From b458e2c14256283cb04679074f4b5657ff9b56b9 Mon Sep 17 00:00:00 2001 From: Matevz Erzen <matevz.erzen@xlab.si> Date: Mon, 18 Oct 2021 17:13:44 +0200 Subject: [PATCH] Changed repo structure --- .gitignore | 2 +- .../Makefile => Makefile | 0 README.md | 3 +- .../clamav/tasks/install-clamav.yml | 0 .../files/custom-integration | 0 .../files/custom-integration.py | 0 .../custom-integration/tasks/main.yml | 0 .../docker/credentials/credentials.yml | 0 .../docker/credentials/vars.yml | 0 .../ansible => ansible}/docker/tasks/main.yml | 0 .../ansible => ansible}/globals/globals.yml | 0 .../ansible => ansible}/globals/vars.yml | 0 .../ansible => ansible}/provision-agents.yml | 2 +- .../provision-evidence-collector.yml | 1 - .../provision-managers.yml | 8 ++--- .../ansible => ansible}/provision.yml | 0 .../vagrant-full-setup/Vagrantfile | 0 .../vagrant-full-setup/inventory.txt | 0 .../vagrant-full-setup/vagrant-full-setup.mk | 0 security-monitoring-ansible/README.md | 35 ------------------- 20 files changed, 8 insertions(+), 43 deletions(-) rename security-monitoring-ansible/Makefile => Makefile (100%) rename {security-monitoring-ansible/ansible => ansible}/clamav/tasks/install-clamav.yml (100%) rename {security-monitoring-ansible/ansible => ansible}/custom-integration/files/custom-integration (100%) rename {security-monitoring-ansible/ansible => ansible}/custom-integration/files/custom-integration.py (100%) rename {security-monitoring-ansible/ansible => ansible}/custom-integration/tasks/main.yml (100%) rename {security-monitoring-ansible/ansible => ansible}/docker/credentials/credentials.yml (100%) rename {security-monitoring-ansible/ansible => ansible}/docker/credentials/vars.yml (100%) rename {security-monitoring-ansible/ansible => ansible}/docker/tasks/main.yml (100%) rename {security-monitoring-ansible/ansible => ansible}/globals/globals.yml (100%) rename {security-monitoring-ansible/ansible => ansible}/globals/vars.yml (100%) rename {security-monitoring-ansible/ansible => ansible}/provision-agents.yml (89%) rename {security-monitoring-ansible/ansible => ansible}/provision-evidence-collector.yml (96%) rename {security-monitoring-ansible/ansible => ansible}/provision-managers.yml (76%) rename {security-monitoring-ansible/ansible => ansible}/provision.yml (100%) rename {security-monitoring-ansible/environments => environments}/vagrant-full-setup/Vagrantfile (100%) rename {security-monitoring-ansible/environments => environments}/vagrant-full-setup/inventory.txt (100%) rename {security-monitoring-ansible/environments => environments}/vagrant-full-setup/vagrant-full-setup.mk (100%) delete mode 100644 security-monitoring-ansible/README.md diff --git a/.gitignore b/.gitignore index 2e0067e..75db421 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,4 @@ wazuh-ansible/ *.swp *.retry -security-monitoring-ansible/ansible/opendistro/ +ansible/opendistro/ diff --git a/security-monitoring-ansible/Makefile b/Makefile similarity index 100% rename from security-monitoring-ansible/Makefile rename to Makefile diff --git a/README.md b/README.md index d4be5ba..6e15ac1 100644 --- a/README.md +++ b/README.md @@ -3,6 +3,8 @@ This project is meant for quickly setting up Wazuh instance using Ansible scripts on top infrastructure provisioned using Vagrant. +In addition to Wazuh, ClamAV is also installed to agent machines (for testing purposes). + ## Requirements * Vagrant 2.2.14 @@ -21,7 +23,6 @@ $ git checkout tags/v4.1.5 1. Provision Wazuh server and Wazuh agents: ``` -$ cd security-monitoring-ansible $ make create provision ``` diff --git a/security-monitoring-ansible/ansible/clamav/tasks/install-clamav.yml b/ansible/clamav/tasks/install-clamav.yml similarity index 100% rename from security-monitoring-ansible/ansible/clamav/tasks/install-clamav.yml rename to ansible/clamav/tasks/install-clamav.yml diff --git a/security-monitoring-ansible/ansible/custom-integration/files/custom-integration b/ansible/custom-integration/files/custom-integration similarity index 100% rename from security-monitoring-ansible/ansible/custom-integration/files/custom-integration rename to ansible/custom-integration/files/custom-integration diff --git a/security-monitoring-ansible/ansible/custom-integration/files/custom-integration.py b/ansible/custom-integration/files/custom-integration.py similarity index 100% rename from security-monitoring-ansible/ansible/custom-integration/files/custom-integration.py rename to ansible/custom-integration/files/custom-integration.py diff --git a/security-monitoring-ansible/ansible/custom-integration/tasks/main.yml b/ansible/custom-integration/tasks/main.yml similarity index 100% rename from security-monitoring-ansible/ansible/custom-integration/tasks/main.yml rename to ansible/custom-integration/tasks/main.yml diff --git a/security-monitoring-ansible/ansible/docker/credentials/credentials.yml b/ansible/docker/credentials/credentials.yml similarity index 100% rename from security-monitoring-ansible/ansible/docker/credentials/credentials.yml rename to ansible/docker/credentials/credentials.yml diff --git a/security-monitoring-ansible/ansible/docker/credentials/vars.yml b/ansible/docker/credentials/vars.yml similarity index 100% rename from security-monitoring-ansible/ansible/docker/credentials/vars.yml rename to ansible/docker/credentials/vars.yml diff --git a/security-monitoring-ansible/ansible/docker/tasks/main.yml b/ansible/docker/tasks/main.yml similarity index 100% rename from security-monitoring-ansible/ansible/docker/tasks/main.yml rename to ansible/docker/tasks/main.yml diff --git a/security-monitoring-ansible/ansible/globals/globals.yml b/ansible/globals/globals.yml similarity index 100% rename from security-monitoring-ansible/ansible/globals/globals.yml rename to ansible/globals/globals.yml diff --git a/security-monitoring-ansible/ansible/globals/vars.yml b/ansible/globals/vars.yml similarity index 100% rename from security-monitoring-ansible/ansible/globals/vars.yml rename to ansible/globals/vars.yml diff --git a/security-monitoring-ansible/ansible/provision-agents.yml b/ansible/provision-agents.yml similarity index 89% rename from security-monitoring-ansible/ansible/provision-agents.yml rename to ansible/provision-agents.yml index 7823533..b5f7fc6 100644 --- a/security-monitoring-ansible/ansible/provision-agents.yml +++ b/ansible/provision-agents.yml @@ -5,7 +5,7 @@ pre_tasks: - import_tasks: "{{ ansible_dir }}/globals/vars.yml" roles: - - ../../../wazuh-ansible/roles/wazuh/ansible-wazuh-agent + - ../wazuh-ansible/roles/wazuh/ansible-wazuh-agent - docker vars: wazuh_managers: diff --git a/security-monitoring-ansible/ansible/provision-evidence-collector.yml b/ansible/provision-evidence-collector.yml similarity index 96% rename from security-monitoring-ansible/ansible/provision-evidence-collector.yml rename to ansible/provision-evidence-collector.yml index 66aa618..627cbbe 100644 --- a/security-monitoring-ansible/ansible/provision-evidence-collector.yml +++ b/ansible/provision-evidence-collector.yml @@ -20,7 +20,6 @@ registry: "{{ docker_registry }}" username: "{{ docker_username }}" password: "{{ docker_token }}" - reauthorize: yes - name: Run Docker container docker_container: name: evidence-collector diff --git a/security-monitoring-ansible/ansible/provision-managers.yml b/ansible/provision-managers.yml similarity index 76% rename from security-monitoring-ansible/ansible/provision-managers.yml rename to ansible/provision-managers.yml index 8c03802..31edada 100644 --- a/security-monitoring-ansible/ansible/provision-managers.yml +++ b/ansible/provision-managers.yml @@ -6,10 +6,10 @@ pre_tasks: - import_tasks: "{{ ansible_dir }}/globals/vars.yml" roles: - - role: ../../../wazuh-ansible/roles/opendistro/opendistro-elasticsearch - - role: ../../../wazuh-ansible/roles/wazuh/ansible-wazuh-manager - - role: ../../../wazuh-ansible/roles/wazuh/ansible-filebeat-oss - - role: ../../../wazuh-ansible/roles/opendistro/opendistro-kibana + - role: ../wazuh-ansible/roles/opendistro/opendistro-elasticsearch + - role: ../wazuh-ansible/roles/wazuh/ansible-wazuh-manager + - role: ../wazuh-ansible/roles/wazuh/ansible-filebeat-oss + - role: ../wazuh-ansible/roles/opendistro/opendistro-kibana - role: custom-integration vars: single_node: true diff --git a/security-monitoring-ansible/ansible/provision.yml b/ansible/provision.yml similarity index 100% rename from security-monitoring-ansible/ansible/provision.yml rename to ansible/provision.yml diff --git a/security-monitoring-ansible/environments/vagrant-full-setup/Vagrantfile b/environments/vagrant-full-setup/Vagrantfile similarity index 100% rename from security-monitoring-ansible/environments/vagrant-full-setup/Vagrantfile rename to environments/vagrant-full-setup/Vagrantfile diff --git a/security-monitoring-ansible/environments/vagrant-full-setup/inventory.txt b/environments/vagrant-full-setup/inventory.txt similarity index 100% rename from security-monitoring-ansible/environments/vagrant-full-setup/inventory.txt rename to environments/vagrant-full-setup/inventory.txt diff --git a/security-monitoring-ansible/environments/vagrant-full-setup/vagrant-full-setup.mk b/environments/vagrant-full-setup/vagrant-full-setup.mk similarity index 100% rename from security-monitoring-ansible/environments/vagrant-full-setup/vagrant-full-setup.mk rename to environments/vagrant-full-setup/vagrant-full-setup.mk diff --git a/security-monitoring-ansible/README.md b/security-monitoring-ansible/README.md deleted file mode 100644 index fd4ffe8..0000000 --- a/security-monitoring-ansible/README.md +++ /dev/null @@ -1,35 +0,0 @@ -# Security Monitoring - -This project is meant for quickly setting up Wazuh instance using Ansible scripts -on top infrastructure provisioned using Vagrant. - -In addition to Wazuh, ClamAV is also installed to agent machines (for testing purposes). - -## Requirements - - * Vagrant 2.2.14 - * Ansible 2.9.16 - -## Setting up the demo - -First, checkout Wazuh's tag `v4.1.5` into the directory above the current one: - -``` -$ cd .. -$ git clone https://github.com/wazuh/wazuh-ansible.git -$ git checkout tags/v4.1.5 -``` - -1. Provision Wazuh server and Wazuh agents: - -``` -[sre maj 12][10:31:32][ales@~/workspace/PIACERE/security-monitoring/security-monitoring-ansible] -$ make create provision - -``` - -2. Check the running instances: - -Navigate browser to: `https://192.168.33.10:5601`, login with default credentials `admin:changeme`. Navigate to `wazuh` section on the left hand-side. - -You should see 2 agents registered and running with Wazuh. \ No newline at end of file -- GitLab