mirror of
https://github.com/wazuh/wazuh-docker.git
synced 2025-10-22 22:01:58 +00:00
Merge branch 'main' of github.com:wazuh/wazuh-docker into merge-4.14.0-into-main
This commit is contained in:
6
.env
6
.env
@@ -1,6 +1,6 @@
|
|||||||
WAZUH_VERSION=4.14.0
|
WAZUH_VERSION=5.0.0
|
||||||
WAZUH_IMAGE_VERSION=4.14.0
|
WAZUH_IMAGE_VERSION=5.0.0
|
||||||
WAZUH_TAG_REVISION=1
|
WAZUH_TAG_REVISION=1
|
||||||
FILEBEAT_TEMPLATE_BRANCH=4.14.0
|
FILEBEAT_TEMPLATE_BRANCH=5.0.0
|
||||||
WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
|
WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
|
||||||
WAZUH_UI_REVISION=1
|
WAZUH_UI_REVISION=1
|
||||||
|
2
.github/.goss.yaml
vendored
2
.github/.goss.yaml
vendored
@@ -56,7 +56,7 @@ package:
|
|||||||
wazuh-manager:
|
wazuh-manager:
|
||||||
installed: true
|
installed: true
|
||||||
versions:
|
versions:
|
||||||
- 4.14.0
|
- 5.0.0
|
||||||
port:
|
port:
|
||||||
tcp:1514:
|
tcp:1514:
|
||||||
listening: true
|
listening: true
|
||||||
|
@@ -6,7 +6,7 @@ on:
|
|||||||
inputs:
|
inputs:
|
||||||
image_tag:
|
image_tag:
|
||||||
description: 'Docker image tag'
|
description: 'Docker image tag'
|
||||||
default: '4.14.0'
|
default: '5.0.0'
|
||||||
required: true
|
required: true
|
||||||
docker_reference:
|
docker_reference:
|
||||||
description: 'wazuh-docker reference'
|
description: 'wazuh-docker reference'
|
||||||
@@ -41,7 +41,7 @@ on:
|
|||||||
inputs:
|
inputs:
|
||||||
image_tag:
|
image_tag:
|
||||||
description: 'Docker image tag'
|
description: 'Docker image tag'
|
||||||
default: '4.14.0'
|
default: '5.0.0'
|
||||||
required: true
|
required: true
|
||||||
type: string
|
type: string
|
||||||
docker_reference:
|
docker_reference:
|
||||||
|
18
CHANGELOG.md
18
CHANGELOG.md
@@ -1,6 +1,24 @@
|
|||||||
# Change Log
|
# Change Log
|
||||||
All notable changes to this project will be documented in this file.
|
All notable changes to this project will be documented in this file.
|
||||||
|
|
||||||
|
## [5.0.0]
|
||||||
|
|
||||||
|
### Added
|
||||||
|
|
||||||
|
- None
|
||||||
|
|
||||||
|
### Changed
|
||||||
|
|
||||||
|
- Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366))
|
||||||
|
|
||||||
|
### Fixed
|
||||||
|
|
||||||
|
- None
|
||||||
|
|
||||||
|
### Deleted
|
||||||
|
|
||||||
|
- None
|
||||||
|
|
||||||
## [4.14.0]
|
## [4.14.0]
|
||||||
|
|
||||||
### Added
|
### Added
|
||||||
|
@@ -18,7 +18,7 @@ The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cyber
|
|||||||
## Branch Convention
|
## Branch Convention
|
||||||
|
|
||||||
- `main`: Developing and testing of new features.
|
- `main`: Developing and testing of new features.
|
||||||
- `X.Y.Z`: Version-specific branches (e.g., `4.14.0`, `4.13.0`, etc.).
|
- `X.Y.Z`: Version-specific branches (e.g., `5.0.0`, `4.14.0`, etc.).
|
||||||
|
|
||||||
## Documentation
|
## Documentation
|
||||||
|
|
||||||
|
@@ -1,4 +1,4 @@
|
|||||||
{
|
{
|
||||||
"version": "4.14.0",
|
"version": "5.0.0",
|
||||||
"stage": "alpha0"
|
"stage": "alpha0"
|
||||||
}
|
}
|
||||||
|
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
|
|||||||
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
|
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
|
||||||
|
|
||||||
```
|
```
|
||||||
$ build-docker-images/build-images.sh -v 4.14.0
|
$ build-docker-images/build-images.sh -v 5.0.0
|
||||||
```
|
```
|
||||||
|
|
||||||
To get all the available script options use the -h or --help option:
|
To get all the available script options use the -h or --help option:
|
||||||
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
|
|||||||
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
|
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
|
||||||
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
|
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
|
||||||
-r, --revision <rev> [Optional] Package revision. By default 1
|
-r, --revision <rev> [Optional] Package revision. By default 1
|
||||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.0.
|
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
|
||||||
-h, --help Show this help.
|
-h, --help Show this help.
|
||||||
|
|
||||||
```
|
```
|
@@ -1,4 +1,4 @@
|
|||||||
WAZUH_IMAGE_VERSION=4.14.0
|
WAZUH_IMAGE_VERSION=5.0.0
|
||||||
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
|
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
|
||||||
WAZUH_TAG_REVISION=1
|
WAZUH_TAG_REVISION=1
|
||||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
|
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
|
||||||
@@ -12,7 +12,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
|
|||||||
# License (version 2) as published by the FSF - Free Software
|
# License (version 2) as published by the FSF - Free Software
|
||||||
# Foundation.
|
# Foundation.
|
||||||
|
|
||||||
WAZUH_IMAGE_VERSION="4.14.0"
|
WAZUH_IMAGE_VERSION="5.0.0"
|
||||||
WAZUH_TAG_REVISION="1"
|
WAZUH_TAG_REVISION="1"
|
||||||
WAZUH_DEV_STAGE=""
|
WAZUH_DEV_STAGE=""
|
||||||
FILEBEAT_MODULE_VERSION="0.4"
|
FILEBEAT_MODULE_VERSION="0.4"
|
||||||
|
@@ -8,7 +8,7 @@ WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags
|
|||||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
|
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
rpm --import "${APT_KEY}"
|
rpm --import "${APT_KEY}"
|
||||||
|
@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
|
|||||||
|
|
||||||
## Variables
|
## Variables
|
||||||
CERT_TOOL=wazuh-certs-tool.sh
|
CERT_TOOL=wazuh-certs-tool.sh
|
||||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
PACKAGES_URL=https://packages.wazuh.com/5.0/
|
||||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
|
||||||
|
|
||||||
## Check if the cert tool exists in S3 buckets
|
## Check if the cert tool exists in S3 buckets
|
||||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||||
|
@@ -8,7 +8,7 @@ WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags
|
|||||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
|
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
rpm --import "${APT_KEY}"
|
rpm --import "${APT_KEY}"
|
||||||
|
@@ -22,8 +22,8 @@ export REPO_DIR=/unattended_installer
|
|||||||
## Variables
|
## Variables
|
||||||
CERT_TOOL=wazuh-certs-tool.sh
|
CERT_TOOL=wazuh-certs-tool.sh
|
||||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
||||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
PACKAGES_URL=https://packages.wazuh.com/5.0/
|
||||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
|
||||||
|
|
||||||
## Check if the cert tool exists in S3 buckets
|
## Check if the cert tool exists in S3 buckets
|
||||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||||
|
@@ -3,7 +3,6 @@ node.name: "wazuh.indexer"
|
|||||||
path.data: /var/lib/wazuh-indexer
|
path.data: /var/lib/wazuh-indexer
|
||||||
path.logs: /var/log/wazuh-indexer
|
path.logs: /var/log/wazuh-indexer
|
||||||
discovery.type: single-node
|
discovery.type: single-node
|
||||||
compatibility.override_main_response_version: true
|
|
||||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
|
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
|
||||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
|
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
|
||||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||||
|
@@ -8,7 +8,7 @@ WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags
|
|||||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
|
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
rpm --import "${APT_KEY}"
|
rpm --import "${APT_KEY}"
|
||||||
|
@@ -4,7 +4,7 @@ WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags
|
|||||||
|
|
||||||
## check tag to use the correct repository
|
## check tag to use the correct repository
|
||||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||||
REPOSITORY="packages.wazuh.com/4.x"
|
REPOSITORY="packages.wazuh.com/5.x"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\
|
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\
|
||||||
|
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
|
|||||||
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
|
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
|
||||||
|
|
||||||
```
|
```
|
||||||
$ build-docker-images/build-images.sh -v 4.14.0
|
$ build-docker-images/build-images.sh -v 5.0.0
|
||||||
```
|
```
|
||||||
|
|
||||||
To get all the available script options use the -h or --help option:
|
To get all the available script options use the -h or --help option:
|
||||||
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
|
|||||||
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
|
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
|
||||||
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
|
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
|
||||||
-r, --revision <rev> [Optional] Package revision. By default 1
|
-r, --revision <rev> [Optional] Package revision. By default 1
|
||||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.0.
|
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
|
||||||
-h, --help Show this help.
|
-h, --help Show this help.
|
||||||
|
|
||||||
```
|
```
|
@@ -1,6 +1,6 @@
|
|||||||
# Development Guide - Introduction
|
# Development Guide - Introduction
|
||||||
|
|
||||||
Welcome to the Development Guide for Wazuh-docker version 4.14.0. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
|
Welcome to the Development Guide for Wazuh-docker version 5.0.0 This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
|
||||||
|
|
||||||
## Purpose of This Guide
|
## Purpose of This Guide
|
||||||
|
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
# Development Guide - Setup Environment
|
# Development Guide - Setup Environment
|
||||||
|
|
||||||
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.14.0). A proper setup is crucial for building images, running tests, and contributing effectively.
|
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 5.0.0). A proper setup is crucial for building images, running tests, and contributing effectively.
|
||||||
|
|
||||||
## Prerequisites
|
## Prerequisites
|
||||||
|
|
||||||
@@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements:
|
|||||||
Follow these steps to prepare your development environment:
|
Follow these steps to prepare your development environment:
|
||||||
|
|
||||||
1. **Clone the Repository**:
|
1. **Clone the Repository**:
|
||||||
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.14.0`.
|
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `5.0.0`.
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||||
cd wazuh-docker
|
cd wazuh-docker
|
||||||
git checkout v4.14.0
|
git checkout v5.0.0
|
||||||
```
|
```
|
||||||
|
|
||||||
2. **Verify Docker Installation**:
|
2. **Verify Docker Installation**:
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
# Reference Manual - Description
|
# Reference Manual - Description
|
||||||
|
|
||||||
This section provides a detailed description of Wazuh-docker (version 4.14.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
|
This section provides a detailed description of Wazuh-docker (version 5.0.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
|
||||||
|
|
||||||
## What is Wazuh?
|
## What is Wazuh?
|
||||||
|
|
||||||
@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi
|
|||||||
|
|
||||||
## Core Components in Wazuh-Docker
|
## Core Components in Wazuh-Docker
|
||||||
|
|
||||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.14.0:
|
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 5.0.0:
|
||||||
|
|
||||||
1. **Wazuh Manager**:
|
1. **Wazuh Manager**:
|
||||||
- The central component that collects and analyzes data from deployed Wazuh agents.
|
- The central component that collects and analyzes data from deployed Wazuh agents.
|
||||||
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
|
|||||||
2. **Wazuh Indexer**:
|
2. **Wazuh Indexer**:
|
||||||
- A highly scalable, full-text search and analytics engine.
|
- A highly scalable, full-text search and analytics engine.
|
||||||
- Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
|
- Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
|
||||||
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.14.0, this is typically an OpenSearch-based component.
|
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 5.0.0, this is typically an OpenSearch-based component.
|
||||||
|
|
||||||
3. **Wazuh Dashboard**:
|
3. **Wazuh Dashboard**:
|
||||||
- A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
|
- A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
# Reference Manual - Introduction
|
# Reference Manual - Introduction
|
||||||
|
|
||||||
Welcome to the Reference Manual for Wazuh-Docker, version 4.14.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
|
Welcome to the Reference Manual for Wazuh-Docker, version 5.0.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
|
||||||
|
|
||||||
## Purpose of This Manual
|
## Purpose of This Manual
|
||||||
|
|
||||||
@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
|
|||||||
- If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
|
- If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
|
||||||
- For specific terms or concepts, consult the [Glossary](glossary.md).
|
- For specific terms or concepts, consult the [Glossary](glossary.md).
|
||||||
|
|
||||||
This manual refers to version 4.14.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
|
This manual refers to version 5.0.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
|
||||||
|
@@ -29,4 +29,4 @@
|
|||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
Consult the official Wazuh documentation for version 4.14.0 for detailed information on all possible configuration parameters for each component.
|
Consult the official Wazuh documentation for version 5.0.0 for detailed information on all possible configuration parameters for each component.
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
# Reference Manual - Configuration
|
# Reference Manual - Configuration
|
||||||
|
|
||||||
This section details how to configure your Wazuh-Docker deployment (version 4.14.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
|
This section details how to configure your Wazuh-Docker deployment (version 5.0.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
|
||||||
|
|
||||||
## Overview of Configuration Methods
|
## Overview of Configuration Methods
|
||||||
|
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
# Reference Manual - Deployment
|
# Reference Manual - Deployment
|
||||||
|
|
||||||
This section provides detailed instructions for deploying Wazuh-Docker (version 4.14.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
|
This section provides detailed instructions for deploying Wazuh-Docker (version 5.0.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
|
||||||
|
|
||||||
## Overview of Deployment Options
|
## Overview of Deployment Options
|
||||||
|
|
||||||
@@ -24,11 +24,11 @@ Ensure you have:
|
|||||||
|
|
||||||
- Met all the [System Requirements](ref/getting-started/requirements.md).
|
- Met all the [System Requirements](ref/getting-started/requirements.md).
|
||||||
- Installed Docker and Docker Compose on your host(s).
|
- Installed Docker and Docker Compose on your host(s).
|
||||||
- Cloned the `wazuh-docker` repository (version `4.14.0`) or downloaded the necessary deployment files.
|
- Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files.
|
||||||
```bash
|
```bash
|
||||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||||
cd wazuh-docker
|
cd wazuh-docker
|
||||||
git checkout v4.14.0
|
git checkout v5.0.0
|
||||||
```
|
```
|
||||||
- Made a backup of any existing Wazuh data if you are migrating or upgrading.
|
- Made a backup of any existing Wazuh data if you are migrating or upgrading.
|
||||||
|
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
# Reference Manual - Getting Started
|
# Reference Manual - Getting Started
|
||||||
|
|
||||||
This section guides you through the initial steps to get your Wazuh-docker (version 4.14.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
|
This section guides you through the initial steps to get your Wazuh-docker (version 5.0.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
|
||||||
|
|
||||||
## Overview
|
## Overview
|
||||||
|
|
||||||
@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
|
|||||||
Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.
|
Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.
|
||||||
|
|
||||||
2. **Obtain Wazuh-docker Configuration**:
|
2. **Obtain Wazuh-docker Configuration**:
|
||||||
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.14.0.
|
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 5.0.0.
|
||||||
```bash
|
```bash
|
||||||
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
|
||||||
cd wazuh-docker
|
cd wazuh-docker
|
||||||
git checkout v4.14.0
|
git checkout v5.0.0
|
||||||
# Navigate to the specific docker-compose directory, e.g., single-node or multi-node
|
# Navigate to the specific docker-compose directory, e.g., single-node or multi-node
|
||||||
# cd docker-compose/single-node/ (example path)
|
# cd docker-compose/single-node/ (example path)
|
||||||
```
|
```
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
# Reference Manual - Requirements
|
# Reference Manual - Requirements
|
||||||
|
|
||||||
Before deploying Wazuh-Docker (version 4.14.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
|
Before deploying Wazuh-Docker (version 5.0.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
|
||||||
|
|
||||||
## Host System Requirements
|
## Host System Requirements
|
||||||
|
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
# Reference Manual - Glossary
|
# Reference Manual - Glossary
|
||||||
|
|
||||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.14.0).
|
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 5.0.0).
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
|
|||||||
|
|
||||||
**D**
|
**D**
|
||||||
|
|
||||||
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.14.0, this is typically OpenSearch Dashboards.
|
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 5.0.0, this is typically OpenSearch Dashboards.
|
||||||
- **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
|
- **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
|
||||||
- **Docker**: An open platform for developing, shipping, and running applications inside containers.
|
- **Docker**: An open platform for developing, shipping, and running applications inside containers.
|
||||||
- **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
|
- **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
|
||||||
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
|
|||||||
|
|
||||||
**I**
|
**I**
|
||||||
|
|
||||||
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.14.0, this is typically OpenSearch.
|
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 5.0.0, this is typically OpenSearch.
|
||||||
|
|
||||||
**L**
|
**L**
|
||||||
|
|
||||||
|
@@ -8,8 +8,8 @@
|
|||||||
## Variables
|
## Variables
|
||||||
CERT_TOOL=wazuh-certs-tool.sh
|
CERT_TOOL=wazuh-certs-tool.sh
|
||||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
||||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
PACKAGES_URL=https://packages.wazuh.com/5.0/
|
||||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
|
||||||
|
|
||||||
## Check if the cert tool exists in S3 buckets
|
## Check if the cert tool exists in S3 buckets
|
||||||
CERT_TOOL_PACKAGES=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_URL$CERT_TOOL")
|
CERT_TOOL_PACKAGES=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_URL$CERT_TOOL")
|
||||||
|
@@ -2,7 +2,7 @@ server.host: 0.0.0.0
|
|||||||
server.port: 5601
|
server.port: 5601
|
||||||
opensearch.hosts: https://wazuh1.indexer:9200
|
opensearch.hosts: https://wazuh1.indexer:9200
|
||||||
opensearch.ssl.verificationMode: certificate
|
opensearch.ssl.verificationMode: certificate
|
||||||
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
|
opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
|
||||||
opensearch_security.multitenancy.enabled: false
|
opensearch_security.multitenancy.enabled: false
|
||||||
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
|
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
|
||||||
server.ssl.enabled: true
|
server.ssl.enabled: true
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
network.host: wazuh1.indexer
|
network.host: wazuh1.indexer
|
||||||
node.name: wazuh1.indexer
|
node.name: wazuh1.indexer
|
||||||
cluster.initial_master_nodes:
|
cluster.initial_cluster_manager_nodes:
|
||||||
- wazuh1.indexer
|
- wazuh1.indexer
|
||||||
- wazuh2.indexer
|
- wazuh2.indexer
|
||||||
- wazuh3.indexer
|
- wazuh3.indexer
|
||||||
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
|
|||||||
- "security_rest_api_access"
|
- "security_rest_api_access"
|
||||||
plugins.security.allow_default_init_securityindex: true
|
plugins.security.allow_default_init_securityindex: true
|
||||||
cluster.routing.allocation.disk.threshold_enabled: false
|
cluster.routing.allocation.disk.threshold_enabled: false
|
||||||
compatibility.override_main_response_version: true
|
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
network.host: wazuh2.indexer
|
network.host: wazuh2.indexer
|
||||||
node.name: wazuh2.indexer
|
node.name: wazuh2.indexer
|
||||||
cluster.initial_master_nodes:
|
cluster.initial_cluster_manager_nodes:
|
||||||
- wazuh1.indexer
|
- wazuh1.indexer
|
||||||
- wazuh2.indexer
|
- wazuh2.indexer
|
||||||
- wazuh3.indexer
|
- wazuh3.indexer
|
||||||
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
|
|||||||
- "security_rest_api_access"
|
- "security_rest_api_access"
|
||||||
plugins.security.allow_default_init_securityindex: true
|
plugins.security.allow_default_init_securityindex: true
|
||||||
cluster.routing.allocation.disk.threshold_enabled: false
|
cluster.routing.allocation.disk.threshold_enabled: false
|
||||||
compatibility.override_main_response_version: true
|
|
@@ -1,6 +1,6 @@
|
|||||||
network.host: wazuh3.indexer
|
network.host: wazuh3.indexer
|
||||||
node.name: wazuh3.indexer
|
node.name: wazuh3.indexer
|
||||||
cluster.initial_master_nodes:
|
cluster.initial_cluster_manager_nodes:
|
||||||
- wazuh1.indexer
|
- wazuh1.indexer
|
||||||
- wazuh2.indexer
|
- wazuh2.indexer
|
||||||
- wazuh3.indexer
|
- wazuh3.indexer
|
||||||
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
|
|||||||
- "security_rest_api_access"
|
- "security_rest_api_access"
|
||||||
plugins.security.allow_default_init_securityindex: true
|
plugins.security.allow_default_init_securityindex: true
|
||||||
cluster.routing.allocation.disk.threshold_enabled: false
|
cluster.routing.allocation.disk.threshold_enabled: false
|
||||||
compatibility.override_main_response_version: true
|
|
@@ -1,7 +1,7 @@
|
|||||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||||
services:
|
services:
|
||||||
wazuh.master:
|
wazuh.master:
|
||||||
image: wazuh/wazuh-manager:4.14.0
|
image: wazuh/wazuh-manager:5.0.0
|
||||||
hostname: wazuh.master
|
hostname: wazuh.master
|
||||||
restart: always
|
restart: always
|
||||||
ulimits:
|
ulimits:
|
||||||
@@ -43,7 +43,7 @@ services:
|
|||||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||||
|
|
||||||
wazuh.worker:
|
wazuh.worker:
|
||||||
image: wazuh/wazuh-manager:4.14.0
|
image: wazuh/wazuh-manager:5.0.0
|
||||||
hostname: wazuh.worker
|
hostname: wazuh.worker
|
||||||
restart: always
|
restart: always
|
||||||
ulimits:
|
ulimits:
|
||||||
@@ -79,7 +79,7 @@ services:
|
|||||||
- ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
|
- ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
|
||||||
|
|
||||||
wazuh1.indexer:
|
wazuh1.indexer:
|
||||||
image: wazuh/wazuh-indexer:4.14.0
|
image: wazuh/wazuh-indexer:5.0.0
|
||||||
hostname: wazuh1.indexer
|
hostname: wazuh1.indexer
|
||||||
restart: always
|
restart: always
|
||||||
ports:
|
ports:
|
||||||
@@ -105,7 +105,7 @@ services:
|
|||||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||||
|
|
||||||
wazuh2.indexer:
|
wazuh2.indexer:
|
||||||
image: wazuh/wazuh-indexer:4.14.0
|
image: wazuh/wazuh-indexer:5.0.0
|
||||||
hostname: wazuh2.indexer
|
hostname: wazuh2.indexer
|
||||||
restart: always
|
restart: always
|
||||||
environment:
|
environment:
|
||||||
@@ -127,7 +127,7 @@ services:
|
|||||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||||
|
|
||||||
wazuh3.indexer:
|
wazuh3.indexer:
|
||||||
image: wazuh/wazuh-indexer:4.14.0
|
image: wazuh/wazuh-indexer:5.0.0
|
||||||
hostname: wazuh3.indexer
|
hostname: wazuh3.indexer
|
||||||
restart: always
|
restart: always
|
||||||
environment:
|
environment:
|
||||||
@@ -149,7 +149,7 @@ services:
|
|||||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||||
|
|
||||||
wazuh.dashboard:
|
wazuh.dashboard:
|
||||||
image: wazuh/wazuh-dashboard:4.14.0
|
image: wazuh/wazuh-dashboard:5.0.0
|
||||||
hostname: wazuh.dashboard
|
hostname: wazuh.dashboard
|
||||||
restart: always
|
restart: always
|
||||||
ports:
|
ports:
|
||||||
|
@@ -2,7 +2,7 @@ server.host: 0.0.0.0
|
|||||||
server.port: 5601
|
server.port: 5601
|
||||||
opensearch.hosts: https://wazuh.indexer:9200
|
opensearch.hosts: https://wazuh.indexer:9200
|
||||||
opensearch.ssl.verificationMode: certificate
|
opensearch.ssl.verificationMode: certificate
|
||||||
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
|
opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
|
||||||
opensearch_security.multitenancy.enabled: false
|
opensearch_security.multitenancy.enabled: false
|
||||||
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
|
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
|
||||||
server.ssl.enabled: true
|
server.ssl.enabled: true
|
||||||
|
@@ -5,7 +5,6 @@ path.logs: /var/log/wazuh-indexer
|
|||||||
discovery.type: single-node
|
discovery.type: single-node
|
||||||
http.port: 9200-9299
|
http.port: 9200-9299
|
||||||
transport.tcp.port: 9300-9399
|
transport.tcp.port: 9300-9399
|
||||||
compatibility.override_main_response_version: true
|
|
||||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||||
|
@@ -1,7 +1,7 @@
|
|||||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||||
services:
|
services:
|
||||||
wazuh.manager:
|
wazuh.manager:
|
||||||
image: wazuh/wazuh-manager:4.14.0
|
image: wazuh/wazuh-manager:5.0.0
|
||||||
hostname: wazuh.manager
|
hostname: wazuh.manager
|
||||||
restart: always
|
restart: always
|
||||||
ulimits:
|
ulimits:
|
||||||
@@ -44,7 +44,7 @@ services:
|
|||||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||||
|
|
||||||
wazuh.indexer:
|
wazuh.indexer:
|
||||||
image: wazuh/wazuh-indexer:4.14.0
|
image: wazuh/wazuh-indexer:5.0.0
|
||||||
hostname: wazuh.indexer
|
hostname: wazuh.indexer
|
||||||
restart: always
|
restart: always
|
||||||
ports:
|
ports:
|
||||||
@@ -69,7 +69,7 @@ services:
|
|||||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||||
|
|
||||||
wazuh.dashboard:
|
wazuh.dashboard:
|
||||||
image: wazuh/wazuh-dashboard:4.14.0
|
image: wazuh/wazuh-dashboard:5.0.0
|
||||||
hostname: wazuh.dashboard
|
hostname: wazuh.dashboard
|
||||||
restart: always
|
restart: always
|
||||||
ports:
|
ports:
|
||||||
|
@@ -1,7 +1,7 @@
|
|||||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||||
services:
|
services:
|
||||||
wazuh.agent:
|
wazuh.agent:
|
||||||
image: wazuh/wazuh-agent:4.14.0
|
image: wazuh/wazuh-agent:5.0.0
|
||||||
restart: always
|
restart: always
|
||||||
environment:
|
environment:
|
||||||
- WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
|
- WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
|
||||||
|
Reference in New Issue
Block a user