Wazuh single-node cluster
This document will go through the installation of the Wazuh server components and Filebeat in a Wazuh single-node cluster.
Note
Root user privileges are required to run all the commands described below.
Prerequisites
Before installing the Wazuh server and Filebeat, some extra packages must be installed:
Install all the required utilities:
# yum install curl
Install all the required utilities:
# apt install curl apt-transport-https lsb-release gnupg2
Install all the required utilities:
# zypper install curl
Installing the Wazuh server
The Wazuh server collects and analyzes data from the deployed Wazuh agents. It runs the Wazuh manager, the Wazuh API, and Filebeat. The first step to set up Wazuh is adding the Wazuh's repository to the server, alternatively, all the available packages can be found here.
Adding the Wazuh repository
Import the GPG key:
# rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
Add the repository:
# cat > /etc/yum.repos.d/wazuh.repo << EOF [wazuh] gpgcheck=1 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH enabled=1 name=EL-$releasever - Wazuh baseurl=https://packages.wazuh.com/4.x/yum/ protect=1 EOF
Install the GPG key:
# curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
Add the repository:
# echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
Update the package information:
# apt-get update
Import the GPG key:
# rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
Add the repository:
# cat > /etc/zypp/repos.d/wazuh.repo <<\EOF [wazuh] gpgcheck=1 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH enabled=1 name=EL-$releasever - Wazuh baseurl=https://packages.wazuh.com/4.x/yum/ protect=1 EOF
Installing the Wazuh manager
Install the Wazuh manager package:
# yum install wazuh-manager-4.0.4-1
# apt-get install wazuh-manager=4.0.4-1
# zypper install wazuh-manager-4.0.4-1
Enable and start the Wazuh manager service:
# systemctl daemon-reload # systemctl enable wazuh-manager # systemctl start wazuh-manager
Choose one option according to the OS used:
RPM based OS:
# chkconfig --add wazuh-manager # service wazuh-manager start
Debian based OS:
# update-rc.d wazuh-manager defaults 95 10 # service wazuh-manager start
Run the following command to check if the Wazuh manager is active:
# systemctl status wazuh-manager
# service wazuh-manager status
Installing Filebeat
Filebeat is the tool on the Wazuh server that securely forwards alerts and archived events to Elasticsearch.
Filebeat installation and configuration
Install the Filebeat package:
# yum install filebeat-7.9.1
# apt-get install filebeat=7.9.1
# zypper install filebeat-7.9.1
Download the pre-configured Filebeat configuration file used to forward the Wazuh alerts to Elasticsearch:
# curl -so /etc/filebeat/filebeat.yml https://raw.githubusercontent.com/wazuh/wazuh-documentation/4.0/resources/open-distro/filebeat/7.x/filebeat.yml
Download the alerts template for Elasticsearch:
# curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.0/extensions/elasticsearch/7.x/wazuh-template.json # chmod go+r /etc/filebeat/wazuh-template.json
Download the Wazuh module for Filebeat:
# curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module
Edit the file
/etc/filebeat/filebeat.yml
:output.elasticsearch: hosts: ["<elasticsearch_ip>:9200"]
Replace
elasticsearch_ip
with the IP address or the hostname of the Elasticsearch server.output.elasticsearch: hosts: ["<elasticsearch_ip_node_1>:9200", "<elasticsearch_ip_node_2>:9200", "<elasticsearch_ip_node_3>:9200"]
Replace
elasticsearch_ip_node_x
with the IP address or the hostname of the Elasticsearch server to connect to.Configure Filebeat certificates:
During the Elasticsearch installation, the
certs.tar
file was created. This guide assumes that a copy of this file has been placed in the root home folder (~/
):# mkdir /etc/filebeat/certs # mv ~/certs.tar /etc/filebeat/certs/ # cd /etc/filebeat/certs/ # tar -xf certs.tar filebeat.pem filebeat.key root-ca.pem
Enable and start the Filebeat service:
# systemctl daemon-reload # systemctl enable filebeat # systemctl start filebeat
Choose one option according to the OS used:
RPM based OS:
# chkconfig --add filebeat # service filebeat start
Debian based OS:
# update-rc.d filebeat defaults 95 10 # service filebeat start
To ensure that Filebeat has been successfully installed, run the following command:
# filebeat test output
An example response should look as follows:
elasticsearch: https://127.0.0.1:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 127.0.0.1
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.9.1
To uninstall Wazuh and Filebeat, visit the uninstalling section.
Next steps
The next step consists of installing Kibana.