Wazuh is a security detection, visibility, and compliance open source project. It was born as a fork of OSSEC HIDS, later was integrated with Elastic Stack and OpenSCAP evolving into a more comprehensive solution. You can read more in https://wazuh.com/
Visualize and analyze Wazuh alerts stored in Elasticsearch using our Kibana app plugin.
- Obtain statistics per agent, search alerts and filter by using the different visualizations.
- View the Wazuh manager configuration.
- File integrity monitoring.
stablebranch on correspond to the last Wazuh app stable version.masterbranch contains the latest code, be aware of possible bugs on this branch.
- Wazuh HIDS 3.12.3
- Wazuh RESTful API 3.12.3
- Kibana 7.7.20
- Elasticsearch 7.7.0
Install the app
cd /usr/share/kibana
sudo -u kibana bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-3.12.3_7.7.0.zip
It is recommended to increase the heap size of Kibana to ensure the plugin installation:
cat >> /etc/default/kibana << EOF
NODE_OPTIONS="--max_old_space_size=2048"
EOF
Restart Kibana
- Systemd:
systemctl restart kibana
- SysV Init:
service kibana restart
Note: Since Wazuh 3.12.0 (regardless of the Elastic Stack version) the location of the wazuh.yml has been moved from /usr/share/kibana/plugins/wazuh/wazuh.yml to /usr/share/kibana/optimize/wazuh/config/wazuh.yml.
Stop Kibana
- Systemd:
systemctl stop kibana
- SysV Init:
service kibana stop
Copy the wazuh.yml to its new location. (Only needed for upgrades from 3.11.x to 3.12.y)
mkdir -p /usr/share/kibana/optimize/wazuh/config
cp /usr/share/kibana/plugins/wazuh/wazuh.yml /usr/share/kibana/optimize/wazuh/config/wazuh.yml
Remove the app using kibana-plugin tool
cd /usr/share/kibana/
sudo -u kibana bin/kibana-plugin remove wazuh
Remove generated bundles
rm -rf /usr/share/kibana/optimize/bundles
Update file permissions. This will avoid several errors prior to updating the app:
chown -R kibana:kibana /usr/share/kibana/optimize
chown -R kibana:kibana /usr/share/kibana/plugins
Install the app
cd /usr/share/kibana/
sudo -u kibana bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-3.12.3_7.7.0.zip
Update configuration file permissions.
sudo chown kibana:kibana /usr/share/kibana/optimize/wazuh/config/wazuh.yml
sudo chmod 600 /usr/share/kibana/optimize/wazuh/config/wazuh.yml
It is recommended to increase the heap size of Kibana to ensure the plugin installation:
cat >> /etc/default/kibana << EOF
NODE_OPTIONS="--max_old_space_size=2048"
EOF
Restart Kibana
- Systemd:
systemctl restart kibana
- SysV Init:
service kibana restart
If you want to contribute to our project please don't hesitate to send a pull request. You can also join our users mailing list, by sending an email to mailto:wazuh+subscribe@googlegroups.com, to ask questions and participate in discussions.
- https://elastic.co
- https://elastic.github.io/eui
- https://material.angularjs.org
- https://angularjs.org
- https://nodejs.org
- https://npmjs.com
- https://reactjs.org
- https://redux.js.org
Copyright © 2020 Wazuh, Inc.
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
Find more information about this on the LICENSE file.