_VERSION="${WAZUH_VERSION%.*}"
-PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/
-PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/
+PACKAGES_URL=https://packages.wazuh.com/4.14/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/

-download_package() {
-    local url=$1
-    local package=$2
-    local output=$2
-    echo "Checking $url$package ..."
-    if curl -fsL "$url$package" -o "$output"; then
-        echo "Downloaded $package from $url"
-        return 0
-    else
-        return 1
-    fi
-}
+## Check if the cert tool exists in S3 buckets
+CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')

-# Download the tool to create the certificates
-echo "Downloading the tool to create the certificates..."
-# Try first the prod URL, if it fails try the dev URL
-if download_package "$PACKAGES_URL" "$CERT_TOOL"; then
-    :
-elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then
-    :
+## If cert tool exists in some bucket, download it, if not exit 1
+if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
+  curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL
+  echo "Cert tool exists in Packages bucket"
+elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
+  curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL
+  echo "Cert tool exists in Packages-dev bucket"
 else
-    echo "The tool to create the certificates does not exist in any bucket"
-    echo "ERROR: certificates were not created"
-    exit 1
+  echo "Cert tool does not exist in any bucket"
+  exit 1
 fi

-# Download the config file for the certificate tool
-echo "Downloading the config file for the certificate tool..."
-# Try first the prod URL, if it fails try the dev URL
-if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then
-    :
-elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then
-    :
-else
-    echo "The config file for the certificate tool does not exist in any bucket"
-    echo "ERROR: certificates were not created"
-    exit 1
-fi
-
-# Modify the config file to set the IP to localhost
-sed -i 's/  ip:.*/  ip: "127.0.0.1"/' $CERT_CONFIG_FILE
-
-chmod 700 "$CERT_CONFIG_FILE"
-# Create the certificates
-chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A
+chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A

 # Create certs directory
 mkdir -p ${CONFIG_DIR}/certs

 # Copy Wazuh dashboard certs to install config dir
-mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/
-cp -pr /wazuh-certificates/dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem
-cp -pr /wazuh-certificates/dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem
-cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key
-cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem
-cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem
-cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem
-
-# Modify opensearch.yml config paths
-sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml
+cp /wazuh-certificates/demo.dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem
+cp /wazuh-certificates/demo.dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem
+cp /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem

 chmod -R 500 ${CONFIG_DIR}/certs
 chmod -R 400 ${CONFIG_DIR}/certs/*
@@ -0,0 +1,5 @@
+nodes:
+  # Wazuh dashboard server nodes
+  dashboard:
+    - name: demo.dashboard
+      ip: demo.dashboard
@@ -0,0 +1,155 @@
+---
+#
+# Wazuh app - App configuration file
+# Copyright (C) 2017, Wazuh Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Find more information about this on the LICENSE file.
+#
+# ======================== Wazuh app configuration file ========================
+#
+# Please check the documentation for more information on configuration options:
+# https://documentation.wazuh.com/current/installation-guide/index.html
+#
+# Also, you can check our repository:
+# https://github.com/wazuh/wazuh-dashboard-plugins
+#
+# ------------------------------- Index patterns -------------------------------
+#
+# Default index pattern to use.
+#pattern: wazuh-alerts-*
+#
+# ----------------------------------- Checks -----------------------------------
+#
+# Defines which checks must to be consider by the healthcheck
+# step once the Wazuh app starts. Values must to be true or false.
+#checks.pattern : true
+#checks.template: true
+#checks.api     : true
+#checks.setup   : true
+#checks.metaFields: true
+#
+# --------------------------------- Extensions ---------------------------------
+#
+# Defines which extensions should be activated when you add a new API entry.
+# You can change them after Wazuh app starts.
+# Values must to be true or false.
+#extensions.pci       : true
+#extensions.gdpr      : true
+#extensions.hipaa     : true
+#extensions.nist      : true
+#extensions.tsc       : true
+#extensions.audit     : true
+#extensions.oscap     : false
+#extensions.ciscat    : false
+#extensions.aws       : false
+#extensions.gcp       : false
+#extensions.virustotal: false
+#extensions.osquery   : false
+#extensions.docker    : false
+#
+# ---------------------------------- Time out ----------------------------------
+#
+# Defines maximum timeout to be used on the Wazuh app requests.
+# It will be ignored if it is bellow 1500.
+# It means milliseconds before we consider a request as failed.
+# Default: 20000
+#timeout: 20000
+#
+# -------------------------------- API selector --------------------------------
+#
+# Defines if the user is allowed to change the selected
+# API directly from the Wazuh app top menu.
+# Default: true
+#api.selector: true
+#
+# --------------------------- Index pattern selector ---------------------------
+#
+# Defines if the user is allowed to change the selected
+# index pattern directly from the Wazuh app top menu.
+# Default: true
+#ip.selector: true
+#
+# List of index patterns to be ignored
+#ip.ignore: []
+#
+# ------------------------------ wazuh-monitoring ------------------------------
+#
+# Custom setting to enable/disable wazuh-monitoring indices.
+# Values: true, false, worker
+# If worker is given as value, the app will show the Agents status
+# visualization but won't insert data on wazuh-monitoring indices.
+# Default: true
+#wazuh.monitoring.enabled: true
+#
+# Custom setting to set the frequency for wazuh-monitoring indices cron task.
+# Default: 900 (s)
+#wazuh.monitoring.frequency: 900
+#
+# Configure wazuh-monitoring-* indices shards and replicas.
+#wazuh.monitoring.shards: 2
+#wazuh.monitoring.replicas: 0
+#
+# Configure wazuh-monitoring-* indices custom creation interval.
+# Values: h (hourly), d (daily), w (weekly), m (monthly)
+# Default: d
+#wazuh.monitoring.creation: d
+#
+# Default index pattern to use for Wazuh monitoring
+#wazuh.monitoring.pattern: wazuh-monitoring-*
+#
+# --------------------------------- wazuh-cron ----------------------------------
+#
+# Customize the index prefix of predefined jobs
+# This change is not retroactive, if you change it new indexes will be created
+# cron.prefix: test
+#
+# ------------------------------ wazuh-statistics -------------------------------
+#
+# Custom setting to enable/disable statistics tasks.
+#cron.statistics.status: true
+#
+# Enter the ID of the APIs you want to save data from, leave this empty to run
+# the task on all configured APIs
+#cron.statistics.apis: []
+#
+# Define the frequency of task execution using cron schedule expressions
+#cron.statistics.interval: 0 0 * * * *
+#
+# Define the name of the index in which the documents are to be saved.
+#cron.statistics.index.name: statistics
+#
+# Define the interval in which the index will be created
+#cron.statistics.index.creation: w
+#
+# ------------------------------- App privileges --------------------------------
+#admin: true
+#
+# ---------------------------- Hide manager alerts ------------------------------
+# Hide the alerts of the manager in all dashboards and discover
+#hideManagerAlerts: false
+#
+# ------------------------------- App logging level -----------------------------
+# Set the logging level for the Wazuh App log files.
+# Default value: info
+# Allowed values: info, debug
+#logs.level: info
+#
+# -------------------------------- Enrollment DNS -------------------------------
+# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment.
+# Default value: ''
+#enrollment.dns: ''
+#
+#-------------------------------- API entries -----------------------------------
+#The following configuration is the default structure to define an API entry.
+#
+#hosts:
+#  - <id>:
+#     url: http(s)://<url>
+#     port: <port>
+#     username: <username>
+#     password: <password>
@@ -32,6 +32,11 @@ do
    fi
 done

+
+grep -q 1513629884013 $dashboard_config_file
+_config_exists=$?
+
+if [[ $_config_exists -ne 0 ]]; then
 cat << EOF >> $dashboard_config_file
 hosts:
  - 1513629884013:
@@ -41,4 +46,7 @@ hosts:
      password: $api_password
      run_as: $api_run_as
 EOF
+else
+  echo "Wazuh APP already configured"
+fi

@@ -3,25 +3,38 @@ FROM amazonlinux:2023 AS builder

 ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
-ARG TARGETARCH
-ARG wazuh_indexer_url_amd64_rpm
-ARG wazuh_indexer_url_arm64_rpm
+
+RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y
+
+COPY config/check_repository.sh /
+RUN chmod 775 /check_repository.sh && \
+    source /check_repository.sh
+
+RUN yum install wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all
+
+COPY config/opensearch.yml /

 COPY config/config.sh .

-RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \
-    indexer_url="${!URL_VAR}" && \
-    dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\
-    curl -o /wazuh-indexer.rpm "${indexer_url}" && \
-    dnf install /wazuh-indexer.rpm -y && \
-    dnf clean all && \
-    bash config.sh
+COPY config/config.yml /
+
+COPY config/action_groups.yml /
+
+COPY config/internal_users.yml /
+
+COPY config/roles_mapping.yml /
+
+COPY config/roles.yml /
+
+RUN bash config.sh

 ################################################################################
 # Build stage 1 (the actual Wazuh indexer image):
 #
 # Copy wazuh-indexer from stage 0
 # Add entrypoint
+
 ################################################################################
 FROM amazonlinux:2023

@@ -30,39 +43,47 @@ ENV USER="wazuh-indexer" \
    NAME="wazuh-indexer" \
    INSTALL_DIR="/usr/share/wazuh-indexer"

+RUN yum install curl-minimal shadow-utils findutils hostname -y

-COPY config/entrypoint.sh /
-COPY config/securityadmin.sh /
+RUN getent group $GROUP || groupadd -r -g 1000 $GROUP

-RUN yum install curl-minimal shadow-utils findutils hostname -y && \
-    yum clean all && \
-    getent group $GROUP || groupadd -r -g 1000 $GROUP && \
-    useradd --system \
+RUN useradd --system \
            --uid 1000 \
            --no-create-home \
            --home-dir $INSTALL_DIR \
            --gid $GROUP \
            --shell /sbin/nologin \
            --comment "$USER user" \
-            $USER && \
-    chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
-    mkdir -p $INSTALL_DIR && \
-    chown 1000:1000 $INSTALL_DIR && \
-    chown 1000:1000 /*.sh && \
-    mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
-    mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \
+            $USER
+
+WORKDIR $INSTALL_DIR
+
+COPY config/entrypoint.sh /
+
+COPY config/securityadmin.sh /
+
+RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
+    mkdir -p /usr/share/wazuh-indexer && \
+    chown 1000:1000 /usr/share/wazuh-indexer && \
+    chown 1000:1000 /*.sh
+
+COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer
+COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer/config
+COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
+COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
+COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
+COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
+
+RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
+    mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
    mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
-    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer    
-
-COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
-
-RUN chmod 700 $INSTALL_DIR && \
-    chmod 700 $INSTALL_DIR/config && \
-    chmod 600 $INSTALL_DIR/config/jvm.options && \
-    chmod 600 $INSTALL_DIR/config/opensearch.yml
+    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
+    chmod 700 /usr/share/wazuh-indexer && \
+    chmod 700 /usr/share/wazuh-indexer/config && \
+    chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \
+    chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml

 USER wazuh-indexer
-WORKDIR $INSTALL_DIR

 # Services ports
 EXPOSE 9200
@@ -0,0 +1,12 @@
+---
+_meta:
+  type: "actiongroups"
+  config_version: 2
+
+# ISM API permissions group
+manage_ism:
+  reserved: true
+  hidden: false
+  allowed_actions:
+  - "cluster:admin/opendistro/ism/*"
+  static: false
@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
@@ -3,6 +3,7 @@
 export DH_OPTIONS

 export NAME=wazuh-indexer
+export TARGET_DIR=${CURDIR}/debian/${NAME}

 # Package build options
 export USER=${NAME}
@@ -13,81 +14,88 @@ export LIB_DIR=/var/lib/${NAME}
 export PID_DIR=/run/${NAME}
 export INSTALLATION_DIR=/usr/share/${NAME}
 export CONFIG_DIR=${INSTALLATION_DIR}/config
-
-
-##############################################################################
-# Downloading Cert Gen Tool
-##############################################################################
+export BASE_DIR=${NAME}-*
+export INDEXER_FILE=wazuh-indexer-base.tar.xz
+export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
+export REPO_DIR=/unattended_installer

 ## Variables
 CERT_TOOL=wazuh-certs-tool.sh
-CERT_CONFIG_FILE=config.yml
-CERT_TOOL_VERSION="${WAZUH_VERSION%.*}"
-PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/
-PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/
+PASSWORD_TOOL=wazuh-passwords-tool.sh
+PACKAGES_URL=https://packages.wazuh.com/4.14/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/

-download_package() {
-    local url=$1
-    local package=$2
-    local output=$2
-    echo "Checking $url$package ..."
-    if curl -fsL "$url$package" -o "$output"; then
-        echo "Downloaded $package from $url"
-        return 0
-    else
-        return 1
-    fi
-}
+## Check if the cert tool exists in S3 buckets
+CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')

-# Download the tool to create the certificates
-echo "Downloading the tool to create the certificates..."
-# Try first the prod URL, if it fails try the dev URL
-if download_package "$PACKAGES_URL" "$CERT_TOOL"; then
-    :
-elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then
-    :
+## If cert tool exists in some bucket, download it, if not exit 1
+if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
+  curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL
+  echo "Cert tool exists in Packages bucket"
+elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
+  curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL
+  echo "Cert tool exists in Packages-dev bucket"
 else
-    echo "The tool to create the certificates does not exist in any bucket"
-    echo "ERROR: certificates were not created"
-    exit 1
+  echo "Cert tool does not exist in any bucket"
+  exit 1
 fi

-# Download the config file for the certificate tool
-echo "Downloading the config file for the certificate tool..."
-# Try first the prod URL, if it fails try the dev URL
-if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then
-    :
-elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then
-    :
+
+## Check if the password tool exists in S3 buckets
+PASSWORD_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$PASSWORD_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+PASSWORD_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$PASSWORD_TOOL | grep -E "^HTTP" | awk  '{print $2}')
+
+## If password tool exists in some bucket, download it, if not exit 1
+if [ "$PASSWORD_TOOL_PACKAGES" = "200" ]; then
+  curl -o $PASSWORD_TOOL $PACKAGES_URL$PASSWORD_TOOL
+  echo "Password tool exists in Packages bucket"
+elif [ "$PASSWORD_TOOL_PACKAGES_DEV" = "200" ]; then
+  curl -o $PASSWORD_TOOL $PACKAGES_DEV_URL$PASSWORD_TOOL
+  echo "Password tool exists in Packages-dev bucket"
 else
-    echo "The config file for the certificate tool does not exist in any bucket"
-    echo "ERROR: certificates were not created"
-    exit 1
+  echo "Password tool does not exist in any bucket"
+  exit 1
 fi

-# Modify the config file to set the IP to localhost
-sed -i 's/  ip:.*/  ip: "127.0.0.1"/' $CERT_CONFIG_FILE
+chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A

-chmod 700 "$CERT_CONFIG_FILE"
-# Create the certificates
-chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A
-
-# Copy Wazuh indexer's certificates and config files to $CONFIG_DIR
-mkdir -p ${CONFIG_DIR}/certs
-mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
-cp -pr /wazuh-certificates/node-1.pem ${CONFIG_DIR}/certs/indexer.pem
-cp -pr /wazuh-certificates/node-1-key.pem ${CONFIG_DIR}/certs/indexer-key.pem
-cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key
-cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem
-cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem
-cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem
-
-# Modify opensearch.yml config paths
-sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml
+# copy to target
+mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}
+mkdir -p ${TARGET_DIR}${CONFIG_DIR}
+mkdir -p ${TARGET_DIR}${LIB_DIR}
+mkdir -p ${TARGET_DIR}${LOG_DIR}
+mkdir -p ${TARGET_DIR}/etc/init.d
+mkdir -p ${TARGET_DIR}/etc/default
+mkdir -p ${TARGET_DIR}/usr/lib/tmpfiles.d
+mkdir -p ${TARGET_DIR}/usr/lib/sysctl.d
+mkdir -p ${TARGET_DIR}/usr/lib/systemd/system
+mkdir -p ${TARGET_DIR}${CONFIG_DIR}/certs
+# Copy Wazuh's config files for the security plugin
+cp -pr /roles_mapping.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
+cp -pr /roles.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
+cp -pr /action_groups.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
+cp -pr /internal_users.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
+cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR}
+# Copy Wazuh indexer's certificates
+cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem
+cp -pr /wazuh-certificates/demo.indexer-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer-key.pem
+cp -pr /wazuh-certificates/root-ca.key ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.key
+cp -pr /wazuh-certificates/root-ca.pem ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.pem
+cp -pr /wazuh-certificates/admin.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin.pem
+cp -pr /wazuh-certificates/admin-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin-key.pem

 # Delete xms and xmx parameters in jvm.options
+sed '/-Xms/d' -i /etc/wazuh-indexer/jvm.options
+sed '/-Xmx/d' -i /etc/wazuh-indexer/jvm.options
 sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options

-chown -R ${USER}:${GROUP} ${CONFIG_DIR}
-chmod -R 500 ${CONFIG_DIR}/certs
-chmod -R 400 ${CONFIG_DIR}/certs/*
+
+chmod -R 500 ${TARGET_DIR}${CONFIG_DIR}/certs
+chmod -R 400 ${TARGET_DIR}${CONFIG_DIR}/certs/*
+
+find ${TARGET_DIR} -type d -exec chmod 750 {} \;
+find ${TARGET_DIR} -type f -perm 644 -exec chmod 640 {} \;
+find ${TARGET_DIR} -type f -perm 664 -exec chmod 660 {} \;
+find ${TARGET_DIR} -type f -perm 755 -exec chmod 750 {} \;
+find ${TARGET_DIR} -type f -perm 744 -exec chmod 740 {} \;
@@ -0,0 +1,5 @@
+nodes:
+  # Wazuh indexer server nodes
+  indexer:
+    - name: demo.indexer
+      ip: demo.indexer
@@ -0,0 +1,74 @@
+---
+# This is the internal user database
+# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
+
+_meta:
+  type: "internalusers"
+  config_version: 2
+
+# Define your internal users here
+
+## Demo users
+
+admin:
+  hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
+  reserved: true
+  backend_roles:
+  - "admin"
+  description: "Demo admin user"
+
+kibanaserver:
+  hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
+  reserved: true
+  description: "Demo kibanaserver user"
+
+kibanaro:
+  hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
+  reserved: false
+  backend_roles:
+  - "kibanauser"
+  - "readall"
+  attributes:
+    attribute1: "value1"
+    attribute2: "value2"
+    attribute3: "value3"
+  description: "Demo kibanaro user"
+
+logstash:
+  hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
+  reserved: false
+  backend_roles:
+  - "logstash"
+  description: "Demo logstash user"
+
+readall:
+  hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
+  reserved: false
+  backend_roles:
+  - "readall"
+  description: "Demo readall user"
+
+snapshotrestore:
+  hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
+  reserved: false
+  backend_roles:
+  - "snapshotrestore"
+  description: "Demo snapshotrestore user"
+
+wazuh_admin:
+  hash: "$2y$12$d2awHiOYvZjI88VfsDON.u6buoBol0gYPJEgdG1ArKVE0OMxViFfu"
+  reserved: true
+  hidden: false
+  backend_roles: []
+  attributes: {}
+  opendistro_security_roles: []
+  static: false
+  
+wazuh_user:
+  hash: "$2y$12$BQixeoQdRubZdVf/7sq1suHwiVRnSst1.lPI2M0.GPZms4bq2D9vO"
+  reserved: true
+  hidden: false
+  backend_roles: []
+  attributes: {}
+  opendistro_security_roles: []
+  static: false  
@@ -0,0 +1,34 @@
+network.host: "0.0.0.0"
+node.name: "wazuh.indexer"
+cluster.name: "wazuh-cluster"
+path.data: /var/lib/wazuh-indexer
+path.logs: /var/log/wazuh-indexer
+discovery.type: single-node
+compatibility.override_main_response_version: true
+plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
+plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
+plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
+plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.ssl.http.enabled_ciphers:
+  - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+  - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+plugins.security.ssl.http.enabled_protocols:
+  - "TLSv1.2"
+plugins.security.authcz.admin_dn:
+- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.nodes_dn:
+- "CN=demo.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.restapi.roles_enabled:
+- "all_access"
+- "security_rest_api_access"
+plugins.security.system_indices.enabled: true
+plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
@@ -0,0 +1,171 @@
+_meta:
+  type: "roles"
+  config_version: 2
+
+# Restrict users so they can only view visualization and dashboards on kibana
+kibana_read_only:
+  reserved: true
+
+# The security REST API access role is used to assign specific users access to change the security settings through the REST API.
+security_rest_api_access:
+  reserved: true
+
+# Allows users to view monitors, destinations and alerts
+alerting_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/alerting/alerts/get'
+    - 'cluster:admin/opendistro/alerting/destination/get'
+    - 'cluster:admin/opendistro/alerting/monitor/get'
+    - 'cluster:admin/opendistro/alerting/monitor/search'
+
+# Allows users to view and acknowledge alerts
+alerting_ack_alerts:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/alerting/alerts/*'
+
+# Allows users to use all alerting functionality
+alerting_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster_monitor'
+    - 'cluster:admin/opendistro/alerting/*'
+  index_permissions:
+    - index_patterns:
+        - '*'
+      allowed_actions:
+        - 'indices_monitor'
+        - 'indices:admin/aliases/get'
+        - 'indices:admin/mappings/get'
+
+# Allow users to read Anomaly Detection detectors and results
+anomaly_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/ad/detector/info'
+    - 'cluster:admin/opendistro/ad/detector/search'
+    - 'cluster:admin/opendistro/ad/detectors/get'
+    - 'cluster:admin/opendistro/ad/result/search'
+    - 'cluster:admin/opendistro/ad/tasks/search'
+
+# Allows users to use all Anomaly Detection functionality
+anomaly_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster_monitor'
+    - 'cluster:admin/opendistro/ad/*'
+  index_permissions:
+    - index_patterns:
+        - '*'
+      allowed_actions:
+        - 'indices_monitor'
+        - 'indices:admin/aliases/get'
+        - 'indices:admin/mappings/get'
+
+# Allows users to read Notebooks
+notebooks_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/notebooks/list'
+    - 'cluster:admin/opendistro/notebooks/get'
+
+# Allows users to all Notebooks functionality
+notebooks_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/notebooks/create'
+    - 'cluster:admin/opendistro/notebooks/update'
+    - 'cluster:admin/opendistro/notebooks/delete'
+    - 'cluster:admin/opendistro/notebooks/get'
+    - 'cluster:admin/opendistro/notebooks/list'
+
+# Allows users to read and download Reports
+reports_instances_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/reports/instance/list'
+    - 'cluster:admin/opendistro/reports/instance/get'
+    - 'cluster:admin/opendistro/reports/menu/download'
+
+# Allows users to read and download Reports and Report-definitions
+reports_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/reports/definition/get'
+    - 'cluster:admin/opendistro/reports/definition/list'
+    - 'cluster:admin/opendistro/reports/instance/list'
+    - 'cluster:admin/opendistro/reports/instance/get'
+    - 'cluster:admin/opendistro/reports/menu/download'
+
+# Allows users to all Reports functionality
+reports_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/reports/definition/create'
+    - 'cluster:admin/opendistro/reports/definition/update'
+    - 'cluster:admin/opendistro/reports/definition/on_demand'
+    - 'cluster:admin/opendistro/reports/definition/delete'
+    - 'cluster:admin/opendistro/reports/definition/get'
+    - 'cluster:admin/opendistro/reports/definition/list'
+    - 'cluster:admin/opendistro/reports/instance/list'
+    - 'cluster:admin/opendistro/reports/instance/get'
+    - 'cluster:admin/opendistro/reports/menu/download'
+
+# Allows users to use all asynchronous-search functionality
+asynchronous_search_full_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/asynchronous_search/*'
+  index_permissions:
+    - index_patterns:
+        - '*'
+      allowed_actions:
+        - 'indices:data/read/search*'
+
+# Allows users to read stored asynchronous-search results
+asynchronous_search_read_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opendistro/asynchronous_search/get'
+
+wazuh_ui_user:
+  reserved: true
+  hidden: false
+  cluster_permissions: []
+  index_permissions:
+  - index_patterns:
+    - "wazuh-*"
+    dls: ""
+    fls: []
+    masked_fields: []
+    allowed_actions:
+    - "read"
+  tenant_permissions: []
+  static: false
+
+wazuh_ui_admin:
+  reserved: true
+  hidden: false
+  cluster_permissions: []
+  index_permissions:
+  - index_patterns:
+    - "wazuh-*"
+    dls: ""
+    fls: []
+    masked_fields: []
+    allowed_actions:
+    - "read"
+    - "delete"
+    - "manage"
+    - "index"
+  tenant_permissions: []
+  static: false
+
+# ISM API permissions role
+manage_ism:
+  reserved: true
+  hidden: false
+  cluster_permissions:
+  - "manage_ism"
+  static: false
@@ -0,0 +1,78 @@
+---
+# In this file users, backendroles and hosts can be mapped to Wazuh indexer Security roles.
+# Permissions for Wazuh indexer roles are configured in roles.yml
+
+_meta:
+  type: "rolesmapping"
+  config_version: 2
+
+# Define your roles mapping here
+
+## Demo roles mapping
+
+all_access:
+  reserved: false
+  backend_roles:
+  - "admin"
+  description: "Maps admin to all_access"
+
+own_index:
+  reserved: false
+  users:
+  - "*"
+  description: "Allow full access to an index named like the username"
+
+logstash:
+  reserved: false
+  backend_roles:
+  - "logstash"
+
+kibana_user:
+  reserved: false
+  backend_roles:
+  - "kibanauser"
+  users:
+  - "wazuh_user"
+  - "wazuh_admin"
+  description: "Maps kibanauser to kibana_user"
+
+readall:
+  reserved: false
+  backend_roles:
+  - "readall"
+
+manage_snapshots:
+  reserved: false
+  backend_roles:
+  - "snapshotrestore"
+
+kibana_server:
+  reserved: true
+  users:
+  - "kibanaserver"
+
+wazuh_ui_admin:
+  reserved: true
+  hidden: false
+  backend_roles: []
+  hosts: []
+  users:
+  - "wazuh_admin"
+  - "kibanaserver"
+  and_backend_roles: []
+
+wazuh_ui_user:
+  reserved: true
+  hidden: false
+  backend_roles: []
+  hosts: []
+  users:
+  - "wazuh_user"
+  and_backend_roles: []
+
+# ISM API permissions role mapping
+manage_ism:
+  reserved: true
+  hidden: false
+  users:
+  - "kibanaserver"
@@ -5,37 +5,60 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh

 ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
+ARG FILEBEAT_TEMPLATE_BRANCH
+ARG FILEBEAT_CHANNEL=filebeat-oss
+ARG FILEBEAT_VERSION=7.10.2
+ARG FILEBEAT_REVISION=2
+ARG WAZUH_FILEBEAT_MODULE
 ARG S6_VERSION="v2.2.0.3"
 ARG TARGETARCH
-ARG wazuh_manager_url_amd64_rpm
-ARG wazuh_manager_url_arm64_rpm

-RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
-    manager_url="${!URL_VAR}" && \
-    dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
-    dnf clean all && \
-    curl -o /wazuh-manager.rpm "${manager_url}" && \
-    dnf install /wazuh-manager.rpm -y && \
-    dnf clean all && \
-    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-    -o /tmp/s6-overlay-amd64.tar.gz && \
-    tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
-    tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \
-    rm  /tmp/s6-overlay-amd64.tar.gz
+RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
+    yum clean all
+
+COPY config/check_repository.sh /
+COPY config/filebeat_module.sh /
+COPY config/permanent_data.env config/permanent_data.sh /
+
+RUN chmod 775 /check_repository.sh
+RUN source /check_repository.sh
+
+RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all && \
+    chmod 775 /filebeat_module.sh && \
+    source /filebeat_module.sh && \
+    rm /filebeat_module.sh && \
+    S6_ARCH="amd64" && \
+    if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
+    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
+    -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
+    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
+    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
+    rm  /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
+    rm -f /var/ossec/etc/sslmanager.key && \
+    rm -f /var/ossec/etc/sslmanager.cert

 COPY config/etc/ /etc/
 COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py

+COPY config/filebeat.yml /etc/filebeat/
+
+RUN chmod go-w /etc/filebeat/filebeat.yml
+
+ADD https://raw.githubusercontent.com/wazuh/wazuh/$FILEBEAT_TEMPLATE_BRANCH/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
+RUN chmod go-w /etc/filebeat/wazuh-template.json
+
 # Prepare permanent data
 # Sync calls are due to https://github.com/docker/docker/issues/9547

-COPY config/permanent_data.env config/permanent_data.sh /
-
 #Make mount directories for keep permissions

 RUN mkdir -p /var/ossec/var/multigroups && \
    chown root:wazuh /var/ossec/var/multigroups && \
    chmod 770 /var/ossec/var/multigroups && \
+    mkdir -p /var/ossec/agentless && \
+    chown root:wazuh /var/ossec/agentless && \
+    chmod 770 /var/ossec/agentless && \
    mkdir -p /var/ossec/active-response/bin && \
    chown root:wazuh /var/ossec/active-response/bin && \
    chmod 770 /var/ossec/active-response/bin && \
@@ -43,6 +66,8 @@ RUN mkdir -p /var/ossec/var/multigroups && \
    sync && /permanent_data.sh && \
    sync && rm /permanent_data.sh

+RUN rm /etc/yum.repos.d/wazuh.repo
+
 # Services ports
 EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp

@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
@@ -6,8 +6,6 @@ source /permanent_data.env

 WAZUH_INSTALL_PATH=/var/ossec
 WAZUH_CONFIG_MOUNT=/wazuh-config-mount
-AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
-

 ##############################################################################
 # Aux functions
@@ -70,8 +68,17 @@ apply_exclusion_data() {
        mkdir -p ${DIR}
      fi

+      safe_cp() {
+          if cp -p "$1" "$2" 2>/dev/null; then
+              return 0
+          else
+              echo "Warning: Could not copy $1 (may be read-only)"
+              return 0
+          fi
+      }
+
      print "Updating ${exclusion_file}"
-      exec_cmd "cp -p ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file} ${exclusion_file}"
+      exec_cmd "safe_cp ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file} ${exclusion_file}"
    fi
  done
 }
@@ -206,13 +213,10 @@ main() {
  # Remove some files in permanent_data (i.e. .template.db)
  remove_data_files

-  # Generate wazuh-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
-  if [ $AUTO_ENROLLMENT_ENABLED == true ]
+  # Create wazuh-authd key and cert if not present
+  if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
  then
-    if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
-    then
-      create_ossec_key_cert
-    fi
+    create_ossec_key_cert
  fi

  # Mount selected files (WAZUH_CONFIG_MOUNT) to container
@@ -0,0 +1,51 @@
+#!/usr/bin/with-contenv bash
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+
+set -e
+
+if [ "$INDEXER_URL" != "" ]; then
+  >&2 echo "Customize Elasticsearch output IP"
+  sed -i "s|hosts:.*|hosts: ['$INDEXER_URL']|g" /etc/filebeat/filebeat.yml
+fi
+
+# Configure filebeat.yml security settings
+
+if [ "$INDEXER_USERNAME" != "" ]; then
+  >&2 echo "Configuring username."
+  sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$INDEXER_PASSWORD" != "" ]; then
+  >&2 echo "Configuring password."
+  sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
+  >&2 echo "Configuring SSL verification mode."
+  sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
+  >&2 echo "Configuring Certificate Authorities."
+  sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_CERTIFICATE" != "" ]; then
+  >&2 echo "Configuring SSL Certificate."
+  sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_KEY" != "" ]; then
+  >&2 echo "Configuring SSL Key."
+  sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
+fi
+
+
+chmod go-w /etc/filebeat/filebeat.yml || true
+chown root: /etc/filebeat/filebeat.yml || true
@@ -60,6 +60,12 @@ function_wazuh_migration(){
      chown wazuh:wazuh /var/ossec/etc/rules/*
      chmod 660 /var/ossec/etc/rules/*

+      if [ -e /wazuh-migration/data/agentless/.passlist ]; then
+        \cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist
+        chown root:wazuh /var/ossec/agentless/.passlist
+        chmod 640 /var/ossec/agentless/.passlist
+      fi
+
      \cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
      chown wazuh:wazuh /var/ossec/queue/db/global.db
      chmod 640 /var/ossec/queue/db/global.db
@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+echo >&2 "Filebeat exited. code=${1}"
+
+# terminate other services to exit from the container
+exec s6-svscanctl -t /var/run/s6/services
+
@@ -0,0 +1,4 @@
+#!/usr/bin/with-contenv sh
+echo >&2 "starting Filebeat"
+
+exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
@@ -0,0 +1,31 @@
+
+# Wazuh - Filebeat configuration file
+filebeat.modules:
+  - module: wazuh
+    alerts:
+      enabled: true
+    archives:
+      enabled: false
+
+setup.template.json.enabled: true
+setup.template.overwrite: true
+setup.template.json.path: '/etc/filebeat/wazuh-template.json'
+setup.template.json.name: 'wazuh'
+setup.ilm.enabled: false
+output.elasticsearch:
+  hosts: ['https://wazuh.indexer:9200']
+  #username:
+  #password:
+  #ssl.verification_mode:
+  #ssl.certificate_authorities:
+  #ssl.certificate:
+  #ssl.key:
+
+logging.metrics.enabled: false
+
+seccomp:
+  default_action: allow
+  syscalls:
+  - action: allow
+    names:
+    - rseq
@@ -0,0 +1,11 @@
+## variables
+REPOSITORY="packages-dev.wazuh.com/pre-release"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  REPOSITORY="packages.wazuh.com/4.x"
+fi
+
+yum install filebeat-${FILEBEAT_VERSION}-${FILEBEAT_REVISION} -y && \
+curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
@@ -4,15 +4,28 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
 PERMANENT_DATA[((i++))]="/var/ossec/etc"
 PERMANENT_DATA[((i++))]="/var/ossec/logs"
 PERMANENT_DATA[((i++))]="/var/ossec/queue"
+PERMANENT_DATA[((i++))]="/var/ossec/agentless"
 PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
+PERMANENT_DATA[((i++))]="/var/ossec/integrations"
 PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin"
 PERMANENT_DATA[((i++))]="/var/ossec/wodles"
+PERMANENT_DATA[((i++))]="/etc/filebeat"

 export PERMANENT_DATA

 # Files mounted in a volume that should not be permanent
 i=0
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
@@ -28,6 +41,18 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
@@ -72,6 +97,11 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes"
+PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json"
+PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/filebeat.yml"
 export PERMANENT_DATA_EXCP

 # Files mounted in a volume that should be deleted
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
 The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:

 ```
-$ build-docker-images/build-images.sh -v 5.0.0
+$ build-docker-images/build-images.sh -v 4.14.3
 ```

 To get all the available script options use the -h or --help option:
@@ -23,9 +23,10 @@ $ build-docker-images/build-images.sh -h

 Usage: build-docker-images/build-images.sh [OPTIONS]

-    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default.
+    -d, --dev <ref>              [Optional] Set the development stage you want to build, example alpha0 or beta1, not used by default.
+    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default 0.4.
    -r, --revision <rev>         [Optional] Package revision. By default 1
-    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
+    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 4.14.3.
    -h, --help                   Show this help.

 ```
@@ -1,6 +1,6 @@
 # Development Guide - Introduction

-Welcome to the Development Guide for Wazuh-docker version 5.0.0 This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
+Welcome to the Development Guide for Wazuh-docker version 4.14.3. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.

 ## Purpose of This Guide

@@ -1,6 +1,6 @@
 # Development Guide - Setup Environment

-This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 5.0.0). A proper setup is crucial for building images, running tests, and contributing effectively.
+This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.14.3). A proper setup is crucial for building images, running tests, and contributing effectively.

 ## Prerequisites

@@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements:
 Follow these steps to prepare your development environment:

 1.  **Clone the Repository**:
-    Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `5.0.0`.
+    Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.14.3`.

    ```bash
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
    cd wazuh-docker
-    git checkout v5.0.0
+    git checkout v4.14.3
    ```

 2.  **Verify Docker Installation**:
@@ -1,6 +1,6 @@
 # Reference Manual - Description

-This section provides a detailed description of Wazuh-docker (version 5.0.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
+This section provides a detailed description of Wazuh-docker (version 4.14.3), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.

 ## What is Wazuh?

@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi

 ## Core Components in Wazuh-Docker

-The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 5.0.0:
+The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.14.3:

 1.  **Wazuh Manager**:
    -   The central component that collects and analyzes data from deployed Wazuh agents.
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
 2.  **Wazuh Indexer**:
    -   A highly scalable, full-text search and analytics engine.
    -   Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
-    -   The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 5.0.0, this is typically an OpenSearch-based component.
+    -   The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.14.3, this is typically an OpenSearch-based component.

 3.  **Wazuh Dashboard**:
    -   A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
@@ -1,6 +1,6 @@
 # Reference Manual - Introduction

-Welcome to the Reference Manual for Wazuh-Docker, version 5.0.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
+Welcome to the Reference Manual for Wazuh-Docker, version 4.14.3. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.

 ## Purpose of This Manual

@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
 -   If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
 -   For specific terms or concepts, consult the [Glossary](glossary.md).

-This manual refers to version 5.0.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
+This manual refers to version 4.14.3 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
@@ -2,7 +2,7 @@

 ### 1. Wazuh Manager Configuration

-* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
+* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, integrations, clustering, and more.
    * **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) .

 ### 2. Wazuh Indexer Configuration
@@ -29,4 +29,4 @@
        ```


-Consult the official Wazuh documentation for version 5.0.0 for detailed information on all possible configuration parameters for each component.
+Consult the official Wazuh documentation for version 4.14.3 for detailed information on all possible configuration parameters for each component.
@@ -1,6 +1,6 @@
 # Reference Manual - Configuration

-This section details how to configure your Wazuh-Docker deployment (version 5.0.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
+This section details how to configure your Wazuh-Docker deployment (version 4.14.3). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.

 ## Overview of Configuration Methods

@@ -1,6 +1,6 @@
 # Reference Manual - Deployment

-This section provides detailed instructions for deploying Wazuh-Docker (version 5.0.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
+This section provides detailed instructions for deploying Wazuh-Docker (version 4.14.3) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.

 ## Overview of Deployment Options

@@ -24,11 +24,11 @@ Ensure you have:

 -   Met all the [System Requirements](ref/getting-started/requirements.md).
 -   Installed Docker and Docker Compose on your host(s).
-   Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files.
+-   Cloned the `wazuh-docker` repository (version `4.14.3`) or downloaded the necessary deployment files.
    ```bash
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
    cd wazuh-docker
-    git checkout v5.0.0
+    git checkout v4.14.3
    ```
 -   Made a backup of any existing Wazuh data if you are migrating or upgrading.

@@ -1,6 +1,6 @@
 # Reference Manual - Getting Started

-This section guides you through the initial steps to get your Wazuh-docker (version 5.0.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
+This section guides you through the initial steps to get your Wazuh-docker (version 4.14.3) environment up and running. We will cover the prerequisites and point you to the deployment instructions.

 ## Overview

@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
    Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.

 2.  **Obtain Wazuh-docker Configuration**:
-    You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 5.0.0.
+    You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.14.3.
    ```bash
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
    cd wazuh-docker
-    git checkout v5.0.0
+    git checkout v4.14.3
    # Navigate to the specific docker-compose directory, e.g., single-node or multi-node
    # cd docker-compose/single-node/ (example path)
    ```
@@ -1,6 +1,6 @@
 # Reference Manual - Requirements

-Before deploying Wazuh-Docker (version 5.0.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
+Before deploying Wazuh-Docker (version 4.14.3), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.

 ## Host System Requirements

@@ -1,6 +1,6 @@
 # Reference Manual - Glossary

-This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 5.0.0).
+This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.14.3).

 ---

@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their

 **D**

-   **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 5.0.0, this is typically OpenSearch Dashboards.
+-   **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.14.3, this is typically OpenSearch Dashboards.
 -   **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
 -   **Docker**: An open platform for developing, shipping, and running applications inside containers.
 -   **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their

 **I**

-   **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 5.0.0, this is typically OpenSearch.
+-   **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.14.3, this is typically OpenSearch.

 **L**

@@ -1,9 +1,27 @@
-# Certificate creation image build
+# Certificate Creation Image Build

-The dockerfile hosted in this directory is used to build the image used to boot Wazuh's single node and multi node stacks.
+The dockerfile hosted in this directory is used to build the image required for generating Wazuh Docker single-node and multi-node certificate files

-To create the image, the following command must be executed:
+## Pre-requisites

+### QEMU
+
+Set up QEMU to enable building multi-architecture Docker images
+
+Useful documentation:
+
+- https://www.qemu.org/download/
+- https://docs.docker.com/build/building/multi-platform/#qemu
+
+## Procedure
+
+Run the following script to build the wazuh-certs-generator docker image
+
+```console
+./build-image.sh -v <IMAGE_TAG> [-m] [-rg <REGISTRY>]
 ```
-$ docker build -t wazuh/wazuh-certs-generator:0.0.3 .
-```
+
+- Replace <IMAGE_TAG> with the new image desired tag.
+- Use the `-m` flag to build a multi-architecture image (supports both `amd64` and `arm64`)
+  - If multiarch build is enabled, the script will attempt to push the image to the specified registry. This image upload will only work if credentials are properly configured.
+- Use the `-rg <REGISTRY>` parameter to specify a custom Docker registry (default is Docker Hub)
@@ -0,0 +1,107 @@
+#!/bin/bash
+
+# Wazuh package generator
+# Copyright (C) 2023, Wazuh Inc.
+#
+# This program is a free software; you can redistribute it
+# and/or modify it under the terms of the GNU General Public
+# License (version 2) as published by the FSF - Free Software
+# Foundation.
+
+WAZUH_CERTS_IMAGE_VERSION="0.0.4"
+WAZUH_REGISTRY="docker.io"
+
+# -----------------------------------------------------------------------------
+
+trap ctrl_c INT
+
+clean() {
+    exit_code=$1
+    exit ${exit_code}
+}
+
+ctrl_c() {
+    clean 1
+}
+
+# -----------------------------------------------------------------------------
+
+build() {
+    IMAGE_TAG="${WAZUH_CERTS_IMAGE_VERSION}"
+
+    echo WAZUH_REGISTRY=$WAZUH_REGISTRY > .env
+    echo IMAGE_TAG=$IMAGE_TAG >> .env
+
+    set -a
+    source .env
+    set +a
+
+    if [ "${MULTIARCH}" ]; then
+        docker buildx bake \
+            --file build-image.yml \
+            --set *.platform=linux/amd64,linux/arm64 \
+            --push \
+            --no-cache || clean 1
+    else
+        docker buildx bake \
+            --file build-image.yml \
+            --load \
+            --no-cache || clean 1
+    fi
+    return 0
+}
+
+# -----------------------------------------------------------------------------
+
+help() {
+    echo
+    echo "Usage: $0 [OPTIONS]"
+    echo
+    echo "    -v, --version <ver>      [Optional] Set the image version. By default ${WAZUH_CERTS_IMAGE_VERSION}."
+    echo "    -rg, --registry <reg>    [Optional] Set the Docker registry to push the images."
+    echo "    -m, --multiarch          [Optional] Enable multi-architecture builds."
+    echo "    -h, --help               Show this help."
+    echo
+    exit $1
+}
+
+# -----------------------------------------------------------------------------
+
+main() {
+    while [ -n "${1}" ]
+    do
+        case "${1}" in
+        "-h"|"--help")
+            help 0
+            ;;
+        "-m"|"--multiarch")
+            MULTIARCH="true"
+            shift
+            ;;
+        "-rg"|"--registry")
+            if [ -n "${2}" ]; then
+                WAZUH_REGISTRY="${2}"
+                shift 2
+            else
+                help 1
+            fi
+            ;;
+        "-v"|"--version")
+            if [ -n "$2" ]; then
+                WAZUH_CERTS_IMAGE_VERSION="$2"
+                shift 2
+            else
+                help 1
+            fi
+            ;;
+        *)
+            help 1
+        esac
+    done
+
+    build || clean 1
+
+    clean 0
+}
+
+main "$@"
@@ -0,0 +1,8 @@
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+services:
+  wazuh.certs.generator:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: ${WAZUH_REGISTRY}/wazuh/wazuh-certs-generator:${IMAGE_TAG}
+    hostname: wazuh-certs-generator
@@ -80,6 +80,13 @@ docker volume create \
           multi-node_master-wazuh-var-multigroups
 ```
 ```
+docker volume create \
+           --label com.docker.compose.project=multi-node \
+           --label com.docker.compose.version=1.25.0 \
+           --label com.docker.compose.volume=master-wazuh-integrations \
+           multi-node_master-wazuh-integrations
+```
+```
 docker volume create \
           --label com.docker.compose.project=multi-node \
           --label com.docker.compose.version=1.25.0 \
@@ -87,6 +94,13 @@ docker volume create \
           multi-node_master-wazuh-active-response
 ```
 ```
+docker volume create \
+           --label com.docker.compose.project=multi-node \
+           --label com.docker.compose.version=1.25.0 \
+           --label com.docker.compose.volume=master-wazuh-agentless \
+           multi-node_master-wazuh-agentless
+```
+```
 docker volume create \
           --label com.docker.compose.project=multi-node \
           --label com.docker.compose.version=1.25.0 \
@@ -143,6 +157,13 @@ docker volume create \
           multi-node_worker-wazuh-var-multigroups
 ```
 ```
+docker volume create \
+           --label com.docker.compose.project=multi-node \
+           --label com.docker.compose.version=1.25.0 \
+           --label com.docker.compose.volume=worker-wazuh-integrations \
+           multi-node_worker-wazuh-integrations
+```
+```
 docker volume create \
           --label com.docker.compose.project=multi-node \
           --label com.docker.compose.version=1.25.0 \
@@ -150,6 +171,13 @@ docker volume create \
           multi-node_worker-wazuh-active-response
 ```
 ```
+docker volume create \
+           --label com.docker.compose.project=multi-node \
+           --label com.docker.compose.version=1.25.0 \
+           --label com.docker.compose.volume=worker-wazuh-agentless \
+           multi-node_worker-wazuh-agentless
+```
+```
 docker volume create \
           --label com.docker.compose.project=multi-node \
           --label com.docker.compose.version=1.25.0 \
@@ -220,12 +248,24 @@ docker container run --rm -it \
           alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
+docker container run --rm -it \
+           -v wazuh-docker_ossec-integrations:/from \
+           -v multi-node_master-wazuh-integrations:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+```
+```
 docker container run --rm -it \
           -v wazuh-docker_ossec-active-response:/from \
           -v multi-node_master-wazuh-active-response:/to \
           alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
+docker container run --rm -it \
+           -v wazuh-docker_ossec-agentless:/from \
+           -v multi-node_master-wazuh-agentless:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+```
+```
 docker container run --rm -it \
           -v wazuh-docker_ossec-wodles:/from \
           -v multi-node_master-wazuh-wodles:/to \
@@ -274,12 +314,24 @@ docker container run --rm -it \
           alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
+docker container run --rm -it \
+           -v wazuh-docker_worker-ossec-integrations:/from \
+           -v multi-node_worker-wazuh-integrations:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+```
+```
 docker container run --rm -it \
           -v wazuh-docker_worker-ossec-active-response:/from \
           -v multi-node_worker-wazuh-active-response:/to \
           alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
+docker container run --rm -it \
+           -v wazuh-docker_worker-ossec-agentless:/from \
+           -v multi-node_worker-wazuh-agentless:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+```
+```
 docker container run --rm -it \
           -v wazuh-docker_worker-ossec-wodles:/from \
           -v multi-node_worker-wazuh-wodles:/to \
@@ -1,10 +1,24 @@
 <ossec_config>
  <global>
-    <agents_disconnection_time>15m</agents_disconnection_time>
+    <jsonout_output>yes</jsonout_output>
+    <alerts_log>yes</alerts_log>
+    <logall>no</logall>
+    <logall_json>no</logall_json>
+    <email_notification>no</email_notification>
+    <smtp_server>smtp.example.wazuh.com</smtp_server>
+    <email_from>wazuh@example.wazuh.com</email_from>
+    <email_to>recipient@example.wazuh.com</email_to>
+    <email_maxperhour>12</email_maxperhour>
+    <email_log_source>alerts.log</email_log_source>
+    <agents_disconnection_time>10m</agents_disconnection_time>
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
-    <update_check>yes</update_check>
  </global>

+  <alerts>
+    <log_alert_level>3</log_alert_level>
+    <email_alert_level>12</email_alert_level>
+  </alerts>
+
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  <logging>
    <log_format>plain</log_format>
@@ -20,6 +34,8 @@
  <!-- Policy monitoring -->
  <rootcheck>
    <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
@@ -29,12 +45,31 @@
    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>43200</frequency>

-    <skip_nfs>yes</skip_nfs>
+    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>

-    <ignore>/var/lib/containerd</ignore>
-    <ignore>/var/lib/docker/overlay2</ignore>
+    <skip_nfs>yes</skip_nfs>
  </rootcheck>

+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <!-- Osquery integration -->
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
  <!-- System inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
@@ -46,15 +81,9 @@
    <packages>yes</packages>
    <ports all="yes">yes</ports>
    <processes>yes</processes>
-    <users>yes</users>
-    <groups>yes</groups>
-    <services>yes</services>
-    <browser_extensions>yes</browser_extensions>

    <!-- Database synchronization settings -->
    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>
@@ -63,13 +92,7 @@
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
-
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
-      <max_eps>10</max_eps>
-    </synchronization>
+    <skip_nfs>yes</skip_nfs>
  </sca>

  <vulnerability-detection>
@@ -101,6 +124,8 @@
    <!-- Frequency that syscheck is executed default every 12 hours -->
    <frequency>43200</frequency>

+    <scan_on_start>yes</scan_on_start>
+
    <!-- Generate alert when new file detected -->
    <alert_new_files>yes</alert_new_files>

@@ -140,12 +165,13 @@
    <process_priority>10</process_priority>

    <!-- Maximum output throughput -->
-    <max_eps>50</max_eps>
+    <max_eps>100</max_eps>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
+      <max_interval>1h</max_interval>
      <max_eps>10</max_eps>
    </synchronization>
  </syscheck>
@@ -240,6 +266,13 @@
    <rule_dir>etc/rules</rule_dir>
  </ruleset>

+  <rule_test>
+    <enabled>yes</enabled>
+    <threads>1</threads>
+    <max_sessions>64</max_sessions>
+    <session_timeout>15m</session_timeout>
+  </rule_test>
+
  <!-- Configuration for wazuh-authd -->
  <auth>
    <disabled>no</disabled>
@@ -272,19 +305,9 @@
 </ossec_config>

 <ossec_config>
-  <localfile>
-    <log_format>journald</log_format>
-    <location>journald</location>
-  </localfile>
-
-  <localfile>
-    <log_format>audit</log_format>
-    <location>/var/log/audit/audit.log</location>
-  </localfile>
-
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

-</ossec_config>
+</ossec_config>
@@ -1,10 +1,24 @@
 <ossec_config>
  <global>
-    <agents_disconnection_time>15m</agents_disconnection_time>
+    <jsonout_output>yes</jsonout_output>
+    <alerts_log>yes</alerts_log>
+    <logall>no</logall>
+    <logall_json>no</logall_json>
+    <email_notification>no</email_notification>
+    <smtp_server>smtp.example.wazuh.com</smtp_server>
+    <email_from>wazuh@example.wazuh.com</email_from>
+    <email_to>recipient@example.wazuh.com</email_to>
+    <email_maxperhour>12</email_maxperhour>
+    <email_log_source>alerts.log</email_log_source>
+    <agents_disconnection_time>10m</agents_disconnection_time>
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
-    <update_check>yes</update_check>
  </global>

+  <alerts>
+    <log_alert_level>3</log_alert_level>
+    <email_alert_level>12</email_alert_level>
+  </alerts>
+
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  <logging>
    <log_format>plain</log_format>
@@ -20,6 +34,8 @@
  <!-- Policy monitoring -->
  <rootcheck>
    <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
@@ -29,12 +45,31 @@
    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>43200</frequency>

-    <skip_nfs>yes</skip_nfs>
+    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>

-    <ignore>/var/lib/containerd</ignore>
-    <ignore>/var/lib/docker/overlay2</ignore>
+    <skip_nfs>yes</skip_nfs>
  </rootcheck>

+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <!-- Osquery integration -->
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
  <!-- System inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
@@ -46,15 +81,9 @@
    <packages>yes</packages>
    <ports all="yes">yes</ports>
    <processes>yes</processes>
-    <users>yes</users>
-    <groups>yes</groups>
-    <services>yes</services>
-    <browser_extensions>yes</browser_extensions>

    <!-- Database synchronization settings -->
    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>
@@ -63,13 +92,7 @@
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
-
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
-      <max_eps>10</max_eps>
-    </synchronization>
+    <skip_nfs>yes</skip_nfs>
  </sca>

  <vulnerability-detection>
@@ -101,6 +124,8 @@
    <!-- Frequency that syscheck is executed default every 12 hours -->
    <frequency>43200</frequency>

+    <scan_on_start>yes</scan_on_start>
+
    <!-- Generate alert when new file detected -->
    <alert_new_files>yes</alert_new_files>

@@ -140,12 +165,13 @@
    <process_priority>10</process_priority>

    <!-- Maximum output throughput -->
-    <max_eps>50</max_eps>
+    <max_eps>100</max_eps>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
+      <max_interval>1h</max_interval>
      <max_eps>10</max_eps>
    </synchronization>
  </syscheck>
@@ -240,6 +266,13 @@
    <rule_dir>etc/rules</rule_dir>
  </ruleset>

+  <rule_test>
+    <enabled>yes</enabled>
+    <threads>1</threads>
+    <max_sessions>64</max_sessions>
+    <session_timeout>15m</session_timeout>
+  </rule_test>
+
  <!-- Configuration for wazuh-authd -->
  <auth>
    <disabled>no</disabled>
@@ -272,19 +305,9 @@
 </ossec_config>

 <ossec_config>
-  <localfile>
-    <log_format>journald</log_format>
-    <location>journald</location>
-  </localfile>
-
-  <localfile>
-    <log_format>audit</log_format>
-    <location>/var/log/audit/audit.log</location>
-  </localfile>
-
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

-</ossec_config>
+</ossec_config>
@@ -2,7 +2,7 @@ server.host: 0.0.0.0
 server.port: 5601
 opensearch.hosts: https://wazuh1.indexer:9200
 opensearch.ssl.verificationMode: certificate
-opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
+opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
 opensearch_security.multitenancy.enabled: false
 opensearch_security.readonly_mode.roles: ["kibana_read_only"]
 server.ssl.enabled: true
@@ -1,6 +1,6 @@
 network.host: wazuh1.indexer
 node.name: wazuh1.indexer
-cluster.initial_cluster_manager_nodes:
+cluster.initial_master_nodes:
        - wazuh1.indexer
        - wazuh2.indexer
        - wazuh3.indexer
@@ -21,6 +21,13 @@ plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/c
 plugins.security.ssl.http.enabled: true
 plugins.security.ssl.transport.enforce_hostname_verification: false
 plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.ssl.http.enabled_ciphers:
+  - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+  - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+plugins.security.ssl.http.enabled_protocols:
+  - "TLSv1.2"
 plugins.security.authcz.admin_dn:
 - "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
 plugins.security.check_snapshot_restore_write_privileges: true
@@ -35,3 +42,4 @@ plugins.security.restapi.roles_enabled:
 - "security_rest_api_access"
 plugins.security.allow_default_init_securityindex: true
 cluster.routing.allocation.disk.threshold_enabled: false
+compatibility.override_main_response_version: true
@@ -1,6 +1,6 @@
 network.host: wazuh2.indexer
 node.name: wazuh2.indexer
-cluster.initial_cluster_manager_nodes:
+cluster.initial_master_nodes:
        - wazuh1.indexer
        - wazuh2.indexer
        - wazuh3.indexer
@@ -21,6 +21,13 @@ plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/c
 plugins.security.ssl.http.enabled: true
 plugins.security.ssl.transport.enforce_hostname_verification: false
 plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.ssl.http.enabled_ciphers:
+  - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+  - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+plugins.security.ssl.http.enabled_protocols:
+  - "TLSv1.2"
 plugins.security.authcz.admin_dn:
 - "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
 plugins.security.check_snapshot_restore_write_privileges: true
@@ -35,3 +42,4 @@ plugins.security.restapi.roles_enabled:
 - "security_rest_api_access"
 plugins.security.allow_default_init_securityindex: true
 cluster.routing.allocation.disk.threshold_enabled: false
+compatibility.override_main_response_version: true
@@ -1,6 +1,6 @@
 network.host: wazuh3.indexer
 node.name: wazuh3.indexer
-cluster.initial_cluster_manager_nodes:
+cluster.initial_master_nodes:
        - wazuh1.indexer
        - wazuh2.indexer
        - wazuh3.indexer
@@ -21,6 +21,13 @@ plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/c
 plugins.security.ssl.http.enabled: true
 plugins.security.ssl.transport.enforce_hostname_verification: false
 plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.ssl.http.enabled_ciphers:
+  - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+  - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+plugins.security.ssl.http.enabled_protocols:
+  - "TLSv1.2"
 plugins.security.authcz.admin_dn:
 - "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
 plugins.security.check_snapshot_restore_write_privileges: true
@@ -35,3 +42,4 @@ plugins.security.restapi.roles_enabled:
 - "security_rest_api_access"
 plugins.security.allow_default_init_securityindex: true
 cluster.routing.allocation.disk.threshold_enabled: false
+compatibility.override_main_response_version: true
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
  wazuh.master:
-    image: wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:4.14.3
    hostname: wazuh.master
    restart: always
    ulimits:
@@ -31,7 +31,9 @@ services:
      - master-wazuh-logs:/var/ossec/logs
      - master-wazuh-queue:/var/ossec/queue
      - master-wazuh-var-multigroups:/var/ossec/var/multigroups
+      - master-wazuh-integrations:/var/ossec/integrations
      - master-wazuh-active-response:/var/ossec/active-response/bin
+      - master-wazuh-agentless:/var/ossec/agentless
      - master-wazuh-wodles:/var/ossec/wodles
      - master-filebeat-etc:/etc/filebeat
      - master-filebeat-var:/var/lib/filebeat
@@ -41,7 +43,7 @@ services:
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

  wazuh.worker:
-    image: wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:4.14.3
    hostname: wazuh.worker
    restart: always
    ulimits:
@@ -65,7 +67,9 @@ services:
      - worker-wazuh-logs:/var/ossec/logs
      - worker-wazuh-queue:/var/ossec/queue
      - worker-wazuh-var-multigroups:/var/ossec/var/multigroups
+      - worker-wazuh-integrations:/var/ossec/integrations
      - worker-wazuh-active-response:/var/ossec/active-response/bin
+      - worker-wazuh-agentless:/var/ossec/agentless
      - worker-wazuh-wodles:/var/ossec/wodles
      - worker-filebeat-etc:/etc/filebeat
      - worker-filebeat-var:/var/lib/filebeat
@@ -75,7 +79,7 @@ services:
      - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf

  wazuh1.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:4.14.3
    hostname: wazuh1.indexer
    restart: always
    ports:
@@ -101,7 +105,7 @@ services:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh2.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:4.14.3
    hostname: wazuh2.indexer
    restart: always
    environment:
@@ -123,7 +127,7 @@ services:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh3.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:4.14.3
    hostname: wazuh3.indexer
    restart: always
    environment:
@@ -145,7 +149,7 @@ services:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0
+    image: wazuh/wazuh-dashboard:4.14.3
    hostname: wazuh.dashboard
    restart: always
    ports:
@@ -194,7 +198,9 @@ volumes:
  master-wazuh-logs:
  master-wazuh-queue:
  master-wazuh-var-multigroups:
+  master-wazuh-integrations:
  master-wazuh-active-response:
+  master-wazuh-agentless:
  master-wazuh-wodles:
  master-filebeat-etc:
  master-filebeat-var:
@@ -203,7 +209,9 @@ volumes:
  worker-wazuh-logs:
  worker-wazuh-queue:
  worker-wazuh-var-multigroups:
+  worker-wazuh-integrations:
  worker-wazuh-active-response:
+  worker-wazuh-agentless:
  worker-wazuh-wodles:
  worker-filebeat-etc:
  worker-filebeat-var:
@@ -46,12 +46,24 @@ docker volume create \
           --label com.docker.compose.volume=master-wazuh-var-multigroups \
           $2_master-wazuh-var-multigroups

+docker volume create \
+           --label com.docker.compose.project=$2 \
+           --label com.docker.compose.version=$1 \
+           --label com.docker.compose.volume=master-wazuh-integrations \
+           $2_master-wazuh-integrations
+
 docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
           --label com.docker.compose.volume=master-wazuh-active-response \
           $2_master-wazuh-active-response

+docker volume create \
+           --label com.docker.compose.project=$2 \
+           --label com.docker.compose.version=$1 \
+           --label com.docker.compose.volume=master-wazuh-agentless \
+           $2_master-wazuh-agentless
+
 docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
@@ -100,12 +112,24 @@ docker volume create \
           --label com.docker.compose.volume=worker-wazuh-var-multigroups \
           $2_worker-wazuh-var-multigroups

+docker volume create \
+           --label com.docker.compose.project=$2 \
+           --label com.docker.compose.version=$1 \
+           --label com.docker.compose.volume=worker-wazuh-integrations \
+           $2_worker-wazuh-integrations
+
 docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
           --label com.docker.compose.volume=worker-wazuh-active-response \
           $2_worker-wazuh-active-response

+docker volume create \
+           --label com.docker.compose.project=$2 \
+           --label com.docker.compose.version=$1 \
+           --label com.docker.compose.volume=worker-wazuh-agentless \
+           $2_worker-wazuh-agentless
+
 docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
@@ -169,11 +193,21 @@ docker container run --rm -it \
           -v $2_master-wazuh-var-multigroups:/to \
           alpine ash -c "cd /from ; cp -avp . /to"

+docker container run --rm -it \
+           -v wazuh-docker_ossec-integrations:/from \
+           -v $2_master-wazuh-integrations:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+
 docker container run --rm -it \
           -v wazuh-docker_ossec-active-response:/from \
           -v $2_master-wazuh-active-response:/to \
           alpine ash -c "cd /from ; cp -avp . /to"

+docker container run --rm -it \
+           -v wazuh-docker_ossec-agentless:/from \
+           -v $2_master-wazuh-agentless:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+
 docker container run --rm -it \
           -v wazuh-docker_ossec-wodles:/from \
           -v $2_master-wazuh-wodles:/to \
@@ -214,11 +248,21 @@ docker container run --rm -it \
           -v $2_worker-wazuh-var-multigroups:/to \
           alpine ash -c "cd /from ; cp -avp . /to"

+docker container run --rm -it \
+           -v wazuh-docker_worker-ossec-integrations:/from \
+           -v $2_worker-wazuh-integrations:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+
 docker container run --rm -it \
           -v wazuh-docker_worker-ossec-active-response:/from \
           -v $2_worker-wazuh-active-response:/to \
           alpine ash -c "cd /from ; cp -avp . /to"

+docker container run --rm -it \
+           -v wazuh-docker_worker-ossec-agentless:/from \
+           -v $2_worker-wazuh-agentless:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+
 docker container run --rm -it \
           -v wazuh-docker_worker-ossec-wodles:/from \
           -v $2_worker-wazuh-wodles:/to \
@@ -1,10 +1,24 @@
 <ossec_config>
  <global>
-    <agents_disconnection_time>15m</agents_disconnection_time>
+    <jsonout_output>yes</jsonout_output>
+    <alerts_log>yes</alerts_log>
+    <logall>no</logall>
+    <logall_json>no</logall_json>
+    <email_notification>no</email_notification>
+    <smtp_server>smtp.example.wazuh.com</smtp_server>
+    <email_from>wazuh@example.wazuh.com</email_from>
+    <email_to>recipient@example.wazuh.com</email_to>
+    <email_maxperhour>12</email_maxperhour>
+    <email_log_source>alerts.log</email_log_source>
+    <agents_disconnection_time>10m</agents_disconnection_time>
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
-    <update_check>yes</update_check>
  </global>

+  <alerts>
+    <log_alert_level>3</log_alert_level>
+    <email_alert_level>12</email_alert_level>
+  </alerts>
+
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  <logging>
    <log_format>plain</log_format>
@@ -20,6 +34,8 @@
  <!-- Policy monitoring -->
  <rootcheck>
    <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
@@ -29,12 +45,31 @@
    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>43200</frequency>

-    <skip_nfs>yes</skip_nfs>
+    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>

-    <ignore>/var/lib/containerd</ignore>
-    <ignore>/var/lib/docker/overlay2</ignore>
+    <skip_nfs>yes</skip_nfs>
  </rootcheck>

+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <!-- Osquery integration -->
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
  <!-- System inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
@@ -46,15 +81,9 @@
    <packages>yes</packages>
    <ports all="yes">yes</ports>
    <processes>yes</processes>
-    <users>yes</users>
-    <groups>yes</groups>
-    <services>yes</services>
-    <browser_extensions>yes</browser_extensions>

    <!-- Database synchronization settings -->
    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>
@@ -63,13 +92,7 @@
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
-
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
-      <max_eps>10</max_eps>
-    </synchronization>
+    <skip_nfs>yes</skip_nfs>
  </sca>

  <vulnerability-detection>
@@ -99,6 +122,8 @@
    <!-- Frequency that syscheck is executed default every 12 hours -->
    <frequency>43200</frequency>

+    <scan_on_start>yes</scan_on_start>
+
    <!-- Generate alert when new file detected -->
    <alert_new_files>yes</alert_new_files>

@@ -138,12 +163,13 @@
    <process_priority>10</process_priority>

    <!-- Maximum output throughput -->
-    <max_eps>50</max_eps>
+    <max_eps>100</max_eps>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
+      <max_interval>1h</max_interval>
      <max_eps>10</max_eps>
    </synchronization>
  </syscheck>
@@ -238,6 +264,13 @@
    <rule_dir>etc/rules</rule_dir>
  </ruleset>

+  <rule_test>
+    <enabled>yes</enabled>
+    <threads>1</threads>
+    <max_sessions>64</max_sessions>
+    <session_timeout>15m</session_timeout>
+  </rule_test>
+
  <!-- Configuration for wazuh-authd -->
  <auth>
    <disabled>no</disabled>
@@ -270,19 +303,9 @@
 </ossec_config>

 <ossec_config>
-  <localfile>
-    <log_format>journald</log_format>
-    <location>journald</location>
-  </localfile>
-
-  <localfile>
-    <log_format>audit</log_format>
-    <location>/var/log/audit/audit.log</location>
-  </localfile>
-
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

-</ossec_config>
+</ossec_config>
@@ -2,7 +2,7 @@ server.host: 0.0.0.0
 server.port: 5601
 opensearch.hosts: https://wazuh.indexer:9200
 opensearch.ssl.verificationMode: certificate
-opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
+opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
 opensearch_security.multitenancy.enabled: false
 opensearch_security.readonly_mode.roles: ["kibana_read_only"]
 server.ssl.enabled: true
@@ -4,17 +4,23 @@ cluster.name: "wazuh-cluster"
 path.data: /var/lib/wazuh-indexer
 path.logs: /var/log/wazuh-indexer
 discovery.type: single-node
-http.port: 9200-9299
-transport.tcp.port: 9300-9399
-plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
-plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
-plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
-plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
-plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
-plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
+compatibility.override_main_response_version: true
+plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
 plugins.security.ssl.http.enabled: true
 plugins.security.ssl.transport.enforce_hostname_verification: false
 plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.ssl.http.enabled_ciphers:
+  - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+  - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+  - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+plugins.security.ssl.http.enabled_protocols:
+  - "TLSv1.2"
 plugins.security.authcz.admin_dn:
 - "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
 plugins.security.check_snapshot_restore_write_privileges: true
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
  wazuh.manager:
-    image: wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:4.14.3
    hostname: wazuh.manager
    restart: always
    ulimits:
@@ -32,7 +32,9 @@ services:
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
      - wazuh_var_multigroups:/var/ossec/var/multigroups
+      - wazuh_integrations:/var/ossec/integrations
      - wazuh_active_response:/var/ossec/active-response/bin
+      - wazuh_agentless:/var/ossec/agentless
      - wazuh_wodles:/var/ossec/wodles
      - filebeat_etc:/etc/filebeat
      - filebeat_var:/var/lib/filebeat
@@ -42,7 +44,7 @@ services:
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

  wazuh.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:4.14.3
    hostname: wazuh.indexer
    restart: always
    ports:
@@ -67,7 +69,7 @@ services:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0
+    image: wazuh/wazuh-dashboard:4.14.3
    hostname: wazuh.dashboard
    restart: always
    ports:
@@ -100,7 +102,9 @@ volumes:
  wazuh_logs:
  wazuh_queue:
  wazuh_var_multigroups:
+  wazuh_integrations:
  wazuh_active_response:
+  wazuh_agentless:
  wazuh_wodles:
  filebeat_etc:
  filebeat_var:
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
  wazuh.agent:
-    image: wazuh/wazuh-agent:5.0.0
+    image: wazuh/wazuh-agent:4.14.3
    restart: always
    environment:
      - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
Author	SHA1	Message	Date
Jesus Garcia	dddfc8adb5	comment out block for testing purposes	2025-12-17 12:12:16 -05:00
Jesus Garcia	f51fc2e4ae	Add check (input.dev must be false) for image validation and GH issue notification in push workflow	2025-12-17 12:10:46 -05:00
Jesus Garcia	089ce24ffc	Enhance script execution of build and improve docs clarity	2025-12-17 01:37:49 -05:00
Gonzalo Acuña	424559518e	Merge pull request #2126 from wazuh/enh/2097-certsgen-imagebuild Modify to build certs gen image	2025-12-17 01:37:49 -05:00
Jesus Garcia	a509f0f8ea	Add changelog	2025-12-17 01:37:49 -05:00
Jesus Garcia	c6a427af70	Update documentation of certs-gen procedure	2025-12-17 01:37:49 -05:00
Jesus Garcia	6675465180	Adapt manager Dockerfile for multi-architecture builds	2025-12-17 01:37:49 -05:00
Jesus Garcia	08c7cbda53	Modify to build certs gen image	2025-12-17 01:37:49 -05:00
Victor Carlos Erenu	0fe3103940	Bring changes from PR #2054	2025-12-17 01:37:40 -05:00
Wazuh CI	f42ec2ba7c	Merge pull request #2110 from wazuh/enhancement/wqa5045-bump-4.14.3 Bump 4.14.3 branch	2025-12-03 12:55:30 +01:00
wazuhci	982d3a649e	feat: bump 4.14.3	2025-12-03 11:55:26 +00:00
Gonzalo Acuña	6aa948d4da	Merge pull request #2104 from wazuh/mtc/2103-Outdated_Indexer_ports_configuration Add missing SSL ciphers and protocols and remove outdated ports parameters from opensearch.yml template	2025-12-02 09:50:56 -03:00
Jesus Garcia	81a7e11da4	Update the opensearch.yml template: * Remove outdated parameters ('http.port' and 'transport.tcp.port') * Add missing SSL ciphers and protocol parameters.	2025-12-01 19:59:47 -05:00
Carlos Bordon	2dc7717e81	Merge pull request #2094 from wazuh/change/6569-nokia-private-key-hardcoded-in-wazuh-manager-image-4.14.2-update The location of the remove command for the wazuh-authd certificates has been changed.	2025-11-27 11:59:50 -03:00
Carlos Bordon	0ba67b1adf	Updated changelog	2025-11-27 11:19:10 -03:00
Carlos Bordon	eecec3db80	The location of the remove command for the wazuh-authd certificates has been changed.	2025-11-27 11:15:32 -03:00
Carlos Bordon	f4cc1bd838	Merge pull request #2093 from wazuh/change/6569-nokia-private-key-hardcoded-in-wazuh-manager-image-4.14.2 Removed sslmanager key from the docker manager image to 4.14.2	2025-11-27 08:14:14 -03:00
Carlos Bordon	0602ce076d	Updated changelog	2025-11-26 16:55:29 -03:00
Carlos Bordon	2d122e1dc9	Removed sslmanager key from the docker manager image to 4.14.2	2025-11-26 15:22:12 -03:00
Carlos Bordon	47a73bdde6	Merge pull request #2090 from wazuh/bug/2088-improvements-4.14.2 Code improvements for 4.14.2	2025-11-26 11:55:25 -03:00
Victor Carlos Erenu	fb6be60afb	Add changelog	2025-11-25 21:52:07 +07:00
Victor Carlos Erenu	2d6c920366	Delete opensearch-security directory creation	2025-11-25 20:57:45 +07:00
Victor Carlos Erenu	d69f5c0c5d	Add new path for Wazun indexer and new function for permanent_data exception	2025-11-25 01:22:11 +07:00
Gonzalo Acuña	d52c076e62	Merge pull request #2078 from wazuh/change/3494-docker-notification Artifactory vulnerabilities notification	2025-11-13 15:45:45 -03:00
Gonzalo Acuña	e5d6ba55cc	Changelog update	2025-11-13 14:41:53 -03:00
Gonzalo Acuña	415ddd7271	Replace secret variables	2025-11-13 14:06:39 -03:00
Gonzalo Acuña	aa98d94f38	Revert test changes	2025-11-13 11:50:18 -03:00
Gonzalo Acuña	af2e4589c0	GH project additional variable assignment fix	2025-11-13 11:42:16 -03:00
Gonzalo Acuña	6a8d0d6288	GH project additional variable assignment	2025-11-13 11:35:03 -03:00
Gonzalo Acuña	11b066ef25	GH project variable assignment	2025-11-13 11:24:48 -03:00
Gonzalo Acuña	11c0ae9161	GH issue creation command fix	2025-11-13 10:01:08 -03:00
Gonzalo Acuña	ecb486f625	GH issue creation commands	2025-11-12 16:52:27 -03:00
Gonzalo Acuña	16de0735a9	GH notification identation fix	2025-11-12 16:21:17 -03:00
Gonzalo Acuña	5103da8dab	GH notification test change	2025-11-12 14:32:45 -03:00
Gonzalo Acuña	91cda37b1f	GH notification changes for image publication	2025-11-12 12:15:37 -03:00
Wazuh CI	aed6d3eea2	Merge pull request #2071 from wazuh/enhancement/wqa4626-bump-4.14.2 Bump 4.14.2 branch	2025-11-10 18:16:57 +01:00
wazuhci	7adc50cf81	feat: bump 4.14.2	2025-11-10 17:16:53 +00:00
Carlos Anguita	4e99641d02	Merge pull request #2068 from wazuh/enhancement/2066-revert-image-tag-for-4.14.1rc2	2025-11-07 10:47:58 +01:00
Enrique Araque	b39237b2c0	Remove docker image tag for 4.14.1-rc2	2025-11-07 10:31:22 +01:00
Wazuh CI	582e5d67ef	Merge pull request #2067 from wazuh/enhancement/wqa4608-bump-4.14.1 Bump 4.14.1 branch	2025-11-07 09:45:57 +01:00
wazuhci	4dac06e335	feat: bump 4.14.1	2025-11-07 08:45:51 +00:00