Migrating to the Wazuh dashboard

Follow this guide to migrate from Open Distro for Elasticsearch Kibana 1.13 to the Wazuh dashboard. These instructions are intended for a standard Wazuh installation, you may need to make some changes to adapt them to your environment.

To guarantee a correct operation of Wazuh, make sure to also migrate from Open Distro for Elasticsearch to the Wazuh indexer. To learn more, see the Migrating to the Wazuh indexer documentation.

Note

You need root user privileges to run all the commands described below.

  1. Stop the Kibana service.

    Systemd

    SysV init

    # systemctl stop kibana

    # service kibana stop

  2. Add the Wazuh repository. You can skip this step if the repository is already present and enabled on your server.

    Yum

    APT

    1. Import the GPG key.

      # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

    2. Add the repository.

      # echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1' | tee /etc/yum.repos.d/wazuh.repo

    1. Install the following packages if missing.

      # apt-get install gnupg apt-transport-https

    2. Install the GPG key.

      # curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

    3. Add the repository.

      # echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

    4. Update the packages information.

      # apt-get update

  3. Install the Wazuh dashboard package.

    Yum

    APT

    # yum -y install wazuh-dashboard

    # apt-get -y install wazuh-dashboard

    Note

    Make sure that your Wazuh manager is updated to the latest version. To learn more, see Upgrading the Wazuh server.

  4. Create the /etc/wazuh-dashboard/certs directory, copy your old certificates to the new location and change ownership and permissions.

    # mkdir /etc/wazuh-dashboard/certs
# cp /etc/kibana/certs/kibana.pem /etc/wazuh-dashboard/certs/dashboard.pem
# cp /etc/kibana/certs/kibana-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
# cp /etc/kibana/certs/root-ca.pem /etc/wazuh-dashboard/certs/root-ca.pem
# chmod 500 /etc/wazuh-dashboard/certs
# chmod 400 /etc/wazuh-dashboard/certs/*
# chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs

  5. Port your settings from /etc/kibana/kibana.yml to the /etc/wazuh-dashboard/opensearch_dashboards.yml file. You can omit the opensearch.username and the opensearch.password settings as they are now stored in the Wazuh dashboard keystore.

    server.host: 0.0.0.0
server.port: 443
opensearch.hosts: https://localhost:9200
opensearch.ssl.verificationMode: certificate
#opensearch.username:
#opensearch.password:
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
opensearch_security.multitenancy.enabled: false
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
server.ssl.enabled: true
server.ssl.key: "/etc/wazuh-dashboard/certs/dashboard-key.pem"
server.ssl.certificate: "/etc/wazuh-dashboard/certs/dashboard.pem"
opensearch.ssl.certificateAuthorities: ["/etc/wazuh-dashboard/certs/root-ca.pem"]
uiSettings.overrides.defaultRoute: /app/wazuh

  6. Add the password of the kibanaserver user to the Wazuh dashboard keystore. Execute the command below and follow the instructions. You may find your old password in the /etc/kibana/kibana.yml configuration file.

    /usr/share/wazuh-dashboard/bin/opensearch-dashboards-keystore --allow-root add opensearch.password

    Optional action - To change the default user, run the following command. You will need to change the password accordingly.

    /usr/share/wazuh-dashboard/bin/opensearch-dashboards-keystore --allow-root add opensearch.username

  7. Enable and start the Wazuh dashboard service.

    Systemd

    SysV init

    # systemctl daemon-reload
# systemctl enable wazuh-dashboard
# systemctl start wazuh-dashboard

    Choose one option according to your operating system:

    1. RPM-based operating system:

    # chkconfig --add wazuh-dashboard
# service wazuh-dashboard start

    1. Debian-based operating system:

    # update-rc.d wazuh-dashboard defaults 95 10
# service wazuh-dashboard start

  8. Port your settings from /usr/share/kibana/data/wazuh/config/wazuh.yml to /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml. It is recommended to copy the content from /usr/share/kibana/data/wazuh/downloads/ as well.

  9. Access the Wazuh web interface at https://<dashboard_ip> with your credentials and make sure that everything is working as expected.

  10. Uninstall Kibana.

    Yum

    APT

    # yum remove opendistroforelasticsearch-kibana

    There are files marked as configuration and data files. Due to this designation, the package manager does not remove those files from the filesystem. The complete file removal action is on user's responsibility. It can be done by removing the folder /var/lib/kibana and /etc/kibana.

    # apt-get remove opendistroforelasticsearch-kibana

    There are files marked as configuration and data files. Due to this designation, the package manager does not remove those files from the filesystem. A complete file removal can be done using the following command:

    # apt-get remove --purge opendistroforelasticsearch-kibana