Updating logstash configuration

README.md

@@ -15,7 +15,7 @@ In addition, a docker-compose file is provided to launch the containers mentione
 
 ## Current release
 
-Containers are currently tested on Wazuh version 3.2.2 and Elastic Stack version 6.2.4. We will do our best to keep this repository updated to latest versions of both Wazuh and Elastic Stack.
+Containers are currently tested on Wazuh version 3.3.1 and Elastic Stack version 6.3.0. We will do our best to keep this repository updated to latest versions of both Wazuh and Elastic Stack.
 
 ## Installation notes
 

docker-compose.yml

@@ -38,7 +38,7 @@ services:
     environment:
       - LS_HEAP_SIZE=2048m
   elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.2.4
+    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.3.0
     hostname: elasticsearch
     restart: always
     ports:

kibana/Dockerfile

@@ -1,6 +1,6 @@
 # Wazuh App Copyright (C) 2018 Wazuh Inc. (License GPLv2)
-FROM docker.elastic.co/kibana/kibana-oss:6.2.4
-ARG WAZUH_APP_VERSION=3.2.2_6.2.4
+FROM docker.elastic.co/kibana/kibana-oss:6.3.0
+ARG WAZUH_APP_VERSION=3.3.1_6.3.0
 USER root
 
 ADD https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip /tmp
@@ -16,4 +16,4 @@ RUN chmod 755 /entrypoint.sh
 
 USER kibana
 
-ENTRYPOINT /entrypoint.sh 
+ENTRYPOINT /entrypoint.sh

kibana/config/entrypoint.sh

@@ -41,7 +41,8 @@ if [ "x$CONFIG_CODE" = "x404" ]; then
         "audit": true,
         "pci": true,
         "aws": true,
-        "virustotal": true
+        "virustotal": true,
+        "gdpr": true
       }
     }
     ' > /dev/null

logstash/Dockerfile

@@ -1,5 +1,5 @@
 # Wazuh App Copyright (C) 2018 Wazuh Inc. (License GPLv2)
-FROM docker.elastic.co/logstash/logstash-oss:6.2.4
+FROM docker.elastic.co/logstash/logstash-oss:6.3.0
 
 RUN rm -f /usr/share/logstash/pipeline/logstash.conf
 

logstash/config/01-wazuh.conf

@@ -26,14 +26,14 @@ filter {
     geoip {
         source => "@src_ip"
         target => "GeoLocation"
-        fields => ["city_name", "continent_code", "country_code2", "country_name", "region_name", "location"]
+        fields => ["city_name", "country_name", "region_name", "location"]
     }
     date {
         match => ["timestamp", "ISO8601"]
         target => "@timestamp"
     }
     mutate {
-        remove_field => [ "timestamp", "beat", "input_type", "tags", "count", "@version", "log", "offset", "type","@src_ip"]
+        remove_field => ["timestamp", "beat", "input_type", "tags", "count", "@version", "log", "offset", "type", "@src_ip", "host"]
     }
 }
 output {

wazuh/Dockerfile

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2018 Wazuh Inc. (License GPLv2)
 FROM phusion/baseimage:latest
-ARG FILEBEAT_VERSION=6.2.4
-ARG WAZUH_VERSION=3.2.2-1
+ARG FILEBEAT_VERSION=6.3.0
+ARG WAZUH_VERSION=3.3.1-1
 
 # Updating image
 RUN apt-get update && apt-get upgrade -y -o Dpkg::Options::="--force-confold"
@@ -11,14 +11,14 @@ RUN echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/so
 RUN curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
 
 # Set nodejs repository.
-RUN curl --silent --location https://deb.nodesource.com/setup_6.x | bash - 
+RUN curl --silent --location https://deb.nodesource.com/setup_8.x | bash -
 
 # Creating ossec user as uid:gid 1000:1000
 RUN groupadd -g 1000 ossec
 RUN useradd -u 1000 -g 1000 ossec
 
 # Configure postfix
-RUN echo "postfix postfix/mailname string wazuh-manager" | debconf-set-selections 
+RUN echo "postfix postfix/mailname string wazuh-manager" | debconf-set-selections
 RUN echo "postfix postfix/main_mailer_type string 'Internet Site'" | debconf-set-selections
 
 # Install packages