Skip to content

Commit cab8427

Browse files
AlexRuiz7AlexRuiz7
committed
Init wazuh-indexer (#3)
* Update CODEOWNERS * Update README.md and SECURITY.md * Add Wazuh configuration files * Update README.md Signed-off-by: Álex Ruiz <[email protected]>
1 parent 4dcad6d commit cab8427

File tree

8 files changed

+456
-14
lines changed

8 files changed

+456
-14
lines changed

‎.github/CODEOWNERS

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
* @reta @anasalkouz @andrross @Bukhtawar @CEHENKLE @dblock @gbbafna @setiah @kartg @kotwanikunal @mch2 @nknize @owaiskazi19 @peternied @Rishikesh1159 @ryanbogan @saratvemulapalli @shwetathareja @dreamer-89 @tlfeng @VachaShah @dbwiddis @sachinpkale @sohami @msfroh
1+
* @AlexRuiz7 @gdiazlo

‎README.md

+27-12
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
1-
<img src="https://opensearch.org/assets/img/opensearch-logo-themed.svg" height="64px">
1+
<p align="center">
2+
<img width="640px" src="https://wazuh.com/brand-assets/Wazuh-Logo.svg"/>
3+
</p>
24

3-
[![Chat](https://img.shields.io/badge/chat-on%20forums-blue)](https://forum.opensearch.org/c/opensearch/)
4-
[![Documentation](https://img.shields.io/badge/documentation-reference-blue)](https://opensearch.org/docs/latest/opensearch/index/)
5+
[![Chat](https://img.shields.io/badge/chat-on%20forums-blue)](https://groups.google.com/forum/#!forum/wazuh)
6+
[![Slack](https://img.shields.io/badge/slack-join-blue.svg)](https://wazuh.com/community/join-us-on-slack)
7+
[![Documentation](https://img.shields.io/badge/documentation-reference-blue)](https://documentation.wazuh.com)
58
[![codecov](https://codecov.io/gh/opensearch-project/OpenSearch/branch/2.x/graph/badge.svg)](https://codecov.io/gh/opensearch-project/OpenSearch)
69
[![GHA gradle check](https://github.com/opensearch-project/OpenSearch/actions/workflows/gradle-check.yml/badge.svg)](https://github.com/opensearch-project/OpenSearch/actions/workflows/gradle-check.yml)
710
[![GHA validate pull request](https://github.com/opensearch-project/OpenSearch/actions/workflows/wrapper.yml/badge.svg)](https://github.com/opensearch-project/OpenSearch/actions/workflows/wrapper.yml)
@@ -19,16 +22,17 @@
1922

2023
## Welcome!
2124

22-
**OpenSearch** is [a community-driven, open source fork](https://aws.amazon.com/blogs/opensource/introducing-opensearch/) of [Elasticsearch](https://en.wikipedia.org/wiki/Elasticsearch) and [Kibana](https://en.wikipedia.org/wiki/Kibana) following the [license change](https://blog.opensource.org/the-sspl-is-not-an-open-source-license/) in early 2021. We're looking to sustain (and evolve!) a search and analytics suite for the multitude of businesses who are dependent on the rights granted by the original, [Apache v2.0 License](LICENSE.txt).
25+
The Wazuh indexer is a highly scalable, full-text search and analytics engine. This Wazuh central component indexes and stores alerts generated by the Wazuh server and provides near real-time data search and analytics capabilities.
26+
27+
Wazuh indexer is a open source fork of [OpenSearch](https://github.com/opensearch-project/opensearch).
2328

2429
## Project Resources
2530

26-
* [Project Website](https://opensearch.org/)
27-
* [Downloads](https://opensearch.org/downloads.html)
28-
* [Documentation](https://opensearch.org/docs/)
29-
* Need help? Try [Forums](https://discuss.opendistrocommunity.dev/)
30-
* [Project Principles](https://opensearch.org/#principles)
31-
* [Contributing to OpenSearch](CONTRIBUTING.md)
31+
* [Project Website](https://wazuh.com)
32+
* [Quickstart](https://documentation.wazuh.com/current/quickstart.html)
33+
* [Documentation](https://documentation.wazuh.com)
34+
* Need help? Try [Slack](https://wazuh.com/community/join-us-on-slack)
35+
* [Contributing to Wazuh indexer](CONTRIBUTING.md)
3236
* [Maintainer Responsibilities](MAINTAINERS.md)
3337
* [Release Management](RELEASING.md)
3438
* [Admin Responsibilities](ADMINS.md)
@@ -40,18 +44,29 @@
4044
This project has adopted the [Amazon Open Source Code of Conduct](CODE_OF_CONDUCT.md). For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq), or contact [[email protected]](mailto:[email protected]) with any additional questions or comments.
4145

4246
## Security
43-
If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [email protected]. Please do **not** create a public GitHub issue.
47+
48+
To report a possible vulnerability or security issue you can:
49+
- Send us an email to [email protected].
50+
- Open a new security report under the security tab on this repository.
51+
52+
**PLEASE DO NOT OPEN A PUBLIC ISSUE ABOUT SECURITY**
53+
54+
We want to protect our community, so please give us time to fix a vulnerability
55+
before publishing it.
4456

4557
## License
4658

4759
This project is licensed under the [Apache v2.0 License](LICENSE.txt).
4860

4961
## Copyright
5062

51-
Copyright OpenSearch Contributors. See [NOTICE](NOTICE.txt) for details.
63+
- Copyright OpenSearch Contributors. See [NOTICE](NOTICE.txt) for details.
64+
- Copyright Wazuh, Inc.
5265

5366
## Trademark
5467

5568
OpenSearch is a registered trademark of Amazon Web Services.
5669

5770
OpenSearch includes certain Apache-licensed Elasticsearch code from Elasticsearch B.V. and other source code. Elasticsearch B.V. is not the source of that other source code. ELASTICSEARCH is a registered trademark of Elasticsearch B.V.
71+
72+
Check Wazuh's [trademark and Brand policy](https://wazuh.com/trademark-and-brand-policy/).

‎SECURITY.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
11
## Reporting a Vulnerability
22

3-
If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [email protected]. Please do **not** create a public GitHub issue.
3+
To report a possible vulnerability or security issue you can:
4+
- Send us an email to [email protected].
5+
- Open a new security report under the security tab on this repository.
6+
7+
**PLEASE DO NOT OPEN A PUBLIC ISSUE ABOUT SECURITY**
8+
9+
We want to protect our community, so please give us time to fix a vulnerability
10+
before publishing it.

‎distribution/src/config/jvm.prod.options

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
## JVM configuration
2+
3+
################################################################
4+
## IMPORTANT: JVM heap size
5+
################################################################
6+
##
7+
## You should always set the min and max JVM heap
8+
## size to the same value. For example, to set
9+
## the heap to 4 GB, set:
10+
##
11+
## -Xms4g
12+
## -Xmx4g
13+
##
14+
## See https://opensearch.org/docs/opensearch/install/important-settings/
15+
## for more information
16+
##
17+
################################################################
18+
19+
# Xms represents the initial size of total heap space
20+
# Xmx represents the maximum size of total heap space
21+
22+
-Xms1g
23+
-Xmx1g
24+
25+
################################################################
26+
## Expert settings
27+
################################################################
28+
##
29+
## All settings below this section are considered
30+
## expert settings. Don't tamper with them unless
31+
## you understand what you are doing
32+
##
33+
################################################################
34+
35+
## GC configuration
36+
8-10:-XX:+UseConcMarkSweepGC
37+
8-10:-XX:CMSInitiatingOccupancyFraction=75
38+
8-10:-XX:+UseCMSInitiatingOccupancyOnly
39+
40+
## G1GC Configuration
41+
# NOTE: G1 GC is only supported on JDK version 10 or later
42+
# to use G1GC, uncomment the next two lines and update the version on the
43+
# following three lines to your version of the JDK
44+
# 10:-XX:-UseConcMarkSweepGC
45+
# 10:-XX:-UseCMSInitiatingOccupancyOnly
46+
11-:-XX:+UseG1GC
47+
11-:-XX:G1ReservePercent=25
48+
11-:-XX:InitiatingHeapOccupancyPercent=30
49+
50+
## JVM temporary directory
51+
-Djava.io.tmpdir=${OPENSEARCH_TMPDIR}
52+
53+
## heap dumps
54+
55+
# generate a heap dump when an allocation from the Java heap fails
56+
# heap dumps are created in the working directory of the JVM
57+
-XX:+HeapDumpOnOutOfMemoryError
58+
59+
# specify an alternative path for heap dumps; ensure the directory exists and
60+
# has sufficient space
61+
-XX:HeapDumpPath=/var/lib/wazuh-indexer
62+
63+
# specify an alternative path for JVM fatal error logs
64+
-XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log
65+
66+
## JDK 8 GC logging
67+
8:-XX:+PrintGCDetails
68+
8:-XX:+PrintGCDateStamps
69+
8:-XX:+PrintTenuringDistribution
70+
8:-XX:+PrintGCApplicationStoppedTime
71+
8:-Xloggc:/var/log/wazuh-indexer/gc.log
72+
8:-XX:+UseGCLogFileRotation
73+
8:-XX:NumberOfGCLogFiles=32
74+
8:-XX:GCLogFileSize=64m
75+
76+
# JDK 9+ GC logging
77+
9-:-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m
78+
79+
# Explicitly allow security manager (https://bugs.openjdk.java.net/browse/JDK-8270380)
80+
18-:-Djava.security.manager=allow
81+
82+
## OpenSearch Performance Analyzer
83+
-Dclk.tck=100
84+
-Djdk.attach.allowAttachSelf=true
85+
-Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy
86+
--add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED

‎distribution/src/config/opensearch.prod.yml

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
network.host: "0.0.0.0"
2+
node.name: "node-1"
3+
cluster.initial_master_nodes:
4+
- "node-1"
5+
#- "node-2"
6+
#- "node-3"
7+
cluster.name: "wazuh-cluster"
8+
#discovery.seed_hosts:
9+
# - "node-1-ip"
10+
# - "node-2-ip"
11+
# - "node-3-ip"
12+
node.max_local_storage_nodes: "3"
13+
path.data: /var/lib/wazuh-indexer
14+
path.logs: /var/log/wazuh-indexer
15+
16+
plugins.security.ssl.http.pemcert_filepath: /etc/wazuh-indexer/certs/indexer.pem
17+
plugins.security.ssl.http.pemkey_filepath: /etc/wazuh-indexer/certs/indexer-key.pem
18+
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
19+
plugins.security.ssl.transport.pemcert_filepath: /etc/wazuh-indexer/certs/indexer.pem
20+
plugins.security.ssl.transport.pemkey_filepath: /etc/wazuh-indexer/certs/indexer-key.pem
21+
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
22+
plugins.security.ssl.http.enabled: true
23+
plugins.security.ssl.transport.enforce_hostname_verification: false
24+
plugins.security.ssl.transport.resolve_hostname: false
25+
26+
plugins.security.authcz.admin_dn:
27+
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
28+
plugins.security.check_snapshot_restore_write_privileges: true
29+
plugins.security.enable_snapshot_restore_privilege: true
30+
plugins.security.nodes_dn:
31+
- "CN=node-1,OU=Wazuh,O=Wazuh,L=California,C=US"
32+
#- "CN=node-2,OU=Wazuh,O=Wazuh,L=California,C=US"
33+
#- "CN=node-3,OU=Wazuh,O=Wazuh,L=California,C=US"
34+
plugins.security.restapi.roles_enabled:
35+
- "all_access"
36+
- "security_rest_api_access"
37+
38+
plugins.security.system_indices.enabled: true
39+
plugins.security.system_indices.indices: [".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
40+
41+
### Option to allow Filebeat-oss 7.10.2 to work ###
42+
compatibility.override_main_response_version: true

‎distribution/src/config/security/internal_users.yml

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
# This is the internal user database
3+
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
4+
5+
_meta:
6+
type: "internalusers"
7+
config_version: 2
8+
9+
# Define your internal users here
10+
11+
## Demo users
12+
13+
admin:
14+
hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
15+
reserved: true
16+
backend_roles:
17+
- "admin"
18+
description: "Demo admin user"
19+
20+
kibanaserver:
21+
hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
22+
reserved: true
23+
description: "Demo kibanaserver user"
24+
25+
kibanaro:
26+
hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
27+
reserved: false
28+
backend_roles:
29+
- "kibanauser"
30+
- "readall"
31+
attributes:
32+
attribute1: "value1"
33+
attribute2: "value2"
34+
attribute3: "value3"
35+
description: "Demo kibanaro user"
36+
37+
logstash:
38+
hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
39+
reserved: false
40+
backend_roles:
41+
- "logstash"
42+
description: "Demo logstash user"
43+
44+
readall:
45+
hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
46+
reserved: false
47+
backend_roles:
48+
- "readall"
49+
description: "Demo readall user"
50+
51+
snapshotrestore:
52+
hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
53+
reserved: false
54+
backend_roles:
55+
- "snapshotrestore"
56+
description: "Demo snapshotrestore user"

0 commit comments

Comments
 (0)