Wazuh cluster installation

This document will go through the installation of the Wazuh manager and the Splunk forwarder.

Note

Root user privileges are required to run all the commands described below.

Prerequisites

Before installing the Wazuh server and the Splunk forwarder, some extra packages must be installed:

Install all the required utilities:

# yum install curl

Installing the Wazuh server

The Wazuh server collects and analyzes data from the deployed Wazuh agents. It runs the Wazuh manager, the Wazuh API, and the Splunk forwarder. The first step to set up Wazuh is adding the Wazuh's repository to the server, alternatively, all the available packages can be found here.

Adding the Wazuh repository

  1. Import the GPG key:

    # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

  2. Add the repository:

    # cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-\$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

Installing the Wazuh manager

Install the Wazuh manager package:

# yum install wazuh-manager-4.1.5-1

Choose the corresponding tab to configure the installation as a single-node or multi-node clustes:

  1. Enable and start the Wazuh manager service:

    # systemctl daemon-reload
# systemctl enable wazuh-manager
# systemctl start wazuh-manager

  2. Run the following command to check if the Wazuh manager is active:

    # systemctl status wazuh-manager

Install and configure Splunk Forwarder

A Splunk Forwarder is required in order to send alerts to the indexer.

Depending on the type of architecture that you're installing, the Splunk Forwarder is configured differently.

Warning

  • On a single-instance architecture, the forwarder must point to the Splunk Enterprise instance where the Wazuh app was installed.

  • On a multi-instance architecture, the forwarder must point to the search peers (or indexers).

  1. Download Splunk Forwarder v8.1.3 package from the official website.

  2. Install the Wazuh manager package:

# yum install splunkforwarder-package.rpm

  1. Ensure Splunk Forwarder v8.1.3 is installed in /opt/splunkforwarder.

Configuration process

This section explains how to configure the Splunk Forwarder to send alerts to the Indexer component.

  • props.conf : In order to consume data inputs, Splunk needs to specify what kind of format will handle.

  • inputs.conf : The Splunk Forwarder needs this file to read data from an input. In this case, the Wazuh alerts file.

Configuring props

  1. Download and insert the props.conf template:

    # curl -so /opt/splunkforwarder/etc/system/local/props.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.1.5-8.1.3/setup/forwarder/props.conf

  2. Download and insert the inputs.conf template:

    # curl -so /opt/splunkforwarder/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.1.5-8.1.3/setup/forwarder/inputs.conf

  3. Set the Wazuh manager hostname:

    # sed -i "s:MANAGER_HOSTNAME:$(hostname):g" /opt/splunkforwarder/etc/system/local/inputs.conf

Set up data forwarding

  1. Point Forwarder output to Wazuh's Splunk Indexer with the following command:

    # /opt/splunkforwarder/bin/splunk add forward-server <INDEXER_IP>:<INDEXER_PORT>

    • INDEXER_IP is the IP address of the Splunk Indexer.

    • INDEXER_PORT is the port of the Splunk Indexer. By default it's 9997.

  2. Restart Splunk Forwarder service:

    # /opt/splunkforwarder/bin/splunk restart

    Warning

    If you get an error message about the port 8089 already being in use, you can change it to use a different one.

    After installing the Splunk Forwarder, incoming data should appear in the designated Indexer.

  3. Optional. If you additionally want the Splunk Forwarder service to start at boot time, please execute the following command:

    # /opt/splunkforwarder/bin/splunk enable boot-start