version default, no changes added

.gitignore

@@ -0,0 +1,12 @@
+wazuh/certs/dashboard_http/*.pem
+wazuh/certs/dashboard_http/*.key
+wazuh/certs/indexer_cluster/*.pem
+wazuh/certs/indexer_cluster/*.key
+wazuh/certs/indexer_cluster/*.csr
+wazuh/certs/indexer_cluster/*.srl
+wazuh-eks/certs/dashboard_http/*.pem
+wazuh-eks/certs/dashboard_http/*.key
+wazuh-eks/certs/indexer_cluster/*.pem
+wazuh-eks/certs/indexer_cluster/*.key
+wazuh-eks/certs/indexer_cluster/*.csr
+wazuh-eks/certs/indexer_cluster/*.srl

postfix/postfix-config-map.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postfix-config-map
+  namespace: wazuh
+data:
+  main.cf: |
+    relayhost = [smtp.gmail.com]:587
+    smtp_sasl_auth_enable = yes
+    smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
+    smtp_sasl_security_options = noanonymous
+    smtp_tls_CAfile = /etc/ssl/certs/thawte_Primary_Root_CA.pem
+    smtp_use_tls = yes
+    compatibility_level = 2
+    inet_protocols = ipv4
+    inet_interfaces = all
+    mynetworks = 127.0.0.0/8 10.0.0.0/16
+    smtp_tls_session_cache_timeout = 3600s
+  init.sh: |
+    #!/bin/sh
+    # Configuración de DNS y hosts
+    echo "nameserver 8.8.8.8" >> /etc/resolv.conf
+    echo "142.251.16.109 smtp.gmail.com" >> /etc/hosts
+    cp /etc/resolv.conf /var/spool/postfix/etc/resolv.conf
+
+    # Configuración de permisos para sasl_passwd
+    postmap /etc/postfix/sasl_passwd
+    chmod 400 /etc/postfix/sasl_passwd
+    chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
+    chmod 0600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
+
+    # Iniciar Postfix en modo foreground
+    exec /usr/sbin/postfix start-fg

postfix/postfix-deployment.yaml

@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postfix
+  namespace: wazuh
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postfix
+  template:
+    metadata:
+      labels:
+        app: postfix
+    spec:
+      containers:
+      - name: postfix
+        image: mwader/postfix-relay
+        securityContext:
+          readOnlyRootFilesystem: false
+        ports:
+        - containerPort: 25
+        volumeMounts:
+        - name: postfix-config
+          mountPath: /etc/postfix/main.cf
+          subPath: main.cf
+        - name: postfix-sasl
+          mountPath: /etc/postfix/sasl_passwd
+          subPath: sasl_passwd
+          readOnly: false
+#        - name: postfix-sasl-db
+#          mountPath: /etc/postfix/sasl_passwd.db
+#          subPath: sasl_passwd.db
+        - name: init-script
+          mountPath: /docker-entrypoint.sh
+          subPath: init.sh
+        command: ["/bin/sh", "/docker-entrypoint.sh"]
+      volumes:
+      - name: postfix-config
+        configMap:
+          name: postfix-config-map
+      - name: postfix-sasl
+        secret:
+          secretName: postfix-sasl
+          defaultMode: 420  # Permisos adecuados para lectura/escritura
+      - name: postfix-sasl-db
+        emptyDir: {}
+      - name: init-script
+        configMap:
+          name: postfix-config-map

postfix/postfix-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postfix
+  namespace: wazuh
+spec:
+  selector:
+    app: postfix
+  ports:
+    - protocol: TCP
+      port: 25
+      targetPort: 25

postfix/sasl_passwd

@@ -0,0 +1 @@
+[smtp.gmail.com]:587 [email protected]:owjn sywf kyrm twrf

sentinelone_decoders.xml

@@ -0,0 +1,124 @@
+<decoder name="sentinelone">
+    <prematch>sentinel -  CEF:\d\|SentinelOne\|</prematch>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>\|SentinelOne\|\w+\|\S+\|\d+\|(\.*) -</regex>
+    <order>log_message1</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>\|SentinelOne\|\w+\|\S+\|\d+\|(\.*)\|\d+</regex>
+    <order>log_message2</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>\|SentinelOne\|\w+\|\S+\|\d+\|\.* machine (\.*)\|\d+</regex>
+    <order>endpoint</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>osName=(\w*\s*\w*\s*\w*\s*)</regex>
+    <order>operating_system</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>fileHash=(\S+)\s</regex>
+    <order>file_hash</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>filePath=(\S+)\s</regex>
+    <order>file_path</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>activityID=(\S+)</regex>
+    <order>activity_id</order>
+</decoder>
+
+<decoder name="sentinelone">
+  <parent>sentinelone</parent>
+  <regex>suser=(\S+)</regex>
+  <order>suser</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>siteId=(\d+)</regex>
+    <order>site_id</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>siteName=(\S+)</regex>
+    <order>site_name</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>accountId=(\d+)</regex>
+    <order>account_id</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>accountName=(\w*\s\w*\s)</regex>
+    <order>account_name</order>
+</decoder>
+
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>groupId=(\d+)</regex>
+    <order>group_id</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>groupName=(\S+\s\S+)</regex>
+    <order>group_name</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>agentId=(\d+)</regex>
+    <order>agent_id</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>userId=(\d+)</regex>
+    <order>user_id</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>threadId=(\d+)</regex>
+    <order>thread_id</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>ip_address=(\d+\.\d+\.\d+\.\d+)</regex>
+    <order>ip_address</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>confidence_level=(\w+)</regex>
+    <order>confidence_level</order>
+</decoder>
+
+<decoder name="sentinelone">
+    <parent>sentinelone</parent>
+    <regex>storyline=(\S+)</regex>
+    <order>storyline</order>
+</decoder>