mirror of
https://github.com/wazuh/wazuh-docker.git
synced 2025-11-02 04:53:19 +00:00
Updated README and docker-compose to avoid error with UDP sockets.
This commit is contained in:
21
README.md
21
README.md
@@ -2,9 +2,9 @@
|
||||
|
||||
In this repository you will find the containers to run:
|
||||
|
||||
* Wazuh server: It runs the Wazuh manager, Wazuh API and Filebeat (for integration with Elastic Stack)
|
||||
* Logstash: It is used to receive alerts generated by the manager and feed Elasticsearch using an alerts template
|
||||
* Kibana: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status.
|
||||
* wazuh: It runs the Wazuh manager, Wazuh API and Filebeat (for integration with Elastic Stack)
|
||||
* wazuh-logstash: It is used to receive alerts generated by the manager and feed Elasticsearch using an alerts template
|
||||
* wazuh-kibana: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status.
|
||||
|
||||
In addition, a docker-compose file is provided to launch the containers mentioned above. It also launches an Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images.
|
||||
|
||||
@@ -12,9 +12,15 @@ In addition, a docker-compose file is provided to launch the containers mentione
|
||||
|
||||
Containers are currently tested on Wazuh version 2.0 and Elastic Stack version 5.4.2. We will do our best to keep this repository updated to latest versions of both Wazuh and Elastic Stack.
|
||||
|
||||
## Installation note
|
||||
## Installation notes
|
||||
|
||||
Kibana container can take a few minutes to install Wazuh plugin, this is perfectly normal.
|
||||
To run all docker instances you can just run ``docker-compose up``, from the directory where you have docker-compose.yml file. The following is part of the expected behavior when setting up the system:
|
||||
|
||||
* Both wazuh-kibana and wazuh-logstash containers will run multiple queries to Elasticsearch API using curl, to learn when Elasticsearch is up. It is expected to see several ``Failed to connect to elasticsearch port 9200`` log messages, until Elasticesearch is started. Then the set up process will continue normally.
|
||||
* Kibana container can take a few minutes to install Wazuh plugin, this takes place after ``Optimizing and caching browser bundles...`` is printed out.
|
||||
* It is recommended to set Docker host preferences to give at least 4GB memory per container (this doesn't necessarily mean they all will use it, but Elasticsearch requires them to work properly).
|
||||
|
||||
Once installed you can browse through the interface at: [http://127.0.0.1:5601]
|
||||
|
||||
## More documentation
|
||||
|
||||
@@ -24,7 +30,10 @@ Kibana container can take a few minutes to install Wazuh plugin, this is perfect
|
||||
|
||||
## Credits
|
||||
|
||||
These Docker containers are based on "deviantony" dockerfiles which can be found at [https://github.com/deviantony/docker-elk](https://github.com/deviantony/docker-elk), and "xetus-oss" dockerfiles, which can be found at [https://github.com/xetus-oss/docker-ossec-server](https://github.com/xetus-oss/docker-ossec-server).
|
||||
These Docker containers are based on:
|
||||
|
||||
* "deviantony" dockerfiles which can be found at [https://github.com/deviantony/docker-elk](https://github.com/deviantony/docker-elk)
|
||||
* "xetus-oss" dockerfiles, which can be found at [https://github.com/xetus-oss/docker-ossec-server](https://github.com/xetus-oss/docker-ossec-server)
|
||||
|
||||
We thank you them and everyone else who has contributed to this project.
|
||||
|
||||
|
||||
@@ -6,9 +6,9 @@ services:
|
||||
hostname: wazuh-manager
|
||||
restart: always
|
||||
ports:
|
||||
- "1514/udp:1514/udp"
|
||||
- "1514:1514/udp"
|
||||
- "1515:1515"
|
||||
- "514/udp:514/udp"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
networks:
|
||||
- docker_elk
|
||||
|
||||
Reference in New Issue
Block a user