Compare commits

..
Author SHA1 Message Date
fcaffieri 2f966b5236 Test new bucket url 2025-07-01 18:44:28 -03:00
23 changed files with 39 additions and 51 deletions
+2 -2
View File
@@ -192,7 +192,7 @@ jobs:
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
- name: Start Wazuh agent - name: Start Wazuh agent
run: docker compose -f wazuh-agent/docker-compose.yml up -d run: docker-compose -f wazuh-agent/docker-compose.yml up -d
- name: Check Wazuh agent enrollment - name: Check Wazuh agent enrollment
run: | run: |
@@ -355,7 +355,7 @@ jobs:
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
- name: Start Wazuh agent - name: Start Wazuh agent
run: docker compose -f wazuh-agent/docker-compose.yml up -d run: docker-compose -f wazuh-agent/docker-compose.yml up -d
- name: Check Wazuh agent enrollment - name: Check Wazuh agent enrollment
run: | run: |
+1 -5
View File
@@ -5,9 +5,6 @@ All notable changes to this project will be documented in this file.
### Added ### Added
- Add opensearch_dashboard.yml parameters. ([#1985](https://github.com/wazuh/wazuh-docker/pull/1985))
- Set right ownership for malicious-ioc files on container start ([#1926](https://github.com/wazuh/wazuh-docker/pull/1926))
- Delete services statement in wazuh agent deployment. ([#1925](https://github.com/wazuh/wazuh-docker/pull/1925))
- Add permanent_data exceptions. ([#1890](https://github.com/wazuh/wazuh-docker/pull/1890)) - Add permanent_data exceptions. ([#1890](https://github.com/wazuh/wazuh-docker/pull/1890))
- Integrate bumper script via GitHub action. ([#1863](https://github.com/wazuh/wazuh-docker/pull/1863)) - Integrate bumper script via GitHub action. ([#1863](https://github.com/wazuh/wazuh-docker/pull/1863))
- Add missing malicious-ioc ruleset lists ([#1870](https://github.com/wazuh/wazuh-docker/pull/1870)) - Add missing malicious-ioc ruleset lists ([#1870](https://github.com/wazuh/wazuh-docker/pull/1870))
@@ -19,12 +16,11 @@ All notable changes to this project will be documented in this file.
### Changed ### Changed
- Syscollector configuration change ([#1994](https://github.com/wazuh/wazuh-docker/pull/1994))
- Modify wazuh-keystore use ([#1750](https://github.com/wazuh/wazuh-docker/pull/1750)) \- (wazuh-keystore) - Modify wazuh-keystore use ([#1750](https://github.com/wazuh/wazuh-docker/pull/1750)) \- (wazuh-keystore)
### Fixed ### Fixed
- Add wazuh-template.json into permanent data exception ([#1968](https://github.com/wazuh/wazuh-docker/pull/1968)) - None
### Deleted ### Deleted
+1 -1
View File
@@ -1,4 +1,4 @@
{ {
"version": "4.13.0", "version": "4.13.0",
"stage": "rc5" "stage": "alpha1"
} }
@@ -1,7 +1,7 @@
## variables ## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
@@ -1,7 +1,7 @@
## variables ## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
@@ -10,7 +10,7 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
## Variables ## Variables
CERT_TOOL=wazuh-certs-tool.sh CERT_TOOL=wazuh-certs-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.13/ PACKAGES_URL=https://packages.wazuh.com/4.13/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/ PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
## Check if the cert tool exists in S3 buckets ## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
@@ -1,7 +1,7 @@
## variables ## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
@@ -23,7 +23,7 @@ export REPO_DIR=/unattended_installer
CERT_TOOL=wazuh-certs-tool.sh CERT_TOOL=wazuh-certs-tool.sh
PASSWORD_TOOL=wazuh-passwords-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.13/ PACKAGES_URL=https://packages.wazuh.com/4.13/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/ PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
## Check if the cert tool exists in S3 buckets ## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
@@ -1,7 +1,7 @@
## variables ## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH APT_KEY=https://packages-dev.wazuh.info/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.info/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
@@ -167,17 +167,16 @@ set_custom_cluster_key() {
} }
############################################################################## ##############################################################################
# Set correct ownership for Wazuh related directories # Modify /var/ossec/queue/rids directory owner on
# on container start. # container start.
############################################################################## ##############################################################################
configure_permissions() { set_rids_owner() {
chown -R wazuh:wazuh /var/ossec/queue/rids chown -R wazuh:wazuh /var/ossec/queue/rids
chown -R wazuh:wazuh /var/ossec/etc/lists
} }
############################################################################## ##############################################################################
# Change any ossec user/group to wazuh user/group # Change any ossec user/group to wazuh user/group
############################################################################## ##############################################################################
set_correct_permOwner() { set_correct_permOwner() {
@@ -227,8 +226,8 @@ main() {
# Delete temporary data folder # Delete temporary data folder
rm -rf ${WAZUH_INSTALL_PATH}/data_tmp rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
# Set correct ownership for Wazuh related directories # Set rids directory owner
configure_permissions set_rids_owner
} }
main main
@@ -1,5 +1,5 @@
## variables ## variables
REPOSITORY="packages-dev.wazuh.com/pre-release" REPOSITORY="packages-dev.wazuh.info/pre-release"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository ## check tag to use the correct repository
@@ -100,7 +100,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes"
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json"
export PERMANENT_DATA_EXCP export PERMANENT_DATA_EXCP
# Files mounted in a volume that should be deleted # Files mounted in a volume that should be deleted
@@ -17,18 +17,18 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes: 3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
```bash ```bash
docker compose -f generate-indexer-certs.yml run --rm generator docker-compose -f generate-indexer-certs.yml run --rm generator
``` ```
4. Start the Wazuh environment using `docker compose`: 4. Start the Wazuh environment using `docker-compose`:
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop): * To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
```bash ```bash
docker compose up docker-compose up
``` ```
* To run in the background (detached mode, allowing the containers to run independently of your terminal): * To run in the background (detached mode, allowing the containers to run independently of your terminal):
```bash ```bash
docker compose up -d docker-compose up -d
``` ```
Please allow some time for the environment to initialize, especially on the first run. A multi-node setup can take a few minutes (depending on your host resources and network) as the Wazuh Indexer cluster forms, and the necessary indexes and index patterns are generated. Please allow some time for the environment to initialize, especially on the first run. A multi-node setup can take a few minutes (depending on your host resources and network) as the Wazuh Indexer cluster forms, and the necessary indexes and index patterns are generated.
@@ -17,18 +17,18 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a
3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes: 3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes:
```bash ```bash
docker compose -f generate-indexer-certs.yml run --rm generator docker-compose -f generate-indexer-certs.yml run --rm generator
``` ```
4. Start the Wazuh environment using `docker compose`: 4. Start the Wazuh environment using `docker-compose`:
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop): * To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
```bash ```bash
docker compose up docker-compose up
``` ```
* To run in the background (detached mode, allowing the containers to run independently of your terminal): * To run in the background (detached mode, allowing the containers to run independently of your terminal):
```bash ```bash
docker compose up -d docker-compose up -d
``` ```
Please allow some time for the environment to initialize, especially on the first run. It can take approximately a minute or two (depending on your host's resources) as the Wazuh Indexer starts up and generates the necessary indexes and index patterns. Please allow some time for the environment to initialize, especially on the first run. It can take approximately a minute or two (depending on your host's resources) as the Wazuh Indexer starts up and generates the necessary indexes and index patterns.
@@ -23,14 +23,14 @@ Follow these steps to deploy the Wazuh agent using Docker.
``` ```
**Note:** Replace `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager. **Note:** Replace `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager.
3. Start the environment using `docker compose`: 3. Start the environment using `docker-compose`:
* To run in the foreground (logs will be displayed in your current terminal, and you can stop it with `Ctrl+C`): * To run in the foreground (logs will be displayed in your current terminal, and you can stop it with `Ctrl+C`):
```bash ```bash
docker compose up docker-compose up
``` ```
* To run in the background (detached mode, allowing the container to run independently of your terminal): * To run in the background (detached mode, allowing the container to run independently of your terminal):
```bash ```bash
docker compose up -d docker-compose up -d
``` ```
+1 -1
View File
@@ -9,7 +9,7 @@
CERT_TOOL=wazuh-certs-tool.sh CERT_TOOL=wazuh-certs-tool.sh
PASSWORD_TOOL=wazuh-passwords-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.13/ PACKAGES_URL=https://packages.wazuh.com/4.13/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/ PACKAGES_DEV_URL=https://packages-dev.wazuh.info/4.13/
## Check if the cert tool exists in S3 buckets ## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
@@ -79,7 +79,7 @@
<os>yes</os> <os>yes</os>
<network>yes</network> <network>yes</network>
<packages>yes</packages> <packages>yes</packages>
<ports all="yes">yes</ports> <ports all="no">yes</ports>
<processes>yes</processes> <processes>yes</processes>
<!-- Database synchronization settings --> <!-- Database synchronization settings -->
@@ -79,7 +79,7 @@
<os>yes</os> <os>yes</os>
<network>yes</network> <network>yes</network>
<packages>yes</packages> <packages>yes</packages>
<ports all="yes">yes</ports> <ports all="no">yes</ports>
<processes>yes</processes> <processes>yes</processes>
<!-- Database synchronization settings --> <!-- Database synchronization settings -->
@@ -10,7 +10,3 @@ server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
uiSettings.overrides.defaultRoute: /app/wz-home uiSettings.overrides.defaultRoute: /app/wz-home
# Session expiration settings
opensearch_security.cookie.ttl: 900000
opensearch_security.session.ttl: 900000
opensearch_security.session.keepalive: true
@@ -79,7 +79,7 @@
<os>yes</os> <os>yes</os>
<network>yes</network> <network>yes</network>
<packages>yes</packages> <packages>yes</packages>
<ports all="yes">yes</ports> <ports all="no">yes</ports>
<processes>yes</processes> <processes>yes</processes>
<!-- Database synchronization settings --> <!-- Database synchronization settings -->
@@ -10,7 +10,3 @@ server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
uiSettings.overrides.defaultRoute: /app/wz-home uiSettings.overrides.defaultRoute: /app/wz-home
# Session expiration settings
opensearch_security.cookie.ttl: 900000
opensearch_security.session.ttl: 900000
opensearch_security.session.keepalive: true
+1 -1
View File
@@ -83,7 +83,7 @@
<os>yes</os> <os>yes</os>
<network>yes</network> <network>yes</network>
<packages>yes</packages> <packages>yes</packages>
<ports all="yes">yes</ports> <ports all="no">yes</ports>
<processes>yes</processes> <processes>yes</processes>
<!-- Database synchronization settings --> <!-- Database synchronization settings -->
+2
View File
@@ -1,4 +1,6 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
version: '3.7'
services: services:
wazuh.agent: wazuh.agent:
image: wazuh/wazuh-agent:4.13.0 image: wazuh/wazuh-agent:4.13.0