diff --git a/integrations/docker/.env b/integrations/docker/.env index 6466f2c305e32..a4c5f05ea7638 100644 --- a/integrations/docker/.env +++ b/integrations/docker/.env @@ -19,11 +19,8 @@ KIBANA_PORT=5602 # Increase or decrease based on the available host memory (in bytes) MEM_LIMIT=1073741824 -# Wazuh version -WAZUH_VERSION=4.9.2 - -# Wazuh Indexer version (Provisionally using OpenSearch) -WAZUH_INDEXER_VERSION=2.18.0 +# Wazuh Indexer version +WAZUH_INDEXER_VERSION=5.0.0-0 # Wazuh Dashboard version (Provisionally using OpenSearch Dashboards) WAZUH_DASHBOARD_VERSION=2.18.0 diff --git a/integrations/docker/amazon-security-lake.yml b/integrations/docker/amazon-security-lake.yml deleted file mode 100644 index c02b51dab8c58..0000000000000 --- a/integrations/docker/amazon-security-lake.yml +++ /dev/null @@ -1,143 +0,0 @@ -version: "3.8" -name: "amazon-security-lake" - -services: - events-generator: - image: wazuh/indexer-events-generator - build: - context: ../tools/events-generator - container_name: events-generator - depends_on: - wazuh.indexer: - condition: service_healthy - command: bash -c "python run.py -a wazuh.indexer" - - wazuh.indexer: - image: opensearchproject/opensearch:2.12.0 - container_name: wazuh.indexer - depends_on: - wazuh-certs-generator: - condition: service_completed_successfully - hostname: wazuh.indexer - ports: - - 9200:9200 - environment: - # - cluster.name=opensearch-cluster - - node.name=wazuh.indexer - - discovery.type=single-node - # - cluster.initial_cluster_manager_nodes=opensearch-node - - bootstrap.memory_lock=true - - "DISABLE_INSTALL_DEMO_CONFIG=true" - - plugins.security.ssl.http.enabled=true - - plugins.security.allow_default_init_securityindex=true - - plugins.security.ssl.http.pemcert_filepath=/usr/share/opensearch/config/wazuh.indexer.pem - - plugins.security.ssl.transport.pemcert_filepath=/usr/share/opensearch/config/wazuh.indexer.pem - - plugins.security.ssl.http.pemkey_filepath=/usr/share/opensearch/config/wazuh.indexer-key.pem - - plugins.security.ssl.transport.pemkey_filepath=/usr/share/opensearch/config/wazuh.indexer-key.pem - - plugins.security.ssl.http.pemtrustedcas_filepath=/usr/share/opensearch/config/root-ca.pem - - plugins.security.ssl.transport.pemtrustedcas_filepath=/usr/share/opensearch/config/root-ca.pem - - plugins.security.authcz.admin_dn="CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California, C=US" - - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - healthcheck: - test: curl -sku admin:admin https://localhost:9200/_cat/health | grep -q docker-cluster - start_period: 10s - start_interval: 3s - volumes: - - data:/usr/share/opensearch/data - - ./certs/wazuh.indexer.pem:/usr/share/opensearch/config/wazuh.indexer.pem - - ./certs/wazuh.indexer-key.pem:/usr/share/opensearch/config/wazuh.indexer-key.pem - - ./certs/root-ca.pem:/usr/share/opensearch/config/root-ca.pem - - wazuh.dashboard: - image: opensearchproject/opensearch-dashboards:2.12.0 - container_name: wazuh.dashboard - depends_on: - - wazuh.indexer - hostname: wazuh.dashboard - ports: - - 5601:5601 # Map host port 5601 to container port 5601 - expose: - - "5601" # Expose port 5601 for web access to OpenSearch Dashboards - environment: - OPENSEARCH_HOSTS: '["https://wazuh.indexer:9200"]' # Define the OpenSearch nodes that OpenSearch Dashboards will query - - wazuh.integration.security.lake: - image: wazuh/indexer-security-lake-integration - build: - context: ../amazon-security-lake - container_name: wazuh.integration.security.lake - depends_on: - - wazuh.indexer - hostname: wazuh.integration.security.lake - environment: - LOG_LEVEL: trace - LOGSTASH_KEYSTORE_PASS: "SecretPassword" - MONITORING_ENABLED: false - AWS_ACCESS_KEY_ID: "AKIAIOSFODNN7EXAMPLE" - AWS_SECRET_ACCESS_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" - AWS_REGION: "us-east-1" - S3_BUCKET_RAW: "wazuh-aws-security-lake-raw" - AWS_ENDPOINT: "http://s3.ninja:9000" - ports: - - "5000:5000/tcp" - - "5000:5000/udp" - - "5044:5044" - - "9600:9600" - volumes: - - ../amazon-security-lake/logstash/pipeline:/usr/share/logstash/pipeline # TODO has 1000:1000. logstash's uid is 999 - - ./certs/root-ca.pem:/usr/share/logstash/root-ca.pem - - ../amazon-security-lake/src:/usr/share/logstash/amazon-security-lake # TODO use dedicated folder - # - ./credentials:/usr/share/logstash/.aws/credentials # TODO credentials are not commited (missing) - command: tail -f /var/log/logstash/logstash-plain.log - - s3.ninja: - image: scireum/s3-ninja:latest - container_name: s3.ninja - hostname: s3.ninja - ports: - - "9444:9000" - volumes: - - s3-data:/home/sirius/data - - aws.lambda: - image: wazuh/indexer-security-lake-integration:lambda - build: - context: ../amazon-security-lake - dockerfile: ../amazon-security-lake/aws-lambda.dockerfile - container_name: wazuh.integration.security.lake.aws.lambda - hostname: wazuh.integration.security.lake.aws.lambda - environment: - AWS_ACCESS_KEY_ID: "AKIAIOSFODNN7EXAMPLE" - AWS_SECRET_ACCESS_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" - AWS_REGION: "us-east-1" - AWS_BUCKET: "wazuh-aws-security-lake-parquet" - S3_BUCKET_OCSF: "wazuh-aws-security-lake-ocsf" - AWS_ENDPOINT: "http://s3.ninja:9000" - SOURCE_LOCATION: "wazuh" - ACCOUNT_ID: "111111111111" - IS_DEV: true - OCSF_CLASS: SECURITY_FINDING - volumes: - - ../amazon-security-lake/src:/var/task - ports: - - "9000:8080" - - wazuh-certs-generator: - image: wazuh/wazuh-certs-generator:0.0.1 - hostname: wazuh-certs-generator - container_name: wazuh-certs-generator - entrypoint: sh -c "/entrypoint.sh; chown -R 1000:999 /certificates; chmod 740 /certificates; chmod 440 /certificates/*" - volumes: - - ./certs/:/certificates/ - - ./config/certs.yml:/config/certs.yml - -volumes: - data: - s3-data: diff --git a/integrations/docker/compose.indexer-opensearch.yml b/integrations/docker/compose.indexer-opensearch.yml index 8fc2c4364117c..56d8f1730fd07 100644 --- a/integrations/docker/compose.indexer-opensearch.yml +++ b/integrations/docker/compose.indexer-opensearch.yml @@ -11,7 +11,7 @@ services: command: bash -c "python run.py -a wazuh.indexer" wazuh.indexer: - image: opensearchproject/opensearch:${WAZUH_INDEXER_VERSION} + image: quay.io/wazuh/wazuh-indexer:${WAZUH_INDEXER_VERSION} depends_on: wazuh-certs-generator: condition: service_completed_successfully @@ -19,20 +19,7 @@ services: ports: - 9200:9200 environment: - - WAZUH_INDEXER_VERSION=${WAZUH_INDEXER_VERSION} - - node.name=wazuh.indexer - - discovery.type=single-node - - bootstrap.memory_lock=true - "DISABLE_INSTALL_DEMO_CONFIG=true" - - plugins.security.ssl.http.enabled=true - - plugins.security.allow_default_init_securityindex=true - - plugins.security.ssl.http.pemcert_filepath=/usr/share/opensearch/config/wazuh.indexer.pem - - plugins.security.ssl.transport.pemcert_filepath=/usr/share/opensearch/config/wazuh.indexer.pem - - plugins.security.ssl.http.pemkey_filepath=/usr/share/opensearch/config/wazuh.indexer-key.pem - - plugins.security.ssl.transport.pemkey_filepath=/usr/share/opensearch/config/wazuh.indexer-key.pem - - plugins.security.ssl.http.pemtrustedcas_filepath=/usr/share/opensearch/config/root-ca.pem - - plugins.security.ssl.transport.pemtrustedcas_filepath=/usr/share/opensearch/config/root-ca.pem - - plugins.security.authcz.admin_dn="CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California, C=US" - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" ulimits: memlock: @@ -46,10 +33,11 @@ services: start_period: 10s start_interval: 3s volumes: - - data:/usr/share/opensearch/data - - ./certs/wazuh.indexer.pem:/usr/share/opensearch/config/wazuh.indexer.pem - - ./certs/wazuh.indexer-key.pem:/usr/share/opensearch/config/wazuh.indexer-key.pem - - ./certs/root-ca.pem:/usr/share/opensearch/config/root-ca.pem + - ./config/opensearch.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - data:/usr/share/wazuh-indexer/data + - ./certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem + - ./certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer-key.pem + - ./certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem wazuh.dashboard: image: opensearchproject/opensearch-dashboards:${WAZUH_DASHBOARD_VERSION} diff --git a/integrations/docker/config/certs.yml b/integrations/docker/config/certs.yml index 7a4ef691e5e10..23d2338c2e409 100644 --- a/integrations/docker/config/certs.yml +++ b/integrations/docker/config/certs.yml @@ -1,20 +1,16 @@ + nodes: - # Wazuh indexer and OpenSearch server nodes indexer: - name: wazuh.indexer - ip: wazuh.indexer + ip: "wazuh.indexer" - name: opensearch.node - ip: opensearch.node - - # Wazuh server nodes - # Use node_type only with more than one Wazuh manager + ip: "opensearch.node" server: - name: wazuh.manager - ip: wazuh.manager - - # Wazuh dashboard and OpenSearch Dashboards nodes + ip: "wazuh.manager" dashboard: - name: wazuh.dashboard - ip: wazuh.dashboard + ip: "wazuh.dashboard" - name: opensearch.dashboards - ip: opensearch.dashboards + ip: "opensearch.dashboards" + diff --git a/integrations/docker/config/opensearch.yml b/integrations/docker/config/opensearch.yml new file mode 100644 index 0000000000000..399ee515b79a2 --- /dev/null +++ b/integrations/docker/config/opensearch.yml @@ -0,0 +1,30 @@ +network.host: "0.0.0.0" +node.name: "wazuh.indexer" +discovery.type: "single-node" +bootstrap.memory_lock: true +path.data: /var/lib/wazuh-indexer +path.logs: /var/log/wazuh-indexer + +plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer-key.pem +plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer-key.pem +plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem +plugins.security.ssl.http.enabled: true +plugins.security.allow_default_init_securityindex: true +plugins.security.ssl.transport.enforce_hostname_verification: false +plugins.security.ssl.transport.resolve_hostname: false + +plugins.security.authcz.admin_dn: +- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California, C=US" +plugins.security.check_snapshot_restore_write_privileges: true +plugins.security.enable_snapshot_restore_privilege: true +plugins.security.nodes_dn: +- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.restapi.roles_enabled: +- "all_access" +- "security_rest_api_access" + +plugins.security.system_indices.enabled: true +plugins.security.system_indices.indices: [".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]