Compare commits

..
Author SHA1 Message Date
fcaffieri 2f966b5236 Test new bucket url 2025-07-01 18:44:28 -03:00
49 changed files with 174 additions and 235 deletions
+3 -3
View File
@@ -1,6 +1,6 @@
WAZUH_VERSION=4.14.0 WAZUH_VERSION=4.13.0
WAZUH_IMAGE_VERSION=4.14.0 WAZUH_IMAGE_VERSION=4.13.0
WAZUH_TAG_REVISION=1 WAZUH_TAG_REVISION=1
FILEBEAT_TEMPLATE_BRANCH=4.14.0 FILEBEAT_TEMPLATE_BRANCH=4.13.0
WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
WAZUH_UI_REVISION=1 WAZUH_UI_REVISION=1
+1 -1
View File
@@ -56,7 +56,7 @@ package:
wazuh-manager: wazuh-manager:
installed: true installed: true
versions: versions:
- 4.14.0 - 4.13.0
port: port:
tcp:1514: tcp:1514:
listening: true listening: true
@@ -6,7 +6,7 @@ on:
inputs: inputs:
image_tag: image_tag:
description: 'Docker image tag' description: 'Docker image tag'
default: '4.14.0' default: '4.13.0'
required: true required: true
docker_reference: docker_reference:
description: 'wazuh-docker reference' description: 'wazuh-docker reference'
@@ -41,7 +41,7 @@ on:
inputs: inputs:
image_tag: image_tag:
description: 'Docker image tag' description: 'Docker image tag'
default: '4.14.0' default: '4.13.0'
required: true required: true
type: string type: string
docker_reference: docker_reference:
+2 -2
View File
@@ -192,7 +192,7 @@ jobs:
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
- name: Start Wazuh agent - name: Start Wazuh agent
run: docker compose -f wazuh-agent/docker-compose.yml up -d run: docker-compose -f wazuh-agent/docker-compose.yml up -d
- name: Check Wazuh agent enrollment - name: Check Wazuh agent enrollment
run: | run: |
@@ -355,7 +355,7 @@ jobs:
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
- name: Start Wazuh agent - name: Start Wazuh agent
run: docker compose -f wazuh-agent/docker-compose.yml up -d run: docker-compose -f wazuh-agent/docker-compose.yml up -d
- name: Check Wazuh agent enrollment - name: Check Wazuh agent enrollment
run: | run: |
+1 -49
View File
@@ -1,57 +1,10 @@
# Change Log # Change Log
All notable changes to this project will be documented in this file. All notable changes to this project will be documented in this file.
## [4.14.0]
### Added
- None
### Changed
- Change filebeat install method ([#2020](https://github.com/wazuh/wazuh-docker/pull/2020))
- Remove dashboard chat setting ([#2021](https://github.com/wazuh/wazuh-docker/pull/2021))
- Rollback data source setting ([#1999](https://github.com/wazuh/wazuh-docker/pull/1999))
- Dashboard settings added ([#1998](https://github.com/wazuh/wazuh-docker/pull/1998))
- Add filebeat config file in the PERMANENT_DATA_EXCP list ([#1898](https://github.com/wazuh/wazuh-docker/pull/1898))
- Change validation of existing certs tool in S3 buckets ([#1880](https://github.com/wazuh/wazuh-docker/pull/1880))
### Fixed
- Change Wazuh indexer directory owner ([#2029](https://github.com/wazuh/wazuh-docker/pull/2029))
- Double the amount of space consumed in Wazuh Indexer ([#1953](https://github.com/wazuh/wazuh-docker/pull/1953))
- Fix config directory for opensearch_security plugin work ([#1951](https://github.com/wazuh/wazuh-docker/pull/1951))
- Update Dockerfile to copy opensearch-security files ([#1928](https://github.com/wazuh/wazuh-docker/pull/1928))
### Deleted
- None
## [4.13.1]
### Added
- None
### Changed
- None
### Fixed
- None
### Deleted
- None
## [4.13.0] ## [4.13.0]
### Added ### Added
- Add opensearch_dashboard.yml parameters. ([#1985](https://github.com/wazuh/wazuh-docker/pull/1985))
- Set right ownership for malicious-ioc files on container start ([#1926](https://github.com/wazuh/wazuh-docker/pull/1926))
- Delete services statement in wazuh agent deployment. ([#1925](https://github.com/wazuh/wazuh-docker/pull/1925))
- Add permanent_data exceptions. ([#1890](https://github.com/wazuh/wazuh-docker/pull/1890)) - Add permanent_data exceptions. ([#1890](https://github.com/wazuh/wazuh-docker/pull/1890))
- Integrate bumper script via GitHub action. ([#1863](https://github.com/wazuh/wazuh-docker/pull/1863)) - Integrate bumper script via GitHub action. ([#1863](https://github.com/wazuh/wazuh-docker/pull/1863))
- Add missing malicious-ioc ruleset lists ([#1870](https://github.com/wazuh/wazuh-docker/pull/1870)) - Add missing malicious-ioc ruleset lists ([#1870](https://github.com/wazuh/wazuh-docker/pull/1870))
@@ -63,12 +16,11 @@ All notable changes to this project will be documented in this file.
### Changed ### Changed
- Syscollector configuration change ([#1994](https://github.com/wazuh/wazuh-docker/pull/1994))
- Modify wazuh-keystore use ([#1750](https://github.com/wazuh/wazuh-docker/pull/1750)) \- (wazuh-keystore) - Modify wazuh-keystore use ([#1750](https://github.com/wazuh/wazuh-docker/pull/1750)) \- (wazuh-keystore)
### Fixed ### Fixed
- Add wazuh-template.json into permanent data exception ([#1968](https://github.com/wazuh/wazuh-docker/pull/1968)) - None
### Deleted ### Deleted
+1 -1
View File
@@ -18,7 +18,7 @@ The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cyber
## Branch Convention ## Branch Convention
- `main`: Developing and testing of new features. - `main`: Developing and testing of new features.
- `X.Y.Z`: Version-specific branches (e.g., `4.14.0`, `4.13.0`, etc.). - `X.Y.Z`: Version-specific branches (e.g., `4.13.0`, `4.12.0`, etc.).
## Documentation ## Documentation
+2 -2
View File
@@ -1,4 +1,4 @@
{ {
"version": "4.14.0", "version": "4.13.0",
"stage": "rc1" "stage": "alpha1"
} }
+2 -2
View File
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument: The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
``` ```
$ build-docker-images/build-images.sh -v 4.14.0 $ build-docker-images/build-images.sh -v 4.13.0
``` ```
To get all the available script options use the -h or --help option: To get all the available script options use the -h or --help option:
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4. -f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
-r, --revision <rev> [Optional] Package revision. By default 1 -r, --revision <rev> [Optional] Package revision. By default 1
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.0. -v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.13.0.
-h, --help Show this help. -h, --help Show this help.
``` ```
+2 -2
View File
@@ -1,4 +1,4 @@
WAZUH_IMAGE_VERSION=4.14.0 WAZUH_IMAGE_VERSION=4.13.0
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
WAZUH_TAG_REVISION=1 WAZUH_TAG_REVISION=1
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
@@ -12,7 +12,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
# License (version 2) as published by the FSF - Free Software # License (version 2) as published by the FSF - Free Software
# Foundation. # Foundation.
WAZUH_IMAGE_VERSION="4.14.0" WAZUH_IMAGE_VERSION="4.13.0"
WAZUH_TAG_REVISION="1" WAZUH_TAG_REVISION="1"
WAZUH_DEV_STAGE="" WAZUH_DEV_STAGE=""
FILEBEAT_MODULE_VERSION="0.4" FILEBEAT_MODULE_VERSION="0.4"
+4 -4
View File
@@ -8,7 +8,7 @@ services:
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH} FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH}
WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE} WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE}
image: merecu/wazuh-manager:${WAZUH_IMAGE_VERSION} image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
hostname: wazuh.manager hostname: wazuh.manager
restart: always restart: always
ports: ports:
@@ -40,7 +40,7 @@ services:
args: args:
WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
image: merecu/wazuh-agent:${WAZUH_IMAGE_VERSION} image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION}
hostname: wazuh.agent hostname: wazuh.agent
restart: always restart: always
@@ -50,7 +50,7 @@ services:
args: args:
WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
image: merecu/wazuh-indexer:${WAZUH_IMAGE_VERSION} image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
hostname: wazuh.indexer hostname: wazuh.indexer
restart: always restart: always
ports: ports:
@@ -72,7 +72,7 @@ services:
WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
WAZUH_UI_REVISION: ${WAZUH_UI_REVISION} WAZUH_UI_REVISION: ${WAZUH_UI_REVISION}
image: merecu/wazuh-dashboard:${WAZUH_IMAGE_VERSION} image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
hostname: wazuh.dashboard hostname: wazuh.dashboard
restart: always restart: always
ports: ports:
@@ -1,7 +1,7 @@
## variables ## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
+9 -12
View File
@@ -5,19 +5,16 @@ ARG WAZUH_VERSION
ARG WAZUH_TAG_REVISION ARG WAZUH_TAG_REVISION
ARG WAZUH_UI_REVISION ARG WAZUH_UI_REVISION
ARG INSTALL_DIR=/usr/share/wazuh-dashboard ARG INSTALL_DIR=/usr/share/wazuh-dashboard
ARG REPO_ORIGIN=https://packages-dev.wazuh.com/pre-release
ARG TARGETARCH
ENV PKG_ARCH=${TARGETARCH}
# Update and install dependencies # Update and install dependencies
RUN dnf install curl-minimal libcap openssl -y &&\ RUN yum install curl-minimal libcap openssl -y
case "$PKG_ARCH" in \
amd64) ARCH_NAME="x86_64" ;; \ COPY config/check_repository.sh /
arm64) ARCH_NAME="aarch64" ;; \ RUN chmod 775 /check_repository.sh && \
*) echo "Unsupported arch: $PKG_ARCH" && exit 1 ;; \ source /check_repository.sh
esac && \
dnf install ${REPO_ORIGIN}/yum/wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}.${ARCH_NAME}.rpm -y && \ RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
dnf clean all yum clean all
# Create and set permissions to data directories # Create and set permissions to data directories
RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
@@ -63,7 +60,7 @@ ENV PATTERN="" \
WAZUH_MONITORING_REPLICAS="" WAZUH_MONITORING_REPLICAS=""
# Update and install dependencies # Update and install dependencies
RUN dnf install shadow-utils -y RUN yum install shadow-utils -y
# Create wazuh-dashboard user and group # Create wazuh-dashboard user and group
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
@@ -1,7 +1,7 @@
## variables ## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
## Variables ## Variables
CERT_TOOL=wazuh-certs-tool.sh CERT_TOOL=wazuh-certs-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.14/ PACKAGES_URL=https://packages.wazuh.com/4.13/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/ PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
## Check if the cert tool exists in S3 buckets ## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
+16 -20
View File
@@ -3,18 +3,15 @@ FROM amazonlinux:2023 AS builder
ARG WAZUH_VERSION ARG WAZUH_VERSION
ARG WAZUH_TAG_REVISION ARG WAZUH_TAG_REVISION
ARG REPO_ORIGIN=https://packages-dev.wazuh.com/pre-release
ARG TARGETARCH
ENV PKG_ARCH=${TARGETARCH}
RUN dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\ RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y
case "$PKG_ARCH" in \
amd64) ARCH_NAME="x86_64" ;; \ COPY config/check_repository.sh /
arm64) ARCH_NAME="aarch64" ;; \ RUN chmod 775 /check_repository.sh && \
*) echo "Unsupported arch: $PKG_ARCH" && exit 1 ;; \ source /check_repository.sh
esac && \
dnf install ${REPO_ORIGIN}/yum/wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}.${ARCH_NAME}.rpm -y && \ RUN yum install wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
dnf clean all yum clean all
COPY config/opensearch.yml / COPY config/opensearch.yml /
@@ -65,26 +62,25 @@ COPY config/entrypoint.sh /
COPY config/securityadmin.sh / COPY config/securityadmin.sh /
RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \ RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh
mkdir -p /usr/share/wazuh-indexer && \
chown 1000:1000 /usr/share/wazuh-indexer && \ RUN chown 1000:1000 /*.sh
chown 1000:1000 /*.sh
COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer
COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer/config COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer
COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
RUN chown -R 1000:1000 /usr/share/wazuh-indexer
RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \ mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
chmod 700 /usr/share/wazuh-indexer && \ chmod 700 /usr/share/wazuh-indexer && \
chmod 700 /usr/share/wazuh-indexer/config && \ chmod 600 /usr/share/wazuh-indexer/jvm.options && \
chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \ chmod 600 /usr/share/wazuh-indexer/opensearch.yml
chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml
USER wazuh-indexer USER wazuh-indexer
@@ -1,7 +1,7 @@
## variables ## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
@@ -13,7 +13,7 @@ export LOG_DIR=/var/log/${NAME}
export LIB_DIR=/var/lib/${NAME} export LIB_DIR=/var/lib/${NAME}
export PID_DIR=/run/${NAME} export PID_DIR=/run/${NAME}
export INSTALLATION_DIR=/usr/share/${NAME} export INSTALLATION_DIR=/usr/share/${NAME}
export CONFIG_DIR=${INSTALLATION_DIR}/config export CONFIG_DIR=${INSTALLATION_DIR}
export BASE_DIR=${NAME}-* export BASE_DIR=${NAME}-*
export INDEXER_FILE=wazuh-indexer-base.tar.xz export INDEXER_FILE=wazuh-indexer-base.tar.xz
export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
@@ -22,8 +22,8 @@ export REPO_DIR=/unattended_installer
## Variables ## Variables
CERT_TOOL=wazuh-certs-tool.sh CERT_TOOL=wazuh-certs-tool.sh
PASSWORD_TOOL=wazuh-passwords-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.14/ PACKAGES_URL=https://packages.wazuh.com/4.13/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/ PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
## Check if the cert tool exists in S3 buckets ## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
@@ -6,7 +6,7 @@ umask 0002
export USER=wazuh-indexer export USER=wazuh-indexer
export INSTALLATION_DIR=/usr/share/wazuh-indexer export INSTALLATION_DIR=/usr/share/wazuh-indexer
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}
export JAVA_HOME=${INSTALLATION_DIR}/jdk export JAVA_HOME=${INSTALLATION_DIR}/jdk
export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
@@ -1,16 +1,15 @@
network.host: "0.0.0.0" network.host: "0.0.0.0"
node.name: "wazuh.indexer" node.name: "wazuh.indexer"
cluster.name: "wazuh-cluster"
path.data: /var/lib/wazuh-indexer path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer path.logs: /var/log/wazuh-indexer
discovery.type: single-node discovery.type: single-node
compatibility.override_main_response_version: true compatibility.override_main_response_version: true
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false plugins.security.ssl.transport.resolve_hostname: false
+10 -12
View File
@@ -8,25 +8,21 @@ ARG WAZUH_TAG_REVISION
ARG FILEBEAT_TEMPLATE_BRANCH ARG FILEBEAT_TEMPLATE_BRANCH
ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.2 ARG FILEBEAT_VERSION=7.10.2
ARG FILEBEAT_REVISION=2
ARG WAZUH_FILEBEAT_MODULE ARG WAZUH_FILEBEAT_MODULE
ARG S6_VERSION="v2.2.0.3" ARG S6_VERSION="v2.2.0.3"
ARG REPO_ORIGIN=https://packages-dev.wazuh.com/pre-release
ARG TARGETARCH
ENV PKG_ARCH=${TARGETARCH}
RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
yum clean all
COPY config/check_repository.sh /
COPY config/filebeat_module.sh / COPY config/filebeat_module.sh /
COPY config/permanent_data.env config/permanent_data.sh / COPY config/permanent_data.env config/permanent_data.sh /
RUN chmod 775 /check_repository.sh
RUN source /check_repository.sh
RUN dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\ RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
case "$PKG_ARCH" in \ yum clean all && \
amd64) ARCH_NAME="x86_64" ;; \
arm64) ARCH_NAME="aarch64" ;; \
*) echo "Unsupported arch: $PKG_ARCH" && exit 1 ;; \
esac && \
dnf install ${REPO_ORIGIN}/yum/wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}.${ARCH_NAME}.rpm -y && \
dnf clean all && \
chmod 775 /filebeat_module.sh && \ chmod 775 /filebeat_module.sh && \
source /filebeat_module.sh && \ source /filebeat_module.sh && \
rm /filebeat_module.sh && \ rm /filebeat_module.sh && \
@@ -64,6 +60,8 @@ RUN mkdir -p /var/ossec/var/multigroups && \
sync && /permanent_data.sh && \ sync && /permanent_data.sh && \
sync && rm /permanent_data.sh sync && rm /permanent_data.sh
RUN rm /etc/yum.repos.d/wazuh.repo
# Services ports # Services ports
EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp
@@ -1,7 +1,7 @@
## variables ## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
@@ -167,17 +167,16 @@ set_custom_cluster_key() {
} }
############################################################################## ##############################################################################
# Set correct ownership for Wazuh related directories # Modify /var/ossec/queue/rids directory owner on
# on container start. # container start.
############################################################################## ##############################################################################
configure_permissions() { set_rids_owner() {
chown -R wazuh:wazuh /var/ossec/queue/rids chown -R wazuh:wazuh /var/ossec/queue/rids
chown -R wazuh:wazuh /var/ossec/etc/lists
} }
############################################################################## ##############################################################################
# Change any ossec user/group to wazuh user/group # Change any ossec user/group to wazuh user/group
############################################################################## ##############################################################################
set_correct_permOwner() { set_correct_permOwner() {
@@ -227,8 +226,8 @@ main() {
# Delete temporary data folder # Delete temporary data folder
rm -rf ${WAZUH_INSTALL_PATH}/data_tmp rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
# Set correct ownership for Wazuh related directories # Set rids directory owner
configure_permissions set_rids_owner
} }
main main
@@ -1,5 +1,12 @@
## variables ## variables
REPOSITORY="packages-dev.wazuh.info/pre-release"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
dnf install ${REPO_ORIGIN}/yum/filebeat-${FILEBEAT_VERSION}-${FILEBEAT_REVISION}.${ARCH_NAME}.rpm -y && \ ## check tag to use the correct repository
curl -s ${REPO_ORIGIN}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module if [[ -n "${WAZUH_TAG}" ]]; then
REPOSITORY="packages.wazuh.com/4.x"
fi
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\
yum install -y ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && \
curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
@@ -100,8 +100,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes"
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json"
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/filebeat.yml"
export PERMANENT_DATA_EXCP export PERMANENT_DATA_EXCP
# Files mounted in a volume that should be deleted # Files mounted in a volume that should be deleted
+2 -2
View File
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument: The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
``` ```
$ build-docker-images/build-images.sh -v 4.14.0 $ build-docker-images/build-images.sh -v 4.13.0
``` ```
To get all the available script options use the -h or --help option: To get all the available script options use the -h or --help option:
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4. -f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
-r, --revision <rev> [Optional] Package revision. By default 1 -r, --revision <rev> [Optional] Package revision. By default 1
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.0. -v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.13.0.
-h, --help Show this help. -h, --help Show this help.
``` ```
+1 -1
View File
@@ -1,6 +1,6 @@
# Development Guide - Introduction # Development Guide - Introduction
Welcome to the Development Guide for Wazuh-docker version 4.14.0. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development. Welcome to the Development Guide for Wazuh-docker version 4.13.0. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
## Purpose of This Guide ## Purpose of This Guide
+3 -3
View File
@@ -1,6 +1,6 @@
# Development Guide - Setup Environment # Development Guide - Setup Environment
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.14.0). A proper setup is crucial for building images, running tests, and contributing effectively. This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.13.0). A proper setup is crucial for building images, running tests, and contributing effectively.
## Prerequisites ## Prerequisites
@@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements:
Follow these steps to prepare your development environment: Follow these steps to prepare your development environment:
1. **Clone the Repository**: 1. **Clone the Repository**:
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.14.0`. Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.13.0`.
```bash ```bash
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git) git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
cd wazuh-docker cd wazuh-docker
git checkout v4.14.0 git checkout 4.13.0
``` ```
2. **Verify Docker Installation**: 2. **Verify Docker Installation**:
+3 -3
View File
@@ -1,6 +1,6 @@
# Reference Manual - Description # Reference Manual - Description
This section provides a detailed description of Wazuh-docker (version 4.14.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment. This section provides a detailed description of Wazuh-docker (version 4.13.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
## What is Wazuh? ## What is Wazuh?
@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi
## Core Components in Wazuh-Docker ## Core Components in Wazuh-Docker
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.14.0: The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.13.0:
1. **Wazuh Manager**: 1. **Wazuh Manager**:
- The central component that collects and analyzes data from deployed Wazuh agents. - The central component that collects and analyzes data from deployed Wazuh agents.
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
2. **Wazuh Indexer**: 2. **Wazuh Indexer**:
- A highly scalable, full-text search and analytics engine. - A highly scalable, full-text search and analytics engine.
- Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager. - Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.14.0, this is typically an OpenSearch-based component. - The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.13.0, this is typically an OpenSearch-based component.
3. **Wazuh Dashboard**: 3. **Wazuh Dashboard**:
- A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana). - A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
+2 -2
View File
@@ -1,6 +1,6 @@
# Reference Manual - Introduction # Reference Manual - Introduction
Welcome to the Reference Manual for Wazuh-Docker, version 4.14.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker. Welcome to the Reference Manual for Wazuh-Docker, version 4.13.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
## Purpose of This Manual ## Purpose of This Manual
@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
- If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section. - If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
- For specific terms or concepts, consult the [Glossary](glossary.md). - For specific terms or concepts, consult the [Glossary](glossary.md).
This manual refers to version 4.14.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version. This manual refers to version 4.13.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
@@ -29,4 +29,4 @@
``` ```
Consult the official Wazuh documentation for version 4.14.0 for detailed information on all possible configuration parameters for each component. Consult the official Wazuh documentation for version 4.13.0 for detailed information on all possible configuration parameters for each component.
+1 -1
View File
@@ -1,6 +1,6 @@
# Reference Manual - Configuration # Reference Manual - Configuration
This section details how to configure your Wazuh-Docker deployment (version 4.14.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment. This section details how to configure your Wazuh-Docker deployment (version 4.13.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
## Overview of Configuration Methods ## Overview of Configuration Methods
@@ -1,6 +1,6 @@
# Reference Manual - Deployment # Reference Manual - Deployment
This section provides detailed instructions for deploying Wazuh-Docker (version 4.14.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments. This section provides detailed instructions for deploying Wazuh-Docker (version 4.13.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
## Overview of Deployment Options ## Overview of Deployment Options
@@ -24,11 +24,11 @@ Ensure you have:
- Met all the [System Requirements](ref/getting-started/requirements.md). - Met all the [System Requirements](ref/getting-started/requirements.md).
- Installed Docker and Docker Compose on your host(s). - Installed Docker and Docker Compose on your host(s).
- Cloned the `wazuh-docker` repository (version `4.14.0`) or downloaded the necessary deployment files. - Cloned the `wazuh-docker` repository (version `4.13.0`) or downloaded the necessary deployment files.
```bash ```bash
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git) git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
cd wazuh-docker cd wazuh-docker
git checkout v4.14.0 git checkout v4.13.0
``` ```
- Made a backup of any existing Wazuh data if you are migrating or upgrading. - Made a backup of any existing Wazuh data if you are migrating or upgrading.
@@ -17,18 +17,18 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes: 3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
```bash ```bash
docker compose -f generate-indexer-certs.yml run --rm generator docker-compose -f generate-indexer-certs.yml run --rm generator
``` ```
4. Start the Wazuh environment using `docker compose`: 4. Start the Wazuh environment using `docker-compose`:
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop): * To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
```bash ```bash
docker compose up docker-compose up
``` ```
* To run in the background (detached mode, allowing the containers to run independently of your terminal): * To run in the background (detached mode, allowing the containers to run independently of your terminal):
```bash ```bash
docker compose up -d docker-compose up -d
``` ```
Please allow some time for the environment to initialize, especially on the first run. A multi-node setup can take a few minutes (depending on your host resources and network) as the Wazuh Indexer cluster forms, and the necessary indexes and index patterns are generated. Please allow some time for the environment to initialize, especially on the first run. A multi-node setup can take a few minutes (depending on your host resources and network) as the Wazuh Indexer cluster forms, and the necessary indexes and index patterns are generated.
@@ -17,18 +17,18 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes: 3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
```bash ```bash
docker compose -f generate-indexer-certs.yml run --rm generator docker-compose -f generate-indexer-certs.yml run --rm generator
``` ```
4. Start the Wazuh environment using `docker compose`: 4. Start the Wazuh environment using `docker-compose`:
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop): * To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
```bash ```bash
docker compose up docker-compose up
``` ```
* To run in the background (detached mode, allowing the containers to run independently of your terminal): * To run in the background (detached mode, allowing the containers to run independently of your terminal):
```bash ```bash
docker compose up -d docker-compose up -d
``` ```
Please allow some time for the environment to initialize, especially on the first run. It can take approximately a minute or two (depending on your host's resources) as the Wazuh Indexer starts up and generates the necessary indexes and index patterns. Please allow some time for the environment to initialize, especially on the first run. It can take approximately a minute or two (depending on your host's resources) as the Wazuh Indexer starts up and generates the necessary indexes and index patterns.
@@ -23,14 +23,14 @@ Follow these steps to deploy the Wazuh agent using Docker.
``` ```
**Note:** Replace `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager. **Note:** Replace `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager.
3. Start the environment using `docker compose`: 3. Start the environment using `docker-compose`:
* To run in the foreground (logs will be displayed in your current terminal, and you can stop it with `Ctrl+C`): * To run in the foreground (logs will be displayed in your current terminal, and you can stop it with `Ctrl+C`):
```bash ```bash
docker compose up docker-compose up
``` ```
* To run in the background (detached mode, allowing the container to run independently of your terminal): * To run in the background (detached mode, allowing the container to run independently of your terminal):
```bash ```bash
docker compose up -d docker-compose up -d
``` ```
+3 -3
View File
@@ -1,6 +1,6 @@
# Reference Manual - Getting Started # Reference Manual - Getting Started
This section guides you through the initial steps to get your Wazuh-docker (version 4.14.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions. This section guides you through the initial steps to get your Wazuh-docker (version 4.13.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
## Overview ## Overview
@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly. Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.
2. **Obtain Wazuh-docker Configuration**: 2. **Obtain Wazuh-docker Configuration**:
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.14.0. You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.13.0.
```bash ```bash
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git) git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
cd wazuh-docker cd wazuh-docker
git checkout v4.14.0 git checkout v4.13.0
# Navigate to the specific docker-compose directory, e.g., single-node or multi-node # Navigate to the specific docker-compose directory, e.g., single-node or multi-node
# cd docker-compose/single-node/ (example path) # cd docker-compose/single-node/ (example path)
``` ```
+1 -1
View File
@@ -1,6 +1,6 @@
# Reference Manual - Requirements # Reference Manual - Requirements
Before deploying Wazuh-Docker (version 4.14.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment. Before deploying Wazuh-Docker (version 4.13.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
## Host System Requirements ## Host System Requirements
+3 -3
View File
@@ -1,6 +1,6 @@
# Reference Manual - Glossary # Reference Manual - Glossary
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.14.0). This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.13.0).
--- ---
@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
**D** **D**
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.14.0, this is typically OpenSearch Dashboards. - **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.13.0, this is typically OpenSearch Dashboards.
- **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data. - **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
- **Docker**: An open platform for developing, shipping, and running applications inside containers. - **Docker**: An open platform for developing, shipping, and running applications inside containers.
- **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes. - **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
**I** **I**
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.14.0, this is typically OpenSearch. - **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.13.0, this is typically OpenSearch.
**L** **L**
+4 -4
View File
@@ -8,12 +8,12 @@
## Variables ## Variables
CERT_TOOL=wazuh-certs-tool.sh CERT_TOOL=wazuh-certs-tool.sh
PASSWORD_TOOL=wazuh-passwords-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.14/ PACKAGES_URL=https://packages.wazuh.com/4.13/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/ PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
## Check if the cert tool exists in S3 buckets ## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_URL$CERT_TOOL") CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
CERT_TOOL_PACKAGES_DEV=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_DEV_URL$CERT_TOOL") CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
## If cert tool exists in some bucket, download it, if not exit 1 ## If cert tool exists in some bucket, download it, if not exit 1
if [ "$CERT_TOOL_PACKAGES" = "200" ]; then if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
@@ -79,7 +79,7 @@
<os>yes</os> <os>yes</os>
<network>yes</network> <network>yes</network>
<packages>yes</packages> <packages>yes</packages>
<ports all="yes">yes</ports> <ports all="no">yes</ports>
<processes>yes</processes> <processes>yes</processes>
<!-- Database synchronization settings --> <!-- Database synchronization settings -->
@@ -79,7 +79,7 @@
<os>yes</os> <os>yes</os>
<network>yes</network> <network>yes</network>
<packages>yes</packages> <packages>yes</packages>
<ports all="yes">yes</ports> <ports all="no">yes</ports>
<processes>yes</processes> <processes>yes</processes>
<!-- Database synchronization settings --> <!-- Database synchronization settings -->
@@ -10,7 +10,3 @@ server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
uiSettings.overrides.defaultRoute: /app/wz-home uiSettings.overrides.defaultRoute: /app/wz-home
# Session expiration settings
opensearch_security.cookie.ttl: 900000
opensearch_security.session.ttl: 900000
opensearch_security.session.keepalive: true
+23 -23
View File
@@ -1,7 +1,7 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
services: services:
wazuh.master: wazuh.master:
image: wazuh/wazuh-manager:4.14.0 image: wazuh/wazuh-manager:4.13.0
hostname: wazuh.master hostname: wazuh.master
restart: always restart: always
ulimits: ulimits:
@@ -43,7 +43,7 @@ services:
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh.worker: wazuh.worker:
image: wazuh/wazuh-manager:4.14.0 image: wazuh/wazuh-manager:4.13.0
hostname: wazuh.worker hostname: wazuh.worker
restart: always restart: always
ulimits: ulimits:
@@ -79,7 +79,7 @@ services:
- ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
wazuh1.indexer: wazuh1.indexer:
image: wazuh/wazuh-indexer:4.14.0 image: wazuh/wazuh-indexer:4.13.0
hostname: wazuh1.indexer hostname: wazuh1.indexer
restart: always restart: always
ports: ports:
@@ -96,16 +96,16 @@ services:
hard: 65536 hard: 65536
volumes: volumes:
- wazuh-indexer-data-1:/var/lib/wazuh-indexer - wazuh-indexer-data-1:/var/lib/wazuh-indexer
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.pem
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
- ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
wazuh2.indexer: wazuh2.indexer:
image: wazuh/wazuh-indexer:4.14.0 image: wazuh/wazuh-indexer:4.13.0
hostname: wazuh2.indexer hostname: wazuh2.indexer
restart: always restart: always
environment: environment:
@@ -120,14 +120,14 @@ services:
hard: 65536 hard: 65536
volumes: volumes:
- wazuh-indexer-data-2:/var/lib/wazuh-indexer - wazuh-indexer-data-2:/var/lib/wazuh-indexer
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.pem
- ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
wazuh3.indexer: wazuh3.indexer:
image: wazuh/wazuh-indexer:4.14.0 image: wazuh/wazuh-indexer:4.13.0
hostname: wazuh3.indexer hostname: wazuh3.indexer
restart: always restart: always
environment: environment:
@@ -142,14 +142,14 @@ services:
hard: 65536 hard: 65536
volumes: volumes:
- wazuh-indexer-data-3:/var/lib/wazuh-indexer - wazuh-indexer-data-3:/var/lib/wazuh-indexer
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.pem
- ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
wazuh.dashboard: wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.14.0 image: wazuh/wazuh-dashboard:4.13.0
hostname: wazuh.dashboard hostname: wazuh.dashboard
restart: always restart: always
ports: ports:
@@ -79,7 +79,7 @@
<os>yes</os> <os>yes</os>
<network>yes</network> <network>yes</network>
<packages>yes</packages> <packages>yes</packages>
<ports all="yes">yes</ports> <ports all="no">yes</ports>
<processes>yes</processes> <processes>yes</processes>
<!-- Database synchronization settings --> <!-- Database synchronization settings -->
@@ -10,7 +10,3 @@ server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
uiSettings.overrides.defaultRoute: /app/wz-home uiSettings.overrides.defaultRoute: /app/wz-home
# Session expiration settings
opensearch_security.cookie.ttl: 900000
opensearch_security.session.ttl: 900000
opensearch_security.session.keepalive: true
@@ -1,18 +1,17 @@
network.host: "0.0.0.0" network.host: "0.0.0.0"
node.name: "wazuh.indexer" node.name: "wazuh.indexer"
cluster.name: "wazuh-cluster"
path.data: /var/lib/wazuh-indexer path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer path.logs: /var/log/wazuh-indexer
discovery.type: single-node discovery.type: single-node
http.port: 9200-9299 http.port: 9200-9299
transport.tcp.port: 9300-9399 transport.tcp.port: 9300-9399
compatibility.override_main_response_version: true compatibility.override_main_response_version: true
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false plugins.security.ssl.transport.resolve_hostname: false
+10 -10
View File
@@ -1,7 +1,7 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
services: services:
wazuh.manager: wazuh.manager:
image: merecu/wazuh-manager:4.14.0 image: wazuh/wazuh-manager:4.13.0
hostname: wazuh.manager hostname: wazuh.manager
restart: always restart: always
ulimits: ulimits:
@@ -44,7 +44,7 @@ services:
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh.indexer: wazuh.indexer:
image: merecu/wazuh-indexer:4.14.0 image: wazuh/wazuh-indexer:4.13.0
hostname: wazuh.indexer hostname: wazuh.indexer
restart: always restart: always
ports: ports:
@@ -60,16 +60,16 @@ services:
hard: 65536 hard: 65536
volumes: volumes:
- wazuh-indexer-data:/var/lib/wazuh-indexer - wazuh-indexer-data:/var/lib/wazuh-indexer
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
wazuh.dashboard: wazuh.dashboard:
image: merecu/wazuh-dashboard:4.14.0 image: wazuh/wazuh-dashboard:4.13.0
hostname: wazuh.dashboard hostname: wazuh.dashboard
restart: always restart: always
ports: ports:
+1 -1
View File
@@ -83,7 +83,7 @@
<os>yes</os> <os>yes</os>
<network>yes</network> <network>yes</network>
<packages>yes</packages> <packages>yes</packages>
<ports all="yes">yes</ports> <ports all="no">yes</ports>
<processes>yes</processes> <processes>yes</processes>
<!-- Database synchronization settings --> <!-- Database synchronization settings -->
+3 -1
View File
@@ -1,7 +1,9 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
version: '3.7'
services: services:
wazuh.agent: wazuh.agent:
image: wazuh/wazuh-agent:4.14.0 image: wazuh/wazuh-agent:4.13.0
restart: always restart: always
environment: environment:
- WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP> - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>