Open Source Security Blogs

Wazuh in K8S (Kubernetes): Enable archives index & get all events

Capturing all coming logs and visualizing them can be a requirement and
enabling that option in an on-prem environment can be achieved as described
in the official guide here https://documentation.wazuh.com/4.4/user-manual/manager/wazuh-archives.html; however, In K8s, restarting the
Filebeat service causes restarting the Wazuh manager pod which will wipe
up the changes and revert the initial configuration (archives disabled).

This article describes how to enable archives in Filebeat and visualize your
archives logs:

Configuration:

Assuming that you have deployed following the official guide https://documentation.wazuh.com/4.4/deployment-options/deploying-
with-kubernetes/kubernetes-deployment.html and you have enabled the
logall_json option (https://documentation.wazuh.com/current/user-
manual/reference/ossec-conf/global.html#logall-json) also it is worth mentioning that the version while writing the post is v4.4.0 as the folder/files path may differ.

  • Add the custom under filebeat.yml that should have the archives enabled /yourpath/wazuh-kubernetes/wazuh/wazuh_managers/wazuh_conf/
# Wazuh - Filebeat configuration file
filebeat.modules:
  - module: wazuh
    alerts:
      enabled: true
    archives:
      enabled: true
  • Add the file name within the file /yourpath/wazuh-kubernetes/wazuh/kustomization.yml in ConfigMapGenerator under wazuh-conf:
configMapGenerator:
  - name: indexer-conf
    files:
      - indexer_stack/wazuh-indexer/indexer_conf/opensearch.yml
      - indexer_stack/wazuh-indexer/indexer_conf/internal_users.yml
  - name: wazuh-conf
    files:
      - wazuh_managers/wazuh_conf/master.conf
      - wazuh_managers/wazuh_conf/worker.conf
      - wazuh_managers/wazuh_conf/filebeat.yml
  • Add a new mount within the wazuh-master-sts.yml and wazuh-worker-sts.yml located in /yourpath/wazuh-kubernetes/wazuh/wazuh_managers:
volumeMounts:
   - name: config
     mountPath: /etc/filebeat/filebeat.yml
     subPath: filebeat.yml
  • Apply the changes kubectl apply -k envs/eks/

I hope you find it helpful 😀

EL WALI KARKOUB

, , , ,

92 responses to “Wazuh in K8S (Kubernetes): Enable archives index & get all events”

  13. Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  28. … [Trackback]

    […] There you will find 25206 more Infos: opensourcesecurityblogs.com/wazuh-in-k8s-kubernetes-enablearchives-index-get-all-events/ […]

  29. 461277 411425I like this web website extremely a lot, Its a truly nice billet to read and obtain info . 600672

  72. Hello I am so happy I found your blog page, I really found you
    by accident, while I was looking on Bing for something else, Anyways I am
    here now and would just like to say kudos for a incredible post
    and a all round exciting blog (I also love the
    theme/design), I don’t have time to read it all at the minute but I have book-marked it and also added
    in your RSS feeds, so when I have time I will be back to
    read a great deal more, Please do keep up the
    awesome b.

    My blog – nordvpn coupons inspiresensation (http://come.ac/)

  87. Fantastic goods from you, man. I have understand your stuff previous to and you are just
    extremely fantastic. I actually like what you’ve acquired here, certainly like what
    you are saying and the way in which you say it. You make it
    entertaining and you still care for to keep it wise.

    I cant wait to read far more from you. This is really a great
    web site.

    Here is my site: nordvpn coupons inspiresensation

  88. Just wish to say your article is as astonishing.
    The clearness in your post is just excellent and i could assume you’re an expert on this subject.
    Fine with your permission let me to grab your feed to keep up
    to date with forthcoming post. Thanks a million and please carry on the gratifying work.

    my page … nordvpn coupons inspiresensation, t.co,

Leave a Reply

Your email address will not be published. Required fields are marked *