diff --git a/.gitignore b/.gitignore index 2e0067e1eb51afd8e04198192ec3b61f73253171..75db421843374a62cd204cb430694a79c296781c 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,4 @@ wazuh-ansible/ *.swp *.retry -security-monitoring-ansible/ansible/opendistro/ +ansible/opendistro/ diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000000000000000000000000000000000000..455e2a7c4e7f2aed15fd5b118cd7991cc2d5e72f --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,4 @@ +Copyright (C) 2021 XLAB d.o.o. +Use of this software allowed only to MEDINA partners for the purpose of research in the scope of MEDINA project, as specified in the MEDINA Consortium Agreement. +No commercial use allowed. +This program is distributed without any warranty. \ No newline at end of file diff --git a/security-monitoring-ansible/Makefile b/Makefile similarity index 70% rename from security-monitoring-ansible/Makefile rename to Makefile index 394e7ffbda06c325f1a897eccee47db497c26d4c..b1d23320ab5c8f612acc3f5861f043c3a5ac0dbf 100644 --- a/security-monitoring-ansible/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -ENVIRONMENT ?= vagrant-1manager-2agents +ENVIRONMENT ?= full-setup DEPLOY_DIR = $(PWD) ENV_DIR = $(DEPLOY_DIR)/environments/$(ENVIRONMENT) ANSIBLE_DIR = $(DEPLOY_DIR)/ansible @@ -7,7 +7,11 @@ include $(ENV_DIR)/$(ENVIRONMENT).mk ANSIBLE_ARGS = -i $(ENV_DIR)/inventory.txt \ -e ansible_dir=$(ANSIBLE_DIR) \ -e environment_dir=$(ENV_DIR) - + +clone-wazuh: + -git clone https://github.com/wazuh/wazuh-ansible.git > /dev/null 2>&1 + cd wazuh-ansible && git checkout tags/v4.1.5 + reprovision: @ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision-reset.yml @@ -17,5 +21,8 @@ provision-managers: provision-agents: @ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision-agents.yml +provision-evidence-collector: + @ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision-evidence-collector.yml + provision: @ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision.yml \ No newline at end of file diff --git a/README.md b/README.md index 51a3540bf8800bfb8a5632a94370c927cd39d824..a588564179e0e01e4675e2094d3006f2f867bb92 100644 --- a/README.md +++ b/README.md @@ -3,6 +3,8 @@ This project is meant for quickly setting up Wazuh instance using Ansible scripts on top infrastructure provisioned using Vagrant. +In addition to Wazuh, ClamAV is also installed to agent machines (for testing purposes). + ## Requirements * Vagrant 2.2.14 @@ -13,15 +15,20 @@ on top infrastructure provisioned using Vagrant. First, checkout Wazuh's tag `v4.1.5` into the current directory: +``` +$ make clone-wazuh +``` +or ``` $ git clone https://github.com/wazuh/wazuh-ansible.git $ git checkout tags/v4.1.5 ``` +Then select your `ENVIRONMENT` in `Makefile`. Set it to `full-setup` or `no-collector`. + 1. Provision Wazuh server and Wazuh agents: ``` -$ cd security-monitoring-ansible $ make create provision ``` @@ -36,8 +43,22 @@ You should see 2 agents registered and running with Wazuh. ``` $ PORT=8088 npx http-echo-server ``` + +## Using Evidence Collector + +To see Evidence Collector's output, `ssh` to it's machine and open Docker logs: + +``` +$ make ssh-evidence-collector +$ docker logs -ft evidence-collector +``` + ## Potential issues +### ClamAV (re)start failed/timed out + +ClamAV restart can time-out due to slow disk read/write speeds (if using HDD) and lack of memory. To resolve this, provide the machine with more RAM. Current implementation has it set to `1024` MB (which should suffice for the majoirty of host machine configurations). If you're using SSD, you can lower it to `512` MB. + ### Vagrant issue: ``` @@ -83,10 +104,8 @@ Host key verification failed. Solution: ``` -ssh-keygen -f "/home/ales/.ssh/known_hosts" -R "192.168.33.10" -ssh-keygen -f "/home/ales/.ssh/known_hosts" -R "192.168.33.11" -ssh-keygen -f "/home/ales/.ssh/known_hosts" -R "192.168.33.12" -ssh-keyscan -H 192.168.33.10 >> /home/ales/.ssh/known_hosts -ssh-keyscan -H 192.168.33.11 >> /home/ales/.ssh/known_hosts -ssh-keyscan -H 192.168.33.12 >> /home/ales/.ssh/known_hosts +ssh-keygen -f ".ssh/known_hosts" -R "192.168.33.10" +ssh-keygen -f ".ssh/known_hosts" -R "192.168.33.11" +ssh-keygen -f ".ssh/known_hosts" -R "192.168.33.12" +ssh-keygen -f ".ssh/known_hosts" -R "192.168.33.13" ``` \ No newline at end of file diff --git a/Security monitoring FISHY.png b/Security monitoring FISHY.png deleted file mode 100644 index ad46f970bbf2b11b4eaa67fad5bcfaf61586f696..0000000000000000000000000000000000000000 Binary files a/Security monitoring FISHY.png and /dev/null differ diff --git a/Security monitoring FISHY.puml b/Security monitoring FISHY.puml deleted file mode 100644 index 8cd83d8748ca7b00731de8ecf2bf0abc8c686028..0000000000000000000000000000000000000000 --- a/Security monitoring FISHY.puml +++ /dev/null @@ -1,28 +0,0 @@ -@startuml -participant "FISHY agent" as FISHY_agent -participant "Security monitoring Tool (appliance runtime)" as SecurityMonitoring #99FF99 - -group Configure FISHY security monitoring via FISHY Agent - FISHY_agent->SecurityMonitoring: Configure security monitroing - SecurityMonitoring -> SecurityMonitoring: Configure server (rules) - SecurityMonitoring -> SecurityMonitoring: Configure agents (register agents, define rules) - SecurityMonitoring -> FISHY_agent: Security monitoring configured - note over SecurityMonitoring:The server and agents should be deployed beforehand via FISHY Agent -end - -group Start security monitoring - FISHY_agent->SecurityMonitoring: Start security monitoring - SecurityMonitoring -> SecurityMonitoring : Start security monitoring - FISHY_agent<-SecurityMonitoring: Security monitoring started -end - -group Security monitoring runtime - FISHY_agent<-SecurityMonitoring: Send monitoring alert -end - -group Stop monitoring - FISHY_agent ->SecurityMonitoring: Stop security monitoring - SecurityMonitoring ->FISHY_agent: Security monitoring stopped -end - -@enduml \ No newline at end of file diff --git a/Security monitoring PIACERE.puml b/Security monitoring PIACERE.puml deleted file mode 100644 index 23cf363944bd25b79df4db9e870e53b4cc0ecb2b..0000000000000000000000000000000000000000 --- a/Security monitoring PIACERE.puml +++ /dev/null @@ -1,32 +0,0 @@ -@startuml -participant RuntimeController -participant RuntimeMonitoring -participant SecurityMonitoring #99FF99 -participant DOML -participant Selflearning - -group Configure security monitoring - RuntimeController->SecurityMonitoring: Start security monitoring configuration - SecurityMonitoring -> DOML: Acquire information about the NFRs to configure security monitoring - SecurityMonitoring -> SecurityMonitoring: Configure server (rules) - SecurityMonitoring -> SecurityMonitoring: Configure agents (register agents, define rules) - SecurityMonitoring -> RuntimeController: Security monitoring configured - note over SecurityMonitoring,RuntimeController:The server and agents should be deployed beforehand (included in the IaC already? Described within DOML/IaC implicitly?) -end - -group Start security monitoring - RuntimeController->SecurityMonitoring: Start security monitoring - SecurityMonitoring -> SecurityMonitoring : Start security monitoring - RuntimeController<-SecurityMonitoring: Security monitoring started -end - -group Security monitoring runtime - Selflearning<-SecurityMonitoring: Send notification/alarm -end - -group Stop security monitoring - RuntimeController ->SecurityMonitoring: Stop security monitoring - SecurityMonitoring ->RuntimeController: Security monitoring stopped -end - -@enduml \ No newline at end of file diff --git a/security-monitoring-ansible/ansible/clamav/tasks/install-clamav.yml b/ansible/clamav/tasks/install-clamav.yml similarity index 100% rename from security-monitoring-ansible/ansible/clamav/tasks/install-clamav.yml rename to ansible/clamav/tasks/install-clamav.yml diff --git a/security-monitoring-ansible/ansible/custom-integration/files/custom-integration b/ansible/custom-integration/files/custom-integration similarity index 100% rename from security-monitoring-ansible/ansible/custom-integration/files/custom-integration rename to ansible/custom-integration/files/custom-integration diff --git a/security-monitoring-ansible/ansible/custom-integration/files/custom-integration.py b/ansible/custom-integration/files/custom-integration.py similarity index 100% rename from security-monitoring-ansible/ansible/custom-integration/files/custom-integration.py rename to ansible/custom-integration/files/custom-integration.py diff --git a/security-monitoring-ansible/ansible/custom-integration/tasks/main.yml b/ansible/custom-integration/tasks/main.yml similarity index 100% rename from security-monitoring-ansible/ansible/custom-integration/tasks/main.yml rename to ansible/custom-integration/tasks/main.yml diff --git a/ansible/docker/credentials/credentials.yml b/ansible/docker/credentials/credentials.yml new file mode 100644 index 0000000000000000000000000000000000000000..d3e73186b46ceba31145217394d228d46c65955a --- /dev/null +++ b/ansible/docker/credentials/credentials.yml @@ -0,0 +1,4 @@ +--- +docker_registry: 'registry-gitlab.xlab.si' +docker_username: 'gitlab+deploy-token-53' +docker_token: '_yRiffnzyub8XmuJ4ugr' \ No newline at end of file diff --git a/ansible/docker/credentials/vars.yml b/ansible/docker/credentials/vars.yml new file mode 100644 index 0000000000000000000000000000000000000000..e209b5f66949fa798c1eb9450c41ce0b63578bf0 --- /dev/null +++ b/ansible/docker/credentials/vars.yml @@ -0,0 +1,3 @@ +--- +- name: include credentials + include_vars: credentials.yml \ No newline at end of file diff --git a/security-monitoring-ansible/ansible/docker/tasks/main.yml b/ansible/docker/tasks/main.yml similarity index 91% rename from security-monitoring-ansible/ansible/docker/tasks/main.yml rename to ansible/docker/tasks/main.yml index 4e0685438aa28b955dcde22a22ded8d7863eff94..42c7d248f955f73f869acaf790d1d2788eab8b43 100644 --- a/security-monitoring-ansible/ansible/docker/tasks/main.yml +++ b/ansible/docker/tasks/main.yml @@ -4,7 +4,7 @@ name: docker-ce-stable file: docker description: Docker CE Stable - $basearch - baseurl: https://download.docker.com/linux/centos/7/$basearch/stable + baseurl: https://download.docker.com/linux/centos/8/$basearch/stable enabled: yes gpgcheck: yes gpgkey: https://download.docker.com/linux/centos/gpg diff --git a/security-monitoring-ansible/ansible/globals/globals.yml b/ansible/globals/globals.yml similarity index 100% rename from security-monitoring-ansible/ansible/globals/globals.yml rename to ansible/globals/globals.yml diff --git a/security-monitoring-ansible/ansible/globals/vars.yml b/ansible/globals/vars.yml similarity index 100% rename from security-monitoring-ansible/ansible/globals/vars.yml rename to ansible/globals/vars.yml diff --git a/security-monitoring-ansible/ansible/provision-agents.yml b/ansible/provision-agents.yml similarity index 89% rename from security-monitoring-ansible/ansible/provision-agents.yml rename to ansible/provision-agents.yml index 7823533d9f4927b8baa619da0a40f682d5d12d38..b5f7fc61f052dfcb81506f8dac3e67cd226b3350 100644 --- a/security-monitoring-ansible/ansible/provision-agents.yml +++ b/ansible/provision-agents.yml @@ -5,7 +5,7 @@ pre_tasks: - import_tasks: "{{ ansible_dir }}/globals/vars.yml" roles: - - ../../../wazuh-ansible/roles/wazuh/ansible-wazuh-agent + - ../wazuh-ansible/roles/wazuh/ansible-wazuh-agent - docker vars: wazuh_managers: diff --git a/ansible/provision-evidence-collector.yml b/ansible/provision-evidence-collector.yml new file mode 100644 index 0000000000000000000000000000000000000000..627cbbe5eecc3654e96a378a4ac7f4fb489c468e --- /dev/null +++ b/ansible/provision-evidence-collector.yml @@ -0,0 +1,29 @@ +--- +# Evidence Collector + - hosts: evidence_collector + become: yes + pre_tasks: + - import_tasks: "{{ ansible_dir }}/docker/credentials/vars.yml" + roles: + - docker + tasks: + # Required by Ansible Docker module + - name: Install python3.6 + package: + name: python36 + state: present + - name: Install docker-py + pip: + name: docker-py + - name: Log in to Docker image registry + docker_login: + registry: "{{ docker_registry }}" + username: "{{ docker_username }}" + password: "{{ docker_token }}" + - name: Run Docker container + docker_container: + name: evidence-collector + image: "{{ docker_registry }}/medina/evidence-collector:latest" + state: started + pull: yes + restart_policy: always \ No newline at end of file diff --git a/security-monitoring-ansible/ansible/provision-managers.yml b/ansible/provision-managers.yml similarity index 76% rename from security-monitoring-ansible/ansible/provision-managers.yml rename to ansible/provision-managers.yml index 8c03802882477a27809635eb1e8f724643480d43..31edada492d9d5af1c5f592114084eb7bf56687f 100644 --- a/security-monitoring-ansible/ansible/provision-managers.yml +++ b/ansible/provision-managers.yml @@ -6,10 +6,10 @@ pre_tasks: - import_tasks: "{{ ansible_dir }}/globals/vars.yml" roles: - - role: ../../../wazuh-ansible/roles/opendistro/opendistro-elasticsearch - - role: ../../../wazuh-ansible/roles/wazuh/ansible-wazuh-manager - - role: ../../../wazuh-ansible/roles/wazuh/ansible-filebeat-oss - - role: ../../../wazuh-ansible/roles/opendistro/opendistro-kibana + - role: ../wazuh-ansible/roles/opendistro/opendistro-elasticsearch + - role: ../wazuh-ansible/roles/wazuh/ansible-wazuh-manager + - role: ../wazuh-ansible/roles/wazuh/ansible-filebeat-oss + - role: ../wazuh-ansible/roles/opendistro/opendistro-kibana - role: custom-integration vars: single_node: true diff --git a/ansible/provision.yml b/ansible/provision.yml new file mode 100644 index 0000000000000000000000000000000000000000..6901c339d3bad30efd718058f10e2e26e5369f31 --- /dev/null +++ b/ansible/provision.yml @@ -0,0 +1,9 @@ +--- +- name: Start provision of the Wazuh Managers + import_playbook: provision-managers.yml + +- name: Start provision of the Wazuh Agents + import_playbook: provision-agents.yml + +- name: Start provision of Evidence Collector + import_playbook: provision-evidence-collector.yml \ No newline at end of file diff --git a/environments/full-setup/Vagrantfile b/environments/full-setup/Vagrantfile new file mode 100644 index 0000000000000000000000000000000000000000..2b311d4158b39a74ff057a0b6c99714bd93d5e31 --- /dev/null +++ b/environments/full-setup/Vagrantfile @@ -0,0 +1,46 @@ +# -*- mode: ruby -*- +# vi: set ft=ruby : + +servers=[ + { + :hostname => "manager", + :ip => "192.168.33.10", + :box => "centos/8", + :ram => 2048, + :cpu => 2 + }, + { + :hostname => "agent1", + :ip => "192.168.33.11", + :box => "centos/8", + :ram => 1024, + :cpu => 1 + }, + { + :hostname => "agent2", + :ip => "192.168.33.12", + :box => "centos/8", + :ram => 1024, + :cpu => 1 + }, + { + :hostname => "evidence-collector", + :ip => "192.168.33.13", + :box => "centos/8", + :ram => 1024, + :cpu => 2 + } +] + +Vagrant.configure(2) do |config| + servers.each do |machine| + config.vm.define machine[:hostname] do |node| + node.vm.box = machine[:box] + node.vm.hostname = machine[:hostname] + node.vm.network "private_network", ip: machine[:ip] + node.vm.provider "virtualbox" do |vb| + vb.customize ["modifyvm", :id, "--memory", machine[:ram]] + end + end + end +end \ No newline at end of file diff --git a/environments/full-setup/full-setup.mk b/environments/full-setup/full-setup.mk new file mode 100644 index 0000000000000000000000000000000000000000..cf5009bb77e1e293c46321646e8509af8d9f0c12 --- /dev/null +++ b/environments/full-setup/full-setup.mk @@ -0,0 +1,21 @@ +VAGRANT_RUN = cd $(ENV_DIR) && vagrant +SSH_PRIVATE_KEY = $(HOME)/.vagrant.d/insecure_private_key +SSH_USER = vagrant + +create: + @$(VAGRANT_RUN) up + +delete: + @$(VAGRANT_RUN) destroy -f + +ssh-manager: + @$(VAGRANT_RUN) ssh manager + +ssh-agent1: + @$(VAGRANT_RUN) ssh agent1 + +ssh-agent2: + @$(VAGRANT_RUN) ssh agent2 + +ssh-evidence-collector: + @$(VAGRANT_RUN) ssh evidence-collector \ No newline at end of file diff --git a/environments/full-setup/inventory.txt b/environments/full-setup/inventory.txt new file mode 100644 index 0000000000000000000000000000000000000000..cea1c6b98ce6f4712d9641a31cfc2ecd3e68ddcc --- /dev/null +++ b/environments/full-setup/inventory.txt @@ -0,0 +1,18 @@ +[wazuh_managers] +192.168.33.10 public_ip=192.168.33.10 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/full-setup/.vagrant/machines/manager/virtualbox/private_key + +[wazuh_managers:vars] +ansible_ssh_common_args='-o StrictHostKeyChecking=no' + +[wazuh_agents] +192.168.33.11 public_ip=192.168.33.11 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/full-setup/.vagrant/machines/agent1/virtualbox/private_key +192.168.33.12 public_ip=192.168.33.12 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/full-setup/.vagrant/machines/agent2/virtualbox/private_key + +[wazuh_agents:vars] +ansible_ssh_common_args='-o StrictHostKeyChecking=no' + +[evidence_collector] +192.168.33.13 public_ip=192.168.33.13 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/full-setup/.vagrant/machines/evidence-collector/virtualbox/private_key + +[evidence_collector:vars] +ansible_ssh_common_args='-o StrictHostKeyChecking=no' \ No newline at end of file diff --git a/environments/no-collector/Vagrantfile b/environments/no-collector/Vagrantfile new file mode 100644 index 0000000000000000000000000000000000000000..33cc1da1d2bdd13f193f816be337471107f60b19 --- /dev/null +++ b/environments/no-collector/Vagrantfile @@ -0,0 +1,39 @@ +# -*- mode: ruby -*- +# vi: set ft=ruby : + +servers=[ + { + :hostname => "manager", + :ip => "192.168.33.10", + :box => "centos/8", + :ram => 2048, + :cpu => 2 + }, + { + :hostname => "agent1", + :ip => "192.168.33.11", + :box => "centos/8", + :ram => 1024, + :cpu => 1 + }, + { + :hostname => "agent2", + :ip => "192.168.33.12", + :box => "centos/8", + :ram => 1024, + :cpu => 1 + } +] + +Vagrant.configure(2) do |config| + servers.each do |machine| + config.vm.define machine[:hostname] do |node| + node.vm.box = machine[:box] + node.vm.hostname = machine[:hostname] + node.vm.network "private_network", ip: machine[:ip] + node.vm.provider "virtualbox" do |vb| + vb.customize ["modifyvm", :id, "--memory", machine[:ram]] + end + end + end +end \ No newline at end of file diff --git a/security-monitoring-ansible/environments/vagrant-1manager-2agents/inventory.txt b/environments/no-collector/inventory.txt similarity index 71% rename from security-monitoring-ansible/environments/vagrant-1manager-2agents/inventory.txt rename to environments/no-collector/inventory.txt index 2626412b402112508c979649780ceb14f1ba723c..30cfc80f8dfec844020bda2a89810f36c8a81a9a 100644 --- a/security-monitoring-ansible/environments/vagrant-1manager-2agents/inventory.txt +++ b/environments/no-collector/inventory.txt @@ -1,12 +1,12 @@ [wazuh_managers] -192.168.33.10 public_ip=192.168.33.10 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/vagrant-1manager-2agents/.vagrant/machines/manager/virtualbox/private_key +192.168.33.10 public_ip=192.168.33.10 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/no-collector/.vagrant/machines/manager/virtualbox/private_key [wazuh_managers:vars] ansible_ssh_common_args='-o StrictHostKeyChecking=no' [wazuh_agents] -192.168.33.11 public_ip=192.168.33.11 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/vagrant-1manager-2agents/.vagrant/machines/agent1/virtualbox/private_key -192.168.33.12 public_ip=192.168.33.12 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/vagrant-1manager-2agents/.vagrant/machines/agent2/virtualbox/private_key +192.168.33.11 public_ip=192.168.33.11 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/no-collector/.vagrant/machines/agent1/virtualbox/private_key +192.168.33.12 public_ip=192.168.33.12 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/no-collector/.vagrant/machines/agent2/virtualbox/private_key [wazuh_agents:vars] ansible_ssh_common_args='-o StrictHostKeyChecking=no' \ No newline at end of file diff --git a/security-monitoring-ansible/environments/vagrant-1manager-2agents/vagrant-1manager-2agents.mk b/environments/no-collector/no-collector.mk similarity index 100% rename from security-monitoring-ansible/environments/vagrant-1manager-2agents/vagrant-1manager-2agents.mk rename to environments/no-collector/no-collector.mk diff --git a/out/Security monitoring PIACERE/Security monitoring PIACERE.png b/out/Security monitoring PIACERE/Security monitoring PIACERE.png deleted file mode 100644 index 752145666405ce2e408e6b3af7dcbc71d0052e40..0000000000000000000000000000000000000000 Binary files a/out/Security monitoring PIACERE/Security monitoring PIACERE.png and /dev/null differ diff --git a/security-monitoring-ansible/README.md b/security-monitoring-ansible/README.md deleted file mode 100644 index fd4ffe8bd96f1f502358b76e997557b40737df62..0000000000000000000000000000000000000000 --- a/security-monitoring-ansible/README.md +++ /dev/null @@ -1,35 +0,0 @@ -# Security Monitoring - -This project is meant for quickly setting up Wazuh instance using Ansible scripts -on top infrastructure provisioned using Vagrant. - -In addition to Wazuh, ClamAV is also installed to agent machines (for testing purposes). - -## Requirements - - * Vagrant 2.2.14 - * Ansible 2.9.16 - -## Setting up the demo - -First, checkout Wazuh's tag `v4.1.5` into the directory above the current one: - -``` -$ cd .. -$ git clone https://github.com/wazuh/wazuh-ansible.git -$ git checkout tags/v4.1.5 -``` - -1. Provision Wazuh server and Wazuh agents: - -``` -[sre maj 12][10:31:32][ales@~/workspace/PIACERE/security-monitoring/security-monitoring-ansible] -$ make create provision - -``` - -2. Check the running instances: - -Navigate browser to: `https://192.168.33.10:5601`, login with default credentials `admin:changeme`. Navigate to `wazuh` section on the left hand-side. - -You should see 2 agents registered and running with Wazuh. \ No newline at end of file diff --git a/security-monitoring-ansible/ansible/provision.yml b/security-monitoring-ansible/ansible/provision.yml deleted file mode 100644 index a4ff61d0e660002b2d7130a081fafeac02332740..0000000000000000000000000000000000000000 --- a/security-monitoring-ansible/ansible/provision.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -- name: Start provision of the Wazuh Managers - import_playbook: provision-managers.yml - -- name: Start provision of the Wazuh Agents - import_playbook: provision-agents.yml \ No newline at end of file diff --git a/security-monitoring-ansible/environments/vagrant-1manager-2agents/Vagrantfile b/security-monitoring-ansible/environments/vagrant-1manager-2agents/Vagrantfile deleted file mode 100644 index 157229a6ea4fb84c503fc64207d59efa679ae6be..0000000000000000000000000000000000000000 --- a/security-monitoring-ansible/environments/vagrant-1manager-2agents/Vagrantfile +++ /dev/null @@ -1,51 +0,0 @@ -# -*- mode: ruby -*- -# vi: set ft=ruby : - -servers=[ - { - :hostname => "manager", - :ip => "192.168.33.10", - :box => "centos/7", - :ram => 4096, - :cpu => 2 - }, - { - :hostname => "agent1", - :ip => "192.168.33.11", - :box => "centos/7", - :ram => 512, - :cpu => 1 - }, - { - :hostname => "agent2", - :ip => "192.168.33.12", - :box => "centos/7", - :ram => 512, - :cpu => 1 - } -] - -Vagrant.configure(2) do |config| - servers.each do |machine| - config.vm.define machine[:hostname] do |node| - # Can cause error: - # "You are trying to forward a host IP that does not exist. Please set `host_ip` - # to the address of an existing IPv4 network interface, or remove the option - # from your port forward configuration." - if machine[:hostname] == "manager" - node.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "192.168.33.10" - node.vm.network "forwarded_port", guest: 443, host: 8443 , host_ip: "192.168.33.10" - node.vm.network "forwarded_port", guest: 55000, host: 55000 , host_ip: "192.168.33.10" - node.vm.network "forwarded_port", guest: 1514, host: 1514 , host_ip: "192.168.33.10" - node.vm.network "forwarded_port", guest: 1515, host: 1515 , host_ip: "192.168.33.10" - node.vm.network "forwarded_port", guest: 1516, host: 1516 , host_ip: "192.168.33.10" - end - node.vm.box = machine[:box] - node.vm.hostname = machine[:hostname] - node.vm.network "private_network", ip: machine[:ip] - node.vm.provider "virtualbox" do |vb| - vb.customize ["modifyvm", :id, "--memory", machine[:ram]] - end - end - end -end \ No newline at end of file diff --git a/security-monitoring-architecture.puml b/security-monitoring-architecture.puml deleted file mode 100644 index c400e8a907f0316650f0f363c84f710a3f5c980a..0000000000000000000000000000000000000000 --- a/security-monitoring-architecture.puml +++ /dev/null @@ -1,31 +0,0 @@ -@startuml -skinparam nodesep 5 - -package "Wazuh Server" { - [Kibana server] - [Kibana server] --> [ElasticSearch]: KQL - [Wazuh cluster] --> [ElasticSearch]: Filebeat -} -interface "Log collector" as LC -interface "File integrity monitoring" as FIM -interface "Command execution" as CE -interface "Security configuration assessment" as SCA -interface "Malware detection" as MD -interface "System inventory" as SI -interface "Cloud security monitoring" as SCM -interface "Container security monitoring" as CSM - -LC -down- [Wazuh agent] -CE -down- [Wazuh agent] -FIM -down- [Wazuh agent] -SCA -down- [Wazuh agent] - -MD -down- [Wazuh agent] -SI -down- [Wazuh agent] -SCM -down- [Wazuh agent] -CSM -down- [Wazuh agent] - - -[Wazuh agent] --> [Wazuh cluster]: TCP or UDP (encrypted) - -@enduml \ No newline at end of file