-
SSO failed after Upgrading Opensearch or Wazuh 4.9.0 : failed parsing SAML config Or 500 internal error
In the latest versions (Wazuh 4.9.0 & OpenSearch 2.10*), SSO has updated the exchange_key format requirements (see: exchange key settings), now mandating it to be 64 characters long. This guide outlines three methods to generate the exchange key. If one method doesn’t resolve the issue, proceed to the next. Apply the change to the /etc/wazuh-indexer/opensearch-security/config.yml…
-
Monitor Docker Containers Resources using Wazuh
Use case: Monitor CPU and memory usage of docker containers using Wazuh. Wazuh Configuration: Within the Wazuh UI, Navigate to Management -> Groups then edit the group configuration to add: The above command will be executed every minute to send an update about the resources to the Wazuh manager. Then add the decoders and rules to parse…
-
Get notified when Elasticsearch/Wazuh Indexer/ OpenSearch stops indexing data
Prerequisites: Use case: Monitor Wazuh indexer/Elasticsearch/Opensearch Indexing and get a discord notification if no events indexed for the last 5 minutes. Monitoring Script: Wazuh Manager Configuration: Place the script in the Wazuh manager under the path /var/ossec/integrations assigning the following permissions and ownership: Add the configuration to run the script and the rules to trigger the alerts…
-
Discord & Wazuh Integration
Discord is a popular communication platform where people chat, share info, and connect. Integrating Wazuh alerts into Discord is key for quick and effective security updates. It can be deemed as a security guard in your digital hangout, making sure everyone stays informed and acts fast if there’s a potential threat. In this guide, we’ll…
-
Wazuh in K8S (Kubernetes): Enable archives index & get all events
Capturing all coming logs and visualizing them can be a requirement andenabling that option in an on-prem environment can be achieved as describedin the official guide here https://documentation.wazuh.com/4.4/user-manual/manager/wazuh-archives.html; however, In K8s, restarting theFilebeat service causes restarting the Wazuh manager pod which will wipeup the changes and revert the initial configuration (archives disabled). This article describes…
-
Enrich Wazuh indices using Elasticsearch ingest Set processor
Elasticsearch offers various processors configurable within the ingest pipelinesallowing you to perform transformations over the data. In this write-up, I will use the Set processor https://www.elastic.co/guide/en/elasticsearch/reference/current/set-processor.html to enrich the Wazuh alerts indices. Use case: Add a flag/field to distinguish between servers in different data centers, knowingthat each data center has servers with unique Operating System.…