forked from wazuh/wazuh-docker
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 fcaffieri
|
2f966b5236 |
@@ -1,6 +1,6 @@
|
||||
WAZUH_VERSION=4.14.0
|
||||
WAZUH_IMAGE_VERSION=4.14.0
|
||||
WAZUH_VERSION=4.13.0
|
||||
WAZUH_IMAGE_VERSION=4.13.0
|
||||
WAZUH_TAG_REVISION=1
|
||||
FILEBEAT_TEMPLATE_BRANCH=4.14.0
|
||||
FILEBEAT_TEMPLATE_BRANCH=4.13.0
|
||||
WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
|
||||
WAZUH_UI_REVISION=1
|
||||
|
||||
+1
-1
@@ -56,7 +56,7 @@ package:
|
||||
wazuh-manager:
|
||||
installed: true
|
||||
versions:
|
||||
- 4.14.0
|
||||
- 4.13.0
|
||||
port:
|
||||
tcp:1514:
|
||||
listening: true
|
||||
|
||||
@@ -6,7 +6,7 @@ on:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag'
|
||||
default: '4.14.0'
|
||||
default: '4.13.0'
|
||||
required: true
|
||||
docker_reference:
|
||||
description: 'wazuh-docker reference'
|
||||
@@ -41,7 +41,7 @@ on:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag'
|
||||
default: '4.14.0'
|
||||
default: '4.13.0'
|
||||
required: true
|
||||
type: string
|
||||
docker_reference:
|
||||
|
||||
@@ -192,7 +192,7 @@ jobs:
|
||||
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
|
||||
|
||||
- name: Start Wazuh agent
|
||||
run: docker compose -f wazuh-agent/docker-compose.yml up -d
|
||||
run: docker-compose -f wazuh-agent/docker-compose.yml up -d
|
||||
|
||||
- name: Check Wazuh agent enrollment
|
||||
run: |
|
||||
@@ -355,7 +355,7 @@ jobs:
|
||||
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
|
||||
|
||||
- name: Start Wazuh agent
|
||||
run: docker compose -f wazuh-agent/docker-compose.yml up -d
|
||||
run: docker-compose -f wazuh-agent/docker-compose.yml up -d
|
||||
|
||||
- name: Check Wazuh agent enrollment
|
||||
run: |
|
||||
|
||||
+1
-49
@@ -1,57 +1,10 @@
|
||||
# Change Log
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## [4.14.0]
|
||||
|
||||
### Added
|
||||
|
||||
- None
|
||||
|
||||
### Changed
|
||||
|
||||
- Change filebeat install method ([#2020](https://github.com/wazuh/wazuh-docker/pull/2020))
|
||||
- Remove dashboard chat setting ([#2021](https://github.com/wazuh/wazuh-docker/pull/2021))
|
||||
- Rollback data source setting ([#1999](https://github.com/wazuh/wazuh-docker/pull/1999))
|
||||
- Dashboard settings added ([#1998](https://github.com/wazuh/wazuh-docker/pull/1998))
|
||||
- Add filebeat config file in the PERMANENT_DATA_EXCP list ([#1898](https://github.com/wazuh/wazuh-docker/pull/1898))
|
||||
- Change validation of existing certs tool in S3 buckets ([#1880](https://github.com/wazuh/wazuh-docker/pull/1880))
|
||||
|
||||
### Fixed
|
||||
|
||||
- Change Wazuh indexer directory owner ([#2029](https://github.com/wazuh/wazuh-docker/pull/2029))
|
||||
- Double the amount of space consumed in Wazuh Indexer ([#1953](https://github.com/wazuh/wazuh-docker/pull/1953))
|
||||
- Fix config directory for opensearch_security plugin work ([#1951](https://github.com/wazuh/wazuh-docker/pull/1951))
|
||||
- Update Dockerfile to copy opensearch-security files ([#1928](https://github.com/wazuh/wazuh-docker/pull/1928))
|
||||
|
||||
### Deleted
|
||||
|
||||
- None
|
||||
|
||||
## [4.13.1]
|
||||
|
||||
### Added
|
||||
|
||||
- None
|
||||
|
||||
### Changed
|
||||
|
||||
- None
|
||||
|
||||
### Fixed
|
||||
|
||||
- None
|
||||
|
||||
### Deleted
|
||||
|
||||
- None
|
||||
|
||||
## [4.13.0]
|
||||
|
||||
### Added
|
||||
|
||||
- Add opensearch_dashboard.yml parameters. ([#1985](https://github.com/wazuh/wazuh-docker/pull/1985))
|
||||
- Set right ownership for malicious-ioc files on container start ([#1926](https://github.com/wazuh/wazuh-docker/pull/1926))
|
||||
- Delete services statement in wazuh agent deployment. ([#1925](https://github.com/wazuh/wazuh-docker/pull/1925))
|
||||
- Add permanent_data exceptions. ([#1890](https://github.com/wazuh/wazuh-docker/pull/1890))
|
||||
- Integrate bumper script via GitHub action. ([#1863](https://github.com/wazuh/wazuh-docker/pull/1863))
|
||||
- Add missing malicious-ioc ruleset lists ([#1870](https://github.com/wazuh/wazuh-docker/pull/1870))
|
||||
@@ -63,12 +16,11 @@ All notable changes to this project will be documented in this file.
|
||||
|
||||
### Changed
|
||||
|
||||
- Syscollector configuration change ([#1994](https://github.com/wazuh/wazuh-docker/pull/1994))
|
||||
- Modify wazuh-keystore use ([#1750](https://github.com/wazuh/wazuh-docker/pull/1750)) \- (wazuh-keystore)
|
||||
|
||||
### Fixed
|
||||
|
||||
- Add wazuh-template.json into permanent data exception ([#1968](https://github.com/wazuh/wazuh-docker/pull/1968))
|
||||
- None
|
||||
|
||||
### Deleted
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cyber
|
||||
## Branch Convention
|
||||
|
||||
- `main`: Developing and testing of new features.
|
||||
- `X.Y.Z`: Version-specific branches (e.g., `4.14.0`, `4.13.0`, etc.).
|
||||
- `X.Y.Z`: Version-specific branches (e.g., `4.13.0`, `4.12.0`, etc.).
|
||||
|
||||
## Documentation
|
||||
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"version": "4.14.0",
|
||||
"stage": "rc1"
|
||||
"version": "4.13.0",
|
||||
"stage": "alpha1"
|
||||
}
|
||||
|
||||
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
|
||||
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
|
||||
|
||||
```
|
||||
$ build-docker-images/build-images.sh -v 4.14.0
|
||||
$ build-docker-images/build-images.sh -v 4.13.0
|
||||
```
|
||||
|
||||
To get all the available script options use the -h or --help option:
|
||||
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
|
||||
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
|
||||
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
|
||||
-r, --revision <rev> [Optional] Package revision. By default 1
|
||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.0.
|
||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.13.0.
|
||||
-h, --help Show this help.
|
||||
|
||||
```
|
||||
@@ -1,4 +1,4 @@
|
||||
WAZUH_IMAGE_VERSION=4.14.0
|
||||
WAZUH_IMAGE_VERSION=4.13.0
|
||||
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
|
||||
WAZUH_TAG_REVISION=1
|
||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
|
||||
@@ -12,7 +12,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
|
||||
WAZUH_IMAGE_VERSION="4.14.0"
|
||||
WAZUH_IMAGE_VERSION="4.13.0"
|
||||
WAZUH_TAG_REVISION="1"
|
||||
WAZUH_DEV_STAGE=""
|
||||
FILEBEAT_MODULE_VERSION="0.4"
|
||||
|
||||
@@ -8,7 +8,7 @@ services:
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH}
|
||||
WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE}
|
||||
image: merecu/wazuh-manager:${WAZUH_IMAGE_VERSION}
|
||||
image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
ports:
|
||||
@@ -40,7 +40,7 @@ services:
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
image: merecu/wazuh-agent:${WAZUH_IMAGE_VERSION}
|
||||
image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION}
|
||||
hostname: wazuh.agent
|
||||
restart: always
|
||||
|
||||
@@ -50,7 +50,7 @@ services:
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
image: merecu/wazuh-indexer:${WAZUH_IMAGE_VERSION}
|
||||
image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
ports:
|
||||
@@ -72,7 +72,7 @@ services:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
WAZUH_UI_REVISION: ${WAZUH_UI_REVISION}
|
||||
image: merecu/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
|
||||
image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
|
||||
@@ -5,19 +5,16 @@ ARG WAZUH_VERSION
|
||||
ARG WAZUH_TAG_REVISION
|
||||
ARG WAZUH_UI_REVISION
|
||||
ARG INSTALL_DIR=/usr/share/wazuh-dashboard
|
||||
ARG REPO_ORIGIN=https://packages-dev.wazuh.com/pre-release
|
||||
ARG TARGETARCH
|
||||
ENV PKG_ARCH=${TARGETARCH}
|
||||
|
||||
# Update and install dependencies
|
||||
RUN dnf install curl-minimal libcap openssl -y &&\
|
||||
case "$PKG_ARCH" in \
|
||||
amd64) ARCH_NAME="x86_64" ;; \
|
||||
arm64) ARCH_NAME="aarch64" ;; \
|
||||
*) echo "Unsupported arch: $PKG_ARCH" && exit 1 ;; \
|
||||
esac && \
|
||||
dnf install ${REPO_ORIGIN}/yum/wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}.${ARCH_NAME}.rpm -y && \
|
||||
dnf clean all
|
||||
RUN yum install curl-minimal libcap openssl -y
|
||||
|
||||
COPY config/check_repository.sh /
|
||||
RUN chmod 775 /check_repository.sh && \
|
||||
source /check_repository.sh
|
||||
|
||||
RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
yum clean all
|
||||
|
||||
# Create and set permissions to data directories
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
|
||||
@@ -63,7 +60,7 @@ ENV PATTERN="" \
|
||||
WAZUH_MONITORING_REPLICAS=""
|
||||
|
||||
# Update and install dependencies
|
||||
RUN dnf install shadow-utils -y
|
||||
RUN yum install shadow-utils -y
|
||||
|
||||
# Create wazuh-dashboard user and group
|
||||
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
|
||||
@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.13/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
||||
@@ -3,18 +3,15 @@ FROM amazonlinux:2023 AS builder
|
||||
|
||||
ARG WAZUH_VERSION
|
||||
ARG WAZUH_TAG_REVISION
|
||||
ARG REPO_ORIGIN=https://packages-dev.wazuh.com/pre-release
|
||||
ARG TARGETARCH
|
||||
ENV PKG_ARCH=${TARGETARCH}
|
||||
|
||||
RUN dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\
|
||||
case "$PKG_ARCH" in \
|
||||
amd64) ARCH_NAME="x86_64" ;; \
|
||||
arm64) ARCH_NAME="aarch64" ;; \
|
||||
*) echo "Unsupported arch: $PKG_ARCH" && exit 1 ;; \
|
||||
esac && \
|
||||
dnf install ${REPO_ORIGIN}/yum/wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}.${ARCH_NAME}.rpm -y && \
|
||||
dnf clean all
|
||||
RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y
|
||||
|
||||
COPY config/check_repository.sh /
|
||||
RUN chmod 775 /check_repository.sh && \
|
||||
source /check_repository.sh
|
||||
|
||||
RUN yum install wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
yum clean all
|
||||
|
||||
COPY config/opensearch.yml /
|
||||
|
||||
@@ -65,26 +62,25 @@ COPY config/entrypoint.sh /
|
||||
|
||||
COPY config/securityadmin.sh /
|
||||
|
||||
RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
|
||||
mkdir -p /usr/share/wazuh-indexer && \
|
||||
chown 1000:1000 /usr/share/wazuh-indexer && \
|
||||
chown 1000:1000 /*.sh
|
||||
RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh
|
||||
|
||||
RUN chown 1000:1000 /*.sh
|
||||
|
||||
COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer
|
||||
COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer/config
|
||||
COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
|
||||
COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
|
||||
|
||||
RUN chown -R 1000:1000 /usr/share/wazuh-indexer
|
||||
|
||||
RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
|
||||
mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
|
||||
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
|
||||
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
|
||||
chmod 700 /usr/share/wazuh-indexer && \
|
||||
chmod 700 /usr/share/wazuh-indexer/config && \
|
||||
chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \
|
||||
chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml
|
||||
chmod 600 /usr/share/wazuh-indexer/jvm.options && \
|
||||
chmod 600 /usr/share/wazuh-indexer/opensearch.yml
|
||||
|
||||
USER wazuh-indexer
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
|
||||
@@ -13,7 +13,7 @@ export LOG_DIR=/var/log/${NAME}
|
||||
export LIB_DIR=/var/lib/${NAME}
|
||||
export PID_DIR=/run/${NAME}
|
||||
export INSTALLATION_DIR=/usr/share/${NAME}
|
||||
export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
export CONFIG_DIR=${INSTALLATION_DIR}
|
||||
export BASE_DIR=${NAME}-*
|
||||
export INDEXER_FILE=wazuh-indexer-base.tar.xz
|
||||
export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
|
||||
@@ -22,8 +22,8 @@ export REPO_DIR=/unattended_installer
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.13/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
||||
@@ -6,7 +6,7 @@ umask 0002
|
||||
|
||||
export USER=wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config
|
||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
|
||||
@@ -1,16 +1,15 @@
|
||||
network.host: "0.0.0.0"
|
||||
node.name: "wazuh.indexer"
|
||||
cluster.name: "wazuh-cluster"
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
discovery.type: single-node
|
||||
compatibility.override_main_response_version: true
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.transport.resolve_hostname: false
|
||||
|
||||
@@ -8,25 +8,21 @@ ARG WAZUH_TAG_REVISION
|
||||
ARG FILEBEAT_TEMPLATE_BRANCH
|
||||
ARG FILEBEAT_CHANNEL=filebeat-oss
|
||||
ARG FILEBEAT_VERSION=7.10.2
|
||||
ARG FILEBEAT_REVISION=2
|
||||
ARG WAZUH_FILEBEAT_MODULE
|
||||
ARG S6_VERSION="v2.2.0.3"
|
||||
ARG REPO_ORIGIN=https://packages-dev.wazuh.com/pre-release
|
||||
ARG TARGETARCH
|
||||
ENV PKG_ARCH=${TARGETARCH}
|
||||
|
||||
RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
|
||||
yum clean all
|
||||
|
||||
COPY config/check_repository.sh /
|
||||
COPY config/filebeat_module.sh /
|
||||
COPY config/permanent_data.env config/permanent_data.sh /
|
||||
|
||||
RUN chmod 775 /check_repository.sh
|
||||
RUN source /check_repository.sh
|
||||
|
||||
RUN dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
|
||||
case "$PKG_ARCH" in \
|
||||
amd64) ARCH_NAME="x86_64" ;; \
|
||||
arm64) ARCH_NAME="aarch64" ;; \
|
||||
*) echo "Unsupported arch: $PKG_ARCH" && exit 1 ;; \
|
||||
esac && \
|
||||
dnf install ${REPO_ORIGIN}/yum/wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}.${ARCH_NAME}.rpm -y && \
|
||||
dnf clean all && \
|
||||
RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
yum clean all && \
|
||||
chmod 775 /filebeat_module.sh && \
|
||||
source /filebeat_module.sh && \
|
||||
rm /filebeat_module.sh && \
|
||||
@@ -64,6 +60,8 @@ RUN mkdir -p /var/ossec/var/multigroups && \
|
||||
sync && /permanent_data.sh && \
|
||||
sync && rm /permanent_data.sh
|
||||
|
||||
RUN rm /etc/yum.repos.d/wazuh.repo
|
||||
|
||||
# Services ports
|
||||
EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
|
||||
@@ -167,17 +167,16 @@ set_custom_cluster_key() {
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
# Set correct ownership for Wazuh related directories
|
||||
# on container start.
|
||||
# Modify /var/ossec/queue/rids directory owner on
|
||||
# container start.
|
||||
##############################################################################
|
||||
|
||||
configure_permissions() {
|
||||
set_rids_owner() {
|
||||
chown -R wazuh:wazuh /var/ossec/queue/rids
|
||||
chown -R wazuh:wazuh /var/ossec/etc/lists
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
# Change any ossec user/group to wazuh user/group
|
||||
# Change any ossec user/group to wazuh user/group
|
||||
##############################################################################
|
||||
|
||||
set_correct_permOwner() {
|
||||
@@ -227,8 +226,8 @@ main() {
|
||||
# Delete temporary data folder
|
||||
rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
|
||||
|
||||
# Set correct ownership for Wazuh related directories
|
||||
configure_permissions
|
||||
# Set rids directory owner
|
||||
set_rids_owner
|
||||
}
|
||||
|
||||
main
|
||||
|
||||
@@ -1,5 +1,12 @@
|
||||
## variables
|
||||
REPOSITORY="packages-dev.wazuh.info/pre-release"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
dnf install ${REPO_ORIGIN}/yum/filebeat-${FILEBEAT_VERSION}-${FILEBEAT_REVISION}.${ARCH_NAME}.rpm -y && \
|
||||
curl -s ${REPO_ORIGIN}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
|
||||
## check tag to use the correct repository
|
||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||
REPOSITORY="packages.wazuh.com/4.x"
|
||||
fi
|
||||
|
||||
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\
|
||||
yum install -y ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && \
|
||||
curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
|
||||
@@ -100,8 +100,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/filebeat.yml"
|
||||
export PERMANENT_DATA_EXCP
|
||||
|
||||
# Files mounted in a volume that should be deleted
|
||||
|
||||
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
|
||||
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
|
||||
|
||||
```
|
||||
$ build-docker-images/build-images.sh -v 4.14.0
|
||||
$ build-docker-images/build-images.sh -v 4.13.0
|
||||
```
|
||||
|
||||
To get all the available script options use the -h or --help option:
|
||||
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
|
||||
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
|
||||
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
|
||||
-r, --revision <rev> [Optional] Package revision. By default 1
|
||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.0.
|
||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.13.0.
|
||||
-h, --help Show this help.
|
||||
|
||||
```
|
||||
@@ -1,6 +1,6 @@
|
||||
# Development Guide - Introduction
|
||||
|
||||
Welcome to the Development Guide for Wazuh-docker version 4.14.0. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
|
||||
Welcome to the Development Guide for Wazuh-docker version 4.13.0. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
|
||||
|
||||
## Purpose of This Guide
|
||||
|
||||
|
||||
+3
-3
@@ -1,6 +1,6 @@
|
||||
# Development Guide - Setup Environment
|
||||
|
||||
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.14.0). A proper setup is crucial for building images, running tests, and contributing effectively.
|
||||
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.13.0). A proper setup is crucial for building images, running tests, and contributing effectively.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
@@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements:
|
||||
Follow these steps to prepare your development environment:
|
||||
|
||||
1. **Clone the Repository**:
|
||||
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.14.0`.
|
||||
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.13.0`.
|
||||
|
||||
```bash
|
||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||
cd wazuh-docker
|
||||
git checkout v4.14.0
|
||||
git checkout 4.13.0
|
||||
```
|
||||
|
||||
2. **Verify Docker Installation**:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Description
|
||||
|
||||
This section provides a detailed description of Wazuh-docker (version 4.14.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
|
||||
This section provides a detailed description of Wazuh-docker (version 4.13.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
|
||||
|
||||
## What is Wazuh?
|
||||
|
||||
@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi
|
||||
|
||||
## Core Components in Wazuh-Docker
|
||||
|
||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.14.0:
|
||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.13.0:
|
||||
|
||||
1. **Wazuh Manager**:
|
||||
- The central component that collects and analyzes data from deployed Wazuh agents.
|
||||
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
|
||||
2. **Wazuh Indexer**:
|
||||
- A highly scalable, full-text search and analytics engine.
|
||||
- Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
|
||||
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.14.0, this is typically an OpenSearch-based component.
|
||||
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.13.0, this is typically an OpenSearch-based component.
|
||||
|
||||
3. **Wazuh Dashboard**:
|
||||
- A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Introduction
|
||||
|
||||
Welcome to the Reference Manual for Wazuh-Docker, version 4.14.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
|
||||
Welcome to the Reference Manual for Wazuh-Docker, version 4.13.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
|
||||
|
||||
## Purpose of This Manual
|
||||
|
||||
@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
|
||||
- If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
|
||||
- For specific terms or concepts, consult the [Glossary](glossary.md).
|
||||
|
||||
This manual refers to version 4.14.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
|
||||
This manual refers to version 4.13.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
|
||||
|
||||
@@ -29,4 +29,4 @@
|
||||
```
|
||||
|
||||
|
||||
Consult the official Wazuh documentation for version 4.14.0 for detailed information on all possible configuration parameters for each component.
|
||||
Consult the official Wazuh documentation for version 4.13.0 for detailed information on all possible configuration parameters for each component.
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Configuration
|
||||
|
||||
This section details how to configure your Wazuh-Docker deployment (version 4.14.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
|
||||
This section details how to configure your Wazuh-Docker deployment (version 4.13.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
|
||||
|
||||
## Overview of Configuration Methods
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Deployment
|
||||
|
||||
This section provides detailed instructions for deploying Wazuh-Docker (version 4.14.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
|
||||
This section provides detailed instructions for deploying Wazuh-Docker (version 4.13.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
|
||||
|
||||
## Overview of Deployment Options
|
||||
|
||||
@@ -24,11 +24,11 @@ Ensure you have:
|
||||
|
||||
- Met all the [System Requirements](ref/getting-started/requirements.md).
|
||||
- Installed Docker and Docker Compose on your host(s).
|
||||
- Cloned the `wazuh-docker` repository (version `4.14.0`) or downloaded the necessary deployment files.
|
||||
- Cloned the `wazuh-docker` repository (version `4.13.0`) or downloaded the necessary deployment files.
|
||||
```bash
|
||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||
cd wazuh-docker
|
||||
git checkout v4.14.0
|
||||
git checkout v4.13.0
|
||||
```
|
||||
- Made a backup of any existing Wazuh data if you are migrating or upgrading.
|
||||
|
||||
|
||||
@@ -17,18 +17,18 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines
|
||||
|
||||
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
|
||||
```bash
|
||||
docker compose -f generate-indexer-certs.yml run --rm generator
|
||||
docker-compose -f generate-indexer-certs.yml run --rm generator
|
||||
```
|
||||
|
||||
4. Start the Wazuh environment using `docker compose`:
|
||||
4. Start the Wazuh environment using `docker-compose`:
|
||||
|
||||
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
|
||||
```bash
|
||||
docker compose up
|
||||
docker-compose up
|
||||
```
|
||||
* To run in the background (detached mode, allowing the containers to run independently of your terminal):
|
||||
```bash
|
||||
docker compose up -d
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Please allow some time for the environment to initialize, especially on the first run. A multi-node setup can take a few minutes (depending on your host resources and network) as the Wazuh Indexer cluster forms, and the necessary indexes and index patterns are generated.
|
||||
|
||||
@@ -17,18 +17,18 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a
|
||||
|
||||
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
|
||||
```bash
|
||||
docker compose -f generate-indexer-certs.yml run --rm generator
|
||||
docker-compose -f generate-indexer-certs.yml run --rm generator
|
||||
```
|
||||
|
||||
4. Start the Wazuh environment using `docker compose`:
|
||||
4. Start the Wazuh environment using `docker-compose`:
|
||||
|
||||
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
|
||||
```bash
|
||||
docker compose up
|
||||
docker-compose up
|
||||
```
|
||||
* To run in the background (detached mode, allowing the containers to run independently of your terminal):
|
||||
```bash
|
||||
docker compose up -d
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Please allow some time for the environment to initialize, especially on the first run. It can take approximately a minute or two (depending on your host's resources) as the Wazuh Indexer starts up and generates the necessary indexes and index patterns.
|
||||
|
||||
@@ -23,14 +23,14 @@ Follow these steps to deploy the Wazuh agent using Docker.
|
||||
```
|
||||
**Note:** Replace `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager.
|
||||
|
||||
3. Start the environment using `docker compose`:
|
||||
3. Start the environment using `docker-compose`:
|
||||
|
||||
* To run in the foreground (logs will be displayed in your current terminal, and you can stop it with `Ctrl+C`):
|
||||
```bash
|
||||
docker compose up
|
||||
docker-compose up
|
||||
```
|
||||
|
||||
* To run in the background (detached mode, allowing the container to run independently of your terminal):
|
||||
```bash
|
||||
docker compose up -d
|
||||
docker-compose up -d
|
||||
```
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Getting Started
|
||||
|
||||
This section guides you through the initial steps to get your Wazuh-docker (version 4.14.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
|
||||
This section guides you through the initial steps to get your Wazuh-docker (version 4.13.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
|
||||
Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.
|
||||
|
||||
2. **Obtain Wazuh-docker Configuration**:
|
||||
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.14.0.
|
||||
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.13.0.
|
||||
```bash
|
||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||
cd wazuh-docker
|
||||
git checkout v4.14.0
|
||||
git checkout v4.13.0
|
||||
# Navigate to the specific docker-compose directory, e.g., single-node or multi-node
|
||||
# cd docker-compose/single-node/ (example path)
|
||||
```
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Requirements
|
||||
|
||||
Before deploying Wazuh-Docker (version 4.14.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
|
||||
Before deploying Wazuh-Docker (version 4.13.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
|
||||
|
||||
## Host System Requirements
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Reference Manual - Glossary
|
||||
|
||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.14.0).
|
||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.13.0).
|
||||
|
||||
---
|
||||
|
||||
@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
|
||||
|
||||
**D**
|
||||
|
||||
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.14.0, this is typically OpenSearch Dashboards.
|
||||
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.13.0, this is typically OpenSearch Dashboards.
|
||||
- **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
|
||||
- **Docker**: An open platform for developing, shipping, and running applications inside containers.
|
||||
- **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
|
||||
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
|
||||
|
||||
**I**
|
||||
|
||||
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.14.0, this is typically OpenSearch.
|
||||
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.13.0, this is typically OpenSearch.
|
||||
|
||||
**L**
|
||||
|
||||
|
||||
@@ -8,12 +8,12 @@
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.13/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_URL$CERT_TOOL")
|
||||
CERT_TOOL_PACKAGES_DEV=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_DEV_URL$CERT_TOOL")
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
||||
## If cert tool exists in some bucket, download it, if not exit 1
|
||||
if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
|
||||
|
||||
@@ -79,7 +79,7 @@
|
||||
<os>yes</os>
|
||||
<network>yes</network>
|
||||
<packages>yes</packages>
|
||||
<ports all="yes">yes</ports>
|
||||
<ports all="no">yes</ports>
|
||||
<processes>yes</processes>
|
||||
|
||||
<!-- Database synchronization settings -->
|
||||
|
||||
@@ -79,7 +79,7 @@
|
||||
<os>yes</os>
|
||||
<network>yes</network>
|
||||
<packages>yes</packages>
|
||||
<ports all="yes">yes</ports>
|
||||
<ports all="no">yes</ports>
|
||||
<processes>yes</processes>
|
||||
|
||||
<!-- Database synchronization settings -->
|
||||
|
||||
@@ -10,7 +10,3 @@ server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
|
||||
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
|
||||
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
|
||||
uiSettings.overrides.defaultRoute: /app/wz-home
|
||||
# Session expiration settings
|
||||
opensearch_security.cookie.ttl: 900000
|
||||
opensearch_security.session.ttl: 900000
|
||||
opensearch_security.session.keepalive: true
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
services:
|
||||
wazuh.master:
|
||||
image: wazuh/wazuh-manager:4.14.0
|
||||
image: wazuh/wazuh-manager:4.13.0
|
||||
hostname: wazuh.master
|
||||
restart: always
|
||||
ulimits:
|
||||
@@ -43,7 +43,7 @@ services:
|
||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh.worker:
|
||||
image: wazuh/wazuh-manager:4.14.0
|
||||
image: wazuh/wazuh-manager:4.13.0
|
||||
hostname: wazuh.worker
|
||||
restart: always
|
||||
ulimits:
|
||||
@@ -79,7 +79,7 @@ services:
|
||||
- ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh1.indexer:
|
||||
image: wazuh/wazuh-indexer:4.14.0
|
||||
image: wazuh/wazuh-indexer:4.13.0
|
||||
hostname: wazuh1.indexer
|
||||
restart: always
|
||||
ports:
|
||||
@@ -96,16 +96,16 @@ services:
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh2.indexer:
|
||||
image: wazuh/wazuh-indexer:4.14.0
|
||||
image: wazuh/wazuh-indexer:4.13.0
|
||||
hostname: wazuh2.indexer
|
||||
restart: always
|
||||
environment:
|
||||
@@ -120,14 +120,14 @@ services:
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-2:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh3.indexer:
|
||||
image: wazuh/wazuh-indexer:4.14.0
|
||||
image: wazuh/wazuh-indexer:4.13.0
|
||||
hostname: wazuh3.indexer
|
||||
restart: always
|
||||
environment:
|
||||
@@ -142,14 +142,14 @@ services:
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-3:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.14.0
|
||||
image: wazuh/wazuh-dashboard:4.13.0
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
|
||||
@@ -79,7 +79,7 @@
|
||||
<os>yes</os>
|
||||
<network>yes</network>
|
||||
<packages>yes</packages>
|
||||
<ports all="yes">yes</ports>
|
||||
<ports all="no">yes</ports>
|
||||
<processes>yes</processes>
|
||||
|
||||
<!-- Database synchronization settings -->
|
||||
|
||||
@@ -10,7 +10,3 @@ server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
|
||||
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
|
||||
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
|
||||
uiSettings.overrides.defaultRoute: /app/wz-home
|
||||
# Session expiration settings
|
||||
opensearch_security.cookie.ttl: 900000
|
||||
opensearch_security.session.ttl: 900000
|
||||
opensearch_security.session.keepalive: true
|
||||
|
||||
@@ -1,18 +1,17 @@
|
||||
network.host: "0.0.0.0"
|
||||
node.name: "wazuh.indexer"
|
||||
cluster.name: "wazuh-cluster"
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
discovery.type: single-node
|
||||
http.port: 9200-9299
|
||||
transport.tcp.port: 9300-9399
|
||||
compatibility.override_main_response_version: true
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.transport.resolve_hostname: false
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
services:
|
||||
wazuh.manager:
|
||||
image: merecu/wazuh-manager:4.14.0
|
||||
image: wazuh/wazuh-manager:4.13.0
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
ulimits:
|
||||
@@ -44,7 +44,7 @@ services:
|
||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh.indexer:
|
||||
image: merecu/wazuh-indexer:4.14.0
|
||||
image: wazuh/wazuh-indexer:4.13.0
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
ports:
|
||||
@@ -60,16 +60,16 @@ services:
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh.dashboard:
|
||||
image: merecu/wazuh-dashboard:4.14.0
|
||||
image: wazuh/wazuh-dashboard:4.13.0
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
|
||||
@@ -83,7 +83,7 @@
|
||||
<os>yes</os>
|
||||
<network>yes</network>
|
||||
<packages>yes</packages>
|
||||
<ports all="yes">yes</ports>
|
||||
<ports all="no">yes</ports>
|
||||
<processes>yes</processes>
|
||||
|
||||
<!-- Database synchronization settings -->
|
||||
|
||||
@@ -1,7 +1,9 @@
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh.agent:
|
||||
image: wazuh/wazuh-agent:4.14.0
|
||||
image: wazuh/wazuh-agent:4.13.0
|
||||
restart: always
|
||||
environment:
|
||||
- WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
|
||||
|
||||
Reference in New Issue
Block a user