Merge pull request #2094 from wazuh/change/6569-nokia-private-key-hardcoded-in-wazuh-manager-image-4.14.2-update

The location of the remove command for the wazuh-authd certificates has been changed.
Updated changelog
2025-11-27 11:59:50 -03:00 · 2025-11-27 11:19:10 -03:00 · 2025-11-27 11:15:32 -03:00 · 2025-11-27 08:14:14 -03:00 · 2025-11-26 16:55:29 -03:00 · 2025-11-26 15:22:12 -03:00
53 changed files with 808 additions and 376 deletions
@@ -1,6 +1,6 @@
-WAZUH_VERSION=main
-WAZUH_IMAGE_VERSION=main
+WAZUH_VERSION=4.14.2
+WAZUH_IMAGE_VERSION=4.14.2
 WAZUH_TAG_REVISION=1
+FILEBEAT_TEMPLATE_BRANCH=4.14.2
+WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
 WAZUH_UI_REVISION=1
-WAZUH_REGISTRY=docker.io
-IMAGE_TAG=main
@@ -56,7 +56,7 @@ package:
  wazuh-manager:
    installed: true
    versions:
-    - 5.0.0
+    - 4.14.2
 port:
  tcp:1514:
    listening: true
@@ -6,19 +6,28 @@ on:
    inputs:
      image_tag:
        description: 'Docker image tag'
-        default: '5.0.0'
+        default: '4.14.2'
        required: true
      docker_reference:
        description: 'wazuh-docker reference'
        required: true
+      products:
+        description: 'Comma-separated list of the image names to build and push'
+        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
+        required: true
+      filebeat_module_version:
+        description: 'Filebeat module version'
+        default: '0.4'
+        required: true
      revision:
        description: 'Package revision'
        default: '1'
        required: true
-      reference:
-        description: 'Dev reference'
-        type: string
-        default: latest 
+      push_images:
+        description: 'Push images'
+        type: boolean
+        default: true
+        required: true
      id:
        description: "ID used to identify the workflow uniquely."
        type: string
@@ -32,22 +41,33 @@ on:
    inputs:
      image_tag:
        description: 'Docker image tag'
-        default: '5.0.0'
+        default: '4.14.2'
        required: true
        type: string
      docker_reference:
        description: 'wazuh-docker reference'
        required: false
        type: string
+      products:
+        description: 'Comma-separated list of the image names to build and push'
+        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
+        required: true
+        type: string
+      filebeat_module_version:
+        description: 'Filebeat module version'
+        default: '0.4'
+        required: true
+        type: string
      revision:
        description: 'Package revision'
        default: '1'
        required: true
        type: string
-      reference:
-        description: 'Dev reference'
-        type: string
-        default: latest 
+      push_images:
+        description: 'Push images'
+        type: boolean
+        default: true
+        required: true
      id:
        description: "ID used to identify the workflow uniquely."
        type: string
@@ -62,15 +82,6 @@ jobs:
  build-and-push:
    runs-on: ubuntu-22.04

-    permissions:
-      id-token: write
-      contents: read
-
-    env:
-      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
-      IMAGE_TAG: ${{ inputs.image_tag }}
-      REVISION: ${{ inputs.revision }}
-
    steps:
    - name: Print inputs
      run: |
@@ -85,10 +96,11 @@ jobs:
        echo "* id: ${{ inputs.id }}"
        echo "* image_tag: ${{ inputs.image_tag }}"
        echo "* docker_reference: ${{ inputs.docker_reference }}"
+        echo "* products: ${{ inputs.products }}"
        echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
        echo "* revision: ${{ inputs.revision }}"
+        echo "* push_images: ${{ inputs.push_images }}"
        echo "* dev: ${{ inputs.dev }}"
-        echo "* dev reference: ${{ inputs.reference }}"
        echo "---------------------------------------------"

    - name: Checkout repository
@@ -96,80 +108,33 @@ jobs:
      with:
        ref: ${{ inputs.docker_reference }}

-    - name: free disk space
-      uses: ./.github/free-disk-space
-    
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Configure aws credentials
-      if: ${{ inputs.dev == true }}
-      uses: aws-actions/configure-aws-credentials@v4
-      with:
-        role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
-        aws-region: "${{ secrets.AWS_REGION }}"
-
-    - name: Log in to Amazon ECR
-      if: ${{ inputs.dev == true }}
-      uses: aws-actions/amazon-ecr-login@v2
-
    - name: Log in to Docker Hub
-      if: ${{ inputs.dev == false }}
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_PASSWORD }}

-    - name: Create packages-url.txt file
-      if : ${{ inputs.dev == true }}
-      run: |
-          cat << EOF > packages-url.txt
-          wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_manager_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_indexer_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_indexer_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_indexer_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_indexer_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_dashboard_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_dashboard_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_dashboard_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_dashboard_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)"
-          wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)"
-          EOF
-      working-directory: ./build-docker-images
-
    - name: Build Wazuh images
      run: |
-        if [ "${{ inputs.dev }}" = true ]; then
-          IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}"
-          ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }}
-        else  
-          if [[ "$IMAGE_TAG" == *"-"* ]]; then
-            IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
-            if [ -z "${tokens[1]}" ]; then
-              echo "Invalid image tag: $IMAGE_TAG"
-              exit 1
-            fi
-            DEV_STAGE=${tokens[1]}
-            WAZUH_VER=${tokens[0]}
-            ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -rg $IMAGE_REGISTRY -m
-          else
-            ./build-images.sh -v $IMAGE_TAG -r $REVISION -rg $IMAGE_REGISTRY -m
+        IMAGE_TAG=${{ inputs.image_tag }}
+        FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }}
+        REVISION=${{ inputs.revision }}
+
+        if [[ "$IMAGE_TAG" == *"-"* ]]; then
+          IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
+          if [ -z "${tokens[1]}" ]; then
+            echo "Invalid image tag: $IMAGE_TAG"
+            exit 1
          fi
+          DEV_STAGE=${tokens[1]}
+          WAZUH_VER=${tokens[0]}
+          ./build-docker-images/build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION
+        else
+          ./build-docker-images/build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION
        fi
+
        # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
-        ENV_FILE_PATH="../.env"
+        ENV_FILE_PATH=".env"

        if [ -f $ENV_FILE_PATH ]; then
          while IFS= read -r line || [ -n "$line" ]; do
@@ -179,4 +144,102 @@ jobs:
          echo "The environment file $ENV_FILE_PATH does not exist!"
          exit 1
        fi
-      working-directory: ./build-docker-images
+
+    - name: Image exists validation
+      if: ${{ inputs.push_images }}
+      id: validation
+      run: |
+        IMAGE_TAG=${{ inputs.image_tag }}
+        PURPOSE=""
+
+        if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if docker manifest inspect wazuh/wazuh-manager:$IMAGE_TAG > /dev/null 2>&1; then
+            PURPOSE="regeneration"
+            echo "Image  wazuh/wazuh-manager:$IMAGE_TAG exists. Setting PURPOSE to 'regeneration'"
+          else
+            PURPOSE="new release"
+            echo "Image wazuh/wazuh-manager:$IMAGE_TAG does NOT exist. Setting PURPOSE to 'new release'"
+          fi
+          echo "✅ Release tag: '$IMAGE_TAG'"
+        elif [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)[0-9]+$ ]]; then
+          PURPOSE="new stage"
+          echo "✅ Stage tag: '$IMAGE_TAG'. Setting PURPOSE to 'new stage'"
+        else
+          echo "❌ No release or stage tag ('$IMAGE_TAG'), the GH issue will not be created"
+        fi
+
+        echo "purpose=$PURPOSE" >> $GITHUB_OUTPUT
+
+    - name: Tag and Push Wazuh images
+      if: ${{ inputs.push_images }}
+      run: |
+        IMAGE_TAG="${{ inputs.image_tag }}$( [ "${{ inputs.dev }}" == "true" ] && echo '-dev' || true )"
+        IMAGE_NAMES=${{ inputs.products }}
+        IFS=',' read -r -a images <<< "$IMAGE_NAMES"
+        for image in "${images[@]}"; do
+          echo "Tagging and pushing wazuh/$image:${WAZUH_VERSION} to wazuh/$image:$IMAGE_TAG"
+          docker tag wazuh/$image:${WAZUH_VERSION} wazuh/$image:$IMAGE_TAG
+          echo "Pushing wazuh/$image:$IMAGE_TAG ..."
+          docker push wazuh/$image:$IMAGE_TAG
+        done
+
+    - name: GH issue notification
+      if: ${{ inputs.push_images && steps.validation.outputs.purpose != '' }}
+      run: |
+        IMAGE_TAG=${{ inputs.image_tag }}
+        GH_TITLE=""
+        GH_MESSAGE=""
+        PURPOSE="${{ steps.validation.outputs.purpose }}"
+
+        ## Setting GH issue title
+        GH_TITLE="Artifactory vulnerabilities update \`v$IMAGE_TAG\`"
+
+        ## Setting GH issue body
+        GH_MESSAGE=$(cat <<- EOF | tr -d '\r' | sed 's/^[[:space:]]*//'
+        ### Description
+        - [ ] Update the [Artifactory vulnerabilities](${{ secrets.NOTIFICATION_SHEET_URL }}) sheet with the \`v$IMAGE_TAG\` vulnerabilities.
+
+        **Purpose**: $PURPOSE
+        >[!NOTE]
+        >To update the \`Tentative Release\` column, follow these steps:
+        https://github.com/wazuh/${{ secrets.NOTIFICATION_REPO }}/issues/2049#issuecomment-2671590268
+        EOF
+        )
+
+        # Print the GH Variables content
+        echo "--- Variable Content ---"
+        echo "$GH_TITLE"
+        echo "------------------------"
+
+        echo "--- Variable Content ---"
+        echo "$GH_MESSAGE"
+        echo "------------------------"
+
+        ## GH issue creation
+        ISSUE_URL=$(gh issue create \
+          -R wazuh/${{ secrets.NOTIFICATION_REPO }} \
+          --title "$GH_TITLE" \
+          --body "$GH_MESSAGE" \
+          --label "level/task" \
+          --label "type/maintenance" \
+          --label "request/operational")
+
+        ## Adding the issue to the team project
+        PROJECT_ITEM_ID=$(gh project item-add \
+          ${{ secrets.NOTIFICATION_PROJECT_NUMBER }} \
+          --url $ISSUE_URL \
+          --owner wazuh \
+          --format json \
+          | jq -r '.id')
+
+          ## Setting Objective
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_OBJECTIVE_ID }} --text  "Security scans"
+          ## Setting Priority
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_OPTION_ID }}
+          ## Setting Size
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_OPTION_ID }}
+          ## Setting Subteam
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_OPTION_ID }}
+
+      env:
+        GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
@@ -2,6 +2,4 @@ single-node/config/wazuh_indexer_ssl_certs/*.pem
 single-node/config/wazuh_indexer_ssl_certs/*.key
 multi-node/config/wazuh_indexer_ssl_certs/*.pem
 multi-node/config/wazuh_indexer_ssl_certs/*.key
-*.log
-build-docker-images/packages_env.txt
-build-docker-images/packages-url.txt
+*.log
@@ -1,16 +1,17 @@
 # Change Log
 All notable changes to this project will be documented in this file.

-## [5.0.0]
+## [4.14.2]

 ### Added

- None
+- Code improvements for 4.14.2 ([#2090](https://github.com/wazuh/wazuh-docker/pull/2090))
+- Artifactory vulnerabilities notification ([#2078](https://github.com/wazuh/wazuh-docker/pull/2078))

 ### Changed

- Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-puppet/issues/2030))
- Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366))
+- The location of the remove command for the wazuh-authd certificates has been changed. ([#2094](https://github.com/wazuh/wazuh-docker/pull/2094))
+- Removed sslmanager key from the docker manager image to 4.14.2. ([#2093](https://github.com/wazuh/wazuh-docker/pull/2093))

 ### Fixed

@@ -18,7 +18,7 @@ The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cyber
 ## Branch Convention

 - `main`: Developing and testing of new features.
- `X.Y.Z`: Version-specific branches (e.g., `5.0.0`, `4.14.0`, etc.).
+- `X.Y.Z`: Version-specific branches (e.g., `4.14.2`, `4.13.0`, etc.).

 ## Documentation

@@ -1,4 +1,4 @@
 {
-    "version": "5.0.0",
+    "version": "4.14.2",
    "stage": "alpha0"
 }
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
 The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:

 ```
-$ build-docker-images/build-images.sh -v 5.0.0
+$ build-docker-images/build-images.sh -v 4.14.2
 ```

 To get all the available script options use the -h or --help option:
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default 0.4.
    -r, --revision <rev>         [Optional] Package revision. By default 1
-    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
+    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 4.14.2.
    -h, --help                   Show this help.

 ```
@@ -1,10 +1,8 @@
-WAZUH_IMAGE_VERSION=main
-IMAGE_TAG=main
+WAZUH_IMAGE_VERSION=4.14.2
 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
 WAZUH_TAG_REVISION=1
 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
 IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
-WAZUH_REGISTRY=docker.io

 # Wazuh package generator
 # Copyright (C) 2023, Wazuh Inc.
@@ -14,10 +12,10 @@ WAZUH_REGISTRY=docker.io
 # License (version 2) as published by the FSF - Free Software
 # Foundation.

-WAZUH_IMAGE_VERSION="main"
+WAZUH_IMAGE_VERSION="4.14.2"
 WAZUH_TAG_REVISION="1"
 WAZUH_DEV_STAGE=""
-WAZUH_TAG_REFERENCE=""
+FILEBEAT_MODULE_VERSION="0.4"

 # -----------------------------------------------------------------------------

@@ -39,44 +37,36 @@ ctrl_c() {
 build() {

    WAZUH_VERSION="$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')"
-    WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}"
+    FILEBEAT_TEMPLATE_BRANCH="${WAZUH_IMAGE_VERSION}"
+    WAZUH_FILEBEAT_MODULE="wazuh-filebeat-${FILEBEAT_MODULE_VERSION}.tar.gz"
    WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}"

-    # Variables
-    FILE="packages-url.txt"
-
-    if [[ -f "$FILE" ]]; then
-        echo "$FILE exists. Using existing file."
+    if  [ "${WAZUH_DEV_STAGE}" ];then
+        FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}"
+        if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
+            echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
+            clean 1
+        fi
    else
-        TAG="v${WAZUH_VERSION}"
-        REPO="wazuh/wazuh-docker"
-        GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}"
-
-        if curl -fsSL "$GH_URL" >/dev/null 2>&1; then
-            curl -fsSL -o "$FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt"
+        if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then
+            FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}"
+        elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
+            FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}"
        else
-            curl -fsSL -o "$FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt"
+            echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
+            clean 1
        fi
    fi
-    awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $FILE > packages_env.txt
-    
-    echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
-    echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
-    echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env
-    echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> ../.env
-    echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env
-    echo IMAGE_TAG=$IMAGE_TAG >> ../.env

-    set -a
-    source ../.env
-    source ./packages_env.txt
-    set +a
+    echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env
+    echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> .env
+    echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env
+    echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> .env
+    echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> .env
+    echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> .env
+
+    docker compose -f build-docker-images/build-images.yml --env-file .env build --no-cache || clean 1

-    if  [ "${MULTIARCH}" ];then
-        docker buildx bake --file build-images.yml --push --set *.platform=linux/amd64,linux/arm64 --no-cache|| clean 1
-    else
-        docker buildx bake --file build-images.yml --no-cache|| clean 1
-    fi
    return 0
 }

@@ -86,12 +76,10 @@ help() {
    echo
    echo "Usage: $0 [OPTIONS]"
    echo
-    echo "    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default."
+    echo "    -d, --dev <ref>              [Optional] Set the development stage you want to build, example alpha0 or beta1, not used by default."
+    echo "    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default ${FILEBEAT_MODULE_VERSION}."
    echo "    -r, --revision <rev>         [Optional] Package revision. By default ${WAZUH_TAG_REVISION}"
-    echo "    -ref, --reference <ref>      [Optional] Set the Wazuh reference to build development images. By default, the latest stable release."
-    echo "    -rg, --registry <reg>        [Optional] Set the Docker registry to push the images."
    echo "    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, ${WAZUH_IMAGE_VERSION}."
-    echo "    -m, --multiarch              [Optional] Enable multi-architecture builds."
    echo "    -h, --help                   Show this help."
    echo
    exit $1
@@ -114,9 +102,13 @@ main() {
                help 1
            fi
            ;;
-        "-m"|"--multiarch")
-            MULTIARCH="true"
-                shift
+        "-f"|"--filebeat-module")
+            if [ -n "${2}" ]; then
+                FILEBEAT_MODULE_VERSION="${2}"
+                shift 2
+            else
+                help 1
+            fi
            ;;
        "-r"|"--revision")
            if [ -n "${2}" ]; then
@@ -126,22 +118,6 @@ main() {
                help 1
            fi
            ;;
-        "-ref"|"--reference")
-            if [ -n "${2}" ]; then
-                WAZUH_TAG_REFERENCE="${2}"
-                shift 2
-            else
-                help 1
-            fi
-            ;;
-        "-rg"|"--registry")
-            if [ -n "${2}" ]; then
-                WAZUH_REGISTRY="${2}"
-                shift 2
-            else
-                help 1
-            fi
-            ;;
        "-v"|"--version")
            if [ -n "$2" ]; then
                WAZUH_IMAGE_VERSION="$2"
@@ -6,9 +6,9 @@ services:
      args:
        WAZUH_VERSION: ${WAZUH_VERSION}
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
-        wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm}
-        wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm}
-    image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG}
+        FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH}
+        WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE}
+    image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
    hostname: wazuh.manager
    restart: always
    ports:
@@ -20,14 +20,19 @@ services:
      - INDEXER_URL=https://wazuh.indexer:9200
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=admin
+      - FILEBEAT_SSL_VERIFICATION_MODE=none
    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
      - wazuh_etc:/var/ossec/etc
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
      - wazuh_var_multigroups:/var/ossec/var/multigroups
+      - wazuh_integrations:/var/ossec/integrations
      - wazuh_active_response:/var/ossec/active-response/bin
+      - wazuh_agentless:/var/ossec/agentless
      - wazuh_wodles:/var/ossec/wodles
+      - filebeat_etc:/etc/filebeat
+      - filebeat_var:/var/lib/filebeat

  wazuh.agent:
    build:
@@ -35,9 +40,7 @@ services:
      args:
        WAZUH_VERSION: ${WAZUH_VERSION}
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
-        wazuh_agent_url_amd64_rpm: ${wazuh_agent_url_x86_64_rpm}
-        wazuh_agent_url_arm64_rpm: ${wazuh_agent_url_aarch64_rpm}
-    image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG}
+    image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION}
    hostname: wazuh.agent
    restart: always

@@ -47,9 +50,7 @@ services:
      args:
        WAZUH_VERSION: ${WAZUH_VERSION}
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
-        wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm}
-        wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm}
-    image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG}
+    image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
    hostname: wazuh.indexer
    restart: always
    ports:
@@ -71,9 +72,7 @@ services:
        WAZUH_VERSION: ${WAZUH_VERSION}
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
        WAZUH_UI_REVISION: ${WAZUH_UI_REVISION}
-        wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm}
-        wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm}
-    image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG}
+    image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
    hostname: wazuh.dashboard
    restart: always
    ports:
@@ -95,6 +94,9 @@ volumes:
  wazuh_logs:
  wazuh_queue:
  wazuh_var_multigroups:
+  wazuh_integrations:
  wazuh_active_response:
+  wazuh_agentless:
  wazuh_wodles:
-
+  filebeat_etc:
+  filebeat_var:
@@ -10,17 +10,18 @@ ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
 ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT'
 ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
 ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
-ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
-ARG TARGETARCH
-ARG wazuh_agent_url_amd64_rpm
-ARG wazuh_agent_url_arm64_rpm
+ARG WAZUH_AGENT_NAME='CHANGEE_AGENT_NAME'

-RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \
-    agent_url="${!URL_VAR}" && \
-    dnf install curl-minimal tar gzip procps -y &&\
-    curl -o /wazuh-agent.rpm "${agent_url}" && \
-    dnf install /wazuh-agent.rpm -y && \
-    dnf clean all && \
+COPY config/check_repository.sh /
+
+RUN yum install curl-minimal tar gzip procps -y &&\
+    yum clean all
+
+RUN chmod 775 /check_repository.sh
+RUN source /check_repository.sh
+
+RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all && \
    sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
    -o /tmp/s6-overlay-amd64.tar.gz && \
@@ -30,4 +31,6 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \

 COPY config/etc/ /etc/

+RUN rm /etc/yum.repos.d/wazuh.repo
+
 ENTRYPOINT [ "/init" ]
@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
@@ -5,17 +5,16 @@ ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
 ARG WAZUH_UI_REVISION
 ARG INSTALL_DIR=/usr/share/wazuh-dashboard
-ARG TARGETARCH
-ARG wazuh_dashboard_url_amd64_rpm
-ARG wazuh_dashboard_url_arm64_rpm

 # Update and install dependencies
-RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \
-    dashboard_url="${!URL_VAR}" && \
-    dnf install curl-minimal libcap openssl -y && \
-    curl -o /wazuh-dashboard.rpm "${dashboard_url}" && \
-    dnf install /wazuh-dashboard.rpm -y && \
-    dnf clean all
+RUN yum install curl-minimal libcap openssl -y
+
+COPY config/check_repository.sh /
+RUN chmod 775 /check_repository.sh && \
+    source /check_repository.sh
+
+RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all

 # Create and set permissions to data directories
 RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
@@ -43,8 +42,10 @@ FROM amazonlinux:2023
 ENV USER="wazuh-dashboard" \
    GROUP="wazuh-dashboard" \
    NAME="wazuh-dashboard" \
-    INSTALL_DIR="/usr/share/wazuh-dashboard" \
-    PATTERN="" \
+    INSTALL_DIR="/usr/share/wazuh-dashboard"
+
+# Set Wazuh app variables
+ENV PATTERN="" \
    CHECKS_PATTERN="" \
    CHECKS_TEMPLATE="" \
    CHECKS_API="" \
@@ -59,7 +60,7 @@ ENV USER="wazuh-dashboard" \
    WAZUH_MONITORING_REPLICAS=""

 # Update and install dependencies
-RUN dnf install shadow-utils -y && dnf clean all
+RUN yum install shadow-utils -y

 # Create wazuh-dashboard user and group
 RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config

 ## Variables
 CERT_TOOL=wazuh-certs-tool.sh
-PACKAGES_URL=https://packages.wazuh.com/5.0/
-PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
+PACKAGES_URL=https://packages.wazuh.com/4.14/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/

 ## Check if the cert tool exists in S3 buckets
 CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
@@ -3,19 +3,31 @@ FROM amazonlinux:2023 AS builder

 ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
-ARG TARGETARCH
-ARG wazuh_indexer_url_amd64_rpm
-ARG wazuh_indexer_url_arm64_rpm
+
+RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y
+
+COPY config/check_repository.sh /
+RUN chmod 775 /check_repository.sh && \
+    source /check_repository.sh
+
+RUN yum install wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all
+
+COPY config/opensearch.yml /

 COPY config/config.sh .

-RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \
-    indexer_url="${!URL_VAR}" && \
-    dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\
-    curl -o /wazuh-indexer.rpm "${indexer_url}" && \
-    dnf install /wazuh-indexer.rpm -y && \
-    dnf clean all && \
-    bash config.sh
+COPY config/config.yml /
+
+COPY config/action_groups.yml /
+
+COPY config/internal_users.yml /
+
+COPY config/roles_mapping.yml /
+
+COPY config/roles.yml /
+
+RUN bash config.sh

 ################################################################################
 # Build stage 1 (the actual Wazuh indexer image):
@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
@@ -22,8 +22,8 @@ export REPO_DIR=/unattended_installer
 ## Variables
 CERT_TOOL=wazuh-certs-tool.sh
 PASSWORD_TOOL=wazuh-passwords-tool.sh
-PACKAGES_URL=https://packages.wazuh.com/5.0/
-PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
+PACKAGES_URL=https://packages.wazuh.com/4.14/
+PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/

 ## Check if the cert tool exists in S3 buckets
 CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
@@ -62,7 +62,6 @@ chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A

 # copy to target
 mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}
-mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
 mkdir -p ${TARGET_DIR}${CONFIG_DIR}
 mkdir -p ${TARGET_DIR}${LIB_DIR}
 mkdir -p ${TARGET_DIR}${LOG_DIR}
@@ -73,10 +72,10 @@ mkdir -p ${TARGET_DIR}/usr/lib/sysctl.d
 mkdir -p ${TARGET_DIR}/usr/lib/systemd/system
 mkdir -p ${TARGET_DIR}${CONFIG_DIR}/certs
 # Copy Wazuh's config files for the security plugin
-cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
-cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
-cp -pr /action_groups.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
-cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
+cp -pr /roles_mapping.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
+cp -pr /roles.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
+cp -pr /action_groups.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
+cp -pr /internal_users.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
 cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR}
 # Copy Wazuh indexer's certificates
 cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem
@@ -4,12 +4,13 @@ cluster.name: "wazuh-cluster"
 path.data: /var/lib/wazuh-indexer
 path.logs: /var/log/wazuh-indexer
 discovery.type: single-node
-plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
-plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
-plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
-plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
-plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
-plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
+compatibility.override_main_response_version: true
+plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
+plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
+plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
+plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
 plugins.security.ssl.http.enabled: true
 plugins.security.ssl.transport.enforce_hostname_verification: false
 plugins.security.ssl.transport.resolve_hostname: false
@@ -5,37 +5,57 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh

 ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
+ARG FILEBEAT_TEMPLATE_BRANCH
+ARG FILEBEAT_CHANNEL=filebeat-oss
+ARG FILEBEAT_VERSION=7.10.2
+ARG FILEBEAT_REVISION=2
+ARG WAZUH_FILEBEAT_MODULE
 ARG S6_VERSION="v2.2.0.3"
-ARG TARGETARCH
-ARG wazuh_manager_url_amd64_rpm
-ARG wazuh_manager_url_arm64_rpm

-RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
-    manager_url="${!URL_VAR}" && \
-    dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
-    dnf clean all && \
-    curl -o /wazuh-manager.rpm "${manager_url}" && \
-    dnf install /wazuh-manager.rpm -y && \
-    dnf clean all && \
+RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
+    yum clean all
+
+COPY config/check_repository.sh /
+COPY config/filebeat_module.sh /
+COPY config/permanent_data.env config/permanent_data.sh /
+
+RUN chmod 775 /check_repository.sh
+RUN source /check_repository.sh
+
+RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all && \
+    chmod 775 /filebeat_module.sh && \
+    source /filebeat_module.sh && \
+    rm /filebeat_module.sh && \
    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
    -o /tmp/s6-overlay-amd64.tar.gz && \
    tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
    tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \
-    rm  /tmp/s6-overlay-amd64.tar.gz
+    rm  /tmp/s6-overlay-amd64.tar.gz && \
+    rm -f /var/ossec/etc/sslmanager.key && \
+    rm -f /var/ossec/etc/sslmanager.cert

 COPY config/etc/ /etc/
 COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py

+COPY config/filebeat.yml /etc/filebeat/
+
+RUN chmod go-w /etc/filebeat/filebeat.yml
+
+ADD https://raw.githubusercontent.com/wazuh/wazuh/$FILEBEAT_TEMPLATE_BRANCH/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
+RUN chmod go-w /etc/filebeat/wazuh-template.json
+
 # Prepare permanent data
 # Sync calls are due to https://github.com/docker/docker/issues/9547

-COPY config/permanent_data.env config/permanent_data.sh /
-
 #Make mount directories for keep permissions

 RUN mkdir -p /var/ossec/var/multigroups && \
    chown root:wazuh /var/ossec/var/multigroups && \
    chmod 770 /var/ossec/var/multigroups && \
+    mkdir -p /var/ossec/agentless && \
+    chown root:wazuh /var/ossec/agentless && \
+    chmod 770 /var/ossec/agentless && \
    mkdir -p /var/ossec/active-response/bin && \
    chown root:wazuh /var/ossec/active-response/bin && \
    chmod 770 /var/ossec/active-response/bin && \
@@ -43,6 +63,8 @@ RUN mkdir -p /var/ossec/var/multigroups && \
    sync && /permanent_data.sh && \
    sync && rm /permanent_data.sh

+RUN rm /etc/yum.repos.d/wazuh.repo
+
 # Services ports
 EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp

@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
@@ -6,8 +6,6 @@ source /permanent_data.env

 WAZUH_INSTALL_PATH=/var/ossec
 WAZUH_CONFIG_MOUNT=/wazuh-config-mount
-AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
-

 ##############################################################################
 # Aux functions
@@ -70,8 +68,17 @@ apply_exclusion_data() {
        mkdir -p ${DIR}
      fi

+      safe_cp() {
+          if cp -p "$1" "$2" 2>/dev/null; then
+              return 0
+          else
+              echo "Warning: Could not copy $1 (may be read-only)"
+              return 0
+          fi
+      }
+
      print "Updating ${exclusion_file}"
-      exec_cmd "cp -p ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file} ${exclusion_file}"
+      exec_cmd "safe_cp ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file} ${exclusion_file}"
    fi
  done
 }
@@ -206,13 +213,10 @@ main() {
  # Remove some files in permanent_data (i.e. .template.db)
  remove_data_files

-  # Generate wazuh-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
-  if [ $AUTO_ENROLLMENT_ENABLED == true ]
+  # Create wazuh-authd key and cert if not present
+  if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
  then
-    if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
-    then
-      create_ossec_key_cert
-    fi
+    create_ossec_key_cert
  fi

  # Mount selected files (WAZUH_CONFIG_MOUNT) to container
@@ -0,0 +1,51 @@
+#!/usr/bin/with-contenv bash
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+
+set -e
+
+if [ "$INDEXER_URL" != "" ]; then
+  >&2 echo "Customize Elasticsearch output IP"
+  sed -i "s|hosts:.*|hosts: ['$INDEXER_URL']|g" /etc/filebeat/filebeat.yml
+fi
+
+# Configure filebeat.yml security settings
+
+if [ "$INDEXER_USERNAME" != "" ]; then
+  >&2 echo "Configuring username."
+  sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$INDEXER_PASSWORD" != "" ]; then
+  >&2 echo "Configuring password."
+  sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
+  >&2 echo "Configuring SSL verification mode."
+  sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
+  >&2 echo "Configuring Certificate Authorities."
+  sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_CERTIFICATE" != "" ]; then
+  >&2 echo "Configuring SSL Certificate."
+  sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_KEY" != "" ]; then
+  >&2 echo "Configuring SSL Key."
+  sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
+fi
+
+
+chmod go-w /etc/filebeat/filebeat.yml || true
+chown root: /etc/filebeat/filebeat.yml || true
@@ -60,6 +60,12 @@ function_wazuh_migration(){
      chown wazuh:wazuh /var/ossec/etc/rules/*
      chmod 660 /var/ossec/etc/rules/*

+      if [ -e /wazuh-migration/data/agentless/.passlist ]; then
+        \cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist
+        chown root:wazuh /var/ossec/agentless/.passlist
+        chmod 640 /var/ossec/agentless/.passlist
+      fi
+
      \cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
      chown wazuh:wazuh /var/ossec/queue/db/global.db
      chmod 640 /var/ossec/queue/db/global.db
@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+echo >&2 "Filebeat exited. code=${1}"
+
+# terminate other services to exit from the container
+exec s6-svscanctl -t /var/run/s6/services
+
@@ -0,0 +1,4 @@
+#!/usr/bin/with-contenv sh
+echo >&2 "starting Filebeat"
+
+exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
@@ -0,0 +1,11 @@
+## variables
+REPOSITORY="packages-dev.wazuh.com/pre-release"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  REPOSITORY="packages.wazuh.com/4.x"
+fi
+
+yum install filebeat-${FILEBEAT_VERSION}-${FILEBEAT_REVISION} -y && \
+curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
@@ -4,15 +4,28 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
 PERMANENT_DATA[((i++))]="/var/ossec/etc"
 PERMANENT_DATA[((i++))]="/var/ossec/logs"
 PERMANENT_DATA[((i++))]="/var/ossec/queue"
+PERMANENT_DATA[((i++))]="/var/ossec/agentless"
 PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
+PERMANENT_DATA[((i++))]="/var/ossec/integrations"
 PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin"
 PERMANENT_DATA[((i++))]="/var/ossec/wodles"
+PERMANENT_DATA[((i++))]="/etc/filebeat"

 export PERMANENT_DATA

 # Files mounted in a volume that should not be permanent
 i=0
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
@@ -28,6 +41,18 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
@@ -72,6 +97,11 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes"
+PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json"
+PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/filebeat.yml"
 export PERMANENT_DATA_EXCP

 # Files mounted in a volume that should be deleted
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
 The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:

 ```
-$ build-docker-images/build-images.sh -v 5.0.0
+$ build-docker-images/build-images.sh -v 4.14.2
 ```

 To get all the available script options use the -h or --help option:
@@ -23,9 +23,10 @@ $ build-docker-images/build-images.sh -h

 Usage: build-docker-images/build-images.sh [OPTIONS]

-    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default.
+    -d, --dev <ref>              [Optional] Set the development stage you want to build, example alpha0 or beta1, not used by default.
+    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default 0.4.
    -r, --revision <rev>         [Optional] Package revision. By default 1
-    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
+    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 4.14.2.
    -h, --help                   Show this help.

 ```
@@ -1,6 +1,6 @@
 # Development Guide - Introduction

-Welcome to the Development Guide for Wazuh-docker version 5.0.0 This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
+Welcome to the Development Guide for Wazuh-docker version 4.14.2. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.

 ## Purpose of This Guide

@@ -1,6 +1,6 @@
 # Development Guide - Setup Environment

-This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 5.0.0). A proper setup is crucial for building images, running tests, and contributing effectively.
+This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.14.2). A proper setup is crucial for building images, running tests, and contributing effectively.

 ## Prerequisites

@@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements:
 Follow these steps to prepare your development environment:

 1.  **Clone the Repository**:
-    Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `5.0.0`.
+    Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.14.2`.

    ```bash
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
    cd wazuh-docker
-    git checkout v5.0.0
+    git checkout v4.14.2
    ```

 2.  **Verify Docker Installation**:
@@ -1,6 +1,6 @@
 # Reference Manual - Description

-This section provides a detailed description of Wazuh-docker (version 5.0.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
+This section provides a detailed description of Wazuh-docker (version 4.14.2), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.

 ## What is Wazuh?

@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi

 ## Core Components in Wazuh-Docker

-The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 5.0.0:
+The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.14.2:

 1.  **Wazuh Manager**:
    -   The central component that collects and analyzes data from deployed Wazuh agents.
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
 2.  **Wazuh Indexer**:
    -   A highly scalable, full-text search and analytics engine.
    -   Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
-    -   The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 5.0.0, this is typically an OpenSearch-based component.
+    -   The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.14.2, this is typically an OpenSearch-based component.

 3.  **Wazuh Dashboard**:
    -   A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
@@ -1,6 +1,6 @@
 # Reference Manual - Introduction

-Welcome to the Reference Manual for Wazuh-Docker, version 5.0.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
+Welcome to the Reference Manual for Wazuh-Docker, version 4.14.2. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.

 ## Purpose of This Manual

@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
 -   If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
 -   For specific terms or concepts, consult the [Glossary](glossary.md).

-This manual refers to version 5.0.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
+This manual refers to version 4.14.2 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
@@ -2,7 +2,7 @@

 ### 1. Wazuh Manager Configuration

-* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
+* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, integrations, clustering, and more.
    * **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) .

 ### 2. Wazuh Indexer Configuration
@@ -29,4 +29,4 @@
        ```


-Consult the official Wazuh documentation for version 5.0.0 for detailed information on all possible configuration parameters for each component.
+Consult the official Wazuh documentation for version 4.14.2 for detailed information on all possible configuration parameters for each component.
@@ -1,6 +1,6 @@
 # Reference Manual - Configuration

-This section details how to configure your Wazuh-Docker deployment (version 5.0.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
+This section details how to configure your Wazuh-Docker deployment (version 4.14.2). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.

 ## Overview of Configuration Methods

@@ -1,6 +1,6 @@
 # Reference Manual - Deployment

-This section provides detailed instructions for deploying Wazuh-Docker (version 5.0.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
+This section provides detailed instructions for deploying Wazuh-Docker (version 4.14.2) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.

 ## Overview of Deployment Options

@@ -24,11 +24,11 @@ Ensure you have:

 -   Met all the [System Requirements](ref/getting-started/requirements.md).
 -   Installed Docker and Docker Compose on your host(s).
-   Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files.
+-   Cloned the `wazuh-docker` repository (version `4.14.2`) or downloaded the necessary deployment files.
    ```bash
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
    cd wazuh-docker
-    git checkout v5.0.0
+    git checkout v4.14.2
    ```
 -   Made a backup of any existing Wazuh data if you are migrating or upgrading.

@@ -1,6 +1,6 @@
 # Reference Manual - Getting Started

-This section guides you through the initial steps to get your Wazuh-docker (version 5.0.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
+This section guides you through the initial steps to get your Wazuh-docker (version 4.14.2) environment up and running. We will cover the prerequisites and point you to the deployment instructions.

 ## Overview

@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
    Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.

 2.  **Obtain Wazuh-docker Configuration**:
-    You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 5.0.0.
+    You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.14.2.
    ```bash
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
    cd wazuh-docker
-    git checkout v5.0.0
+    git checkout v4.14.2
    # Navigate to the specific docker-compose directory, e.g., single-node or multi-node
    # cd docker-compose/single-node/ (example path)
    ```
@@ -1,6 +1,6 @@
 # Reference Manual - Requirements

-Before deploying Wazuh-Docker (version 5.0.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
+Before deploying Wazuh-Docker (version 4.14.2), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.

 ## Host System Requirements

@@ -1,6 +1,6 @@
 # Reference Manual - Glossary

-This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 5.0.0).
+This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.14.2).

 ---

@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their

 **D**

-   **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 5.0.0, this is typically OpenSearch Dashboards.
+-   **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.14.2, this is typically OpenSearch Dashboards.
 -   **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
 -   **Docker**: An open platform for developing, shipping, and running applications inside containers.
 -   **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their

 **I**

-   **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 5.0.0, this is typically OpenSearch.
+-   **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.14.2, this is typically OpenSearch.

 **L**

@@ -80,6 +80,13 @@ docker volume create \
           multi-node_master-wazuh-var-multigroups
 ```
 ```
+docker volume create \
+           --label com.docker.compose.project=multi-node \
+           --label com.docker.compose.version=1.25.0 \
+           --label com.docker.compose.volume=master-wazuh-integrations \
+           multi-node_master-wazuh-integrations
+```
+```
 docker volume create \
           --label com.docker.compose.project=multi-node \
           --label com.docker.compose.version=1.25.0 \
@@ -87,6 +94,13 @@ docker volume create \
           multi-node_master-wazuh-active-response
 ```
 ```
+docker volume create \
+           --label com.docker.compose.project=multi-node \
+           --label com.docker.compose.version=1.25.0 \
+           --label com.docker.compose.volume=master-wazuh-agentless \
+           multi-node_master-wazuh-agentless
+```
+```
 docker volume create \
           --label com.docker.compose.project=multi-node \
           --label com.docker.compose.version=1.25.0 \
@@ -143,6 +157,13 @@ docker volume create \
           multi-node_worker-wazuh-var-multigroups
 ```
 ```
+docker volume create \
+           --label com.docker.compose.project=multi-node \
+           --label com.docker.compose.version=1.25.0 \
+           --label com.docker.compose.volume=worker-wazuh-integrations \
+           multi-node_worker-wazuh-integrations
+```
+```
 docker volume create \
           --label com.docker.compose.project=multi-node \
           --label com.docker.compose.version=1.25.0 \
@@ -150,6 +171,13 @@ docker volume create \
           multi-node_worker-wazuh-active-response
 ```
 ```
+docker volume create \
+           --label com.docker.compose.project=multi-node \
+           --label com.docker.compose.version=1.25.0 \
+           --label com.docker.compose.volume=worker-wazuh-agentless \
+           multi-node_worker-wazuh-agentless
+```
+```
 docker volume create \
           --label com.docker.compose.project=multi-node \
           --label com.docker.compose.version=1.25.0 \
@@ -220,12 +248,24 @@ docker container run --rm -it \
           alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
+docker container run --rm -it \
+           -v wazuh-docker_ossec-integrations:/from \
+           -v multi-node_master-wazuh-integrations:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+```
+```
 docker container run --rm -it \
           -v wazuh-docker_ossec-active-response:/from \
           -v multi-node_master-wazuh-active-response:/to \
           alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
+docker container run --rm -it \
+           -v wazuh-docker_ossec-agentless:/from \
+           -v multi-node_master-wazuh-agentless:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+```
+```
 docker container run --rm -it \
           -v wazuh-docker_ossec-wodles:/from \
           -v multi-node_master-wazuh-wodles:/to \
@@ -274,12 +314,24 @@ docker container run --rm -it \
           alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
+docker container run --rm -it \
+           -v wazuh-docker_worker-ossec-integrations:/from \
+           -v multi-node_worker-wazuh-integrations:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+```
+```
 docker container run --rm -it \
           -v wazuh-docker_worker-ossec-active-response:/from \
           -v multi-node_worker-wazuh-active-response:/to \
           alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
+docker container run --rm -it \
+           -v wazuh-docker_worker-ossec-agentless:/from \
+           -v multi-node_worker-wazuh-agentless:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+```
+```
 docker container run --rm -it \
           -v wazuh-docker_worker-ossec-wodles:/from \
           -v multi-node_worker-wazuh-wodles:/to \
@@ -1,10 +1,24 @@
 <ossec_config>
  <global>
-    <agents_disconnection_time>15m</agents_disconnection_time>
+    <jsonout_output>yes</jsonout_output>
+    <alerts_log>yes</alerts_log>
+    <logall>no</logall>
+    <logall_json>no</logall_json>
+    <email_notification>no</email_notification>
+    <smtp_server>smtp.example.wazuh.com</smtp_server>
+    <email_from>wazuh@example.wazuh.com</email_from>
+    <email_to>recipient@example.wazuh.com</email_to>
+    <email_maxperhour>12</email_maxperhour>
+    <email_log_source>alerts.log</email_log_source>
+    <agents_disconnection_time>10m</agents_disconnection_time>
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
-    <update_check>yes</update_check>
  </global>

+  <alerts>
+    <log_alert_level>3</log_alert_level>
+    <email_alert_level>12</email_alert_level>
+  </alerts>
+
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  <logging>
    <log_format>plain</log_format>
@@ -20,6 +34,8 @@
  <!-- Policy monitoring -->
  <rootcheck>
    <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
@@ -29,12 +45,31 @@
    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>43200</frequency>

-    <skip_nfs>yes</skip_nfs>
+    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>

-    <ignore>/var/lib/containerd</ignore>
-    <ignore>/var/lib/docker/overlay2</ignore>
+    <skip_nfs>yes</skip_nfs>
  </rootcheck>

+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <!-- Osquery integration -->
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
  <!-- System inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
@@ -46,15 +81,9 @@
    <packages>yes</packages>
    <ports all="yes">yes</ports>
    <processes>yes</processes>
-    <users>yes</users>
-    <groups>yes</groups>
-    <services>yes</services>
-    <browser_extensions>yes</browser_extensions>

    <!-- Database synchronization settings -->
    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>
@@ -63,13 +92,7 @@
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
-
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
-      <max_eps>10</max_eps>
-    </synchronization>
+    <skip_nfs>yes</skip_nfs>
  </sca>

  <vulnerability-detection>
@@ -101,6 +124,8 @@
    <!-- Frequency that syscheck is executed default every 12 hours -->
    <frequency>43200</frequency>

+    <scan_on_start>yes</scan_on_start>
+
    <!-- Generate alert when new file detected -->
    <alert_new_files>yes</alert_new_files>

@@ -140,12 +165,13 @@
    <process_priority>10</process_priority>

    <!-- Maximum output throughput -->
-    <max_eps>50</max_eps>
+    <max_eps>100</max_eps>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
+      <max_interval>1h</max_interval>
      <max_eps>10</max_eps>
    </synchronization>
  </syscheck>
@@ -240,6 +266,13 @@
    <rule_dir>etc/rules</rule_dir>
  </ruleset>

+  <rule_test>
+    <enabled>yes</enabled>
+    <threads>1</threads>
+    <max_sessions>64</max_sessions>
+    <session_timeout>15m</session_timeout>
+  </rule_test>
+
  <!-- Configuration for wazuh-authd -->
  <auth>
    <disabled>no</disabled>
@@ -272,19 +305,9 @@
 </ossec_config>

 <ossec_config>
-  <localfile>
-    <log_format>journald</log_format>
-    <location>journald</location>
-  </localfile>
-
-  <localfile>
-    <log_format>audit</log_format>
-    <location>/var/log/audit/audit.log</location>
-  </localfile>
-
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

-</ossec_config>
+</ossec_config>
@@ -1,10 +1,24 @@
 <ossec_config>
  <global>
-    <agents_disconnection_time>15m</agents_disconnection_time>
+    <jsonout_output>yes</jsonout_output>
+    <alerts_log>yes</alerts_log>
+    <logall>no</logall>
+    <logall_json>no</logall_json>
+    <email_notification>no</email_notification>
+    <smtp_server>smtp.example.wazuh.com</smtp_server>
+    <email_from>wazuh@example.wazuh.com</email_from>
+    <email_to>recipient@example.wazuh.com</email_to>
+    <email_maxperhour>12</email_maxperhour>
+    <email_log_source>alerts.log</email_log_source>
+    <agents_disconnection_time>10m</agents_disconnection_time>
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
-    <update_check>yes</update_check>
  </global>

+  <alerts>
+    <log_alert_level>3</log_alert_level>
+    <email_alert_level>12</email_alert_level>
+  </alerts>
+
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  <logging>
    <log_format>plain</log_format>
@@ -20,6 +34,8 @@
  <!-- Policy monitoring -->
  <rootcheck>
    <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
@@ -29,12 +45,31 @@
    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>43200</frequency>

-    <skip_nfs>yes</skip_nfs>
+    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>

-    <ignore>/var/lib/containerd</ignore>
-    <ignore>/var/lib/docker/overlay2</ignore>
+    <skip_nfs>yes</skip_nfs>
  </rootcheck>

+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <!-- Osquery integration -->
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
  <!-- System inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
@@ -46,15 +81,9 @@
    <packages>yes</packages>
    <ports all="yes">yes</ports>
    <processes>yes</processes>
-    <users>yes</users>
-    <groups>yes</groups>
-    <services>yes</services>
-    <browser_extensions>yes</browser_extensions>

    <!-- Database synchronization settings -->
    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>
@@ -63,13 +92,7 @@
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
-
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
-      <max_eps>10</max_eps>
-    </synchronization>
+    <skip_nfs>yes</skip_nfs>
  </sca>

  <vulnerability-detection>
@@ -101,6 +124,8 @@
    <!-- Frequency that syscheck is executed default every 12 hours -->
    <frequency>43200</frequency>

+    <scan_on_start>yes</scan_on_start>
+
    <!-- Generate alert when new file detected -->
    <alert_new_files>yes</alert_new_files>

@@ -140,12 +165,13 @@
    <process_priority>10</process_priority>

    <!-- Maximum output throughput -->
-    <max_eps>50</max_eps>
+    <max_eps>100</max_eps>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
+      <max_interval>1h</max_interval>
      <max_eps>10</max_eps>
    </synchronization>
  </syscheck>
@@ -240,6 +266,13 @@
    <rule_dir>etc/rules</rule_dir>
  </ruleset>

+  <rule_test>
+    <enabled>yes</enabled>
+    <threads>1</threads>
+    <max_sessions>64</max_sessions>
+    <session_timeout>15m</session_timeout>
+  </rule_test>
+
  <!-- Configuration for wazuh-authd -->
  <auth>
    <disabled>no</disabled>
@@ -272,19 +305,9 @@
 </ossec_config>

 <ossec_config>
-  <localfile>
-    <log_format>journald</log_format>
-    <location>journald</location>
-  </localfile>
-
-  <localfile>
-    <log_format>audit</log_format>
-    <location>/var/log/audit/audit.log</location>
-  </localfile>
-
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

-</ossec_config>
+</ossec_config>
@@ -2,7 +2,7 @@ server.host: 0.0.0.0
 server.port: 5601
 opensearch.hosts: https://wazuh1.indexer:9200
 opensearch.ssl.verificationMode: certificate
-opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
+opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
 opensearch_security.multitenancy.enabled: false
 opensearch_security.readonly_mode.roles: ["kibana_read_only"]
 server.ssl.enabled: true
@@ -1,6 +1,6 @@
 network.host: wazuh1.indexer
 node.name: wazuh1.indexer
-cluster.initial_cluster_manager_nodes:
+cluster.initial_master_nodes:
        - wazuh1.indexer
        - wazuh2.indexer
        - wazuh3.indexer
@@ -35,3 +35,4 @@ plugins.security.restapi.roles_enabled:
 - "security_rest_api_access"
 plugins.security.allow_default_init_securityindex: true
 cluster.routing.allocation.disk.threshold_enabled: false
+compatibility.override_main_response_version: true
@@ -1,6 +1,6 @@
 network.host: wazuh2.indexer
 node.name: wazuh2.indexer
-cluster.initial_cluster_manager_nodes:
+cluster.initial_master_nodes:
        - wazuh1.indexer
        - wazuh2.indexer
        - wazuh3.indexer
@@ -35,3 +35,4 @@ plugins.security.restapi.roles_enabled:
 - "security_rest_api_access"
 plugins.security.allow_default_init_securityindex: true
 cluster.routing.allocation.disk.threshold_enabled: false
+compatibility.override_main_response_version: true
@@ -1,6 +1,6 @@
 network.host: wazuh3.indexer
 node.name: wazuh3.indexer
-cluster.initial_cluster_manager_nodes:
+cluster.initial_master_nodes:
        - wazuh1.indexer
        - wazuh2.indexer
        - wazuh3.indexer
@@ -35,3 +35,4 @@ plugins.security.restapi.roles_enabled:
 - "security_rest_api_access"
 plugins.security.allow_default_init_securityindex: true
 cluster.routing.allocation.disk.threshold_enabled: false
+compatibility.override_main_response_version: true
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
  wazuh.master:
-    image: wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:4.14.2
    hostname: wazuh.master
    restart: always
    ulimits:
@@ -31,7 +31,9 @@ services:
      - master-wazuh-logs:/var/ossec/logs
      - master-wazuh-queue:/var/ossec/queue
      - master-wazuh-var-multigroups:/var/ossec/var/multigroups
+      - master-wazuh-integrations:/var/ossec/integrations
      - master-wazuh-active-response:/var/ossec/active-response/bin
+      - master-wazuh-agentless:/var/ossec/agentless
      - master-wazuh-wodles:/var/ossec/wodles
      - master-filebeat-etc:/etc/filebeat
      - master-filebeat-var:/var/lib/filebeat
@@ -41,7 +43,7 @@ services:
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

  wazuh.worker:
-    image: wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:4.14.2
    hostname: wazuh.worker
    restart: always
    ulimits:
@@ -65,7 +67,9 @@ services:
      - worker-wazuh-logs:/var/ossec/logs
      - worker-wazuh-queue:/var/ossec/queue
      - worker-wazuh-var-multigroups:/var/ossec/var/multigroups
+      - worker-wazuh-integrations:/var/ossec/integrations
      - worker-wazuh-active-response:/var/ossec/active-response/bin
+      - worker-wazuh-agentless:/var/ossec/agentless
      - worker-wazuh-wodles:/var/ossec/wodles
      - worker-filebeat-etc:/etc/filebeat
      - worker-filebeat-var:/var/lib/filebeat
@@ -75,7 +79,7 @@ services:
      - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf

  wazuh1.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:4.14.2
    hostname: wazuh1.indexer
    restart: always
    ports:
@@ -101,7 +105,7 @@ services:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh2.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:4.14.2
    hostname: wazuh2.indexer
    restart: always
    environment:
@@ -123,7 +127,7 @@ services:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh3.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:4.14.2
    hostname: wazuh3.indexer
    restart: always
    environment:
@@ -145,7 +149,7 @@ services:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0
+    image: wazuh/wazuh-dashboard:4.14.2
    hostname: wazuh.dashboard
    restart: always
    ports:
@@ -194,7 +198,9 @@ volumes:
  master-wazuh-logs:
  master-wazuh-queue:
  master-wazuh-var-multigroups:
+  master-wazuh-integrations:
  master-wazuh-active-response:
+  master-wazuh-agentless:
  master-wazuh-wodles:
  master-filebeat-etc:
  master-filebeat-var:
@@ -203,7 +209,9 @@ volumes:
  worker-wazuh-logs:
  worker-wazuh-queue:
  worker-wazuh-var-multigroups:
+  worker-wazuh-integrations:
  worker-wazuh-active-response:
+  worker-wazuh-agentless:
  worker-wazuh-wodles:
  worker-filebeat-etc:
  worker-filebeat-var:
@@ -46,12 +46,24 @@ docker volume create \
           --label com.docker.compose.volume=master-wazuh-var-multigroups \
           $2_master-wazuh-var-multigroups

+docker volume create \
+           --label com.docker.compose.project=$2 \
+           --label com.docker.compose.version=$1 \
+           --label com.docker.compose.volume=master-wazuh-integrations \
+           $2_master-wazuh-integrations
+
 docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
           --label com.docker.compose.volume=master-wazuh-active-response \
           $2_master-wazuh-active-response

+docker volume create \
+           --label com.docker.compose.project=$2 \
+           --label com.docker.compose.version=$1 \
+           --label com.docker.compose.volume=master-wazuh-agentless \
+           $2_master-wazuh-agentless
+
 docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
@@ -100,12 +112,24 @@ docker volume create \
           --label com.docker.compose.volume=worker-wazuh-var-multigroups \
           $2_worker-wazuh-var-multigroups

+docker volume create \
+           --label com.docker.compose.project=$2 \
+           --label com.docker.compose.version=$1 \
+           --label com.docker.compose.volume=worker-wazuh-integrations \
+           $2_worker-wazuh-integrations
+
 docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
           --label com.docker.compose.volume=worker-wazuh-active-response \
           $2_worker-wazuh-active-response

+docker volume create \
+           --label com.docker.compose.project=$2 \
+           --label com.docker.compose.version=$1 \
+           --label com.docker.compose.volume=worker-wazuh-agentless \
+           $2_worker-wazuh-agentless
+
 docker volume create \
           --label com.docker.compose.project=$2 \
           --label com.docker.compose.version=$1 \
@@ -169,11 +193,21 @@ docker container run --rm -it \
           -v $2_master-wazuh-var-multigroups:/to \
           alpine ash -c "cd /from ; cp -avp . /to"

+docker container run --rm -it \
+           -v wazuh-docker_ossec-integrations:/from \
+           -v $2_master-wazuh-integrations:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+
 docker container run --rm -it \
           -v wazuh-docker_ossec-active-response:/from \
           -v $2_master-wazuh-active-response:/to \
           alpine ash -c "cd /from ; cp -avp . /to"

+docker container run --rm -it \
+           -v wazuh-docker_ossec-agentless:/from \
+           -v $2_master-wazuh-agentless:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+
 docker container run --rm -it \
           -v wazuh-docker_ossec-wodles:/from \
           -v $2_master-wazuh-wodles:/to \
@@ -214,11 +248,21 @@ docker container run --rm -it \
           -v $2_worker-wazuh-var-multigroups:/to \
           alpine ash -c "cd /from ; cp -avp . /to"

+docker container run --rm -it \
+           -v wazuh-docker_worker-ossec-integrations:/from \
+           -v $2_worker-wazuh-integrations:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+
 docker container run --rm -it \
           -v wazuh-docker_worker-ossec-active-response:/from \
           -v $2_worker-wazuh-active-response:/to \
           alpine ash -c "cd /from ; cp -avp . /to"

+docker container run --rm -it \
+           -v wazuh-docker_worker-ossec-agentless:/from \
+           -v $2_worker-wazuh-agentless:/to \
+           alpine ash -c "cd /from ; cp -avp . /to"
+
 docker container run --rm -it \
           -v wazuh-docker_worker-ossec-wodles:/from \
           -v $2_worker-wazuh-wodles:/to \
@@ -1,10 +1,24 @@
 <ossec_config>
  <global>
-    <agents_disconnection_time>15m</agents_disconnection_time>
+    <jsonout_output>yes</jsonout_output>
+    <alerts_log>yes</alerts_log>
+    <logall>no</logall>
+    <logall_json>no</logall_json>
+    <email_notification>no</email_notification>
+    <smtp_server>smtp.example.wazuh.com</smtp_server>
+    <email_from>wazuh@example.wazuh.com</email_from>
+    <email_to>recipient@example.wazuh.com</email_to>
+    <email_maxperhour>12</email_maxperhour>
+    <email_log_source>alerts.log</email_log_source>
+    <agents_disconnection_time>10m</agents_disconnection_time>
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
-    <update_check>yes</update_check>
  </global>

+  <alerts>
+    <log_alert_level>3</log_alert_level>
+    <email_alert_level>12</email_alert_level>
+  </alerts>
+
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  <logging>
    <log_format>plain</log_format>
@@ -20,6 +34,8 @@
  <!-- Policy monitoring -->
  <rootcheck>
    <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
@@ -29,12 +45,31 @@
    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>43200</frequency>

-    <skip_nfs>yes</skip_nfs>
+    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>

-    <ignore>/var/lib/containerd</ignore>
-    <ignore>/var/lib/docker/overlay2</ignore>
+    <skip_nfs>yes</skip_nfs>
  </rootcheck>

+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <!-- Osquery integration -->
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
  <!-- System inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
@@ -46,15 +81,9 @@
    <packages>yes</packages>
    <ports all="yes">yes</ports>
    <processes>yes</processes>
-    <users>yes</users>
-    <groups>yes</groups>
-    <services>yes</services>
-    <browser_extensions>yes</browser_extensions>

    <!-- Database synchronization settings -->
    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
      <max_eps>10</max_eps>
    </synchronization>
  </wodle>
@@ -63,13 +92,7 @@
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
-
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
-      <max_eps>10</max_eps>
-    </synchronization>
+    <skip_nfs>yes</skip_nfs>
  </sca>

  <vulnerability-detection>
@@ -99,6 +122,8 @@
    <!-- Frequency that syscheck is executed default every 12 hours -->
    <frequency>43200</frequency>

+    <scan_on_start>yes</scan_on_start>
+
    <!-- Generate alert when new file detected -->
    <alert_new_files>yes</alert_new_files>

@@ -138,12 +163,13 @@
    <process_priority>10</process_priority>

    <!-- Maximum output throughput -->
-    <max_eps>50</max_eps>
+    <max_eps>100</max_eps>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
+      <max_interval>1h</max_interval>
      <max_eps>10</max_eps>
    </synchronization>
  </syscheck>
@@ -238,6 +264,13 @@
    <rule_dir>etc/rules</rule_dir>
  </ruleset>

+  <rule_test>
+    <enabled>yes</enabled>
+    <threads>1</threads>
+    <max_sessions>64</max_sessions>
+    <session_timeout>15m</session_timeout>
+  </rule_test>
+
  <!-- Configuration for wazuh-authd -->
  <auth>
    <disabled>no</disabled>
@@ -270,19 +303,9 @@
 </ossec_config>

 <ossec_config>
-  <localfile>
-    <log_format>journald</log_format>
-    <location>journald</location>
-  </localfile>
-
-  <localfile>
-    <log_format>audit</log_format>
-    <location>/var/log/audit/audit.log</location>
-  </localfile>
-
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

-</ossec_config>
+</ossec_config>
@@ -2,7 +2,7 @@ server.host: 0.0.0.0
 server.port: 5601
 opensearch.hosts: https://wazuh.indexer:9200
 opensearch.ssl.verificationMode: certificate
-opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
+opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
 opensearch_security.multitenancy.enabled: false
 opensearch_security.readonly_mode.roles: ["kibana_read_only"]
 server.ssl.enabled: true
@@ -6,12 +6,13 @@ path.logs: /var/log/wazuh-indexer
 discovery.type: single-node
 http.port: 9200-9299
 transport.tcp.port: 9300-9399
-plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
-plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
-plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
-plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
-plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
-plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
+compatibility.override_main_response_version: true
+plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
 plugins.security.ssl.http.enabled: true
 plugins.security.ssl.transport.enforce_hostname_verification: false
 plugins.security.ssl.transport.resolve_hostname: false
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
  wazuh.manager:
-    image: wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:4.14.2
    hostname: wazuh.manager
    restart: always
    ulimits:
@@ -32,7 +32,9 @@ services:
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
      - wazuh_var_multigroups:/var/ossec/var/multigroups
+      - wazuh_integrations:/var/ossec/integrations
      - wazuh_active_response:/var/ossec/active-response/bin
+      - wazuh_agentless:/var/ossec/agentless
      - wazuh_wodles:/var/ossec/wodles
      - filebeat_etc:/etc/filebeat
      - filebeat_var:/var/lib/filebeat
@@ -42,7 +44,7 @@ services:
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

  wazuh.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:4.14.2
    hostname: wazuh.indexer
    restart: always
    ports:
@@ -67,7 +69,7 @@ services:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0
+    image: wazuh/wazuh-dashboard:4.14.2
    hostname: wazuh.dashboard
    restart: always
    ports:
@@ -100,7 +102,9 @@ volumes:
  wazuh_logs:
  wazuh_queue:
  wazuh_var_multigroups:
+  wazuh_integrations:
  wazuh_active_response:
+  wazuh_agentless:
  wazuh_wodles:
  filebeat_etc:
  filebeat_var:
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
  wazuh.agent:
-    image: wazuh/wazuh-agent:5.0.0
+    image: wazuh/wazuh-agent:4.14.2
    restart: always
    environment:
      - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
Author	SHA1	Message	Date
Carlos Bordon	2dc7717e81	Merge pull request #2094 from wazuh/change/6569-nokia-private-key-hardcoded-in-wazuh-manager-image-4.14.2-update The location of the remove command for the wazuh-authd certificates has been changed.	2025-11-27 11:59:50 -03:00
Carlos Bordon	0ba67b1adf	Updated changelog	2025-11-27 11:19:10 -03:00
Carlos Bordon	eecec3db80	The location of the remove command for the wazuh-authd certificates has been changed.	2025-11-27 11:15:32 -03:00
Carlos Bordon	f4cc1bd838	Merge pull request #2093 from wazuh/change/6569-nokia-private-key-hardcoded-in-wazuh-manager-image-4.14.2 Removed sslmanager key from the docker manager image to 4.14.2	2025-11-27 08:14:14 -03:00
Carlos Bordon	0602ce076d	Updated changelog	2025-11-26 16:55:29 -03:00
Carlos Bordon	2d122e1dc9	Removed sslmanager key from the docker manager image to 4.14.2	2025-11-26 15:22:12 -03:00
Carlos Bordon	47a73bdde6	Merge pull request #2090 from wazuh/bug/2088-improvements-4.14.2 Code improvements for 4.14.2	2025-11-26 11:55:25 -03:00
Victor Carlos Erenu	fb6be60afb	Add changelog	2025-11-25 21:52:07 +07:00
Victor Carlos Erenu	2d6c920366	Delete opensearch-security directory creation	2025-11-25 20:57:45 +07:00
Victor Carlos Erenu	d69f5c0c5d	Add new path for Wazun indexer and new function for permanent_data exception	2025-11-25 01:22:11 +07:00
Gonzalo Acuña	d52c076e62	Merge pull request #2078 from wazuh/change/3494-docker-notification Artifactory vulnerabilities notification	2025-11-13 15:45:45 -03:00
Gonzalo Acuña	e5d6ba55cc	Changelog update	2025-11-13 14:41:53 -03:00
Gonzalo Acuña	415ddd7271	Replace secret variables	2025-11-13 14:06:39 -03:00
Gonzalo Acuña	aa98d94f38	Revert test changes	2025-11-13 11:50:18 -03:00
Gonzalo Acuña	af2e4589c0	GH project additional variable assignment fix	2025-11-13 11:42:16 -03:00
Gonzalo Acuña	6a8d0d6288	GH project additional variable assignment	2025-11-13 11:35:03 -03:00
Gonzalo Acuña	11b066ef25	GH project variable assignment	2025-11-13 11:24:48 -03:00
Gonzalo Acuña	11c0ae9161	GH issue creation command fix	2025-11-13 10:01:08 -03:00
Gonzalo Acuña	ecb486f625	GH issue creation commands	2025-11-12 16:52:27 -03:00
Gonzalo Acuña	16de0735a9	GH notification identation fix	2025-11-12 16:21:17 -03:00
Gonzalo Acuña	5103da8dab	GH notification test change	2025-11-12 14:32:45 -03:00
Gonzalo Acuña	91cda37b1f	GH notification changes for image publication	2025-11-12 12:15:37 -03:00
Wazuh CI	aed6d3eea2	Merge pull request #2071 from wazuh/enhancement/wqa4626-bump-4.14.2 Bump 4.14.2 branch	2025-11-10 18:16:57 +01:00
wazuhci	7adc50cf81	feat: bump 4.14.2	2025-11-10 17:16:53 +00:00
Carlos Anguita	4e99641d02	Merge pull request #2068 from wazuh/enhancement/2066-revert-image-tag-for-4.14.1rc2	2025-11-07 10:47:58 +01:00
Enrique Araque	b39237b2c0	Remove docker image tag for 4.14.1-rc2	2025-11-07 10:31:22 +01:00
Wazuh CI	582e5d67ef	Merge pull request #2067 from wazuh/enhancement/wqa4608-bump-4.14.1 Bump 4.14.1 branch	2025-11-07 09:45:57 +01:00
wazuhci	4dac06e335	feat: bump 4.14.1	2025-11-07 08:45:51 +00:00
Carlos Anguita	f08620251d	Merge pull request #2059 from wazuh/enhancement/2055-revert-image-tag-for-4.14.1rc1	2025-10-31 10:10:53 +01:00
Enrique Araque	f7cebff2e9	Remove image tag for 4.14.1 rc1	2025-10-31 10:09:11 +01:00
Wazuh CI	a9ef0e901a	Merge pull request #2056 from wazuh/enhancement/wqa4563-bump-4.14.1 Bump 4.14.1 branch	2025-10-30 10:32:35 +01:00
wazuhci	b031e317f7	feat: bump 4.14.1	2025-10-30 09:32:26 +00:00