Install Elastic Stack with RPM packages

Preparation

1. Oracle Java JRE is required by Logstash and Elasticsearch.

Note

The following command accepts the necessary cookies to download Oracle Java JRE. Please, visit Oracle Java 8 JRE Download Page for more information.

# curl -Lo jre-8-linux-x64.rpm --header "Cookie: oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/8u151-b12/e758a0de34e24606bca991d704f6dcbf/jre-8u151-linux-x64.rpm"

Now check if the package was download successfully:

# rpm -qlp jre-8-linux-x64.rpm > /dev/null 2>&1 && echo "Java package downloaded successfully" || echo "Java package did not download successfully"

Finally, install the RPM package using yum:

# yum install jre-8-linux-x64.rpm
# rm jre-8-linux-x64.rpm

2. Install the Elastic repository and its GPG key:

# rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

# cat > /etc/yum.repos.d/elastic.repo << EOF
[elasticsearch-6.x]
name=Elasticsearch repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

Elasticsearch

Elasticsearch is a highly scalable full-text search and analytics engine. For more info please see Elasticsearch.

1. Install the Elasticsearch package:

# yum install elasticsearch-6.1.0

2. Enable and start the Elasticsearch service:

1. For Systemd:

# systemctl daemon-reload
# systemctl enable elasticsearch.service
# systemctl start elasticsearch.service

2. For SysV Init:

# chkconfig --add elasticsearch
# service elasticsearch start

3. Load Wazuh Elasticsearch templates:

# curl https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/elasticsearch/wazuh-elastic6-template-alerts.json | curl -XPUT 'http://localhost:9200/_template/wazuh' -H 'Content-Type: application/json' -d @-

# curl https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/elasticsearch/wazuh-elastic6-template-monitoring.json | curl -XPUT 'http://localhost:9200/_template/wazuh-agent' -H 'Content-Type: application/json' -d @-

4. Insert sample alert:

# curl https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/elasticsearch/alert_sample.json | curl -XPUT "http://localhost:9200/wazuh-alerts-3.x-"`date +%Y.%m.%d`"/wazuh/sample" -H 'Content-Type: application/json' -d @-

Logstash

Logstash is the tool that will collect, parse, and forward to Elasticsearch for indexing and storage all logs generated by Wazuh server. For more info please see Logstash.

1. Install the Logstash package:

# yum install logstash-6.1.0

2. Download the Wazuh config for Logstash:

• Local configuration (only in a single-host architecture):

  # curl -so /etc/logstash/conf.d/01-wazuh.conf https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/logstash/01-wazuh-local.conf
  

  Because the Logstash user needs to read the alerts.json file, please add it to OSSEC group by running:

  # usermod -a -G ossec logstash
  

• Remote configuration (only in a distributed architecture):

  # curl -so /etc/logstash/conf.d/01-wazuh.conf https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/logstash/01-wazuh-remote.conf
  

1) Edit the file /etc/logstash/startup.options and in the line 30 change the LS_GROUP=logstash to LS_GROUP=ossec.
2) Update the service with the new parameters run the command /usr/share/logstash/bin/system-install
3) Start Logstash again.

3. Enable and start the Logstash service:

1. For Systemd:

# systemctl daemon-reload
# systemctl enable logstash.service
# systemctl start logstash.service

2. For SysV Init:

# chkconfig --add logstash
# service logstash start

Kibana

Kibana is a flexible and intuitive web interface for mining and visualizing the events and archives stored in Elasticsearch. More info at Kibana.

1. Install the Kibana package:

# yum install kibana-6.1.0

2. Install the Wazuh App plugin for Kibana:

2.1) Increase the default Node.js heap memory limit to prevent out of memory errors when installing the Wazuh App. Set the limit as follow:

# export NODE_OPTIONS="--max-old-space-size=3072"

2.2) Install Wazuh App:

# /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp.zip

Warning

The Kibana plugin installation process may take several minutes. Please wait patiently.

Note

If you want to download a different Wazuh App plugin for another version of Wazuh or the Elastic Stack, you can check the table available at GitHub and use the appropiate installation command.

3. Optional. Kibana will listen only on the loopback interface (localhost) by default. To set up Kibana to listen on all interfaces, edit the file /etc/kibana/kibana.yml. Uncomment the setting server.host and change the value to:

server.host: "0.0.0.0"

Note

It is recommended to set up an Nginx proxy for Kibana in order to use SSL encryption and to enable authentication. Instructions to set the proxy up can be found at Setting up SSL and authentication for Kibana.

4. Enable and start the Kibana service:

1. For Systemd:

# systemctl daemon-reload
# systemctl enable kibana.service
# systemctl start kibana.service

2. For SysV Init:

# chkconfig --add kibana
# service kibana start

5. Disable the Elasticsearch repository:

We recommend to disable the Elasticsearch repository in order to prevent an upgrade to a newer Elastic Stack version due to possible breaking changes with our App, so you should do it as follow:

# sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo

Connecting the Wazuh App with the API

Follow the next guide in order to connect the Wazuh App with the API: