mirror of
				https://github.com/wazuh/wazuh-docker.git
				synced 2025-11-03 21:43:17 +00:00 
			
		
		
		
	Compare commits
	
		
			136 Commits
		
	
	
		
			v4.13.0
			...
			2695-packa
		
	
	| Author | SHA1 | Date | |
|---|---|---|---|
| 
						 | 
					eb49d515d8 | ||
| 
						 | 
					8c6a0a9319 | ||
| 
						 | 
					cb8a69026f | ||
| 
						 | 
					46829ed9ee | ||
| 
						 | 
					d654b17189 | ||
| 
						 | 
					d46c4ef5b2 | ||
| 
						 | 
					34ebf7a859 | ||
| 
						 | 
					3a605b3f6a | ||
| 
						 | 
					babaea694e | ||
| 
						 | 
					c893d86b4a | ||
| 
						 | 
					9882a9ca6d | ||
| 
						 | 
					355daccb69 | ||
| 
						 | 
					184675bab5 | ||
| 
						 | 
					2df9e3a942 | ||
| 
						 | 
					152a5476f7 | ||
| 
						 | 
					2fccb3f4c4 | ||
| 
						 | 
					afb044a3b0 | ||
| 
						 | 
					4c7ee8abac | ||
| 
						 | 
					17d61960d5 | ||
| 
						 | 
					efddce0e3e | ||
| 
						 | 
					b400409314 | ||
| 
						 | 
					05fcfd5652 | ||
| 
						 | 
					0e1fa7f1c0 | ||
| 
						 | 
					77323aaaee | ||
| 
						 | 
					7334111f1c | ||
| 
						 | 
					53a5d1a7e4 | ||
| 
						 | 
					93812b3d07 | ||
| 
						 | 
					cb6fa28bbc | ||
| 
						 | 
					782d2cfa67 | ||
| 
						 | 
					84e13a51c1 | ||
| 
						 | 
					3835b4c6db | ||
| 
						 | 
					652a7cfe9a | ||
| 
						 | 
					c910773076 | ||
| 
						 | 
					901f29b68f | ||
| 
						 | 
					2d56895f47 | ||
| 
						 | 
					ccab3b6d7e | ||
| 
						 | 
					44a7f8cedc | ||
| 
						 | 
					57c6ac12d0 | ||
| 
						 | 
					2b0575b1f9 | ||
| 
						 | 
					ecf80f9122 | ||
| 
						 | 
					e22d4a9d40 | ||
| 
						 | 
					3186bc7711 | ||
| 
						 | 
					a5f0113c75 | ||
| 
						 | 
					d4371324c9 | ||
| 
						 | 
					9eb188fc88 | ||
| 
						 | 
					8f5aa86dff | ||
| 
						 | 
					e6f077bb1f | ||
| 
						 | 
					35af57be29 | ||
| 
						 | 
					ed92382ff1 | ||
| 
						 | 
					9529953842 | ||
| 
						 | 
					9c58a48684 | ||
| 
						 | 
					a42a354c68 | ||
| 
						 | 
					7a3dce5014 | ||
| 
						 | 
					2d39e6a06b | ||
| 
						 | 
					927fcfc3b8 | ||
| 
						 | 
					58f5dadef6 | ||
| 
						 | 
					87be7e6b36 | ||
| 
						 | 
					180236e269 | ||
| 
						 | 
					1d03c17d60 | ||
| 
						 | 
					ee087c7ebf | ||
| 
						 | 
					75e3eb0b7e | ||
| 
						 | 
					0163675682 | ||
| 
						 | 
					6ef7e3acaf | ||
| 
						 | 
					a9c6beaecd | ||
| 
						 | 
					cccb4da130 | ||
| 
						 | 
					434f99b182 | ||
| 
						 | 
					ac64909b22 | ||
| 
						 | 
					63eec35a3c | ||
| 
						 | 
					ac126173e3 | ||
| 
						 | 
					5054f26b99 | ||
| 
						 | 
					e0f6ab5dda | ||
| 
						 | 
					a990518208 | ||
| 
						 | 
					9b916b1ce8 | ||
| 
						 | 
					75e09fcc19 | ||
| 
						 | 
					3748d61d5f | ||
| 
						 | 
					b2420a5946 | ||
| 
						 | 
					a136444ee9 | ||
| 
						 | 
					0989e11d43 | ||
| 
						 | 
					6c87ecf7f0 | ||
| 
						 | 
					555a0e2590 | ||
| 
						 | 
					54fe999414 | ||
| 
						 | 
					c027b3efba | ||
| 
						 | 
					7bc871bde9 | ||
| 
						 | 
					bc4d15d1c2 | ||
| 
						 | 
					82a967c0df | ||
| 
						 | 
					29190cce99 | ||
| 
						 | 
					beef440c3a | ||
| 
						 | 
					3243306b07 | ||
| 
						 | 
					81208b9abe | ||
| 
						 | 
					f53f1930aa | ||
| 
						 | 
					85709013bc | ||
| 
						 | 
					6f94d5aa65 | ||
| 
						 | 
					846ae52263 | ||
| 
						 | 
					c129cd9835 | ||
| 
						 | 
					a1afcd2c40 | ||
| 
						 | 
					76e3c62b9a | ||
| 
						 | 
					5a1daaf4ce | ||
| 
						 | 
					2d2d3ec7ca | ||
| 
						 | 
					9cc135d05b | ||
| 
						 | 
					60e43e2737 | ||
| 
						 | 
					a809b4b60b | ||
| 
						 | 
					a5eab952aa | ||
| 
						 | 
					78948b164a | ||
| 
						 | 
					de11f97bf0 | ||
| 
						 | 
					f7cbdd4884 | ||
| 
						 | 
					184802c3b9 | ||
| 
						 | 
					a5d961040a | ||
| 
						 | 
					bca60dd0b6 | ||
| 
						 | 
					6bac41a05d | ||
| 
						 | 
					1bfc4ff4c2 | ||
| 
						 | 
					a3479b0035 | ||
| 
						 | 
					f57f0b33f2 | ||
| 
						 | 
					ba4e72a2e0 | ||
| 
						 | 
					b374f4ba2e | ||
| 
						 | 
					e2a2533501 | ||
| 
						 | 
					c6369f9463 | ||
| 
						 | 
					d5e4917414 | ||
| 
						 | 
					99a703136d | ||
| 
						 | 
					c111f8497e | ||
| 
						 | 
					52570181ba | ||
| 
						 | 
					04f386e050 | ||
| 
						 | 
					43b129c857 | ||
| 
						 | 
					f1a3a48c1a | ||
| 
						 | 
					90eb7a5af8 | ||
| 
						 | 
					aa46ce2079 | ||
| 
						 | 
					3717c6cfe2 | ||
| 
						 | 
					cd69030b16 | ||
| 
						 | 
					947f87b9ad | ||
| 
						 | 
					b326241400 | ||
| 
						 | 
					662d5aaa70 | ||
| 
						 | 
					c6327ac7a2 | ||
| 
						 | 
					3593e5ed8c | ||
| 
						 | 
					e32f46a6d1 | ||
| 
						 | 
					393956be6a | ||
| 
						 | 
					9a9da404a7 | ||
| 
						 | 
					02de528417 | 
							
								
								
									
										8
									
								
								.env
									
									
									
									
									
								
							
							
						
						
									
										8
									
								
								.env
									
									
									
									
									
								
							@@ -1,6 +1,6 @@
 | 
			
		||||
WAZUH_VERSION=4.13.0
 | 
			
		||||
WAZUH_IMAGE_VERSION=4.13.0
 | 
			
		||||
WAZUH_VERSION=main
 | 
			
		||||
WAZUH_IMAGE_VERSION=main
 | 
			
		||||
WAZUH_TAG_REVISION=1
 | 
			
		||||
FILEBEAT_TEMPLATE_BRANCH=4.13.0
 | 
			
		||||
WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
 | 
			
		||||
WAZUH_UI_REVISION=1
 | 
			
		||||
WAZUH_REGISTRY=docker.io
 | 
			
		||||
IMAGE_TAG=main
 | 
			
		||||
 
 | 
			
		||||
							
								
								
									
										2
									
								
								.github/.goss.yaml
									
									
									
									
										vendored
									
									
								
							
							
						
						
									
										2
									
								
								.github/.goss.yaml
									
									
									
									
										vendored
									
									
								
							@@ -56,7 +56,7 @@ package:
 | 
			
		||||
  wazuh-manager:
 | 
			
		||||
    installed: true
 | 
			
		||||
    versions:
 | 
			
		||||
    - 4.13.0
 | 
			
		||||
    - 5.0.0
 | 
			
		||||
port:
 | 
			
		||||
  tcp:1514:
 | 
			
		||||
    listening: true
 | 
			
		||||
 
 | 
			
		||||
							
								
								
									
										145
									
								
								.github/workflows/Procedure_push_docker_images.yml
									
									
									
									
										vendored
									
									
								
							
							
						
						
									
										145
									
								
								.github/workflows/Procedure_push_docker_images.yml
									
									
									
									
										vendored
									
									
								
							@@ -6,28 +6,19 @@ on:
 | 
			
		||||
    inputs:
 | 
			
		||||
      image_tag:
 | 
			
		||||
        description: 'Docker image tag'
 | 
			
		||||
        default: '4.13.0'
 | 
			
		||||
        default: '5.0.0'
 | 
			
		||||
        required: true
 | 
			
		||||
      docker_reference:
 | 
			
		||||
        description: 'wazuh-docker reference'
 | 
			
		||||
        required: true
 | 
			
		||||
      products:
 | 
			
		||||
        description: 'Comma-separated list of the image names to build and push'
 | 
			
		||||
        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
 | 
			
		||||
        required: true
 | 
			
		||||
      filebeat_module_version:
 | 
			
		||||
        description: 'Filebeat module version'
 | 
			
		||||
        default: '0.4'
 | 
			
		||||
        required: true
 | 
			
		||||
      revision:
 | 
			
		||||
        description: 'Package revision'
 | 
			
		||||
        default: '1'
 | 
			
		||||
        required: true
 | 
			
		||||
      push_images:
 | 
			
		||||
        description: 'Push images'
 | 
			
		||||
        type: boolean
 | 
			
		||||
        default: true
 | 
			
		||||
        required: true
 | 
			
		||||
      reference:
 | 
			
		||||
        description: 'Dev reference'
 | 
			
		||||
        type: string
 | 
			
		||||
        default: latest 
 | 
			
		||||
      id:
 | 
			
		||||
        description: "ID used to identify the workflow uniquely."
 | 
			
		||||
        type: string
 | 
			
		||||
@@ -41,33 +32,22 @@ on:
 | 
			
		||||
    inputs:
 | 
			
		||||
      image_tag:
 | 
			
		||||
        description: 'Docker image tag'
 | 
			
		||||
        default: '4.13.0'
 | 
			
		||||
        default: '5.0.0'
 | 
			
		||||
        required: true
 | 
			
		||||
        type: string
 | 
			
		||||
      docker_reference:
 | 
			
		||||
        description: 'wazuh-docker reference'
 | 
			
		||||
        required: false
 | 
			
		||||
        type: string
 | 
			
		||||
      products:
 | 
			
		||||
        description: 'Comma-separated list of the image names to build and push'
 | 
			
		||||
        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
 | 
			
		||||
        required: true
 | 
			
		||||
        type: string
 | 
			
		||||
      filebeat_module_version:
 | 
			
		||||
        description: 'Filebeat module version'
 | 
			
		||||
        default: '0.4'
 | 
			
		||||
        required: true
 | 
			
		||||
        type: string
 | 
			
		||||
      revision:
 | 
			
		||||
        description: 'Package revision'
 | 
			
		||||
        default: '1'
 | 
			
		||||
        required: true
 | 
			
		||||
        type: string
 | 
			
		||||
      push_images:
 | 
			
		||||
        description: 'Push images'
 | 
			
		||||
        type: boolean
 | 
			
		||||
        default: true
 | 
			
		||||
        required: true
 | 
			
		||||
      reference:
 | 
			
		||||
        description: 'Dev reference'
 | 
			
		||||
        type: string
 | 
			
		||||
        default: latest 
 | 
			
		||||
      id:
 | 
			
		||||
        description: "ID used to identify the workflow uniquely."
 | 
			
		||||
        type: string
 | 
			
		||||
@@ -82,6 +62,15 @@ jobs:
 | 
			
		||||
  build-and-push:
 | 
			
		||||
    runs-on: ubuntu-22.04
 | 
			
		||||
 | 
			
		||||
    permissions:
 | 
			
		||||
      id-token: write
 | 
			
		||||
      contents: read
 | 
			
		||||
 | 
			
		||||
    env:
 | 
			
		||||
      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
 | 
			
		||||
      IMAGE_TAG: ${{ inputs.image_tag }}
 | 
			
		||||
      REVISION: ${{ inputs.revision }}
 | 
			
		||||
 | 
			
		||||
    steps:
 | 
			
		||||
    - name: Print inputs
 | 
			
		||||
      run: |
 | 
			
		||||
@@ -96,11 +85,10 @@ jobs:
 | 
			
		||||
        echo "* id: ${{ inputs.id }}"
 | 
			
		||||
        echo "* image_tag: ${{ inputs.image_tag }}"
 | 
			
		||||
        echo "* docker_reference: ${{ inputs.docker_reference }}"
 | 
			
		||||
        echo "* products: ${{ inputs.products }}"
 | 
			
		||||
        echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
 | 
			
		||||
        echo "* revision: ${{ inputs.revision }}"
 | 
			
		||||
        echo "* push_images: ${{ inputs.push_images }}"
 | 
			
		||||
        echo "* dev: ${{ inputs.dev }}"
 | 
			
		||||
        echo "* dev reference: ${{ inputs.reference }}"
 | 
			
		||||
        echo "---------------------------------------------"
 | 
			
		||||
 | 
			
		||||
    - name: Checkout repository
 | 
			
		||||
@@ -108,33 +96,80 @@ jobs:
 | 
			
		||||
      with:
 | 
			
		||||
        ref: ${{ inputs.docker_reference }}
 | 
			
		||||
 | 
			
		||||
    - name: free disk space
 | 
			
		||||
      uses: ./.github/free-disk-space
 | 
			
		||||
    
 | 
			
		||||
    - name: Set up QEMU
 | 
			
		||||
      uses: docker/setup-qemu-action@v3
 | 
			
		||||
 | 
			
		||||
    - name: Set up Docker Buildx
 | 
			
		||||
      uses: docker/setup-buildx-action@v3
 | 
			
		||||
 | 
			
		||||
    - name: Configure aws credentials
 | 
			
		||||
      if: ${{ inputs.dev == true }}
 | 
			
		||||
      uses: aws-actions/configure-aws-credentials@v4
 | 
			
		||||
      with:
 | 
			
		||||
        role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
 | 
			
		||||
        aws-region: "${{ secrets.AWS_REGION }}"
 | 
			
		||||
 | 
			
		||||
    - name: Log in to Amazon ECR
 | 
			
		||||
      if: ${{ inputs.dev == true }}
 | 
			
		||||
      uses: aws-actions/amazon-ecr-login@v2
 | 
			
		||||
 | 
			
		||||
    - name: Log in to Docker Hub
 | 
			
		||||
      if: ${{ inputs.dev == false }}
 | 
			
		||||
      uses: docker/login-action@v3
 | 
			
		||||
      with:
 | 
			
		||||
        username: ${{ secrets.DOCKERHUB_USERNAME }}
 | 
			
		||||
        password: ${{ secrets.DOCKERHUB_PASSWORD }}
 | 
			
		||||
 | 
			
		||||
    - name: Create packages-url.txt file
 | 
			
		||||
      if : ${{ inputs.dev == true }}
 | 
			
		||||
      run: |
 | 
			
		||||
          cat << EOF > packages-url.txt
 | 
			
		||||
          wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_manager_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_indexer_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_indexer_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_indexer_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_indexer_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_dashboard_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_dashboard_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_dashboard_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_dashboard_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_agent_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_agent_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_agent_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_agent_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)"
 | 
			
		||||
          EOF
 | 
			
		||||
      working-directory: ./build-docker-images
 | 
			
		||||
 | 
			
		||||
    - name: Build Wazuh images
 | 
			
		||||
      run: |
 | 
			
		||||
        IMAGE_TAG=${{ inputs.image_tag }}
 | 
			
		||||
        FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }}
 | 
			
		||||
        REVISION=${{ inputs.revision }}
 | 
			
		||||
 | 
			
		||||
        if [[ "$IMAGE_TAG" == *"-"* ]]; then
 | 
			
		||||
          IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
 | 
			
		||||
          if [ -z "${tokens[1]}" ]; then
 | 
			
		||||
            echo "Invalid image tag: $IMAGE_TAG"
 | 
			
		||||
            exit 1
 | 
			
		||||
        if [ "${{ inputs.dev }}" = true ]; then
 | 
			
		||||
          IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}"
 | 
			
		||||
          ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }}
 | 
			
		||||
        else  
 | 
			
		||||
          if [[ "$IMAGE_TAG" == *"-"* ]]; then
 | 
			
		||||
            IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
 | 
			
		||||
            if [ -z "${tokens[1]}" ]; then
 | 
			
		||||
              echo "Invalid image tag: $IMAGE_TAG"
 | 
			
		||||
              exit 1
 | 
			
		||||
            fi
 | 
			
		||||
            DEV_STAGE=${tokens[1]}
 | 
			
		||||
            WAZUH_VER=${tokens[0]}
 | 
			
		||||
            ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -rg $IMAGE_REGISTRY -m
 | 
			
		||||
          else
 | 
			
		||||
            ./build-images.sh -v $IMAGE_TAG -r $REVISION -rg $IMAGE_REGISTRY -m
 | 
			
		||||
          fi
 | 
			
		||||
          DEV_STAGE=${tokens[1]}
 | 
			
		||||
          WAZUH_VER=${tokens[0]}
 | 
			
		||||
          ./build-docker-images/build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION
 | 
			
		||||
        else
 | 
			
		||||
          ./build-docker-images/build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION
 | 
			
		||||
        fi
 | 
			
		||||
 | 
			
		||||
        # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
 | 
			
		||||
        ENV_FILE_PATH=".env"
 | 
			
		||||
        ENV_FILE_PATH="../.env"
 | 
			
		||||
 | 
			
		||||
        if [ -f $ENV_FILE_PATH ]; then
 | 
			
		||||
          while IFS= read -r line || [ -n "$line" ]; do
 | 
			
		||||
@@ -144,16 +179,4 @@ jobs:
 | 
			
		||||
          echo "The environment file $ENV_FILE_PATH does not exist!"
 | 
			
		||||
          exit 1
 | 
			
		||||
        fi
 | 
			
		||||
 | 
			
		||||
    - name: Tag and Push Wazuh images
 | 
			
		||||
      if: ${{ inputs.push_images }}
 | 
			
		||||
      run: |
 | 
			
		||||
        IMAGE_TAG="${{ inputs.image_tag }}$( [ "${{ inputs.dev }}" == "true" ] && echo '-dev' || true )"
 | 
			
		||||
        IMAGE_NAMES=${{ inputs.products }}
 | 
			
		||||
        IFS=',' read -r -a images <<< "$IMAGE_NAMES"
 | 
			
		||||
        for image in "${images[@]}"; do
 | 
			
		||||
          echo "Tagging and pushing wazuh/$image:${WAZUH_VERSION} to wazuh/$image:$IMAGE_TAG"
 | 
			
		||||
          docker tag wazuh/$image:${WAZUH_VERSION} wazuh/$image:$IMAGE_TAG
 | 
			
		||||
          echo "Pushing wazuh/$image:$IMAGE_TAG ..."
 | 
			
		||||
          docker push wazuh/$image:$IMAGE_TAG
 | 
			
		||||
        done
 | 
			
		||||
      working-directory: ./build-docker-images
 | 
			
		||||
 
 | 
			
		||||
							
								
								
									
										4
									
								
								.gitignore
									
									
									
									
										vendored
									
									
								
							
							
						
						
									
										4
									
								
								.gitignore
									
									
									
									
										vendored
									
									
								
							@@ -2,4 +2,6 @@ single-node/config/wazuh_indexer_ssl_certs/*.pem
 | 
			
		||||
single-node/config/wazuh_indexer_ssl_certs/*.key
 | 
			
		||||
multi-node/config/wazuh_indexer_ssl_certs/*.pem
 | 
			
		||||
multi-node/config/wazuh_indexer_ssl_certs/*.key
 | 
			
		||||
*.log
 | 
			
		||||
*.log
 | 
			
		||||
build-docker-images/packages_env.txt
 | 
			
		||||
build-docker-images/packages-url.txt
 | 
			
		||||
							
								
								
									
										81
									
								
								CHANGELOG.md
									
									
									
									
									
								
							
							
						
						
									
										81
									
								
								CHANGELOG.md
									
									
									
									
									
								
							@@ -1,6 +1,87 @@
 | 
			
		||||
# Change Log
 | 
			
		||||
All notable changes to this project will be documented in this file.
 | 
			
		||||
 | 
			
		||||
## [5.0.0]
 | 
			
		||||
 | 
			
		||||
### Added
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
### Changed
 | 
			
		||||
 | 
			
		||||
- Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-puppet/issues/2030))
 | 
			
		||||
- Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366))
 | 
			
		||||
 | 
			
		||||
### Fixed
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
### Deleted
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
## [4.14.1]
 | 
			
		||||
 | 
			
		||||
### Added
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
### Changed
 | 
			
		||||
 | 
			
		||||
- Wazuh cert tool generator improvements ([#2027](https://github.com/wazuh/wazuh-docker/pull/2027))
 | 
			
		||||
 | 
			
		||||
### Fixed
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
### Deleted
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
## [4.14.0]
 | 
			
		||||
 | 
			
		||||
### Added
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
### Changed
 | 
			
		||||
 | 
			
		||||
- Change filebeat install method ([#2020](https://github.com/wazuh/wazuh-docker/pull/2020))
 | 
			
		||||
- Remove dashboard chat setting ([#2021](https://github.com/wazuh/wazuh-docker/pull/2021))
 | 
			
		||||
- Rollback data source setting ([#1999](https://github.com/wazuh/wazuh-docker/pull/1999))
 | 
			
		||||
- Dashboard settings added ([#1998](https://github.com/wazuh/wazuh-docker/pull/1998))
 | 
			
		||||
- Add filebeat config file in the PERMANENT_DATA_EXCP list ([#1898](https://github.com/wazuh/wazuh-docker/pull/1898))
 | 
			
		||||
- Change validation of existing certs tool in S3 buckets ([#1880](https://github.com/wazuh/wazuh-docker/pull/1880))
 | 
			
		||||
 | 
			
		||||
### Fixed
 | 
			
		||||
 | 
			
		||||
- Change Wazuh indexer directory owner ([#2029](https://github.com/wazuh/wazuh-docker/pull/2029))
 | 
			
		||||
- Double the amount of space consumed in Wazuh Indexer ([#1953](https://github.com/wazuh/wazuh-docker/pull/1953))
 | 
			
		||||
- Fix config directory for opensearch_security plugin work ([#1951](https://github.com/wazuh/wazuh-docker/pull/1951))
 | 
			
		||||
- Update Dockerfile to copy opensearch-security files ([#1928](https://github.com/wazuh/wazuh-docker/pull/1928))
 | 
			
		||||
 | 
			
		||||
### Deleted
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
## [4.13.1]
 | 
			
		||||
 | 
			
		||||
### Added
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
### Changed
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
### Fixed
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
### Deleted
 | 
			
		||||
 | 
			
		||||
- None
 | 
			
		||||
 | 
			
		||||
## [4.13.0]
 | 
			
		||||
 | 
			
		||||
### Added
 | 
			
		||||
 
 | 
			
		||||
@@ -18,7 +18,7 @@ The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cyber
 | 
			
		||||
## Branch Convention
 | 
			
		||||
 | 
			
		||||
- `main`: Developing and testing of new features.
 | 
			
		||||
- `X.Y.Z`: Version-specific branches (e.g., `4.13.0`, `4.12.0`, etc.).
 | 
			
		||||
- `X.Y.Z`: Version-specific branches (e.g., `5.0.0`, `4.14.0`, etc.).
 | 
			
		||||
 | 
			
		||||
## Documentation
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -1,4 +1,4 @@
 | 
			
		||||
{
 | 
			
		||||
    "version": "4.13.0",
 | 
			
		||||
    "stage": "rc5"
 | 
			
		||||
    "version": "5.0.0",
 | 
			
		||||
    "stage": "alpha0"
 | 
			
		||||
}
 | 
			
		||||
 
 | 
			
		||||
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
 | 
			
		||||
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
 | 
			
		||||
 | 
			
		||||
```
 | 
			
		||||
$ build-docker-images/build-images.sh -v 4.13.0
 | 
			
		||||
$ build-docker-images/build-images.sh -v 5.0.0
 | 
			
		||||
```
 | 
			
		||||
 | 
			
		||||
To get all the available script options use the -h or --help option:
 | 
			
		||||
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
 | 
			
		||||
    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
 | 
			
		||||
    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default 0.4.
 | 
			
		||||
    -r, --revision <rev>         [Optional] Package revision. By default 1
 | 
			
		||||
    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 4.13.0.
 | 
			
		||||
    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
 | 
			
		||||
    -h, --help                   Show this help.
 | 
			
		||||
 | 
			
		||||
```
 | 
			
		||||
@@ -1,8 +1,10 @@
 | 
			
		||||
WAZUH_IMAGE_VERSION=4.13.0
 | 
			
		||||
WAZUH_IMAGE_VERSION=main
 | 
			
		||||
IMAGE_TAG=main
 | 
			
		||||
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
 | 
			
		||||
WAZUH_TAG_REVISION=1
 | 
			
		||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
 | 
			
		||||
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
 | 
			
		||||
WAZUH_REGISTRY=docker.io
 | 
			
		||||
 | 
			
		||||
# Wazuh package generator
 | 
			
		||||
# Copyright (C) 2023, Wazuh Inc.
 | 
			
		||||
@@ -12,10 +14,10 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
 | 
			
		||||
# License (version 2) as published by the FSF - Free Software
 | 
			
		||||
# Foundation.
 | 
			
		||||
 | 
			
		||||
WAZUH_IMAGE_VERSION="4.13.0"
 | 
			
		||||
WAZUH_IMAGE_VERSION="main"
 | 
			
		||||
WAZUH_TAG_REVISION="1"
 | 
			
		||||
WAZUH_DEV_STAGE=""
 | 
			
		||||
FILEBEAT_MODULE_VERSION="0.4"
 | 
			
		||||
WAZUH_TAG_REFERENCE=""
 | 
			
		||||
 | 
			
		||||
# -----------------------------------------------------------------------------
 | 
			
		||||
 | 
			
		||||
@@ -37,36 +39,44 @@ ctrl_c() {
 | 
			
		||||
build() {
 | 
			
		||||
 | 
			
		||||
    WAZUH_VERSION="$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')"
 | 
			
		||||
    FILEBEAT_TEMPLATE_BRANCH="${WAZUH_IMAGE_VERSION}"
 | 
			
		||||
    WAZUH_FILEBEAT_MODULE="wazuh-filebeat-${FILEBEAT_MODULE_VERSION}.tar.gz"
 | 
			
		||||
    WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}"
 | 
			
		||||
    WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}"
 | 
			
		||||
 | 
			
		||||
    if  [ "${WAZUH_DEV_STAGE}" ];then
 | 
			
		||||
        FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}"
 | 
			
		||||
        if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
 | 
			
		||||
            echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
 | 
			
		||||
            clean 1
 | 
			
		||||
        fi
 | 
			
		||||
    # Variables
 | 
			
		||||
    FILE="packages-url.txt"
 | 
			
		||||
 | 
			
		||||
    if [[ -f "$FILE" ]]; then
 | 
			
		||||
        echo "$FILE exists. Using existing file."
 | 
			
		||||
    else
 | 
			
		||||
        if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then
 | 
			
		||||
            FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}"
 | 
			
		||||
        elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
 | 
			
		||||
            FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}"
 | 
			
		||||
        TAG="v${WAZUH_VERSION}"
 | 
			
		||||
        REPO="wazuh/wazuh-docker"
 | 
			
		||||
        GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}"
 | 
			
		||||
 | 
			
		||||
        if curl -fsSL "$GH_URL" >/dev/null 2>&1; then
 | 
			
		||||
            curl -fsSL -o "$FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt"
 | 
			
		||||
        else
 | 
			
		||||
            echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
 | 
			
		||||
            clean 1
 | 
			
		||||
            curl -fsSL -o "$FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt"
 | 
			
		||||
        fi
 | 
			
		||||
    fi
 | 
			
		||||
    awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $FILE > packages_env.txt
 | 
			
		||||
    
 | 
			
		||||
    echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
 | 
			
		||||
    echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
 | 
			
		||||
    echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env
 | 
			
		||||
    echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> ../.env
 | 
			
		||||
    echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env
 | 
			
		||||
    echo IMAGE_TAG=$IMAGE_TAG >> ../.env
 | 
			
		||||
 | 
			
		||||
    echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env
 | 
			
		||||
    echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> .env
 | 
			
		||||
    echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env
 | 
			
		||||
    echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> .env
 | 
			
		||||
    echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> .env
 | 
			
		||||
    echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> .env
 | 
			
		||||
 | 
			
		||||
    docker compose -f build-docker-images/build-images.yml --env-file .env build --no-cache || clean 1
 | 
			
		||||
    set -a
 | 
			
		||||
    source ../.env
 | 
			
		||||
    source ./packages_env.txt
 | 
			
		||||
    set +a
 | 
			
		||||
 | 
			
		||||
    if  [ "${MULTIARCH}" ];then
 | 
			
		||||
        docker buildx bake --file build-images.yml --push --set *.platform=linux/amd64,linux/arm64 --no-cache|| clean 1
 | 
			
		||||
    else
 | 
			
		||||
        docker buildx bake --file build-images.yml --no-cache|| clean 1
 | 
			
		||||
    fi
 | 
			
		||||
    return 0
 | 
			
		||||
}
 | 
			
		||||
 | 
			
		||||
@@ -76,10 +86,12 @@ help() {
 | 
			
		||||
    echo
 | 
			
		||||
    echo "Usage: $0 [OPTIONS]"
 | 
			
		||||
    echo
 | 
			
		||||
    echo "    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default."
 | 
			
		||||
    echo "    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default ${FILEBEAT_MODULE_VERSION}."
 | 
			
		||||
    echo "    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default."
 | 
			
		||||
    echo "    -r, --revision <rev>         [Optional] Package revision. By default ${WAZUH_TAG_REVISION}"
 | 
			
		||||
    echo "    -ref, --reference <ref>      [Optional] Set the Wazuh reference to build development images. By default, the latest stable release."
 | 
			
		||||
    echo "    -rg, --registry <reg>        [Optional] Set the Docker registry to push the images."
 | 
			
		||||
    echo "    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, ${WAZUH_IMAGE_VERSION}."
 | 
			
		||||
    echo "    -m, --multiarch              [Optional] Enable multi-architecture builds."
 | 
			
		||||
    echo "    -h, --help                   Show this help."
 | 
			
		||||
    echo
 | 
			
		||||
    exit $1
 | 
			
		||||
@@ -102,17 +114,29 @@ main() {
 | 
			
		||||
                help 1
 | 
			
		||||
            fi
 | 
			
		||||
            ;;
 | 
			
		||||
        "-f"|"--filebeat-module")
 | 
			
		||||
        "-m"|"--multiarch")
 | 
			
		||||
            MULTIARCH="true"
 | 
			
		||||
                shift
 | 
			
		||||
            ;;
 | 
			
		||||
        "-r"|"--revision")
 | 
			
		||||
            if [ -n "${2}" ]; then
 | 
			
		||||
                FILEBEAT_MODULE_VERSION="${2}"
 | 
			
		||||
                WAZUH_TAG_REVISION="${2}"
 | 
			
		||||
                shift 2
 | 
			
		||||
            else
 | 
			
		||||
                help 1
 | 
			
		||||
            fi
 | 
			
		||||
            ;;
 | 
			
		||||
        "-r"|"--revision")
 | 
			
		||||
        "-ref"|"--reference")
 | 
			
		||||
            if [ -n "${2}" ]; then
 | 
			
		||||
                WAZUH_TAG_REVISION="${2}"
 | 
			
		||||
                WAZUH_TAG_REFERENCE="${2}"
 | 
			
		||||
                shift 2
 | 
			
		||||
            else
 | 
			
		||||
                help 1
 | 
			
		||||
            fi
 | 
			
		||||
            ;;
 | 
			
		||||
        "-rg"|"--registry")
 | 
			
		||||
            if [ -n "${2}" ]; then
 | 
			
		||||
                WAZUH_REGISTRY="${2}"
 | 
			
		||||
                shift 2
 | 
			
		||||
            else
 | 
			
		||||
                help 1
 | 
			
		||||
 
 | 
			
		||||
@@ -6,9 +6,9 @@ services:
 | 
			
		||||
      args:
 | 
			
		||||
        WAZUH_VERSION: ${WAZUH_VERSION}
 | 
			
		||||
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
 | 
			
		||||
        FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH}
 | 
			
		||||
        WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE}
 | 
			
		||||
    image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
 | 
			
		||||
        wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm}
 | 
			
		||||
        wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm}
 | 
			
		||||
    image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG}
 | 
			
		||||
    hostname: wazuh.manager
 | 
			
		||||
    restart: always
 | 
			
		||||
    ports:
 | 
			
		||||
@@ -20,19 +20,14 @@ services:
 | 
			
		||||
      - INDEXER_URL=https://wazuh.indexer:9200
 | 
			
		||||
      - INDEXER_USERNAME=admin
 | 
			
		||||
      - INDEXER_PASSWORD=admin
 | 
			
		||||
      - FILEBEAT_SSL_VERIFICATION_MODE=none
 | 
			
		||||
    volumes:
 | 
			
		||||
      - wazuh_api_configuration:/var/ossec/api/configuration
 | 
			
		||||
      - wazuh_etc:/var/ossec/etc
 | 
			
		||||
      - wazuh_logs:/var/ossec/logs
 | 
			
		||||
      - wazuh_queue:/var/ossec/queue
 | 
			
		||||
      - wazuh_var_multigroups:/var/ossec/var/multigroups
 | 
			
		||||
      - wazuh_integrations:/var/ossec/integrations
 | 
			
		||||
      - wazuh_active_response:/var/ossec/active-response/bin
 | 
			
		||||
      - wazuh_agentless:/var/ossec/agentless
 | 
			
		||||
      - wazuh_wodles:/var/ossec/wodles
 | 
			
		||||
      - filebeat_etc:/etc/filebeat
 | 
			
		||||
      - filebeat_var:/var/lib/filebeat
 | 
			
		||||
 | 
			
		||||
  wazuh.agent:
 | 
			
		||||
    build:
 | 
			
		||||
@@ -40,7 +35,9 @@ services:
 | 
			
		||||
      args:
 | 
			
		||||
        WAZUH_VERSION: ${WAZUH_VERSION}
 | 
			
		||||
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
 | 
			
		||||
    image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION}
 | 
			
		||||
        wazuh_agent_url_amd64_rpm: ${wazuh_agent_url_x86_64_rpm}
 | 
			
		||||
        wazuh_agent_url_arm64_rpm: ${wazuh_agent_url_aarch64_rpm}
 | 
			
		||||
    image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG}
 | 
			
		||||
    hostname: wazuh.agent
 | 
			
		||||
    restart: always
 | 
			
		||||
 | 
			
		||||
@@ -50,7 +47,9 @@ services:
 | 
			
		||||
      args:
 | 
			
		||||
        WAZUH_VERSION: ${WAZUH_VERSION}
 | 
			
		||||
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
 | 
			
		||||
    image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
 | 
			
		||||
        wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm}
 | 
			
		||||
        wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm}
 | 
			
		||||
    image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG}
 | 
			
		||||
    hostname: wazuh.indexer
 | 
			
		||||
    restart: always
 | 
			
		||||
    ports:
 | 
			
		||||
@@ -72,7 +71,9 @@ services:
 | 
			
		||||
        WAZUH_VERSION: ${WAZUH_VERSION}
 | 
			
		||||
        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
 | 
			
		||||
        WAZUH_UI_REVISION: ${WAZUH_UI_REVISION}
 | 
			
		||||
    image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
 | 
			
		||||
        wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm}
 | 
			
		||||
        wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm}
 | 
			
		||||
    image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG}
 | 
			
		||||
    hostname: wazuh.dashboard
 | 
			
		||||
    restart: always
 | 
			
		||||
    ports:
 | 
			
		||||
@@ -94,9 +95,6 @@ volumes:
 | 
			
		||||
  wazuh_logs:
 | 
			
		||||
  wazuh_queue:
 | 
			
		||||
  wazuh_var_multigroups:
 | 
			
		||||
  wazuh_integrations:
 | 
			
		||||
  wazuh_active_response:
 | 
			
		||||
  wazuh_agentless:
 | 
			
		||||
  wazuh_wodles:
 | 
			
		||||
  filebeat_etc:
 | 
			
		||||
  filebeat_var:
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -10,18 +10,17 @@ ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
 | 
			
		||||
ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT'
 | 
			
		||||
ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
 | 
			
		||||
ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
 | 
			
		||||
ARG WAZUH_AGENT_NAME='CHANGEE_AGENT_NAME'
 | 
			
		||||
ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
 | 
			
		||||
ARG TARGETARCH
 | 
			
		||||
ARG wazuh_agent_url_amd64_rpm
 | 
			
		||||
ARG wazuh_agent_url_arm64_rpm
 | 
			
		||||
 | 
			
		||||
COPY config/check_repository.sh /
 | 
			
		||||
 | 
			
		||||
RUN yum install curl-minimal tar gzip procps -y &&\
 | 
			
		||||
    yum clean all
 | 
			
		||||
 | 
			
		||||
RUN chmod 775 /check_repository.sh
 | 
			
		||||
RUN source /check_repository.sh
 | 
			
		||||
 | 
			
		||||
RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
 | 
			
		||||
    yum clean all && \
 | 
			
		||||
RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \
 | 
			
		||||
    agent_url="${!URL_VAR}" && \
 | 
			
		||||
    dnf install curl-minimal tar gzip procps -y &&\
 | 
			
		||||
    curl -o /wazuh-agent.rpm "${agent_url}" && \
 | 
			
		||||
    dnf install /wazuh-agent.rpm -y && \
 | 
			
		||||
    dnf clean all && \
 | 
			
		||||
    sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
 | 
			
		||||
    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
 | 
			
		||||
    -o /tmp/s6-overlay-amd64.tar.gz && \
 | 
			
		||||
@@ -31,6 +30,4 @@ RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
 | 
			
		||||
 | 
			
		||||
COPY config/etc/ /etc/
 | 
			
		||||
 | 
			
		||||
RUN rm /etc/yum.repos.d/wazuh.repo
 | 
			
		||||
 | 
			
		||||
ENTRYPOINT [ "/init" ]
 | 
			
		||||
 
 | 
			
		||||
@@ -1,15 +0,0 @@
 | 
			
		||||
## variables
 | 
			
		||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
 | 
			
		||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 | 
			
		||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
 | 
			
		||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
 | 
			
		||||
 | 
			
		||||
## check tag to use the correct repository
 | 
			
		||||
if [[ -n "${WAZUH_TAG}" ]]; then
 | 
			
		||||
  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
 | 
			
		||||
  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 | 
			
		||||
  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
rpm --import "${APT_KEY}"
 | 
			
		||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
 | 
			
		||||
@@ -5,16 +5,17 @@ ARG WAZUH_VERSION
 | 
			
		||||
ARG WAZUH_TAG_REVISION
 | 
			
		||||
ARG WAZUH_UI_REVISION
 | 
			
		||||
ARG INSTALL_DIR=/usr/share/wazuh-dashboard
 | 
			
		||||
ARG TARGETARCH
 | 
			
		||||
ARG wazuh_dashboard_url_amd64_rpm
 | 
			
		||||
ARG wazuh_dashboard_url_arm64_rpm
 | 
			
		||||
 | 
			
		||||
# Update and install dependencies
 | 
			
		||||
RUN yum install curl-minimal libcap openssl -y
 | 
			
		||||
 | 
			
		||||
COPY config/check_repository.sh /
 | 
			
		||||
RUN chmod 775 /check_repository.sh && \
 | 
			
		||||
    source /check_repository.sh
 | 
			
		||||
 | 
			
		||||
RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
 | 
			
		||||
    yum clean all
 | 
			
		||||
RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \
 | 
			
		||||
    dashboard_url="${!URL_VAR}" && \
 | 
			
		||||
    dnf install curl-minimal libcap openssl -y && \
 | 
			
		||||
    curl -o /wazuh-dashboard.rpm "${dashboard_url}" && \
 | 
			
		||||
    dnf install /wazuh-dashboard.rpm -y && \
 | 
			
		||||
    dnf clean all
 | 
			
		||||
 | 
			
		||||
# Create and set permissions to data directories
 | 
			
		||||
RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
 | 
			
		||||
@@ -42,10 +43,8 @@ FROM amazonlinux:2023
 | 
			
		||||
ENV USER="wazuh-dashboard" \
 | 
			
		||||
    GROUP="wazuh-dashboard" \
 | 
			
		||||
    NAME="wazuh-dashboard" \
 | 
			
		||||
    INSTALL_DIR="/usr/share/wazuh-dashboard"
 | 
			
		||||
 | 
			
		||||
# Set Wazuh app variables
 | 
			
		||||
ENV PATTERN="" \
 | 
			
		||||
    INSTALL_DIR="/usr/share/wazuh-dashboard" \
 | 
			
		||||
    PATTERN="" \
 | 
			
		||||
    CHECKS_PATTERN="" \
 | 
			
		||||
    CHECKS_TEMPLATE="" \
 | 
			
		||||
    CHECKS_API="" \
 | 
			
		||||
@@ -60,7 +59,7 @@ ENV PATTERN="" \
 | 
			
		||||
    WAZUH_MONITORING_REPLICAS=""
 | 
			
		||||
 | 
			
		||||
# Update and install dependencies
 | 
			
		||||
RUN yum install shadow-utils -y
 | 
			
		||||
RUN dnf install shadow-utils -y && dnf clean all
 | 
			
		||||
 | 
			
		||||
# Create wazuh-dashboard user and group
 | 
			
		||||
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
 | 
			
		||||
 
 | 
			
		||||
@@ -1,15 +0,0 @@
 | 
			
		||||
## variables
 | 
			
		||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
 | 
			
		||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 | 
			
		||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
 | 
			
		||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
 | 
			
		||||
 | 
			
		||||
## check tag to use the correct repository
 | 
			
		||||
if [[ -n "${WAZUH_TAG}" ]]; then
 | 
			
		||||
  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
 | 
			
		||||
  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 | 
			
		||||
  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
rpm --import "${APT_KEY}"
 | 
			
		||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
 | 
			
		||||
@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
 | 
			
		||||
 | 
			
		||||
## Variables
 | 
			
		||||
CERT_TOOL=wazuh-certs-tool.sh
 | 
			
		||||
PACKAGES_URL=https://packages.wazuh.com/4.13/
 | 
			
		||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/
 | 
			
		||||
PACKAGES_URL=https://packages.wazuh.com/5.0/
 | 
			
		||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
 | 
			
		||||
 | 
			
		||||
## Check if the cert tool exists in S3 buckets
 | 
			
		||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
 | 
			
		||||
 
 | 
			
		||||
@@ -3,31 +3,19 @@ FROM amazonlinux:2023 AS builder
 | 
			
		||||
 | 
			
		||||
ARG WAZUH_VERSION
 | 
			
		||||
ARG WAZUH_TAG_REVISION
 | 
			
		||||
 | 
			
		||||
RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y
 | 
			
		||||
 | 
			
		||||
COPY config/check_repository.sh /
 | 
			
		||||
RUN chmod 775 /check_repository.sh && \
 | 
			
		||||
    source /check_repository.sh
 | 
			
		||||
 | 
			
		||||
RUN yum install wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
 | 
			
		||||
    yum clean all
 | 
			
		||||
 | 
			
		||||
COPY config/opensearch.yml /
 | 
			
		||||
ARG TARGETARCH
 | 
			
		||||
ARG wazuh_indexer_url_amd64_rpm
 | 
			
		||||
ARG wazuh_indexer_url_arm64_rpm
 | 
			
		||||
 | 
			
		||||
COPY config/config.sh .
 | 
			
		||||
 | 
			
		||||
COPY config/config.yml /
 | 
			
		||||
 | 
			
		||||
COPY config/action_groups.yml /
 | 
			
		||||
 | 
			
		||||
COPY config/internal_users.yml /
 | 
			
		||||
 | 
			
		||||
COPY config/roles_mapping.yml /
 | 
			
		||||
 | 
			
		||||
COPY config/roles.yml /
 | 
			
		||||
 | 
			
		||||
RUN bash config.sh
 | 
			
		||||
RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \
 | 
			
		||||
    indexer_url="${!URL_VAR}" && \
 | 
			
		||||
    dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\
 | 
			
		||||
    curl -o /wazuh-indexer.rpm "${indexer_url}" && \
 | 
			
		||||
    dnf install /wazuh-indexer.rpm -y && \
 | 
			
		||||
    dnf clean all && \
 | 
			
		||||
    bash config.sh
 | 
			
		||||
 | 
			
		||||
################################################################################
 | 
			
		||||
# Build stage 1 (the actual Wazuh indexer image):
 | 
			
		||||
@@ -62,25 +50,26 @@ COPY config/entrypoint.sh /
 | 
			
		||||
 | 
			
		||||
COPY config/securityadmin.sh /
 | 
			
		||||
 | 
			
		||||
RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh
 | 
			
		||||
 | 
			
		||||
RUN chown 1000:1000 /*.sh
 | 
			
		||||
RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
 | 
			
		||||
    mkdir -p /usr/share/wazuh-indexer && \
 | 
			
		||||
    chown 1000:1000 /usr/share/wazuh-indexer && \
 | 
			
		||||
    chown 1000:1000 /*.sh
 | 
			
		||||
 | 
			
		||||
COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer
 | 
			
		||||
COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer
 | 
			
		||||
COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer/config
 | 
			
		||||
COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
 | 
			
		||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
 | 
			
		||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
 | 
			
		||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
 | 
			
		||||
 | 
			
		||||
RUN chown -R 1000:1000 /usr/share/wazuh-indexer
 | 
			
		||||
 | 
			
		||||
RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
 | 
			
		||||
    mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
 | 
			
		||||
    mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
 | 
			
		||||
    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
 | 
			
		||||
    chmod 700 /usr/share/wazuh-indexer && \
 | 
			
		||||
    chmod 600 /usr/share/wazuh-indexer/jvm.options && \
 | 
			
		||||
    chmod 600 /usr/share/wazuh-indexer/opensearch.yml
 | 
			
		||||
    chmod 700 /usr/share/wazuh-indexer/config && \
 | 
			
		||||
    chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \
 | 
			
		||||
    chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml
 | 
			
		||||
 | 
			
		||||
USER wazuh-indexer
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -1,15 +0,0 @@
 | 
			
		||||
## variables
 | 
			
		||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
 | 
			
		||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 | 
			
		||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
 | 
			
		||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
 | 
			
		||||
 | 
			
		||||
## check tag to use the correct repository
 | 
			
		||||
if [[ -n "${WAZUH_TAG}" ]]; then
 | 
			
		||||
  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
 | 
			
		||||
  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 | 
			
		||||
  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
rpm --import "${APT_KEY}"
 | 
			
		||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
 | 
			
		||||
@@ -13,7 +13,7 @@ export LOG_DIR=/var/log/${NAME}
 | 
			
		||||
export LIB_DIR=/var/lib/${NAME}
 | 
			
		||||
export PID_DIR=/run/${NAME}
 | 
			
		||||
export INSTALLATION_DIR=/usr/share/${NAME}
 | 
			
		||||
export CONFIG_DIR=${INSTALLATION_DIR}
 | 
			
		||||
export CONFIG_DIR=${INSTALLATION_DIR}/config
 | 
			
		||||
export BASE_DIR=${NAME}-*
 | 
			
		||||
export INDEXER_FILE=wazuh-indexer-base.tar.xz
 | 
			
		||||
export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
 | 
			
		||||
@@ -22,8 +22,8 @@ export REPO_DIR=/unattended_installer
 | 
			
		||||
## Variables
 | 
			
		||||
CERT_TOOL=wazuh-certs-tool.sh
 | 
			
		||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
 | 
			
		||||
PACKAGES_URL=https://packages.wazuh.com/4.13/
 | 
			
		||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/
 | 
			
		||||
PACKAGES_URL=https://packages.wazuh.com/5.0/
 | 
			
		||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
 | 
			
		||||
 | 
			
		||||
## Check if the cert tool exists in S3 buckets
 | 
			
		||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
 | 
			
		||||
 
 | 
			
		||||
@@ -6,7 +6,7 @@ umask 0002
 | 
			
		||||
 | 
			
		||||
export USER=wazuh-indexer
 | 
			
		||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
 | 
			
		||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}
 | 
			
		||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config
 | 
			
		||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
 | 
			
		||||
export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
 | 
			
		||||
export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
 | 
			
		||||
 
 | 
			
		||||
@@ -1,9 +1,9 @@
 | 
			
		||||
network.host: "0.0.0.0"
 | 
			
		||||
node.name: "wazuh.indexer"
 | 
			
		||||
cluster.name: "wazuh-cluster"
 | 
			
		||||
path.data: /var/lib/wazuh-indexer
 | 
			
		||||
path.logs: /var/log/wazuh-indexer
 | 
			
		||||
discovery.type: single-node
 | 
			
		||||
compatibility.override_main_response_version: true
 | 
			
		||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
 | 
			
		||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
 | 
			
		||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
 | 
			
		||||
 
 | 
			
		||||
@@ -5,27 +5,18 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh
 | 
			
		||||
 | 
			
		||||
ARG WAZUH_VERSION
 | 
			
		||||
ARG WAZUH_TAG_REVISION
 | 
			
		||||
ARG FILEBEAT_TEMPLATE_BRANCH
 | 
			
		||||
ARG FILEBEAT_CHANNEL=filebeat-oss
 | 
			
		||||
ARG FILEBEAT_VERSION=7.10.2
 | 
			
		||||
ARG WAZUH_FILEBEAT_MODULE
 | 
			
		||||
ARG S6_VERSION="v2.2.0.3"
 | 
			
		||||
ARG TARGETARCH
 | 
			
		||||
ARG wazuh_manager_url_amd64_rpm
 | 
			
		||||
ARG wazuh_manager_url_arm64_rpm
 | 
			
		||||
 | 
			
		||||
RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
 | 
			
		||||
    yum clean all
 | 
			
		||||
 | 
			
		||||
COPY config/check_repository.sh /
 | 
			
		||||
COPY config/filebeat_module.sh /
 | 
			
		||||
COPY config/permanent_data.env config/permanent_data.sh /
 | 
			
		||||
 | 
			
		||||
RUN chmod 775 /check_repository.sh
 | 
			
		||||
RUN source /check_repository.sh
 | 
			
		||||
 | 
			
		||||
RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
 | 
			
		||||
    yum clean all && \
 | 
			
		||||
    chmod 775 /filebeat_module.sh && \
 | 
			
		||||
    source /filebeat_module.sh && \
 | 
			
		||||
    rm /filebeat_module.sh && \
 | 
			
		||||
RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
 | 
			
		||||
    manager_url="${!URL_VAR}" && \
 | 
			
		||||
    dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
 | 
			
		||||
    dnf clean all && \
 | 
			
		||||
    curl -o /wazuh-manager.rpm "${manager_url}" && \
 | 
			
		||||
    dnf install /wazuh-manager.rpm -y && \
 | 
			
		||||
    dnf clean all && \
 | 
			
		||||
    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
 | 
			
		||||
    -o /tmp/s6-overlay-amd64.tar.gz && \
 | 
			
		||||
    tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
 | 
			
		||||
@@ -35,24 +26,16 @@ RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
 | 
			
		||||
COPY config/etc/ /etc/
 | 
			
		||||
COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py
 | 
			
		||||
 | 
			
		||||
COPY config/filebeat.yml /etc/filebeat/
 | 
			
		||||
 | 
			
		||||
RUN chmod go-w /etc/filebeat/filebeat.yml
 | 
			
		||||
 | 
			
		||||
ADD https://raw.githubusercontent.com/wazuh/wazuh/$FILEBEAT_TEMPLATE_BRANCH/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
 | 
			
		||||
RUN chmod go-w /etc/filebeat/wazuh-template.json
 | 
			
		||||
 | 
			
		||||
# Prepare permanent data
 | 
			
		||||
# Sync calls are due to https://github.com/docker/docker/issues/9547
 | 
			
		||||
 | 
			
		||||
COPY config/permanent_data.env config/permanent_data.sh /
 | 
			
		||||
 | 
			
		||||
#Make mount directories for keep permissions
 | 
			
		||||
 | 
			
		||||
RUN mkdir -p /var/ossec/var/multigroups && \
 | 
			
		||||
    chown root:wazuh /var/ossec/var/multigroups && \
 | 
			
		||||
    chmod 770 /var/ossec/var/multigroups && \
 | 
			
		||||
    mkdir -p /var/ossec/agentless && \
 | 
			
		||||
    chown root:wazuh /var/ossec/agentless && \
 | 
			
		||||
    chmod 770 /var/ossec/agentless && \
 | 
			
		||||
    mkdir -p /var/ossec/active-response/bin && \
 | 
			
		||||
    chown root:wazuh /var/ossec/active-response/bin && \
 | 
			
		||||
    chmod 770 /var/ossec/active-response/bin && \
 | 
			
		||||
@@ -60,8 +43,6 @@ RUN mkdir -p /var/ossec/var/multigroups && \
 | 
			
		||||
    sync && /permanent_data.sh && \
 | 
			
		||||
    sync && rm /permanent_data.sh
 | 
			
		||||
 | 
			
		||||
RUN rm /etc/yum.repos.d/wazuh.repo
 | 
			
		||||
 | 
			
		||||
# Services ports
 | 
			
		||||
EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -1,15 +0,0 @@
 | 
			
		||||
## variables
 | 
			
		||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
 | 
			
		||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 | 
			
		||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
 | 
			
		||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
 | 
			
		||||
 | 
			
		||||
## check tag to use the correct repository
 | 
			
		||||
if [[ -n "${WAZUH_TAG}" ]]; then
 | 
			
		||||
  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
 | 
			
		||||
  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
 | 
			
		||||
  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
rpm --import "${APT_KEY}"
 | 
			
		||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
 | 
			
		||||
@@ -1,51 +0,0 @@
 | 
			
		||||
#!/usr/bin/with-contenv bash
 | 
			
		||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 | 
			
		||||
 | 
			
		||||
set -e
 | 
			
		||||
 | 
			
		||||
if [ "$INDEXER_URL" != "" ]; then
 | 
			
		||||
  >&2 echo "Customize Elasticsearch output IP"
 | 
			
		||||
  sed -i "s|hosts:.*|hosts: ['$INDEXER_URL']|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
# Configure filebeat.yml security settings
 | 
			
		||||
 | 
			
		||||
if [ "$INDEXER_USERNAME" != "" ]; then
 | 
			
		||||
  >&2 echo "Configuring username."
 | 
			
		||||
  sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
  sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
if [ "$INDEXER_PASSWORD" != "" ]; then
 | 
			
		||||
  >&2 echo "Configuring password."
 | 
			
		||||
  sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
  sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
 | 
			
		||||
  >&2 echo "Configuring SSL verification mode."
 | 
			
		||||
  sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
  sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
 | 
			
		||||
  >&2 echo "Configuring Certificate Authorities."
 | 
			
		||||
  sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
  sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
if [ "$SSL_CERTIFICATE" != "" ]; then
 | 
			
		||||
  >&2 echo "Configuring SSL Certificate."
 | 
			
		||||
  sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
  sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
if [ "$SSL_KEY" != "" ]; then
 | 
			
		||||
  >&2 echo "Configuring SSL Key."
 | 
			
		||||
  sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
  sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
 | 
			
		||||
chmod go-w /etc/filebeat/filebeat.yml || true
 | 
			
		||||
chown root: /etc/filebeat/filebeat.yml || true
 | 
			
		||||
@@ -60,12 +60,6 @@ function_wazuh_migration(){
 | 
			
		||||
      chown wazuh:wazuh /var/ossec/etc/rules/*
 | 
			
		||||
      chmod 660 /var/ossec/etc/rules/*
 | 
			
		||||
 | 
			
		||||
      if [ -e /wazuh-migration/data/agentless/.passlist ]; then
 | 
			
		||||
        \cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist
 | 
			
		||||
        chown root:wazuh /var/ossec/agentless/.passlist
 | 
			
		||||
        chmod 640 /var/ossec/agentless/.passlist
 | 
			
		||||
      fi
 | 
			
		||||
 | 
			
		||||
      \cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
 | 
			
		||||
      chown wazuh:wazuh /var/ossec/queue/db/global.db
 | 
			
		||||
      chmod 640 /var/ossec/queue/db/global.db
 | 
			
		||||
@@ -1,6 +0,0 @@
 | 
			
		||||
#!/usr/bin/env sh
 | 
			
		||||
echo >&2 "Filebeat exited. code=${1}"
 | 
			
		||||
 | 
			
		||||
# terminate other services to exit from the container
 | 
			
		||||
exec s6-svscanctl -t /var/run/s6/services
 | 
			
		||||
 | 
			
		||||
@@ -1,4 +0,0 @@
 | 
			
		||||
#!/usr/bin/with-contenv sh
 | 
			
		||||
echo >&2 "starting Filebeat"
 | 
			
		||||
 | 
			
		||||
exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
 | 
			
		||||
@@ -1,12 +0,0 @@
 | 
			
		||||
## variables
 | 
			
		||||
REPOSITORY="packages-dev.wazuh.com/pre-release"
 | 
			
		||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
 | 
			
		||||
 | 
			
		||||
## check tag to use the correct repository
 | 
			
		||||
if [[ -n "${WAZUH_TAG}" ]]; then
 | 
			
		||||
  REPOSITORY="packages.wazuh.com/4.x"
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\
 | 
			
		||||
yum install -y ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && \
 | 
			
		||||
curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
 | 
			
		||||
@@ -4,28 +4,15 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/var/ossec/etc"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/var/ossec/logs"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/var/ossec/queue"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/var/ossec/agentless"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/var/ossec/integrations"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/var/ossec/wodles"
 | 
			
		||||
PERMANENT_DATA[((i++))]="/etc/filebeat"
 | 
			
		||||
 | 
			
		||||
export PERMANENT_DATA
 | 
			
		||||
 | 
			
		||||
# Files mounted in a volume that should not be permanent
 | 
			
		||||
i=0
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
 | 
			
		||||
@@ -41,18 +28,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
 | 
			
		||||
@@ -97,10 +72,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes"
 | 
			
		||||
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json"
 | 
			
		||||
export PERMANENT_DATA_EXCP
 | 
			
		||||
 | 
			
		||||
# Files mounted in a volume that should be deleted
 | 
			
		||||
 
 | 
			
		||||
@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
 | 
			
		||||
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
 | 
			
		||||
 | 
			
		||||
```
 | 
			
		||||
$ build-docker-images/build-images.sh -v 4.13.0
 | 
			
		||||
$ build-docker-images/build-images.sh -v 5.0.0
 | 
			
		||||
```
 | 
			
		||||
 | 
			
		||||
To get all the available script options use the -h or --help option:
 | 
			
		||||
@@ -23,10 +23,9 @@ $ build-docker-images/build-images.sh -h
 | 
			
		||||
 | 
			
		||||
Usage: build-docker-images/build-images.sh [OPTIONS]
 | 
			
		||||
 | 
			
		||||
    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
 | 
			
		||||
    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default 0.4.
 | 
			
		||||
    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default.
 | 
			
		||||
    -r, --revision <rev>         [Optional] Package revision. By default 1
 | 
			
		||||
    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 4.13.0.
 | 
			
		||||
    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
 | 
			
		||||
    -h, --help                   Show this help.
 | 
			
		||||
 | 
			
		||||
```
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Development Guide - Introduction
 | 
			
		||||
 | 
			
		||||
Welcome to the Development Guide for Wazuh-docker version 4.13.0. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
 | 
			
		||||
Welcome to the Development Guide for Wazuh-docker version 5.0.0 This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
 | 
			
		||||
 | 
			
		||||
## Purpose of This Guide
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Development Guide - Setup Environment
 | 
			
		||||
 | 
			
		||||
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.13.0). A proper setup is crucial for building images, running tests, and contributing effectively.
 | 
			
		||||
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 5.0.0). A proper setup is crucial for building images, running tests, and contributing effectively.
 | 
			
		||||
 | 
			
		||||
## Prerequisites
 | 
			
		||||
 | 
			
		||||
@@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements:
 | 
			
		||||
Follow these steps to prepare your development environment:
 | 
			
		||||
 | 
			
		||||
1.  **Clone the Repository**:
 | 
			
		||||
    Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.13.0`.
 | 
			
		||||
    Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `5.0.0`.
 | 
			
		||||
 | 
			
		||||
    ```bash
 | 
			
		||||
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
 | 
			
		||||
    cd wazuh-docker
 | 
			
		||||
    git checkout 4.13.0
 | 
			
		||||
    git checkout v5.0.0
 | 
			
		||||
    ```
 | 
			
		||||
 | 
			
		||||
2.  **Verify Docker Installation**:
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Reference Manual - Description
 | 
			
		||||
 | 
			
		||||
This section provides a detailed description of Wazuh-docker (version 4.13.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
 | 
			
		||||
This section provides a detailed description of Wazuh-docker (version 5.0.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
 | 
			
		||||
 | 
			
		||||
## What is Wazuh?
 | 
			
		||||
 | 
			
		||||
@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi
 | 
			
		||||
 | 
			
		||||
## Core Components in Wazuh-Docker
 | 
			
		||||
 | 
			
		||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.13.0:
 | 
			
		||||
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 5.0.0:
 | 
			
		||||
 | 
			
		||||
1.  **Wazuh Manager**:
 | 
			
		||||
    -   The central component that collects and analyzes data from deployed Wazuh agents.
 | 
			
		||||
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
 | 
			
		||||
2.  **Wazuh Indexer**:
 | 
			
		||||
    -   A highly scalable, full-text search and analytics engine.
 | 
			
		||||
    -   Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
 | 
			
		||||
    -   The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.13.0, this is typically an OpenSearch-based component.
 | 
			
		||||
    -   The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 5.0.0, this is typically an OpenSearch-based component.
 | 
			
		||||
 | 
			
		||||
3.  **Wazuh Dashboard**:
 | 
			
		||||
    -   A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Reference Manual - Introduction
 | 
			
		||||
 | 
			
		||||
Welcome to the Reference Manual for Wazuh-Docker, version 4.13.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
 | 
			
		||||
Welcome to the Reference Manual for Wazuh-Docker, version 5.0.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
 | 
			
		||||
 | 
			
		||||
## Purpose of This Manual
 | 
			
		||||
 | 
			
		||||
@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
 | 
			
		||||
-   If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
 | 
			
		||||
-   For specific terms or concepts, consult the [Glossary](glossary.md).
 | 
			
		||||
 | 
			
		||||
This manual refers to version 4.13.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
 | 
			
		||||
This manual refers to version 5.0.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
 | 
			
		||||
 
 | 
			
		||||
@@ -2,7 +2,7 @@
 | 
			
		||||
 | 
			
		||||
### 1. Wazuh Manager Configuration
 | 
			
		||||
 | 
			
		||||
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, integrations, clustering, and more.
 | 
			
		||||
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
 | 
			
		||||
    * **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) .
 | 
			
		||||
 | 
			
		||||
### 2. Wazuh Indexer Configuration
 | 
			
		||||
@@ -29,4 +29,4 @@
 | 
			
		||||
        ```
 | 
			
		||||
 | 
			
		||||
 | 
			
		||||
Consult the official Wazuh documentation for version 4.13.0 for detailed information on all possible configuration parameters for each component.
 | 
			
		||||
Consult the official Wazuh documentation for version 5.0.0 for detailed information on all possible configuration parameters for each component.
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Reference Manual - Configuration
 | 
			
		||||
 | 
			
		||||
This section details how to configure your Wazuh-Docker deployment (version 4.13.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
 | 
			
		||||
This section details how to configure your Wazuh-Docker deployment (version 5.0.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
 | 
			
		||||
 | 
			
		||||
## Overview of Configuration Methods
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Reference Manual - Deployment
 | 
			
		||||
 | 
			
		||||
This section provides detailed instructions for deploying Wazuh-Docker (version 4.13.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
 | 
			
		||||
This section provides detailed instructions for deploying Wazuh-Docker (version 5.0.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
 | 
			
		||||
 | 
			
		||||
## Overview of Deployment Options
 | 
			
		||||
 | 
			
		||||
@@ -24,11 +24,11 @@ Ensure you have:
 | 
			
		||||
 | 
			
		||||
-   Met all the [System Requirements](ref/getting-started/requirements.md).
 | 
			
		||||
-   Installed Docker and Docker Compose on your host(s).
 | 
			
		||||
-   Cloned the `wazuh-docker` repository (version `4.13.0`) or downloaded the necessary deployment files.
 | 
			
		||||
-   Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files.
 | 
			
		||||
    ```bash
 | 
			
		||||
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
 | 
			
		||||
    cd wazuh-docker
 | 
			
		||||
    git checkout v4.13.0
 | 
			
		||||
    git checkout v5.0.0
 | 
			
		||||
    ```
 | 
			
		||||
-   Made a backup of any existing Wazuh data if you are migrating or upgrading.
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Reference Manual - Getting Started
 | 
			
		||||
 | 
			
		||||
This section guides you through the initial steps to get your Wazuh-docker (version 4.13.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
 | 
			
		||||
This section guides you through the initial steps to get your Wazuh-docker (version 5.0.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
 | 
			
		||||
 | 
			
		||||
## Overview
 | 
			
		||||
 | 
			
		||||
@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
 | 
			
		||||
    Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.
 | 
			
		||||
 | 
			
		||||
2.  **Obtain Wazuh-docker Configuration**:
 | 
			
		||||
    You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.13.0.
 | 
			
		||||
    You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 5.0.0.
 | 
			
		||||
    ```bash
 | 
			
		||||
    git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
 | 
			
		||||
    cd wazuh-docker
 | 
			
		||||
    git checkout v4.13.0
 | 
			
		||||
    git checkout v5.0.0
 | 
			
		||||
    # Navigate to the specific docker-compose directory, e.g., single-node or multi-node
 | 
			
		||||
    # cd docker-compose/single-node/ (example path)
 | 
			
		||||
    ```
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Reference Manual - Requirements
 | 
			
		||||
 | 
			
		||||
Before deploying Wazuh-Docker (version 4.13.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
 | 
			
		||||
Before deploying Wazuh-Docker (version 5.0.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
 | 
			
		||||
 | 
			
		||||
## Host System Requirements
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
# Reference Manual - Glossary
 | 
			
		||||
 | 
			
		||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.13.0).
 | 
			
		||||
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 5.0.0).
 | 
			
		||||
 | 
			
		||||
---
 | 
			
		||||
 | 
			
		||||
@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
 | 
			
		||||
 | 
			
		||||
**D**
 | 
			
		||||
 | 
			
		||||
-   **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.13.0, this is typically OpenSearch Dashboards.
 | 
			
		||||
-   **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 5.0.0, this is typically OpenSearch Dashboards.
 | 
			
		||||
-   **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
 | 
			
		||||
-   **Docker**: An open platform for developing, shipping, and running applications inside containers.
 | 
			
		||||
-   **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
 | 
			
		||||
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
 | 
			
		||||
 | 
			
		||||
**I**
 | 
			
		||||
 | 
			
		||||
-   **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.13.0, this is typically OpenSearch.
 | 
			
		||||
-   **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 5.0.0, this is typically OpenSearch.
 | 
			
		||||
 | 
			
		||||
**L**
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -1,7 +1,7 @@
 | 
			
		||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 | 
			
		||||
FROM ubuntu:focal
 | 
			
		||||
FROM amazonlinux:2023
 | 
			
		||||
 | 
			
		||||
RUN apt-get update && apt-get install openssl curl -y
 | 
			
		||||
RUN yum update -y && yum install openssl curl-minimal -y
 | 
			
		||||
 | 
			
		||||
WORKDIR /
 | 
			
		||||
 | 
			
		||||
 
 | 
			
		||||
@@ -5,5 +5,5 @@ The dockerfile hosted in this directory is used to build the image used to boot
 | 
			
		||||
To create the image, the following command must be executed:
 | 
			
		||||
 | 
			
		||||
```
 | 
			
		||||
$ docker build -t wazuh/wazuh-certs-generator:0.0.2 .
 | 
			
		||||
$ docker build -t wazuh/wazuh-certs-generator:0.0.3 .
 | 
			
		||||
```
 | 
			
		||||
 
 | 
			
		||||
@@ -8,29 +8,35 @@
 | 
			
		||||
## Variables
 | 
			
		||||
CERT_TOOL=wazuh-certs-tool.sh
 | 
			
		||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
 | 
			
		||||
PACKAGES_URL=https://packages.wazuh.com/4.13/
 | 
			
		||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/
 | 
			
		||||
PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/
 | 
			
		||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/
 | 
			
		||||
 | 
			
		||||
## Check if the cert tool exists in S3 buckets
 | 
			
		||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
 | 
			
		||||
CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}')
 | 
			
		||||
OUTPUT_FILE="/$CERT_TOOL"
 | 
			
		||||
 | 
			
		||||
## If cert tool exists in some bucket, download it, if not exit 1
 | 
			
		||||
if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
 | 
			
		||||
  curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL -s
 | 
			
		||||
  echo "The tool to create the certificates exists in the in Packages bucket"
 | 
			
		||||
elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
 | 
			
		||||
  curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL -s
 | 
			
		||||
  echo "The tool to create the certificates exists in Packages-dev bucket"
 | 
			
		||||
download_package() {
 | 
			
		||||
    local url=$1
 | 
			
		||||
    echo "Checking $url$CERT_TOOL ..."
 | 
			
		||||
    if curl -fsL "$url$CERT_TOOL" -o "$OUTPUT_FILE"; then
 | 
			
		||||
        echo "Downloaded $CERT_TOOL from $url"
 | 
			
		||||
        return 0
 | 
			
		||||
    else
 | 
			
		||||
        return 1
 | 
			
		||||
    fi
 | 
			
		||||
}
 | 
			
		||||
 | 
			
		||||
# Try first the prod URL, if it fails try the dev URL
 | 
			
		||||
if download_package "$PACKAGES_URL"; then
 | 
			
		||||
    :
 | 
			
		||||
elif download_package "$PACKAGES_DEV_URL"; then
 | 
			
		||||
    :
 | 
			
		||||
else
 | 
			
		||||
  echo "The tool to create the certificates does not exist in any bucket"
 | 
			
		||||
  echo "ERROR: certificates were not created"
 | 
			
		||||
  exit 1
 | 
			
		||||
    echo "The tool to create the certificates does not exist in any bucket"
 | 
			
		||||
    echo "ERROR: certificates were not created"
 | 
			
		||||
    exit 1
 | 
			
		||||
fi
 | 
			
		||||
 | 
			
		||||
cp /config/certs.yml /config.yml
 | 
			
		||||
 | 
			
		||||
chmod 700 /$CERT_TOOL
 | 
			
		||||
chmod 700 "$OUTPUT_FILE"
 | 
			
		||||
 | 
			
		||||
##############################################################################
 | 
			
		||||
# Creating Cluster certificates
 | 
			
		||||
 
 | 
			
		||||
@@ -80,13 +80,6 @@ docker volume create \
 | 
			
		||||
           multi-node_master-wazuh-var-multigroups
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=multi-node \
 | 
			
		||||
           --label com.docker.compose.version=1.25.0 \
 | 
			
		||||
           --label com.docker.compose.volume=master-wazuh-integrations \
 | 
			
		||||
           multi-node_master-wazuh-integrations
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=multi-node \
 | 
			
		||||
           --label com.docker.compose.version=1.25.0 \
 | 
			
		||||
@@ -94,13 +87,6 @@ docker volume create \
 | 
			
		||||
           multi-node_master-wazuh-active-response
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=multi-node \
 | 
			
		||||
           --label com.docker.compose.version=1.25.0 \
 | 
			
		||||
           --label com.docker.compose.volume=master-wazuh-agentless \
 | 
			
		||||
           multi-node_master-wazuh-agentless
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=multi-node \
 | 
			
		||||
           --label com.docker.compose.version=1.25.0 \
 | 
			
		||||
@@ -157,13 +143,6 @@ docker volume create \
 | 
			
		||||
           multi-node_worker-wazuh-var-multigroups
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=multi-node \
 | 
			
		||||
           --label com.docker.compose.version=1.25.0 \
 | 
			
		||||
           --label com.docker.compose.volume=worker-wazuh-integrations \
 | 
			
		||||
           multi-node_worker-wazuh-integrations
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=multi-node \
 | 
			
		||||
           --label com.docker.compose.version=1.25.0 \
 | 
			
		||||
@@ -171,13 +150,6 @@ docker volume create \
 | 
			
		||||
           multi-node_worker-wazuh-active-response
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=multi-node \
 | 
			
		||||
           --label com.docker.compose.version=1.25.0 \
 | 
			
		||||
           --label com.docker.compose.volume=worker-wazuh-agentless \
 | 
			
		||||
           multi-node_worker-wazuh-agentless
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=multi-node \
 | 
			
		||||
           --label com.docker.compose.version=1.25.0 \
 | 
			
		||||
@@ -248,24 +220,12 @@ docker container run --rm -it \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_ossec-integrations:/from \
 | 
			
		||||
           -v multi-node_master-wazuh-integrations:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_ossec-active-response:/from \
 | 
			
		||||
           -v multi-node_master-wazuh-active-response:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_ossec-agentless:/from \
 | 
			
		||||
           -v multi-node_master-wazuh-agentless:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_ossec-wodles:/from \
 | 
			
		||||
           -v multi-node_master-wazuh-wodles:/to \
 | 
			
		||||
@@ -314,24 +274,12 @@ docker container run --rm -it \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_worker-ossec-integrations:/from \
 | 
			
		||||
           -v multi-node_worker-wazuh-integrations:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_worker-ossec-active-response:/from \
 | 
			
		||||
           -v multi-node_worker-wazuh-active-response:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_worker-ossec-agentless:/from \
 | 
			
		||||
           -v multi-node_worker-wazuh-agentless:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
```
 | 
			
		||||
```
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_worker-ossec-wodles:/from \
 | 
			
		||||
           -v multi-node_worker-wazuh-wodles:/to \
 | 
			
		||||
 
 | 
			
		||||
@@ -1,24 +1,10 @@
 | 
			
		||||
<ossec_config>
 | 
			
		||||
  <global>
 | 
			
		||||
    <jsonout_output>yes</jsonout_output>
 | 
			
		||||
    <alerts_log>yes</alerts_log>
 | 
			
		||||
    <logall>no</logall>
 | 
			
		||||
    <logall_json>no</logall_json>
 | 
			
		||||
    <email_notification>no</email_notification>
 | 
			
		||||
    <smtp_server>smtp.example.wazuh.com</smtp_server>
 | 
			
		||||
    <email_from>wazuh@example.wazuh.com</email_from>
 | 
			
		||||
    <email_to>recipient@example.wazuh.com</email_to>
 | 
			
		||||
    <email_maxperhour>12</email_maxperhour>
 | 
			
		||||
    <email_log_source>alerts.log</email_log_source>
 | 
			
		||||
    <agents_disconnection_time>10m</agents_disconnection_time>
 | 
			
		||||
    <agents_disconnection_time>15m</agents_disconnection_time>
 | 
			
		||||
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
 | 
			
		||||
    <update_check>yes</update_check>
 | 
			
		||||
  </global>
 | 
			
		||||
 | 
			
		||||
  <alerts>
 | 
			
		||||
    <log_alert_level>3</log_alert_level>
 | 
			
		||||
    <email_alert_level>12</email_alert_level>
 | 
			
		||||
  </alerts>
 | 
			
		||||
 | 
			
		||||
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
 | 
			
		||||
  <logging>
 | 
			
		||||
    <log_format>plain</log_format>
 | 
			
		||||
@@ -34,8 +20,6 @@
 | 
			
		||||
  <!-- Policy monitoring -->
 | 
			
		||||
  <rootcheck>
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
    <check_files>yes</check_files>
 | 
			
		||||
    <check_trojans>yes</check_trojans>
 | 
			
		||||
    <check_dev>yes</check_dev>
 | 
			
		||||
    <check_sys>yes</check_sys>
 | 
			
		||||
    <check_pids>yes</check_pids>
 | 
			
		||||
@@ -45,31 +29,12 @@
 | 
			
		||||
    <!-- Frequency that rootcheck is executed - every 12 hours -->
 | 
			
		||||
    <frequency>43200</frequency>
 | 
			
		||||
 | 
			
		||||
    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
 | 
			
		||||
    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
 | 
			
		||||
 | 
			
		||||
    <skip_nfs>yes</skip_nfs>
 | 
			
		||||
 | 
			
		||||
    <ignore>/var/lib/containerd</ignore>
 | 
			
		||||
    <ignore>/var/lib/docker/overlay2</ignore>
 | 
			
		||||
  </rootcheck>
 | 
			
		||||
 | 
			
		||||
  <wodle name="cis-cat">
 | 
			
		||||
    <disabled>yes</disabled>
 | 
			
		||||
    <timeout>1800</timeout>
 | 
			
		||||
    <interval>1d</interval>
 | 
			
		||||
    <scan-on-start>yes</scan-on-start>
 | 
			
		||||
 | 
			
		||||
    <java_path>wodles/java</java_path>
 | 
			
		||||
    <ciscat_path>wodles/ciscat</ciscat_path>
 | 
			
		||||
  </wodle>
 | 
			
		||||
 | 
			
		||||
  <!-- Osquery integration -->
 | 
			
		||||
  <wodle name="osquery">
 | 
			
		||||
    <disabled>yes</disabled>
 | 
			
		||||
    <run_daemon>yes</run_daemon>
 | 
			
		||||
    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
 | 
			
		||||
    <config_path>/etc/osquery/osquery.conf</config_path>
 | 
			
		||||
    <add_labels>yes</add_labels>
 | 
			
		||||
  </wodle>
 | 
			
		||||
 | 
			
		||||
  <!-- System inventory -->
 | 
			
		||||
  <wodle name="syscollector">
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
@@ -81,9 +46,15 @@
 | 
			
		||||
    <packages>yes</packages>
 | 
			
		||||
    <ports all="yes">yes</ports>
 | 
			
		||||
    <processes>yes</processes>
 | 
			
		||||
    <users>yes</users>
 | 
			
		||||
    <groups>yes</groups>
 | 
			
		||||
    <services>yes</services>
 | 
			
		||||
    <browser_extensions>yes</browser_extensions>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </wodle>
 | 
			
		||||
@@ -92,7 +63,13 @@
 | 
			
		||||
    <enabled>yes</enabled>
 | 
			
		||||
    <scan_on_start>yes</scan_on_start>
 | 
			
		||||
    <interval>12h</interval>
 | 
			
		||||
    <skip_nfs>yes</skip_nfs>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </sca>
 | 
			
		||||
 | 
			
		||||
  <vulnerability-detection>
 | 
			
		||||
@@ -124,8 +101,6 @@
 | 
			
		||||
    <!-- Frequency that syscheck is executed default every 12 hours -->
 | 
			
		||||
    <frequency>43200</frequency>
 | 
			
		||||
 | 
			
		||||
    <scan_on_start>yes</scan_on_start>
 | 
			
		||||
 | 
			
		||||
    <!-- Generate alert when new file detected -->
 | 
			
		||||
    <alert_new_files>yes</alert_new_files>
 | 
			
		||||
 | 
			
		||||
@@ -165,13 +140,12 @@
 | 
			
		||||
    <process_priority>10</process_priority>
 | 
			
		||||
 | 
			
		||||
    <!-- Maximum output throughput -->
 | 
			
		||||
    <max_eps>100</max_eps>
 | 
			
		||||
    <max_eps>50</max_eps>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_interval>1h</max_interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </syscheck>
 | 
			
		||||
@@ -266,13 +240,6 @@
 | 
			
		||||
    <rule_dir>etc/rules</rule_dir>
 | 
			
		||||
  </ruleset>
 | 
			
		||||
 | 
			
		||||
  <rule_test>
 | 
			
		||||
    <enabled>yes</enabled>
 | 
			
		||||
    <threads>1</threads>
 | 
			
		||||
    <max_sessions>64</max_sessions>
 | 
			
		||||
    <session_timeout>15m</session_timeout>
 | 
			
		||||
  </rule_test>
 | 
			
		||||
 | 
			
		||||
  <!-- Configuration for wazuh-authd -->
 | 
			
		||||
  <auth>
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
@@ -305,9 +272,19 @@
 | 
			
		||||
</ossec_config>
 | 
			
		||||
 | 
			
		||||
<ossec_config>
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>journald</log_format>
 | 
			
		||||
    <location>journald</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>audit</log_format>
 | 
			
		||||
    <location>/var/log/audit/audit.log</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>syslog</log_format>
 | 
			
		||||
    <location>/var/ossec/logs/active-responses.log</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
</ossec_config>
 | 
			
		||||
</ossec_config>
 | 
			
		||||
@@ -1,24 +1,10 @@
 | 
			
		||||
<ossec_config>
 | 
			
		||||
  <global>
 | 
			
		||||
    <jsonout_output>yes</jsonout_output>
 | 
			
		||||
    <alerts_log>yes</alerts_log>
 | 
			
		||||
    <logall>no</logall>
 | 
			
		||||
    <logall_json>no</logall_json>
 | 
			
		||||
    <email_notification>no</email_notification>
 | 
			
		||||
    <smtp_server>smtp.example.wazuh.com</smtp_server>
 | 
			
		||||
    <email_from>wazuh@example.wazuh.com</email_from>
 | 
			
		||||
    <email_to>recipient@example.wazuh.com</email_to>
 | 
			
		||||
    <email_maxperhour>12</email_maxperhour>
 | 
			
		||||
    <email_log_source>alerts.log</email_log_source>
 | 
			
		||||
    <agents_disconnection_time>10m</agents_disconnection_time>
 | 
			
		||||
    <agents_disconnection_time>15m</agents_disconnection_time>
 | 
			
		||||
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
 | 
			
		||||
    <update_check>yes</update_check>
 | 
			
		||||
  </global>
 | 
			
		||||
 | 
			
		||||
  <alerts>
 | 
			
		||||
    <log_alert_level>3</log_alert_level>
 | 
			
		||||
    <email_alert_level>12</email_alert_level>
 | 
			
		||||
  </alerts>
 | 
			
		||||
 | 
			
		||||
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
 | 
			
		||||
  <logging>
 | 
			
		||||
    <log_format>plain</log_format>
 | 
			
		||||
@@ -34,8 +20,6 @@
 | 
			
		||||
  <!-- Policy monitoring -->
 | 
			
		||||
  <rootcheck>
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
    <check_files>yes</check_files>
 | 
			
		||||
    <check_trojans>yes</check_trojans>
 | 
			
		||||
    <check_dev>yes</check_dev>
 | 
			
		||||
    <check_sys>yes</check_sys>
 | 
			
		||||
    <check_pids>yes</check_pids>
 | 
			
		||||
@@ -45,31 +29,12 @@
 | 
			
		||||
    <!-- Frequency that rootcheck is executed - every 12 hours -->
 | 
			
		||||
    <frequency>43200</frequency>
 | 
			
		||||
 | 
			
		||||
    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
 | 
			
		||||
    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
 | 
			
		||||
 | 
			
		||||
    <skip_nfs>yes</skip_nfs>
 | 
			
		||||
 | 
			
		||||
    <ignore>/var/lib/containerd</ignore>
 | 
			
		||||
    <ignore>/var/lib/docker/overlay2</ignore>
 | 
			
		||||
  </rootcheck>
 | 
			
		||||
 | 
			
		||||
  <wodle name="cis-cat">
 | 
			
		||||
    <disabled>yes</disabled>
 | 
			
		||||
    <timeout>1800</timeout>
 | 
			
		||||
    <interval>1d</interval>
 | 
			
		||||
    <scan-on-start>yes</scan-on-start>
 | 
			
		||||
 | 
			
		||||
    <java_path>wodles/java</java_path>
 | 
			
		||||
    <ciscat_path>wodles/ciscat</ciscat_path>
 | 
			
		||||
  </wodle>
 | 
			
		||||
 | 
			
		||||
  <!-- Osquery integration -->
 | 
			
		||||
  <wodle name="osquery">
 | 
			
		||||
    <disabled>yes</disabled>
 | 
			
		||||
    <run_daemon>yes</run_daemon>
 | 
			
		||||
    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
 | 
			
		||||
    <config_path>/etc/osquery/osquery.conf</config_path>
 | 
			
		||||
    <add_labels>yes</add_labels>
 | 
			
		||||
  </wodle>
 | 
			
		||||
 | 
			
		||||
  <!-- System inventory -->
 | 
			
		||||
  <wodle name="syscollector">
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
@@ -81,9 +46,15 @@
 | 
			
		||||
    <packages>yes</packages>
 | 
			
		||||
    <ports all="yes">yes</ports>
 | 
			
		||||
    <processes>yes</processes>
 | 
			
		||||
    <users>yes</users>
 | 
			
		||||
    <groups>yes</groups>
 | 
			
		||||
    <services>yes</services>
 | 
			
		||||
    <browser_extensions>yes</browser_extensions>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </wodle>
 | 
			
		||||
@@ -92,7 +63,13 @@
 | 
			
		||||
    <enabled>yes</enabled>
 | 
			
		||||
    <scan_on_start>yes</scan_on_start>
 | 
			
		||||
    <interval>12h</interval>
 | 
			
		||||
    <skip_nfs>yes</skip_nfs>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </sca>
 | 
			
		||||
 | 
			
		||||
  <vulnerability-detection>
 | 
			
		||||
@@ -124,8 +101,6 @@
 | 
			
		||||
    <!-- Frequency that syscheck is executed default every 12 hours -->
 | 
			
		||||
    <frequency>43200</frequency>
 | 
			
		||||
 | 
			
		||||
    <scan_on_start>yes</scan_on_start>
 | 
			
		||||
 | 
			
		||||
    <!-- Generate alert when new file detected -->
 | 
			
		||||
    <alert_new_files>yes</alert_new_files>
 | 
			
		||||
 | 
			
		||||
@@ -165,13 +140,12 @@
 | 
			
		||||
    <process_priority>10</process_priority>
 | 
			
		||||
 | 
			
		||||
    <!-- Maximum output throughput -->
 | 
			
		||||
    <max_eps>100</max_eps>
 | 
			
		||||
    <max_eps>50</max_eps>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_interval>1h</max_interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </syscheck>
 | 
			
		||||
@@ -266,13 +240,6 @@
 | 
			
		||||
    <rule_dir>etc/rules</rule_dir>
 | 
			
		||||
  </ruleset>
 | 
			
		||||
 | 
			
		||||
  <rule_test>
 | 
			
		||||
    <enabled>yes</enabled>
 | 
			
		||||
    <threads>1</threads>
 | 
			
		||||
    <max_sessions>64</max_sessions>
 | 
			
		||||
    <session_timeout>15m</session_timeout>
 | 
			
		||||
  </rule_test>
 | 
			
		||||
 | 
			
		||||
  <!-- Configuration for wazuh-authd -->
 | 
			
		||||
  <auth>
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
@@ -305,9 +272,19 @@
 | 
			
		||||
</ossec_config>
 | 
			
		||||
 | 
			
		||||
<ossec_config>
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>journald</log_format>
 | 
			
		||||
    <location>journald</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>audit</log_format>
 | 
			
		||||
    <location>/var/log/audit/audit.log</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>syslog</log_format>
 | 
			
		||||
    <location>/var/ossec/logs/active-responses.log</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
</ossec_config>
 | 
			
		||||
</ossec_config>
 | 
			
		||||
@@ -2,7 +2,7 @@ server.host: 0.0.0.0
 | 
			
		||||
server.port: 5601
 | 
			
		||||
opensearch.hosts: https://wazuh1.indexer:9200
 | 
			
		||||
opensearch.ssl.verificationMode: certificate
 | 
			
		||||
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
 | 
			
		||||
opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
 | 
			
		||||
opensearch_security.multitenancy.enabled: false
 | 
			
		||||
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
 | 
			
		||||
server.ssl.enabled: true
 | 
			
		||||
@@ -13,4 +13,4 @@ uiSettings.overrides.defaultRoute: /app/wz-home
 | 
			
		||||
# Session expiration settings
 | 
			
		||||
opensearch_security.cookie.ttl: 900000
 | 
			
		||||
opensearch_security.session.ttl: 900000
 | 
			
		||||
opensearch_security.session.keepalive: true
 | 
			
		||||
opensearch_security.session.keepalive: true
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
network.host: wazuh1.indexer
 | 
			
		||||
node.name: wazuh1.indexer
 | 
			
		||||
cluster.initial_master_nodes:
 | 
			
		||||
cluster.initial_cluster_manager_nodes:
 | 
			
		||||
        - wazuh1.indexer
 | 
			
		||||
        - wazuh2.indexer
 | 
			
		||||
        - wazuh3.indexer
 | 
			
		||||
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
 | 
			
		||||
- "security_rest_api_access"
 | 
			
		||||
plugins.security.allow_default_init_securityindex: true
 | 
			
		||||
cluster.routing.allocation.disk.threshold_enabled: false
 | 
			
		||||
compatibility.override_main_response_version: true
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
network.host: wazuh2.indexer
 | 
			
		||||
node.name: wazuh2.indexer
 | 
			
		||||
cluster.initial_master_nodes:
 | 
			
		||||
cluster.initial_cluster_manager_nodes:
 | 
			
		||||
        - wazuh1.indexer
 | 
			
		||||
        - wazuh2.indexer
 | 
			
		||||
        - wazuh3.indexer
 | 
			
		||||
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
 | 
			
		||||
- "security_rest_api_access"
 | 
			
		||||
plugins.security.allow_default_init_securityindex: true
 | 
			
		||||
cluster.routing.allocation.disk.threshold_enabled: false
 | 
			
		||||
compatibility.override_main_response_version: true
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
network.host: wazuh3.indexer
 | 
			
		||||
node.name: wazuh3.indexer
 | 
			
		||||
cluster.initial_master_nodes:
 | 
			
		||||
cluster.initial_cluster_manager_nodes:
 | 
			
		||||
        - wazuh1.indexer
 | 
			
		||||
        - wazuh2.indexer
 | 
			
		||||
        - wazuh3.indexer
 | 
			
		||||
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
 | 
			
		||||
- "security_rest_api_access"
 | 
			
		||||
plugins.security.allow_default_init_securityindex: true
 | 
			
		||||
cluster.routing.allocation.disk.threshold_enabled: false
 | 
			
		||||
compatibility.override_main_response_version: true
 | 
			
		||||
@@ -1,7 +1,7 @@
 | 
			
		||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 | 
			
		||||
services:
 | 
			
		||||
  wazuh.master:
 | 
			
		||||
    image: wazuh/wazuh-manager:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-manager:5.0.0
 | 
			
		||||
    hostname: wazuh.master
 | 
			
		||||
    restart: always
 | 
			
		||||
    ulimits:
 | 
			
		||||
@@ -31,9 +31,7 @@ services:
 | 
			
		||||
      - master-wazuh-logs:/var/ossec/logs
 | 
			
		||||
      - master-wazuh-queue:/var/ossec/queue
 | 
			
		||||
      - master-wazuh-var-multigroups:/var/ossec/var/multigroups
 | 
			
		||||
      - master-wazuh-integrations:/var/ossec/integrations
 | 
			
		||||
      - master-wazuh-active-response:/var/ossec/active-response/bin
 | 
			
		||||
      - master-wazuh-agentless:/var/ossec/agentless
 | 
			
		||||
      - master-wazuh-wodles:/var/ossec/wodles
 | 
			
		||||
      - master-filebeat-etc:/etc/filebeat
 | 
			
		||||
      - master-filebeat-var:/var/lib/filebeat
 | 
			
		||||
@@ -43,7 +41,7 @@ services:
 | 
			
		||||
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
 | 
			
		||||
 | 
			
		||||
  wazuh.worker:
 | 
			
		||||
    image: wazuh/wazuh-manager:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-manager:5.0.0
 | 
			
		||||
    hostname: wazuh.worker
 | 
			
		||||
    restart: always
 | 
			
		||||
    ulimits:
 | 
			
		||||
@@ -67,9 +65,7 @@ services:
 | 
			
		||||
      - worker-wazuh-logs:/var/ossec/logs
 | 
			
		||||
      - worker-wazuh-queue:/var/ossec/queue
 | 
			
		||||
      - worker-wazuh-var-multigroups:/var/ossec/var/multigroups
 | 
			
		||||
      - worker-wazuh-integrations:/var/ossec/integrations
 | 
			
		||||
      - worker-wazuh-active-response:/var/ossec/active-response/bin
 | 
			
		||||
      - worker-wazuh-agentless:/var/ossec/agentless
 | 
			
		||||
      - worker-wazuh-wodles:/var/ossec/wodles
 | 
			
		||||
      - worker-filebeat-etc:/etc/filebeat
 | 
			
		||||
      - worker-filebeat-var:/var/lib/filebeat
 | 
			
		||||
@@ -79,7 +75,7 @@ services:
 | 
			
		||||
      - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
 | 
			
		||||
 | 
			
		||||
  wazuh1.indexer:
 | 
			
		||||
    image: wazuh/wazuh-indexer:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-indexer:5.0.0
 | 
			
		||||
    hostname: wazuh1.indexer
 | 
			
		||||
    restart: always
 | 
			
		||||
    ports:
 | 
			
		||||
@@ -96,16 +92,16 @@ services:
 | 
			
		||||
        hard: 65536
 | 
			
		||||
    volumes:
 | 
			
		||||
      - wazuh-indexer-data-1:/var/lib/wazuh-indexer
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.key
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
 | 
			
		||||
      - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
 | 
			
		||||
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 | 
			
		||||
      - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
 | 
			
		||||
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
 | 
			
		||||
 | 
			
		||||
  wazuh2.indexer:
 | 
			
		||||
    image: wazuh/wazuh-indexer:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-indexer:5.0.0
 | 
			
		||||
    hostname: wazuh2.indexer
 | 
			
		||||
    restart: always
 | 
			
		||||
    environment:
 | 
			
		||||
@@ -120,14 +116,14 @@ services:
 | 
			
		||||
        hard: 65536
 | 
			
		||||
    volumes:
 | 
			
		||||
      - wazuh-indexer-data-2:/var/lib/wazuh-indexer
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.key
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.pem
 | 
			
		||||
      - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
 | 
			
		||||
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem
 | 
			
		||||
      - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
 | 
			
		||||
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
 | 
			
		||||
 | 
			
		||||
  wazuh3.indexer:
 | 
			
		||||
    image: wazuh/wazuh-indexer:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-indexer:5.0.0
 | 
			
		||||
    hostname: wazuh3.indexer
 | 
			
		||||
    restart: always
 | 
			
		||||
    environment:
 | 
			
		||||
@@ -142,14 +138,14 @@ services:
 | 
			
		||||
        hard: 65536
 | 
			
		||||
    volumes:
 | 
			
		||||
      - wazuh-indexer-data-3:/var/lib/wazuh-indexer
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.key
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.pem
 | 
			
		||||
      - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
 | 
			
		||||
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem
 | 
			
		||||
      - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
 | 
			
		||||
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
 | 
			
		||||
 | 
			
		||||
  wazuh.dashboard:
 | 
			
		||||
    image: wazuh/wazuh-dashboard:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-dashboard:5.0.0
 | 
			
		||||
    hostname: wazuh.dashboard
 | 
			
		||||
    restart: always
 | 
			
		||||
    ports:
 | 
			
		||||
@@ -198,9 +194,7 @@ volumes:
 | 
			
		||||
  master-wazuh-logs:
 | 
			
		||||
  master-wazuh-queue:
 | 
			
		||||
  master-wazuh-var-multigroups:
 | 
			
		||||
  master-wazuh-integrations:
 | 
			
		||||
  master-wazuh-active-response:
 | 
			
		||||
  master-wazuh-agentless:
 | 
			
		||||
  master-wazuh-wodles:
 | 
			
		||||
  master-filebeat-etc:
 | 
			
		||||
  master-filebeat-var:
 | 
			
		||||
@@ -209,9 +203,7 @@ volumes:
 | 
			
		||||
  worker-wazuh-logs:
 | 
			
		||||
  worker-wazuh-queue:
 | 
			
		||||
  worker-wazuh-var-multigroups:
 | 
			
		||||
  worker-wazuh-integrations:
 | 
			
		||||
  worker-wazuh-active-response:
 | 
			
		||||
  worker-wazuh-agentless:
 | 
			
		||||
  worker-wazuh-wodles:
 | 
			
		||||
  worker-filebeat-etc:
 | 
			
		||||
  worker-filebeat-var:
 | 
			
		||||
 
 | 
			
		||||
@@ -1,8 +1,10 @@
 | 
			
		||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 | 
			
		||||
services:
 | 
			
		||||
  generator:
 | 
			
		||||
    image: wazuh/wazuh-certs-generator:0.0.2
 | 
			
		||||
    image: wazuh/wazuh-certs-generator:0.0.3
 | 
			
		||||
    hostname: wazuh-certs-generator
 | 
			
		||||
    environment:
 | 
			
		||||
      - CERT_TOOL_VERSION=4.14
 | 
			
		||||
    volumes:
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/:/certificates/
 | 
			
		||||
      - ./config/certs.yml:/config/certs.yml
 | 
			
		||||
@@ -46,24 +46,12 @@ docker volume create \
 | 
			
		||||
           --label com.docker.compose.volume=master-wazuh-var-multigroups \
 | 
			
		||||
           $2_master-wazuh-var-multigroups
 | 
			
		||||
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=$2 \
 | 
			
		||||
           --label com.docker.compose.version=$1 \
 | 
			
		||||
           --label com.docker.compose.volume=master-wazuh-integrations \
 | 
			
		||||
           $2_master-wazuh-integrations
 | 
			
		||||
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=$2 \
 | 
			
		||||
           --label com.docker.compose.version=$1 \
 | 
			
		||||
           --label com.docker.compose.volume=master-wazuh-active-response \
 | 
			
		||||
           $2_master-wazuh-active-response
 | 
			
		||||
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=$2 \
 | 
			
		||||
           --label com.docker.compose.version=$1 \
 | 
			
		||||
           --label com.docker.compose.volume=master-wazuh-agentless \
 | 
			
		||||
           $2_master-wazuh-agentless
 | 
			
		||||
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=$2 \
 | 
			
		||||
           --label com.docker.compose.version=$1 \
 | 
			
		||||
@@ -112,24 +100,12 @@ docker volume create \
 | 
			
		||||
           --label com.docker.compose.volume=worker-wazuh-var-multigroups \
 | 
			
		||||
           $2_worker-wazuh-var-multigroups
 | 
			
		||||
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=$2 \
 | 
			
		||||
           --label com.docker.compose.version=$1 \
 | 
			
		||||
           --label com.docker.compose.volume=worker-wazuh-integrations \
 | 
			
		||||
           $2_worker-wazuh-integrations
 | 
			
		||||
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=$2 \
 | 
			
		||||
           --label com.docker.compose.version=$1 \
 | 
			
		||||
           --label com.docker.compose.volume=worker-wazuh-active-response \
 | 
			
		||||
           $2_worker-wazuh-active-response
 | 
			
		||||
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=$2 \
 | 
			
		||||
           --label com.docker.compose.version=$1 \
 | 
			
		||||
           --label com.docker.compose.volume=worker-wazuh-agentless \
 | 
			
		||||
           $2_worker-wazuh-agentless
 | 
			
		||||
 | 
			
		||||
docker volume create \
 | 
			
		||||
           --label com.docker.compose.project=$2 \
 | 
			
		||||
           --label com.docker.compose.version=$1 \
 | 
			
		||||
@@ -193,21 +169,11 @@ docker container run --rm -it \
 | 
			
		||||
           -v $2_master-wazuh-var-multigroups:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_ossec-integrations:/from \
 | 
			
		||||
           -v $2_master-wazuh-integrations:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_ossec-active-response:/from \
 | 
			
		||||
           -v $2_master-wazuh-active-response:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_ossec-agentless:/from \
 | 
			
		||||
           -v $2_master-wazuh-agentless:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_ossec-wodles:/from \
 | 
			
		||||
           -v $2_master-wazuh-wodles:/to \
 | 
			
		||||
@@ -248,21 +214,11 @@ docker container run --rm -it \
 | 
			
		||||
           -v $2_worker-wazuh-var-multigroups:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_worker-ossec-integrations:/from \
 | 
			
		||||
           -v $2_worker-wazuh-integrations:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_worker-ossec-active-response:/from \
 | 
			
		||||
           -v $2_worker-wazuh-active-response:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_worker-ossec-agentless:/from \
 | 
			
		||||
           -v $2_worker-wazuh-agentless:/to \
 | 
			
		||||
           alpine ash -c "cd /from ; cp -avp . /to"
 | 
			
		||||
 | 
			
		||||
docker container run --rm -it \
 | 
			
		||||
           -v wazuh-docker_worker-ossec-wodles:/from \
 | 
			
		||||
           -v $2_worker-wazuh-wodles:/to \
 | 
			
		||||
 
 | 
			
		||||
@@ -1,24 +1,10 @@
 | 
			
		||||
<ossec_config>
 | 
			
		||||
  <global>
 | 
			
		||||
    <jsonout_output>yes</jsonout_output>
 | 
			
		||||
    <alerts_log>yes</alerts_log>
 | 
			
		||||
    <logall>no</logall>
 | 
			
		||||
    <logall_json>no</logall_json>
 | 
			
		||||
    <email_notification>no</email_notification>
 | 
			
		||||
    <smtp_server>smtp.example.wazuh.com</smtp_server>
 | 
			
		||||
    <email_from>wazuh@example.wazuh.com</email_from>
 | 
			
		||||
    <email_to>recipient@example.wazuh.com</email_to>
 | 
			
		||||
    <email_maxperhour>12</email_maxperhour>
 | 
			
		||||
    <email_log_source>alerts.log</email_log_source>
 | 
			
		||||
    <agents_disconnection_time>10m</agents_disconnection_time>
 | 
			
		||||
    <agents_disconnection_time>15m</agents_disconnection_time>
 | 
			
		||||
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
 | 
			
		||||
    <update_check>yes</update_check>
 | 
			
		||||
  </global>
 | 
			
		||||
 | 
			
		||||
  <alerts>
 | 
			
		||||
    <log_alert_level>3</log_alert_level>
 | 
			
		||||
    <email_alert_level>12</email_alert_level>
 | 
			
		||||
  </alerts>
 | 
			
		||||
 | 
			
		||||
  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
 | 
			
		||||
  <logging>
 | 
			
		||||
    <log_format>plain</log_format>
 | 
			
		||||
@@ -34,8 +20,6 @@
 | 
			
		||||
  <!-- Policy monitoring -->
 | 
			
		||||
  <rootcheck>
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
    <check_files>yes</check_files>
 | 
			
		||||
    <check_trojans>yes</check_trojans>
 | 
			
		||||
    <check_dev>yes</check_dev>
 | 
			
		||||
    <check_sys>yes</check_sys>
 | 
			
		||||
    <check_pids>yes</check_pids>
 | 
			
		||||
@@ -45,31 +29,12 @@
 | 
			
		||||
    <!-- Frequency that rootcheck is executed - every 12 hours -->
 | 
			
		||||
    <frequency>43200</frequency>
 | 
			
		||||
 | 
			
		||||
    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
 | 
			
		||||
    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
 | 
			
		||||
 | 
			
		||||
    <skip_nfs>yes</skip_nfs>
 | 
			
		||||
 | 
			
		||||
    <ignore>/var/lib/containerd</ignore>
 | 
			
		||||
    <ignore>/var/lib/docker/overlay2</ignore>
 | 
			
		||||
  </rootcheck>
 | 
			
		||||
 | 
			
		||||
  <wodle name="cis-cat">
 | 
			
		||||
    <disabled>yes</disabled>
 | 
			
		||||
    <timeout>1800</timeout>
 | 
			
		||||
    <interval>1d</interval>
 | 
			
		||||
    <scan-on-start>yes</scan-on-start>
 | 
			
		||||
 | 
			
		||||
    <java_path>wodles/java</java_path>
 | 
			
		||||
    <ciscat_path>wodles/ciscat</ciscat_path>
 | 
			
		||||
  </wodle>
 | 
			
		||||
 | 
			
		||||
  <!-- Osquery integration -->
 | 
			
		||||
  <wodle name="osquery">
 | 
			
		||||
    <disabled>yes</disabled>
 | 
			
		||||
    <run_daemon>yes</run_daemon>
 | 
			
		||||
    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
 | 
			
		||||
    <config_path>/etc/osquery/osquery.conf</config_path>
 | 
			
		||||
    <add_labels>yes</add_labels>
 | 
			
		||||
  </wodle>
 | 
			
		||||
 | 
			
		||||
  <!-- System inventory -->
 | 
			
		||||
  <wodle name="syscollector">
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
@@ -81,9 +46,15 @@
 | 
			
		||||
    <packages>yes</packages>
 | 
			
		||||
    <ports all="yes">yes</ports>
 | 
			
		||||
    <processes>yes</processes>
 | 
			
		||||
    <users>yes</users>
 | 
			
		||||
    <groups>yes</groups>
 | 
			
		||||
    <services>yes</services>
 | 
			
		||||
    <browser_extensions>yes</browser_extensions>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </wodle>
 | 
			
		||||
@@ -92,7 +63,13 @@
 | 
			
		||||
    <enabled>yes</enabled>
 | 
			
		||||
    <scan_on_start>yes</scan_on_start>
 | 
			
		||||
    <interval>12h</interval>
 | 
			
		||||
    <skip_nfs>yes</skip_nfs>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </sca>
 | 
			
		||||
 | 
			
		||||
  <vulnerability-detection>
 | 
			
		||||
@@ -122,8 +99,6 @@
 | 
			
		||||
    <!-- Frequency that syscheck is executed default every 12 hours -->
 | 
			
		||||
    <frequency>43200</frequency>
 | 
			
		||||
 | 
			
		||||
    <scan_on_start>yes</scan_on_start>
 | 
			
		||||
 | 
			
		||||
    <!-- Generate alert when new file detected -->
 | 
			
		||||
    <alert_new_files>yes</alert_new_files>
 | 
			
		||||
 | 
			
		||||
@@ -163,13 +138,12 @@
 | 
			
		||||
    <process_priority>10</process_priority>
 | 
			
		||||
 | 
			
		||||
    <!-- Maximum output throughput -->
 | 
			
		||||
    <max_eps>100</max_eps>
 | 
			
		||||
    <max_eps>50</max_eps>
 | 
			
		||||
 | 
			
		||||
    <!-- Database synchronization settings -->
 | 
			
		||||
    <synchronization>
 | 
			
		||||
      <enabled>yes</enabled>
 | 
			
		||||
      <interval>5m</interval>
 | 
			
		||||
      <max_interval>1h</max_interval>
 | 
			
		||||
      <max_eps>10</max_eps>
 | 
			
		||||
    </synchronization>
 | 
			
		||||
  </syscheck>
 | 
			
		||||
@@ -264,13 +238,6 @@
 | 
			
		||||
    <rule_dir>etc/rules</rule_dir>
 | 
			
		||||
  </ruleset>
 | 
			
		||||
 | 
			
		||||
  <rule_test>
 | 
			
		||||
    <enabled>yes</enabled>
 | 
			
		||||
    <threads>1</threads>
 | 
			
		||||
    <max_sessions>64</max_sessions>
 | 
			
		||||
    <session_timeout>15m</session_timeout>
 | 
			
		||||
  </rule_test>
 | 
			
		||||
 | 
			
		||||
  <!-- Configuration for wazuh-authd -->
 | 
			
		||||
  <auth>
 | 
			
		||||
    <disabled>no</disabled>
 | 
			
		||||
@@ -303,9 +270,19 @@
 | 
			
		||||
</ossec_config>
 | 
			
		||||
 | 
			
		||||
<ossec_config>
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>journald</log_format>
 | 
			
		||||
    <location>journald</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>audit</log_format>
 | 
			
		||||
    <location>/var/log/audit/audit.log</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
  <localfile>
 | 
			
		||||
    <log_format>syslog</log_format>
 | 
			
		||||
    <location>/var/ossec/logs/active-responses.log</location>
 | 
			
		||||
  </localfile>
 | 
			
		||||
 | 
			
		||||
</ossec_config>
 | 
			
		||||
</ossec_config>
 | 
			
		||||
@@ -2,7 +2,7 @@ server.host: 0.0.0.0
 | 
			
		||||
server.port: 5601
 | 
			
		||||
opensearch.hosts: https://wazuh.indexer:9200
 | 
			
		||||
opensearch.ssl.verificationMode: certificate
 | 
			
		||||
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
 | 
			
		||||
opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
 | 
			
		||||
opensearch_security.multitenancy.enabled: false
 | 
			
		||||
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
 | 
			
		||||
server.ssl.enabled: true
 | 
			
		||||
@@ -13,4 +13,4 @@ uiSettings.overrides.defaultRoute: /app/wz-home
 | 
			
		||||
# Session expiration settings
 | 
			
		||||
opensearch_security.cookie.ttl: 900000
 | 
			
		||||
opensearch_security.session.ttl: 900000
 | 
			
		||||
opensearch_security.session.keepalive: true
 | 
			
		||||
opensearch_security.session.keepalive: true
 | 
			
		||||
 
 | 
			
		||||
@@ -1,11 +1,11 @@
 | 
			
		||||
network.host: "0.0.0.0"
 | 
			
		||||
node.name: "wazuh.indexer"
 | 
			
		||||
cluster.name: "wazuh-cluster"
 | 
			
		||||
path.data: /var/lib/wazuh-indexer
 | 
			
		||||
path.logs: /var/log/wazuh-indexer
 | 
			
		||||
discovery.type: single-node
 | 
			
		||||
http.port: 9200-9299
 | 
			
		||||
transport.tcp.port: 9300-9399
 | 
			
		||||
compatibility.override_main_response_version: true
 | 
			
		||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
 | 
			
		||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
 | 
			
		||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
 | 
			
		||||
 
 | 
			
		||||
@@ -1,7 +1,7 @@
 | 
			
		||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 | 
			
		||||
services:
 | 
			
		||||
  wazuh.manager:
 | 
			
		||||
    image: wazuh/wazuh-manager:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-manager:5.0.0
 | 
			
		||||
    hostname: wazuh.manager
 | 
			
		||||
    restart: always
 | 
			
		||||
    ulimits:
 | 
			
		||||
@@ -32,9 +32,7 @@ services:
 | 
			
		||||
      - wazuh_logs:/var/ossec/logs
 | 
			
		||||
      - wazuh_queue:/var/ossec/queue
 | 
			
		||||
      - wazuh_var_multigroups:/var/ossec/var/multigroups
 | 
			
		||||
      - wazuh_integrations:/var/ossec/integrations
 | 
			
		||||
      - wazuh_active_response:/var/ossec/active-response/bin
 | 
			
		||||
      - wazuh_agentless:/var/ossec/agentless
 | 
			
		||||
      - wazuh_wodles:/var/ossec/wodles
 | 
			
		||||
      - filebeat_etc:/etc/filebeat
 | 
			
		||||
      - filebeat_var:/var/lib/filebeat
 | 
			
		||||
@@ -44,7 +42,7 @@ services:
 | 
			
		||||
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
 | 
			
		||||
 | 
			
		||||
  wazuh.indexer:
 | 
			
		||||
    image: wazuh/wazuh-indexer:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-indexer:5.0.0
 | 
			
		||||
    hostname: wazuh.indexer
 | 
			
		||||
    restart: always
 | 
			
		||||
    ports:
 | 
			
		||||
@@ -60,16 +58,16 @@ services:
 | 
			
		||||
        hard: 65536
 | 
			
		||||
    volumes:
 | 
			
		||||
      - wazuh-indexer-data:/var/lib/wazuh-indexer
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
 | 
			
		||||
      - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
 | 
			
		||||
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 | 
			
		||||
      - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
 | 
			
		||||
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
 | 
			
		||||
 | 
			
		||||
  wazuh.dashboard:
 | 
			
		||||
    image: wazuh/wazuh-dashboard:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-dashboard:5.0.0
 | 
			
		||||
    hostname: wazuh.dashboard
 | 
			
		||||
    restart: always
 | 
			
		||||
    ports:
 | 
			
		||||
@@ -102,9 +100,7 @@ volumes:
 | 
			
		||||
  wazuh_logs:
 | 
			
		||||
  wazuh_queue:
 | 
			
		||||
  wazuh_var_multigroups:
 | 
			
		||||
  wazuh_integrations:
 | 
			
		||||
  wazuh_active_response:
 | 
			
		||||
  wazuh_agentless:
 | 
			
		||||
  wazuh_wodles:
 | 
			
		||||
  filebeat_etc:
 | 
			
		||||
  filebeat_var:
 | 
			
		||||
 
 | 
			
		||||
@@ -1,8 +1,10 @@
 | 
			
		||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 | 
			
		||||
services:
 | 
			
		||||
  generator:
 | 
			
		||||
    image: wazuh/wazuh-certs-generator:0.0.2
 | 
			
		||||
    image: wazuh/wazuh-certs-generator:0.0.3
 | 
			
		||||
    hostname: wazuh-certs-generator
 | 
			
		||||
    environment:
 | 
			
		||||
      - CERT_TOOL_VERSION=4.14
 | 
			
		||||
    volumes:
 | 
			
		||||
      - ./config/wazuh_indexer_ssl_certs/:/certificates/
 | 
			
		||||
      - ./config/certs.yml:/config/certs.yml
 | 
			
		||||
 
 | 
			
		||||
@@ -1,7 +1,7 @@
 | 
			
		||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 | 
			
		||||
services:
 | 
			
		||||
  wazuh.agent:
 | 
			
		||||
    image: wazuh/wazuh-agent:4.13.0
 | 
			
		||||
    image: wazuh/wazuh-agent:5.0.0
 | 
			
		||||
    restart: always
 | 
			
		||||
    environment:
 | 
			
		||||
      - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user