Skip to content

Commit d596683

Browse files
AlexRuiz7AlexRuiz7
committed
Add Manager to OpenSearch integration (#267)
* Add Manager to OpenSearch integreation Also fixes small issues on other integrations * Add changes to README
1 parent d11232f commit d596683

File tree

7 files changed

+220
-17
lines changed

7 files changed

+220
-17
lines changed

‎integrations/docker/elastic.yml

-4
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,13 @@ services:
55
image: wazuh/indexer-events-generator
66
build:
77
context: ../tools/events-generator
8-
container_name: events-generator
98
depends_on:
109
wazuh.indexer:
1110
condition: service_healthy
1211
command: bash -c "python run.py -a wazuh.indexer"
1312

1413
wazuh.indexer:
1514
image: opensearchproject/opensearch:2.12.0
16-
container_name: wazuh.indexer
1715
depends_on:
1816
wazuh-certs-generator:
1917
condition: service_completed_successfully
@@ -54,7 +52,6 @@ services:
5452

5553
wazuh.dashboard:
5654
image: opensearchproject/opensearch-dashboards:2.12.0
57-
container_name: wazuh.dashboard
5855
depends_on:
5956
- wazuh.indexer
6057
hostname: wazuh.dashboard
@@ -68,7 +65,6 @@ services:
6865
wazuh-certs-generator:
6966
image: wazuh/wazuh-certs-generator:0.0.1
7067
hostname: wazuh-certs-generator
71-
container_name: wazuh-certs-generator
7268
entrypoint: sh -c "/entrypoint.sh; chown -R 1000:999 /certificates; chmod 740 /certificates; chmod 440 /certificates/*"
7369
volumes:
7470
- ./certs/:/certificates/

‎integrations/docker/manager-elastic.yml

-2
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,6 @@ services:
4545
- ./certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
4646
- ./certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
4747
- ./certs/root-ca.pem:/usr/share/logstash/root-ca.pem
48-
- ../elastic/logstash/pipeline:/usr/share/logstash/pipeline
49-
- es_certs:/etc/certs/elastic
5048
- alerts:/var/ossec/logs/alerts/
5149

5250
wazuh.indexer:

‎integrations/docker/manager-opensearch.yml

+181
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
name: "manager-opensearch-integration"
2+
3+
services:
4+
events-generator:
5+
image: wazuh/indexer-events-generator
6+
build:
7+
context: ../tools/events-generator
8+
depends_on:
9+
wazuh.indexer:
10+
condition: service_healthy
11+
command: bash -c "python run.py -o filebeat"
12+
volumes:
13+
- alerts:/var/ossec/logs/alerts/
14+
15+
wazuh.manager:
16+
image: wazuh/wazuh-manager:${WAZUH_VERSION}
17+
hostname: wazuh.manager
18+
restart: always
19+
ulimits:
20+
memlock:
21+
soft: -1
22+
hard: -1
23+
nofile:
24+
soft: 655360
25+
hard: 655360
26+
ports:
27+
- "1514:1514"
28+
- "1515:1515"
29+
- "514:514/udp"
30+
- "55000:55000"
31+
environment:
32+
- INDEXER_URL=https://wazuh.indexer:9200
33+
- INDEXER_USERNAME=admin
34+
- INDEXER_PASSWORD=admin
35+
- FILEBEAT_SSL_VERIFICATION_MODE=full
36+
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
37+
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
38+
- SSL_KEY=/etc/ssl/filebeat.key
39+
- API_USERNAME=wazuh-wui
40+
- API_PASSWORD=MyS3cr37P450r.*-
41+
- LOG_LEVEL=info
42+
- MONITORING_ENABLED=false
43+
volumes:
44+
- ./certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
45+
- ./certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
46+
- ./certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
47+
- ./certs/root-ca.pem:/usr/share/logstash/root-ca.pem
48+
- alerts:/var/ossec/logs/alerts/
49+
50+
wazuh.indexer:
51+
image: opensearchproject/opensearch:2.12.0
52+
depends_on:
53+
wazuh-certs-generator:
54+
condition: service_completed_successfully
55+
hostname: wazuh.indexer
56+
ports:
57+
- 9200:9200
58+
environment:
59+
- node.name=wazuh.indexer
60+
- discovery.type=single-node
61+
- bootstrap.memory_lock=true
62+
- "DISABLE_INSTALL_DEMO_CONFIG=true"
63+
- plugins.security.ssl.http.enabled=true
64+
- plugins.security.allow_default_init_securityindex=true
65+
- plugins.security.ssl.http.pemcert_filepath=/usr/share/opensearch/config/wazuh.indexer.pem
66+
- plugins.security.ssl.transport.pemcert_filepath=/usr/share/opensearch/config/wazuh.indexer.pem
67+
- plugins.security.ssl.http.pemkey_filepath=/usr/share/opensearch/config/wazuh.indexer-key.pem
68+
- plugins.security.ssl.transport.pemkey_filepath=/usr/share/opensearch/config/wazuh.indexer-key.pem
69+
- plugins.security.ssl.http.pemtrustedcas_filepath=/usr/share/opensearch/config/root-ca.pem
70+
- plugins.security.ssl.transport.pemtrustedcas_filepath=/usr/share/opensearch/config/root-ca.pem
71+
- plugins.security.authcz.admin_dn="CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California, C=US"
72+
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
73+
- compatibility.override_main_response_version=true
74+
ulimits:
75+
memlock:
76+
soft: -1
77+
hard: -1
78+
nofile:
79+
soft: 65536
80+
hard: 65536
81+
healthcheck:
82+
test: curl -sku admin:admin https://localhost:9200/_cat/health | grep -q docker-cluster
83+
start_period: 10s
84+
start_interval: 3s
85+
volumes:
86+
- data:/usr/share/opensearch/data
87+
- ./certs/wazuh.indexer.pem:/usr/share/opensearch/config/wazuh.indexer.pem
88+
- ./certs/wazuh.indexer-key.pem:/usr/share/opensearch/config/wazuh.indexer-key.pem
89+
- ./certs/root-ca.pem:/usr/share/opensearch/config/root-ca.pem
90+
91+
wazuh-certs-generator:
92+
image: wazuh/wazuh-certs-generator:0.0.1
93+
hostname: wazuh-certs-generator
94+
entrypoint: sh -c "/entrypoint.sh; chown -R 1000:999 /certificates; chmod 740 /certificates; chmod 440 /certificates/*"
95+
volumes:
96+
- ./certs/:/certificates/
97+
- ./config/certs.yml:/config/certs.yml
98+
99+
logstash:
100+
depends_on:
101+
opensearch.node:
102+
condition: service_healthy
103+
wazuh-certs-generator:
104+
condition: service_completed_successfully
105+
image: logstash-oss:8.6.2
106+
build:
107+
dockerfile: ../elastic/Dockerfile
108+
context: ../opensearch
109+
environment:
110+
LOG_LEVEL: info
111+
MONITORING_ENABLED: false
112+
volumes:
113+
- ../opensearch/logstash/pipeline:/usr/share/logstash/pipeline
114+
- ./certs/root-ca.pem:/etc/ssl/root-ca.pem
115+
- alerts:/var/ossec/logs/alerts/
116+
command: logstash -f /usr/share/logstash/pipeline/manager-to-opensearch.conf
117+
118+
# ================================================
119+
# OpenSearch and OpenSearch Dashboards
120+
# ================================================
121+
122+
opensearch.node:
123+
image: opensearchproject/opensearch:${OS_VERSION}
124+
depends_on:
125+
wazuh-certs-generator:
126+
condition: service_completed_successfully
127+
environment:
128+
- cluster.name=opensearch-cluster
129+
- node.name=opensearch.node
130+
- discovery.type=single-node
131+
- bootstrap.memory_lock=true
132+
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
133+
- "DISABLE_INSTALL_DEMO_CONFIG=true"
134+
volumes:
135+
- ../opensearch/opensearch.yml:/usr/share/opensearch/config/opensearch.yml
136+
- ./certs/opensearch.node-key.pem:/usr/share/opensearch/config/certs/opensearch.key
137+
- ./certs/opensearch.node.pem:/usr/share/opensearch/config/certs/opensearch.pem
138+
- ./certs/root-ca.pem:/usr/share/opensearch/config/certs/root-ca.pem
139+
ulimits:
140+
memlock:
141+
soft: -1
142+
hard: -1
143+
nofile:
144+
soft: 65536
145+
hard: 65536
146+
ports:
147+
- 9201:9200
148+
- 9600:9600
149+
healthcheck:
150+
test:
151+
[
152+
"CMD-SHELL",
153+
"curl -sku admin:admin https://opensearch.node:9200 2>&1 | grep -q 'The OpenSearch Project: https://opensearch.org/'",
154+
]
155+
interval: 1s
156+
timeout: 5s
157+
retries: 120
158+
159+
opensearch-dashboards:
160+
image: opensearchproject/opensearch-dashboards:${OS_VERSION}
161+
depends_on:
162+
opensearch.node:
163+
condition: service_healthy
164+
ports:
165+
- 5602:5601
166+
expose:
167+
- "5602"
168+
volumes:
169+
- ../opensearch/opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
170+
- ./certs/:/usr/share/opensearch-dashboards/config/certs/
171+
- ./certs/opensearch.dashboards-key.pem:/usr/share/opensearch-dashboards/config/certs/opensearch.key
172+
- ./certs/opensearch.dashboards.pem:/usr/share/opensearch-dashboards/config/certs/opensearch.pem
173+
- ./certs/root-ca.pem:/usr/share/opensearch-dashboards/config/certs/root-ca.pem
174+
175+
environment:
176+
- 'OPENSEARCH_HOSTS="https://opensearch.node:9200"'
177+
178+
volumes:
179+
data:
180+
es_certs:
181+
alerts:

‎integrations/docker/opensearch.yml

-7
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,13 @@ services:
55
image: wazuh/indexer-events-generator
66
build:
77
context: ../tools/events-generator
8-
container_name: events-generator
98
depends_on:
109
wazuh.indexer:
1110
condition: service_healthy
1211
command: bash -c "python run.py -a wazuh.indexer"
1312

1413
wazuh.indexer:
1514
image: opensearchproject/opensearch:2.12.0
16-
container_name: wazuh.indexer
1715
depends_on:
1816
wazuh-certs-generator:
1917
condition: service_completed_successfully
@@ -54,7 +52,6 @@ services:
5452

5553
wazuh.dashboard:
5654
image: opensearchproject/opensearch-dashboards:2.12.0
57-
container_name: wazuh.dashboard
5855
depends_on:
5956
- wazuh.indexer
6057
hostname: wazuh.dashboard
@@ -79,7 +76,6 @@ services:
7976
wazuh-certs-generator:
8077
image: wazuh/wazuh-certs-generator:0.0.1
8178
hostname: wazuh-certs-generator
82-
container_name: wazuh-certs-generator
8379
entrypoint: sh -c "/entrypoint.sh; chown -R 1000:999 /certificates; chmod 740 /certificates; chmod 440 /certificates/*"
8480
volumes:
8581
- ./certs/:/certificates/
@@ -95,7 +91,6 @@ services:
9591
depends_on:
9692
wazuh-certs-generator:
9793
condition: service_completed_successfully
98-
container_name: opensearch.node
9994
environment:
10095
- cluster.name=opensearch-cluster
10196
- node.name=opensearch.node
@@ -133,7 +128,6 @@ services:
133128
depends_on:
134129
opensearch.node:
135130
condition: service_healthy
136-
container_name: opensearch-dashboards
137131
ports:
138132
- 5602:5601
139133
expose:
@@ -153,7 +147,6 @@ services:
153147
depends_on:
154148
opensearch.node:
155149
condition: service_healthy
156-
container_name: logstash
157150
build:
158151
context: ../opensearch
159152
environment:

‎integrations/elastic/README.md

-2
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ The Docker Compose project will bring up the following services:
2222

2323
- 1x Events Generator (learn more in [wazuh-indexer/integrations/tools/events-generator](../tools/events-generator/README.md)).
2424
- 1x Wazuh Indexer (OpenSearch).
25-
- 1x Wazuh Dashboards (OpenSearch Dashboards).
2625
- 1x Logstash
2726
- 1x Elastic
2827
- 1x Kibana
@@ -43,7 +42,6 @@ Check the files above for **credentials**, ports, and other configurations.
4342
| Service | Address | Credentials |
4443
| ---------------- | ---------------------- | --------------- |
4544
| Wazuh Indexer | https://localhost:9200 | admin:admin |
46-
| Wazuh Dashboards | https://localhost:5601 | admin:admin |
4745
| Elastic | https://localhost:9201 | elastic:elastic |
4846
| Kibana | https://localhost:5602 | elastic:elastic |
4947

‎integrations/opensearch/README.md

+9-2
Original file line numberDiff line numberDiff line change
@@ -13,28 +13,35 @@ This document describes how to prepare a Docker Compose environment to test the
1313
```bash
1414
docker compose -f ./docker/opensearch.yml up -d
1515
```
16+
3. If you prefer, you can start the integration with the Wazuh Manager as data source:
17+
```bash
18+
docker compose -f ./docker/manager-opensearch.yml up -d
19+
```
1620

1721
The Docker Compose project will bring up the following services:
1822

1923
- 1x Events Generator (learn more in [wazuh-indexer/integrations/tools/events-generator](../tools/events-generator/README.md)).
2024
- 1x Wazuh Indexer (OpenSearch).
21-
- 1x Wazuh Dashboards (OpenSearch Dashboards).
2225
- 1x Logstash
2326
- 1x OpenSearch
2427
- 1x OpenSearch Dashboards
28+
- 1x Wazuh Manager (optional).
2529

2630
For custom configurations, you may need to modify these files:
2731

2832
- [docker/opensearch.yml](../docker/opensearch.yml): Docker Compose file.
2933
- [docker/.env](../docker/.env): Environment variables file.
3034
- [opensearch/logstash/pipeline/indexer-to-opensearch.conf](./logstash/pipeline/indexer-to-opensearch.conf): Logstash Pipeline configuration file.
3135

36+
If you opted to start the integration with the Wazuh Manager, you can modify the following files:
37+
- [docker/manager-opensearch.yml](../docker/manager-opensearch.yml): Docker Compose file.
38+
- [opensearch/logstash/pipeline/manager-to-opensearch.conf](./logstash/pipeline/manager-to-opensearch.conf): Logstash Pipeline configuration file.
39+
3240
Check the files above for **credentials**, ports, and other configurations.
3341

3442
| Service | Address | Credentials |
3543
| --------------------- | ---------------------- | ----------- |
3644
| Wazuh Indexer | https://localhost:9200 | admin:admin |
37-
| Wazuh Dashboard | https://localhost:5601 | admin:admin |
3845
| OpenSearch | https://localhost:9201 | admin:admin |
3946
| OpenSearch Dashboards | https://localhost:5602 | admin:admin |
4047

‎integrations/opensearch/logstash/pipeline/manager-to-opensearch.conf

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
input {
2+
file {
3+
id => "wazuh_alerts"
4+
codec => "json"
5+
start_position => "beginning"
6+
stat_interval => "1 second"
7+
path => "/var/ossec/logs/alerts/alerts.json"
8+
mode => "tail"
9+
ecs_compatibility => "disabled"
10+
}
11+
}
12+
13+
output {
14+
opensearch {
15+
hosts => ["opensearch.node:9200"]
16+
auth_type => {
17+
type => 'basic'
18+
user => 'admin'
19+
password => 'admin'
20+
}
21+
index => "wazuh-alerts-4.x-%{+YYYY.MM.dd}"
22+
ssl => true
23+
cacert => "/etc/ssl/root-ca.pem"
24+
template => '/usr/share/logstash/pipeline/os_template.json'
25+
template_name => 'wazuh'
26+
template_overwrite => true
27+
legacy_template => false
28+
}
29+
stdout{}
30+
}

0 commit comments

Comments
 (0)