Release 4.5.0 - Alpha 1 - Specific systems #18074
Assignees
Labels
Comments
2 tasks
Deblintrake09
changed the title
Analysis report - Solaris 11 SPARC 🟢System infoInstall
Alert
{"timestamp":"2023-07-27T17:50:50.376+0000","rule":{"level":7,"description":"SCA summary: CIS Benchmark for Oracle Solaris 11 v1.1.0: Score less than 50% (31)","id":"19004","firedtimes":4,"mail":false,"groups":["sca"],"gdpr":["IV_35.7.d"],"pci_dss":["2.2"],"nist_800_53":["CM.1"],"tsc":["CC7.1","CC7.2"]},"agent":{"id":"007","name":"sossp613","ip":"192.168.253.13"},"manager":{"name":"wazuh-server"},"id":"1690480250.343118","decoder":{"name":"sca"},"data":{"sca":{"type":"summary","scan_id":"20579","policy":"CIS Benchmark for Oracle Solaris 11 v1.1.0","description":"This document, CIS Oracle Solaris 11 Benchmark v1.1.0, provides prescriptive guidance for establishing a secure configuration posture for Oracle Solaris 11 on both x86 and SPARC platforms. This guide was tested against Solaris 11 11/11 release, updated to the Software Repository Update 5 (SRU5). As of the publication of this document, Solaris 11 11/11 SRU5 is the latest available support update for the Solaris 11 OS. The recommendations included in this document may need to be adjusted for future Solaris 11 updates.","policy_id":"cis_solaris11","passed":"16","failed":"35","invalid":"0","total_checks":"51","score":"31","file":"cis_solaris11.yml"}},"location":"sca"}
{"timestamp":"2023-07-27T17:53:37.947+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":2,"mail":false,"groups":["ossec","rootcheck"],"pci_dss":["10.6.1"],"gdpr":["IV_35.7.d"]},"agent":{"id":"007","name":"sossp613","ip":"192.168.253.13"},"manager":{"name":"wazuh-server"},"id":"1690480417.348205","full_log":"Trojaned version of file '/usr/bin/kill' detected. Signature used: '/dev/[ab,d-k,m-z]|/dev/[F-Z]|/dev/[A-D]|/dev/[0-9]|proc\\.h|bash|tmp' (Generic).","decoder":{"name":"rootcheck"},"data":{"title":"Trojaned version of file detected.","file":"/usr/bin/kill"},"location":"rootcheck"}RemoveUpgrade 4.4.5 -> 4.5.0-alpha1
Users and groups |
Analysis report - HP-UX 🟢System infoInstall
Alert- TCP{"timestamp":"2023-07-27T15:53:02.590+0000","rule":{"level":5,"description":"sshd: authentication failed.","id":"5760","mitre":{"id":["T1110.001","T1021.004"],"tactic":["Credential Access","Lateral Movement"],"technique":["Password Guessing","SSH"]},"firedtimes":2,"mail":false,"groups":["syslog","sshd","authentication_failed"],"gdpr":["IV_35.7.d","IV_32.2"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"001","name":"sovmh336"},"manager":{"name":"wazuh-server"},"id":"1690473182.28905","full_log":"Jul 27 10:00:31 sovmh336 sshd[9468]: Failed password for root from 202.53.72.150 port 65166 ssh2","predecoder":{"program_name":"sshd","timestamp":"Jul 27 10:00:31","hostname":"sovmh336"},"decoder":{"parent":"sshd","name":"sshd"},"data":{"srcip":"202.53.72.150","srcport":"65166","dstuser":"root"},"location":"/var/adm/syslog/syslog.log"}
RemoveUpgrade 4.4.5 -> 4.5.0-alpha1Users and groups |
Analysis report - AMI 🟢AMI - Agent connection and workload
This was tested as part of Special systems (HP UX), since the AMI was the Wazuh Manager AMI - WUI
AMI - Logs
AMI - Filebeat testAMI - Wazuh Indexer ClusterAMI - UsersAMI - VersionsAMI - Processes |
Analysis report - Solaris 10 SPARC 🟢System infoInstall
Alert
{"timestamp":"2023-07-27T16:13:14.905+0000","rule":{"level":7,"description":"SCA summary: System audit for Unix based systems: Score less than 50% (45)","id":"19004","firedtimes":1,"mail":false,"groups":["sca"],"gdpr":["IV_35.7.d"],"pci_dss":["2.2"],"nist_800_53":["CM.1"],"tsc":["CC7.1","CC7.2"]},"agent":{"id":"003","name":"sossp273","ip":"192.168.241.173"},"manager":{"name":"wazuh-server"},"id":"1690474394.92231","decoder":{"name":"sca"},"data":{"sca":{"type":"summary","scan_id":"11516","policy":"System audit for Unix based systems","description":"Guidance for establishing a secure configuration for Unix based systems.","policy_id":"unix_audit","passed":"5","failed":"6","invalid":"12","total_checks":"23","score":"45","file":"sca_unix_audit.yml"}},"location":"sca"}
RemoveUpgrade 4.4.5 -> 4.5.0Users and groups |
Analysis report - AIX 🟢System infoInstall
Alert
{"timestamp":"2023-07-27T18:21:31.867+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":26,"mail":false,"groups":["ossec","rootcheck"],"pci_dss":["10.6.1"],"gdpr":["IV_35.7.d"]},"agent":{"id":"009","name":"soaxp078"},"manager":{"name":"wazuh-server"},"id":"1690482091.686107","full_log":"File '/tmp/.com_ibm_tools_attach/_notifier' is owned by root and has written permissions to anyone.","decoder":{"name":"rootcheck"},"data":{"title":"File is owned by root and has written permissions to anyone.","file":"/tmp/.com_ibm_tools_attach/_notifier"},"location":"rootcheck"}
{"timestamp":"2023-07-27T18:21:31.865+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":25,"mail":false,"groups":["ossec","rootcheck"],"pci_dss":["10.6.1"],"gdpr":["IV_35.7.d"]},"agent":{"id":"009","name":"soaxp078"},"manager":{"name":"wazuh-server"},"id":"1690482091.685702","full_log":"File '/tmp/.com_ibm_tools_attach/_master' is owned by root and has written permissions to anyone.","decoder":{"name":"rootcheck"},"data":{"title":"File is owned by root and has written permissions to anyone.","file":"/tmp/.com_ibm_tools_attach/_master"},"location":"rootcheck"}
{"timestamp":"2023-07-27T18:21:31.867+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":26,"mail":false,"groups":["ossec","rootcheck"],"pci_dss":["10.6.1"],"gdpr":["IV_35.7.d"]},"agent":{"id":"009","name":"soaxp078"},"manager":{"name":"wazuh-server"},"id":"1690482091.686107","full_log":"File '/tmp/.com_ibm_tools_attach/_notifier' is owned by root and has written permissions to anyone.","decoder":{"name":"rootcheck"},"data":{"title":"File is owned by root and has written permissions to anyone.","file":"/tmp/.com_ibm_tools_attach/_notifier"},"location":"rootcheck"}RemoveUpgrade 4.4.5 -> 4.5.0
Users and groups |
Analysis report - PPC64LE 🟢Deployment + InstallCentOS 7Debian StretchAlertsCentOS 7{"timestamp":"2023-07-28T15:37:36.953+0000","rule":{"level":3,"description":"Wazuh agent stopped.","id":"506","mitre":{"id":["T1562.001"],"tactic":["Defense Evasion"],"technique":["Disable or Modify Tools"]},"firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1","10.2.6"],"gpg13":["10.1"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6","AU.14","AU.5"],"tsc":["CC7.2","CC7.3","CC6.8"]},"agent":{"id":"011","name":"wazuh3.novalocal","ip":"140.211.169.156"},"manager":{"name":"wazuh-server"},"id":"1690558656.1143187","full_log":"ossec: Agent stopped: 'wazuh3.novalocal->any'.","decoder":{"parent":"ossec","name":"ossec"},"data":{"extra_data":"wazuh3.novalocal->any"},"location":"wazuh-remoted"}
{"timestamp":"2023-07-28T15:38:09.492+0000","rule":{"level":3,"description":"Wazuh agent started.","id":"503","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1","10.2.6"],"gpg13":["10.1"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6","AU.14","AU.5"],"tsc":["CC7.2","CC7.3","CC6.8"]},"agent":{"id":"011","name":"wazuh3.novalocal","ip":"140.211.169.156"},"manager":{"name":"wazuh-server"},"id":"1690558689.1145332","full_log":"ossec: Agent started: 'wazuh3.novalocal->any'.","decoder":{"parent":"ossec","name":"ossec"},"data":{"extra_data":"wazuh3.novalocal->any"},"location":"wazuh-agent"}
Debian Stretch{"timestamp":"2023-07-28T17:59:38.390+0000","rule":{"level":3,"description":"Wazuh server started.","id":"502","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"gpg13":["10.1"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1690567178.2301354","full_log":"ossec: Manager started.","decoder":{"name":"ossec"},"location":"wazuh-monitord"}
{"timestamp":"2023-07-28T18:01:44.810+0000","rule":{"level":3,"description":"Wazuh agent started.","id":"503","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1","10.2.6"],"gpg13":["10.1"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6","AU.14","AU.5"],"tsc":["CC7.2","CC7.3","CC6.8"]},"agent":{"id":"013","name":"wazuh1","ip":"140.211.169.152"},"manager":{"name":"wazuh-server"},"id":"1690567304.2303366","full_log":"ossec: Agent started: 'wazuh1->any'.","decoder":{"parent":"ossec","name":"ossec"},"data":{"extra_data":"wazuh1->any"},"location":"wazuh-agent"}RemoveCentOS 7Debian StretchUpgradeCentOS 7
Debian Stretch
root@wazuh1:/home/debian# /var/ossec/bin/wazuh-control start /var/ossec/bin/agent_control -i 014Wazuh agent_control. Agent information: Operating system: Linux |wazuh1 |4.9.0-13-powerpc64le |#1 SMP Debian 4.9.228-1 (2020-07-05) |ppc64le Syscheck last started at: Fri Jul 28 18:10:28 2023 |
Analysis report - OVA 🟢Agent info# curl -OL https://packages-dev.wazuh.com/pre-release/apt/pool/main/w/wazuh-agent/wazuh-agent_4.5.0-1_amd64.deb
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 8711k 100 8711k 0 0 945k 0 0:00:09 0:00:09 --:--:-- 1149k
# apt install /home/vagrant/wazuh-agent_4.5.0-1_amd64.deb
Reading package lists... Done
Building dependency tree
Reading state information... Done
Note, selecting 'wazuh-agent' instead of '/home/vagrant/wazuh-agent_4.5.0-1_amd64.deb'
The following NEW packages will be installed:
wazuh-agent
0 upgraded, 1 newly installed, 0 to remove and 56 not upgraded.
Need to get 0 B/8921 kB of archives.
After this operation, 30.2 MB of additional disk space will be used.
Get:1 /home/vagrant/wazuh-agent_4.5.0-1_amd64.deb wazuh-agent amd64 4.5.0-1 [8921 kB]
Preconfiguring packages ...
Selecting previously unselected package wazuh-agent.
(Reading database ... 130749 files and directories currently installed.)
Preparing to unpack .../wazuh-agent_4.5.0-1_amd64.deb ...
Unpacking wazuh-agent (4.5.0-1) ...
Setting up wazuh-agent (4.5.0-1) ...
Processing triggers for systemd (245.4-4ubuntu3.20) ...
# nano /var/ossec/etc/ossec.conf
# /var/ossec/bin/wazuh-control start
Starting Wazuh v4.5.0...
Started wazuh-execd...
Started wazuh-agentd...
Started wazuh-syscheckd...
Started wazuh-logcollector...
Started wazuh-modulesd...
Completed.
# /var/ossec/bin/wazuh-control info
WAZUH_VERSION="v4.5.0"
WAZUH_REVISION="40500"
WAZUH_TYPE="agent"# /var/ossec/bin/agent_control -i 001
Wazuh agent_control. Agent information:
Agent ID: 001
Agent Name: ubuntu-focal
IP address: any
Status: Active
Operating system: Linux |ubuntu-focal |5.4.0-155-generic |#172-Ubuntu SMP Fri Jul 7 16:10:02 UTC 2023 |x86_64
Client version: Wazuh v4.5.0
Configuration hash: ab73af41699f13fdd81903b5f23d8d00
Shared file hash: 4a8724b20dee0124ff9656783c490c4e
Last keep alive: 1690568779
Syscheck last started at: Fri Jul 28 18:23:05 2023
Syscheck last ended at: Fri Jul 28 18:23:12 2023OVA - Check Wazuh agent connection[root@wazuh-server wazuh-user]# cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04.5 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.5 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal
[root@wazuh-server wazuh-user]# grep "tcp" /var/ossec/etc/ossec.conf
<protocol>tcp</protocol>
[root@wazuh-server wazuh-user]# grep -i -E "tcp" /var/ossec/logs/ossec.log
2023/07/28 18:22:58 wazuh-agentd: INFO: Trying to connect to server ([192.168.2.28]:1514/tcp).
2023/07/28 18:22:58 wazuh-agentd: INFO: (4102): Connected to the server ([192.168.2.28]:1514/tcp).
2023/07/28 18:23:04 wazuh-agentd: INFO: Trying to connect to server ([192.168.2.28]:1514/tcp).
2023/07/28 18:23:04 wazuh-agentd: INFO: (4102): Connected to the server ([192.168.2.28]:1514/tcp).
[root@wazuh-server wazuh-user]# vi /var/ossec/etc/ossec.conf
[root@wazuh-server wazuh-user]# /var/ossec/bin/wazuh-control restart
wazuh-clusterd not running...
Killing wazuh-modulesd...
Killing wazuh-monitord...
Killing wazuh-logcollector...
Killing wazuh-remoted...
Killing wazuh-syscheckd...
Killing wazuh-analysisd...
wazuh-maild not running...
Killing wazuh-execd...
Killing wazuh-db...
Killing wazuh-authd...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
Killing wazuh-apid...
Wazuh v4.5.0 Stopped
Starting Wazuh v4.5.0...
Started wazuh-apid...
Started wazuh-csyslogd...
Started wazuh-dbd...
2023/07/28 18:29:42 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
Started wazuh-integratord...
Started wazuh-agentlessd...
Started wazuh-authd...
Started wazuh-db...
Started wazuh-execd...
Started wazuh-analysisd...
Started wazuh-syscheckd...
Started wazuh-remoted...
Started wazuh-logcollector...
Started wazuh-monitord...
Started wazuh-modulesd...
Completed.
[root@wazuh-server wazuh-user]# grep "udp" /var/ossec/etc/ossec.conf
<protocol>udp</protocol>
[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -i 001
Wazuh agent_control. Agent information:
Agent ID: 001
Agent Name: ubuntu-focal
IP address: any
Status: Active
Operating system: Linux |ubuntu-focal |5.4.0-155-generic |#172-Ubuntu SMP Fri Jul 7 16:10:02 UTC 2023 |x86_64
Client version: Wazuh v4.5.0
Configuration hash: ab73af41699f13fdd81903b5f23d8d00
Shared file hash: 4a8724b20dee0124ff9656783c490c4e
Last keep alive: 1690569015
Syscheck last started at: Fri Jul 28 18:28:40 2023
Syscheck last ended at: Fri Jul 28 18:28:51 2023
[root@wazuh-server wazuh-user]# grep -i -E "udp" /var/ossec/logs/ossec.log
2023/07/28 18:29:45 wazuh-remoted: INFO: Started (pid: 3716). Listening on port 1514/UDP (secure).
[root@wazuh-server wazuh-user]# grep -i -E "error|critical|fatal|warning" /var/ossec/logs/ossec.log
root@ubuntu-focal:/home/vagrant# grep -i -E "udp" /var/ossec/logs/ossec.log
2023/07/28 18:28:38 wazuh-agentd: INFO: Trying to connect to server ([192.168.2.28]:1514/udp).
2023/07/28 18:28:49 wazuh-agentd: INFO: Closing connection to server ([192.168.2.28]:1514/udp).
2023/07/28 18:28:49 wazuh-agentd: INFO: Trying to connect to server ([192.168.2.28]:1514/udp).
2023/07/28 18:28:49 wazuh-agentd: INFO: (4102): Connected to the server ([192.168.2.28]:1514/udpWazuh processes[root@wazuh-server wazuh-user]# ps -ef | grep wazuh
wazuh-d+ 430 1 0 18:15 ? 00:00:08 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/opensearch_dashboards.yml
root 451 1 0 18:15 ? 00:00:00 login -- wazuh-user
root 958 1 0 18:15 ? 00:00:00 /sbin/dhclient -1 -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid -H wazuh-server eth0
wazuh-u+ 2911 451 0 18:16 tty1 00:00:00 -bash
root 2940 1023 0 18:17 ? 00:00:00 sshd: wazuh-user [priv]
wazuh-u+ 2944 2940 0 18:17 ? 00:00:00 sshd: wazuh-user@pts/0
wazuh-u+ 2945 2944 0 18:17 pts/0 00:00:00 -bash
wazuh-i+ 3025 1 7 18:21 ? 00:00:41 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=SPI,COMPAT -Xms3990m -Xmx3990m -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/opensearch-5351821074469943771 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/wazuh-indexer -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Dclk.tck=100 -Djdk.attach.allowAttachSelf=true -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED -XX:MaxDirectMemorySize=2091909120 -Dopensearch.path.home=/usr/share/wazuh-indexer -Dopensearch.path.conf=/etc/wazuh-indexer -Dopensearch.distribution.type=rpm -Dopensearch.bundled_jdk=true -cp /usr/share/wazuh-indexer/lib/* org.opensearch.bootstrap.OpenSearch -p /run/wazuh-indexer/wazuh-indexer.pid --quiet
wazuh 3540 1 3 18:29 ? 00:00:04 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root 3580 1 0 18:29 ? 00:00:00 /var/ossec/bin/wazuh-authd
wazuh 3594 1 0 18:29 ? 00:00:00 /var/ossec/bin/wazuh-db
wazuh 3609 3540 0 18:29 ? 00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 3612 3540 0 18:29 ? 00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root 3625 1 0 18:29 ? 00:00:00 /var/ossec/bin/wazuh-execd
wazuh 3637 1 0 18:29 ? 00:00:00 /var/ossec/bin/wazuh-analysisd
root 3699 1 5 18:29 ? 00:00:06 /var/ossec/bin/wazuh-syscheckd
wazuh 3716 1 0 18:29 ? 00:00:00 /var/ossec/bin/wazuh-remoted
root 3787 1 0 18:29 ? 00:00:00 /var/ossec/bin/wazuh-logcollector
wazuh 3833 1 0 18:29 ? 00:00:00 /var/ossec/bin/wazuh-monitord
root 3886 1 1 18:29 ? 00:00:01 /var/ossec/bin/wazuh-modulesd
root 5054 2973 0 18:31 pts/0 00:00:00 grep --color=auto wazuh
[root@wazuh-server wazuh-user]# /var/ossec/bin/wazuh-control restart
wazuh-clusterd not running...
Killing wazuh-modulesd...
Killing wazuh-monitord...
Killing wazuh-logcollector...
Killing wazuh-remoted...
Killing wazuh-syscheckd...
Killing wazuh-analysisd...
wazuh-maild not running...
Killing wazuh-execd...
Killing wazuh-db...
Killing wazuh-authd...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
Killing wazuh-apid...
Wazuh v4.5.0 Stopped
Starting Wazuh v4.5.0...
Started wazuh-apid...
Started wazuh-csyslogd...
Started wazuh-dbd...
2023/07/28 18:32:18 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
Started wazuh-integratord...
Started wazuh-agentlessd...
Started wazuh-authd...
Started wazuh-db...
Started wazuh-execd...
Started wazuh-analysisd...
Started wazuh-syscheckd...
Started wazuh-remoted...
Started wazuh-logcollector...
Started wazuh-monitord...
Started wazuh-modulesd...
Completed.
[root@wazuh-server wazuh-user]# ps -ef | grep wazuh
wazuh-d+ 430 1 0 18:15 ? 00:00:09 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/opensearch_dashboards.yml
root 451 1 0 18:15 ? 00:00:00 login -- wazuh-user
root 958 1 0 18:15 ? 00:00:00 /sbin/dhclient -1 -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid -H wazuh-server eth0
wazuh-u+ 2911 451 0 18:16 tty1 00:00:00 -bash
root 2940 1023 0 18:17 ? 00:00:00 sshd: wazuh-user [priv]
wazuh-u+ 2944 2940 0 18:17 ? 00:00:00 sshd: wazuh-user@pts/0
wazuh-u+ 2945 2944 0 18:17 pts/0 00:00:00 -bash
wazuh-i+ 3025 1 6 18:21 ? 00:00:43 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=SPI,COMPAT -Xms3990m -Xmx3990m -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/opensearch-5351821074469943771 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/wazuh-indexer -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Dclk.tck=100 -Djdk.attach.allowAttachSelf=true -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED -XX:MaxDirectMemorySize=2091909120 -Dopensearch.path.home=/usr/share/wazuh-indexer -Dopensearch.path.conf=/etc/wazuh-indexer -Dopensearch.distribution.type=rpm -Dopensearch.bundled_jdk=true -cp /usr/share/wazuh-indexer/lib/* org.opensearch.bootstrap.OpenSearch -p /run/wazuh-indexer/wazuh-indexer.pid --quiet
wazuh 5237 1 8 18:32 ? 00:00:04 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root 5277 1 0 18:32 ? 00:00:00 /var/ossec/bin/wazuh-authd
wazuh 5291 1 0 18:32 ? 00:00:00 /var/ossec/bin/wazuh-db
wazuh 5306 5237 0 18:32 ? 00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 5309 5237 0 18:32 ? 00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root 5322 1 0 18:32 ? 00:00:00 /var/ossec/bin/wazuh-execd
wazuh 5334 1 0 18:32 ? 00:00:00 /var/ossec/bin/wazuh-analysisd
root 5344 1 12 18:32 ? 00:00:07 /var/ossec/bin/wazuh-syscheckd
wazuh 5410 1 0 18:32 ? 00:00:00 /var/ossec/bin/wazuh-remoted
root 5471 1 0 18:32 ? 00:00:00 /var/ossec/bin/wazuh-logcollector
wazuh 5490 1 0 18:32 ? 00:00:00 /var/ossec/bin/wazuh-monitord
root 5533 1 2 18:32 ? 00:00:01 /var/ossec/bin/wazuh-modulesd
root 6732 2973 0 18:33 pts/0 00:00:00 grep --color=auto wazuhVersions[root@wazuh-server wazuh-user]# /var/ossec/bin/wazuh-control info
WAZUH_VERSION="v4.5.0"
WAZUH_REVISION="40500"
WAZUH_TYPE="server"
[root@wazuh-server wazuh-user]# cat /usr/share/wazuh-indexer/VERSION
4.5.0
[root@wazuh-server wazuh-user]# cat /usr/share/wazuh-dashboard/VERSION
4.5.0
[root@wazuh-server wazuh-user]# cat /usr/share/wazuh-dashboard/package.json
{
"name": "opensearch-dashboards",
"description": "OpenSearch Dashboards is a browser based analytics and search dashboard for OpenSearch. OpenSearch Dashboards is a snap to setup and start using. OpenSearch Dashboards strives to be easy to get started with, while also being flexible and powerful, just like OpenSearch.",
"keywords": [
"opensearch-dashboards",
"opensearch",
"logstash",
"analytics",
"visualizations",
"dashboards",
"dashboarding"
],
"version": "2.6.0",
"branch": "2.6",
"build": {
"number": 45001,
"sha": "b15a28f9d6d6ec40d695a2eb01442d2a7d6d72d9",
"distributable": true,
"release": true
},
"repository": {
"type": "git",
"url": "https://github.com/opensearch-project/opensearch-dashboards.git"
},
"engines": {
"node": "14.20.1"
}
}OVA - Users[root@wazuh-server wazuh-user]# grep -R "wazuh" /etc/group
wheel:x:10:wazuh-user
wazuh-user:x:1000:
wazuh-indexer:x:993:
wazuh:x:992:wazuh
wazuh-dashboard:x:991:wazuh-dashboard
[root@wazuh-server wazuh-user]# grep -R "wazuh" /etc/passwd
wazuh-user:x:1000:
wazuh-indexer:x:993:
wazuh:x:992:wazuh
wazuh-dashboard:x:991:wazuh-dashboard
[root@wazuh-server wazuh-user]# grep -R "wazuh" /etc/passwd
wazuh-user:x:1000:1000::/home/wazuh-user:/bin/bash
wazuh-indexer:x:996:993:wazuh-indexer user:/usr/share/wazuh-indexer:/sbin/nologin
wazuh:x:995:992::/var/ossec:/sbin/nologin
wazuh-dashboard:x:994:991::/usr/share/wazuh-dashboard/:/sbin/nologinOVA - WUI
OVA - Logs
OVA - Filebeat test[root@wazuh-server wazuh-user]# filebeat test output
elasticsearch: https://127.0.0.1:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 127.0.0.1
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.2
dial up... OK
talk to server... OK
version: 7.10.2OVA - Wazuh indexer cluster[root@wazuh-server wazuh-user]# curl -k -u admin:admin https://127.0.0.1:9200
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 127.0.0.1
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.2
dial up... OK
talk to server... OK
version: 7.10.2
[root@wazuh-server wazuh-user]# curl -k -u admin:admin https://127.0.0.1:9200
{
"name" : "node-1",
"cluster_name" : "wazuh-cluster",
"cluster_uuid" : "iQBIKAiRRdaC2Z1VFla4MA",
"version" : {
"number" : "7.10.2",
"build_type" : "rpm",
"build_hash" : "7203a5af21a8a009aece1474446b437a3c674db6",
"build_date" : "2023-02-24T18:57:04.388618985Z",
"build_snapshot" : false,
"lucene_version" : "9.5.0",
"minimum_wire_compatibility_version" : "7.10.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "The OpenSearch Project: https://opensearch.org/"
}
[root@wazuh-server wazuh-user]# curl -k -u admin:admin https://127.0.0.1:9200/_cat/nodes?v
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles cluster_manager name
127.0.0.1 11 81 1 0.04 0.06 0.10 dimr cluster_manager,data,ingest,remote_cluster_client * node-1
[root@wazuh-server wazuh-user]# curl -k -u admin:admin https://127.0.0.1:9200/_cluster/health?pretty
{
"cluster_name" : "wazuh-cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"discovered_master" : true,
"discovered_cluster_manager" : true,
"active_primary_shards" : 11,
"active_shards" : 11,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
} |
|
LGTM! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Packages tests metrics information
Build packages
Test packages
PPC64EL packages
OVA/AMI specific tests
Status legend:
⚫ - Pending/In progress
⚪ - Skipped
🔴 - Rejected
🟡 - Ready to review
🟢 - Approved
Auditor's validation
In order to close and proceed with the release or the next candidate version, the following auditors must give the green light to this RC.
The text was updated successfully, but these errors were encountered: