diff --git a/CHANGELOG.md b/CHANGELOG.md index e0ef16a9a7..7962e91358 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -56,6 +56,16 @@ All notable changes to this project will be documented in this file. - Updated Filebeat module revision to `0.4`. ([#6861](https://github.com/wazuh/wazuh-documentation/pull/6861)) - Updated AWS, Azure, and GCP cloud security dependency installation steps. ([#6847](https://github.com/wazuh/wazuh-documentation/pull/6847)) - Updated the vulnerability detection (VD) sections following the VD module refactor. ([#6792](https://github.com/wazuh/wazuh-documentation/pull/6792)) +- Updated screenshot and module reference from **Security events** to **Threat Hunting** in Amazon Security Lake section. ([#6956](https://github.com/wazuh/wazuh-documentation/pull/6956)) +- Improved steps in the Google Cloud Platform prerequisites section. ([#6964](https://github.com/wazuh/wazuh-documentation/pull/6964)) + +### Fixed + +- Added the ``wazuh::repo`` class in Puppet manifest example in install Wazuh agent via Puppet section. ([#6954](https://github.com/wazuh/wazuh-documentation/pull/6954)) +- Added the ``-i`` option to the cluster initialization command in the offline installation guide. ([#6945](https://github.com/wazuh/wazuh-documentation/pull/6945)) +- Removed steps to modify the number of shards from the offline installation guide. ([#6958](https://github.com/wazuh/wazuh-documentation/pull/6958)) +- Fixed password update step for distributed deployments. ([#6967](https://github.com/wazuh/wazuh-documentation/pull/6967)) +- Added fixes and updates to the MITRE ATT&CK framework section. ([#6962](https://github.com/wazuh/wazuh-documentation/pull/6962)) ### Removed diff --git a/requirements.txt b/requirements.txt index 1e7a2636b6..f20148b487 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4,6 +4,6 @@ sphinxcontrib-applehelp==1.0.4 sphinxcontrib-htmlhelp==2.0.1 docutils==0.18.1 jsmin==3.0.1 -Jinja2==3.1.2 +Jinja2==3.1.3 Pygments==2.15.1 sphinx-reredirects==0.1.2 \ No newline at end of file diff --git a/source/_static/js/redirects.js b/source/_static/js/redirects.js index 81f264f403..dd631924bf 100644 --- a/source/_static/js/redirects.js +++ b/source/_static/js/redirects.js @@ -101,6 +101,7 @@ removedUrls['4.9'] = [ newUrls['4.8'] = [ '/release-notes/release-4-8-0.html', + '/release-notes/release-4-8-1.html', '/release-notes/release-4-8-2.html', ]; @@ -143,6 +144,26 @@ newUrls['4.7'] = [ '/release-notes/release-4-7-2.html', '/cloud-security/azure/posture-management.html', '/cloud-security/gcp/posture-management.html', + '/cloud-service/archive-data/index.html', + '/cloud-service/archive-data/access.html', + '/cloud-service/archive-data/configuration.html', + '/cloud-service/archive-data/filename-format.html', + '/cloud-service/getting-started/enroll-agents.html', + '/cloud-service/your-environment/limits.html', + '/cloud-service/your-environment/settings.html', + '/user-manual/capabilities/malware-detection/osquery.html', +]; + +/* Pages no longer available in 4.7 */ + + +removedUrls['4.7'] = [ + '/cloud-service/cold-storage/index.html', + '/cloud-service/cold-storage/access.html', + '/cloud-service/cold-storage/configuration.html', + '/cloud-service/cold-storage/filename-format.html', + '/cloud-service/getting-started/register-agents.html', + '/user-manual/capabilities/osquery.html', ]; /* *** RELEASE 4.6 ****/ diff --git a/source/_themes/wazuh_doc_theme_v3/package-lock.json b/source/_themes/wazuh_doc_theme_v3/package-lock.json index eb515a1e36..b695494b88 100644 --- a/source/_themes/wazuh_doc_theme_v3/package-lock.json +++ b/source/_themes/wazuh_doc_theme_v3/package-lock.json @@ -90,13 +90,76 @@ "dev": true }, "@babel/helper-function-name": { - "version": "7.22.5", - "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.22.5.tgz", - "integrity": "sha512-wtHSq6jMRE3uF2otvfuD3DIvVhOsSNshQl0Qrd7qC9oQJzHvOL4qQXlQn2916+CXGywIjpGuIkoyZRRxHPiNQQ==", + "version": "7.23.0", + "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.23.0.tgz", + "integrity": "sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==", "dev": true, "requires": { - "@babel/template": "^7.22.5", - "@babel/types": "^7.22.5" + "@babel/template": "^7.22.15", + "@babel/types": "^7.23.0" + }, + "dependencies": { + "@babel/code-frame": { + "version": "7.23.5", + "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.23.5.tgz", + "integrity": "sha512-CgH3s1a96LipHCmSUmYFPwY7MNx8C3avkq7i4Wl3cfa662ldtUe4VM1TPXX70pfmrlWTb6jLqTYrZyT2ZTJBgA==", + "dev": true, + "requires": { + "@babel/highlight": "^7.23.4", + "chalk": "^2.4.2" + } + }, + "@babel/helper-string-parser": { + "version": "7.23.4", + "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.23.4.tgz", + "integrity": "sha512-803gmbQdqwdf4olxrX4AJyFBV/RTr3rSmOj0rKwesmzlfhYNDEs+/iOcznzpNWlJlIlTJC2QfPFcHB6DlzdVLQ==", + "dev": true + }, + "@babel/helper-validator-identifier": { + "version": "7.22.20", + "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz", + "integrity": "sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==", + "dev": true + }, + "@babel/highlight": { + "version": "7.23.4", + "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.23.4.tgz", + "integrity": "sha512-acGdbYSfp2WheJoJm/EBBBLh/ID8KDc64ISZ9DYtBmC8/Q204PZJLHyzeB5qMzJ5trcOkybd78M4x2KWsUq++A==", + "dev": true, + "requires": { + "@babel/helper-validator-identifier": "^7.22.20", + "chalk": "^2.4.2", + "js-tokens": "^4.0.0" + } + }, + "@babel/parser": { + "version": "7.23.6", + "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.6.tgz", + "integrity": "sha512-Z2uID7YJ7oNvAI20O9X0bblw7Qqs8Q2hFy0R9tAfnfLkp5MW0UH9eUvnDSnFwKZ0AvgS1ucqR4KzvVHgnke1VQ==", + "dev": true + }, + "@babel/template": { + "version": "7.22.15", + "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.22.15.tgz", + "integrity": "sha512-QPErUVm4uyJa60rkI73qneDacvdvzxshT3kksGqlGWYdOTIUOwJ7RDUL8sGqslY1uXWSL6xMFKEXDS3ox2uF0w==", + "dev": true, + "requires": { + "@babel/code-frame": "^7.22.13", + "@babel/parser": "^7.22.15", + "@babel/types": "^7.22.15" + } + }, + "@babel/types": { + "version": "7.23.6", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.6.tgz", + "integrity": "sha512-+uarb83brBzPKN38NX1MkB6vb6+mwvR6amUulqAE7ccQw1pEl+bCia9TbdG1lsnFP7lZySvUn37CHyXQdfTwzg==", + "dev": true, + "requires": { + "@babel/helper-string-parser": "^7.23.4", + "@babel/helper-validator-identifier": "^7.22.20", + "to-fast-properties": "^2.0.0" + } + } } }, "@babel/helper-hoist-variables": { @@ -209,21 +272,91 @@ } }, "@babel/traverse": { - "version": "7.22.8", - "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.22.8.tgz", - "integrity": "sha512-y6LPR+wpM2I3qJrsheCTwhIinzkETbplIgPBbwvqPKc+uljeA5gP+3nP8irdYt1mjQaDnlIcG+dw8OjAco4GXw==", + "version": "7.23.7", + "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.23.7.tgz", + "integrity": "sha512-tY3mM8rH9jM0YHFGyfC0/xf+SB5eKUu7HPj7/k3fpi9dAlsMc5YbQvDi0Sh2QTPXqMhyaAtzAr807TIyfQrmyg==", "dev": true, "requires": { - "@babel/code-frame": "^7.22.5", - "@babel/generator": "^7.22.7", - "@babel/helper-environment-visitor": "^7.22.5", - "@babel/helper-function-name": "^7.22.5", + "@babel/code-frame": "^7.23.5", + "@babel/generator": "^7.23.6", + "@babel/helper-environment-visitor": "^7.22.20", + "@babel/helper-function-name": "^7.23.0", "@babel/helper-hoist-variables": "^7.22.5", "@babel/helper-split-export-declaration": "^7.22.6", - "@babel/parser": "^7.22.7", - "@babel/types": "^7.22.5", - "debug": "^4.1.0", + "@babel/parser": "^7.23.6", + "@babel/types": "^7.23.6", + "debug": "^4.3.1", "globals": "^11.1.0" + }, + "dependencies": { + "@babel/code-frame": { + "version": "7.23.5", + "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.23.5.tgz", + "integrity": "sha512-CgH3s1a96LipHCmSUmYFPwY7MNx8C3avkq7i4Wl3cfa662ldtUe4VM1TPXX70pfmrlWTb6jLqTYrZyT2ZTJBgA==", + "dev": true, + "requires": { + "@babel/highlight": "^7.23.4", + "chalk": "^2.4.2" + } + }, + "@babel/generator": { + "version": "7.23.6", + "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.23.6.tgz", + "integrity": "sha512-qrSfCYxYQB5owCmGLbl8XRpX1ytXlpueOb0N0UmQwA073KZxejgQTzAmJezxvpwQD9uGtK2shHdi55QT+MbjIw==", + "dev": true, + "requires": { + "@babel/types": "^7.23.6", + "@jridgewell/gen-mapping": "^0.3.2", + "@jridgewell/trace-mapping": "^0.3.17", + "jsesc": "^2.5.1" + } + }, + "@babel/helper-environment-visitor": { + "version": "7.22.20", + "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.22.20.tgz", + "integrity": "sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA==", + "dev": true + }, + "@babel/helper-string-parser": { + "version": "7.23.4", + "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.23.4.tgz", + "integrity": "sha512-803gmbQdqwdf4olxrX4AJyFBV/RTr3rSmOj0rKwesmzlfhYNDEs+/iOcznzpNWlJlIlTJC2QfPFcHB6DlzdVLQ==", + "dev": true + }, + "@babel/helper-validator-identifier": { + "version": "7.22.20", + "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz", + "integrity": "sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==", + "dev": true + }, + "@babel/highlight": { + "version": "7.23.4", + "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.23.4.tgz", + "integrity": "sha512-acGdbYSfp2WheJoJm/EBBBLh/ID8KDc64ISZ9DYtBmC8/Q204PZJLHyzeB5qMzJ5trcOkybd78M4x2KWsUq++A==", + "dev": true, + "requires": { + "@babel/helper-validator-identifier": "^7.22.20", + "chalk": "^2.4.2", + "js-tokens": "^4.0.0" + } + }, + "@babel/parser": { + "version": "7.23.6", + "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.6.tgz", + "integrity": "sha512-Z2uID7YJ7oNvAI20O9X0bblw7Qqs8Q2hFy0R9tAfnfLkp5MW0UH9eUvnDSnFwKZ0AvgS1ucqR4KzvVHgnke1VQ==", + "dev": true + }, + "@babel/types": { + "version": "7.23.6", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.6.tgz", + "integrity": "sha512-+uarb83brBzPKN38NX1MkB6vb6+mwvR6amUulqAE7ccQw1pEl+bCia9TbdG1lsnFP7lZySvUn37CHyXQdfTwzg==", + "dev": true, + "requires": { + "@babel/helper-string-parser": "^7.23.4", + "@babel/helper-validator-identifier": "^7.22.20", + "to-fast-properties": "^2.0.0" + } + } } }, "@babel/types": { diff --git a/source/_themes/wazuh_doc_theme_v3/static/js/min/bootstrap.bundle.min.js b/source/_themes/wazuh_doc_theme_v3/static/js/min/bootstrap.bundle.min.js index f45a7f304f..17e1bdcfcd 100644 --- a/source/_themes/wazuh_doc_theme_v3/static/js/min/bootstrap.bundle.min.js +++ b/source/_themes/wazuh_doc_theme_v3/static/js/min/bootstrap.bundle.min.js @@ -1,6 +1,6 @@ /*! * Bootstrap v4.6.0 (https://getbootstrap.com/) - * Copyright 2011-2023 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) + * Copyright 2011-2024 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */ !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("jquery")):"function"==typeof define&&define.amd?define(["exports","jquery"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).bootstrap={},e.jQuery)}(this,function(e,t){"use strict";function P(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var d=P(t);const R="transitionend";function M(e){let t=!1;return d.default(this).one(a.TRANSITION_END,()=>{t=!0}),setTimeout(()=>{t||a.triggerTransitionEnd(this)},e),this}const a={TRANSITION_END:"bsTransitionEnd",getUID(e){for(;e+=~~(1e6*Math.random()),document.getElementById(e););return e},getSelectorFromElement(e){let t=e.getAttribute("data-target");t&&"#"!==t||(e=e.getAttribute("href"),t=e&&"#"!==e?e.trim():"");try{return document.querySelector(t)?t:null}catch(e){return null}},getTransitionDurationFromElement(e){if(!e)return 0;let t=d.default(e).css("transition-duration"),i=d.default(e).css("transition-delay");var e=parseFloat(t),n=parseFloat(i);return e||n?(t=t.split(",")[0],i=i.split(",")[0],1e3*(parseFloat(t)+parseFloat(i))):0},reflow(e){return e.offsetHeight},triggerTransitionEnd(e){d.default(e).trigger(R)},supportsTransitionEnd(){return Boolean(R)},isElement(e){return(e[0]||e).nodeType},typeCheckConfig(e,t,i){for(const s in i)if(Object.prototype.hasOwnProperty.call(i,s)){var n=i[s],o=t[s],o=o&&a.isElement(o)?"element":null===(o=o)||"undefined"==typeof o?""+o:{}.toString.call(o).match(/\s([a-z]+)/i)[1].toLowerCase();if(!new RegExp(n).test(o))throw new Error(e.toUpperCase()+": "+`Option "${s}" provided type "${o}" `+`but expected type "${n}".`)}},findShadowRoot(e){var t;return document.documentElement.attachShadow?"function"==typeof e.getRootNode?(t=e.getRootNode())instanceof ShadowRoot?t:null:e instanceof ShadowRoot?e:e.parentNode?a.findShadowRoot(e.parentNode):null:null},jQueryDetection(){if("undefined"==typeof d.default)throw new TypeError("Bootstrap's JavaScript requires jQuery. jQuery must be included before Bootstrap's JavaScript.");var e=d.default.fn.jquery.split(" ")[0].split(".");if(e[0]<2&&e[1]<9||1===e[0]&&9===e[1]&&e[2]<1||4<=e[0])throw new Error("Bootstrap's JavaScript requires at least jQuery v1.9.1 but less than v4.0.0")}},H=(a.jQueryDetection(),d.default.fn.emulateTransitionEnd=M,d.default.event.special[a.TRANSITION_END]={bindType:R,delegateType:R,handle(e){if(d.default(e.target).is(this))return e.handleObj.handler.apply(this,arguments)}},"alert"),B="bs.alert";B;const q=d.default.fn[H];class n{constructor(e){this._element=e}static get VERSION(){return"4.6.0"}close(e){let t=this._element;e&&(t=this._getRootElement(e)),this._triggerCloseEvent(t).isDefaultPrevented()||this._removeElement(t)}dispose(){d.default.removeData(this._element,B),this._element=null}_getRootElement(e){var t=a.getSelectorFromElement(e);let i=!1;return i=(i=t?document.querySelector(t):i)||d.default(e).closest(".alert")[0]}_triggerCloseEvent(e){var t=d.default.Event("close.bs.alert");return d.default(e).trigger(t),t}_removeElement(t){var e;d.default(t).removeClass("show"),d.default(t).hasClass("fade")?(e=a.getTransitionDurationFromElement(t),d.default(t).one(a.TRANSITION_END,e=>this._destroyElement(t,e)).emulateTransitionEnd(e)):this._destroyElement(t)}_destroyElement(e){d.default(e).detach().trigger("closed.bs.alert").remove()}static _jQueryInterface(i){return this.each(function(){var e=d.default(this);let t=e.data(B);t||(t=new n(this),e.data(B,t)),"close"===i&&t[i](this)})}static _handleDismiss(t){return function(e){e&&e.preventDefault(),t.close(this)}}}d.default(document).on("click.bs.alert.data-api",'[data-dismiss="alert"]',n._handleDismiss(new n)),d.default.fn[H]=n._jQueryInterface,d.default.fn[H].Constructor=n,d.default.fn[H].noConflict=()=>(d.default.fn[H]=q,n._jQueryInterface);const W="button",Q="bs.button";Q;const U=d.default.fn[W],r="active";t='[data-toggle^="button"]';const $='input:not([type="hidden"])',V=".btn";class o{constructor(e){this._element=e,this.shouldAvoidTriggerChange=!1}static get VERSION(){return"4.6.0"}toggle(){let e=!0,t=!0;var i,n=d.default(this._element).closest('[data-toggle="buttons"]')[0];n&&(i=this._element.querySelector($))&&("radio"===i.type&&(i.checked&&this._element.classList.contains(r)?e=!1:(n=n.querySelector(".active"))&&d.default(n).removeClass(r)),e&&("checkbox"!==i.type&&"radio"!==i.type||(i.checked=!this._element.classList.contains(r)),this.shouldAvoidTriggerChange||d.default(i).trigger("change")),i.focus(),t=!1),this._element.hasAttribute("disabled")||this._element.classList.contains("disabled")||(t&&this._element.setAttribute("aria-pressed",!this._element.classList.contains(r)),e&&d.default(this._element).toggleClass(r))}dispose(){d.default.removeData(this._element,Q),this._element=null}static _jQueryInterface(i,n){return this.each(function(){var e=d.default(this);let t=e.data(Q);t||(t=new o(this),e.data(Q,t)),t.shouldAvoidTriggerChange=n,"toggle"===i&&t[i]()})}}d.default(document).on("click.bs.button.data-api",t,e=>{let t=e.target;var i,n=t;!(t=d.default(t).hasClass("btn")?t:d.default(t).closest(V)[0])||t.hasAttribute("disabled")||t.classList.contains("disabled")||(i=t.querySelector($))&&(i.hasAttribute("disabled")||i.classList.contains("disabled"))?e.preventDefault():"INPUT"!==n.tagName&&"LABEL"===t.tagName||o._jQueryInterface.call(d.default(t),"toggle","INPUT"===n.tagName)}).on("focus.bs.button.data-api blur.bs.button.data-api",t,e=>{var t=d.default(e.target).closest(V)[0];d.default(t).toggleClass("focus",/^focus(in)?$/.test(e.type))}),d.default(window).on("load.bs.button.data-api",()=>{let i=[].slice.call(document.querySelectorAll('[data-toggle="buttons"] .btn'));for(let e=0,t=i.length;e(d.default.fn[W]=U,o._jQueryInterface);const i="collapse",s="bs.collapse";s;const Y=d.default.fn[i],z={toggle:!0,parent:""},K={toggle:"boolean",parent:"(string|element)"};const G="show",J="collapse",X="collapsing",Z="collapsed",ee='[data-toggle="collapse"]';class l{constructor(i,e){this._isTransitioning=!1,this._element=i,this._config=this._getConfig(e),this._triggerArray=[].slice.call(document.querySelectorAll(`[data-toggle="collapse"][href="#${i.id}"],`+`[data-toggle="collapse"][data-target="#${i.id}"]`));var n=[].slice.call(document.querySelectorAll(ee));for(let e=0,t=n.length;ee===i);null!==s&&0"string"==typeof this._config.parent?e.getAttribute("data-parent")===this._config.parent:e.classList.contains(J))).length?null:e)&&(t=d.default(e).not(this._selector).data(s))&&t._isTransitioning)){var i=d.default.Event("show.bs.collapse");if(d.default(this._element).trigger(i),!i.isDefaultPrevented()){e&&(l._jQueryInterface.call(d.default(e).not(this._selector),"hide"),t||d.default(e).data(s,null));const o=this._getDimension();d.default(this._element).removeClass(J).addClass(X),this._element.style[o]=0,this._triggerArray.length&&d.default(this._triggerArray).removeClass(Z).attr("aria-expanded",!0),this.setTransitioning(!0);var i="scroll"+(o[0].toUpperCase()+o.slice(1)),n=a.getTransitionDurationFromElement(this._element);d.default(this._element).one(a.TRANSITION_END,()=>{d.default(this._element).removeClass(X).addClass(J+" show"),this._element.style[o]="",this.setTransitioning(!1),d.default(this._element).trigger("shown.bs.collapse")}).emulateTransitionEnd(n),this._element.style[o]=this._element[i]+"px"}}}}hide(){if(!this._isTransitioning&&d.default(this._element).hasClass(G)){var e=d.default.Event("hide.bs.collapse");if(d.default(this._element).trigger(e),!e.isDefaultPrevented()){var e=this._getDimension(),t=(this._element.style[e]=this._element.getBoundingClientRect()[e]+"px",a.reflow(this._element),d.default(this._element).addClass(X).removeClass(J+" show"),this._triggerArray.length);if(0{this.setTransitioning(!1),d.default(this._element).removeClass(X).addClass(J).trigger("hidden.bs.collapse")}).emulateTransitionEnd(e)}}}setTransitioning(e){this._isTransitioning=e}dispose(){d.default.removeData(this._element,s),this._config=null,this._parent=null,this._element=null,this._triggerArray=null,this._isTransitioning=null}_getConfig(e){return(e={...z,...e}).toggle=Boolean(e.toggle),a.typeCheckConfig(i,e,K),e}_getDimension(){return d.default(this._element).hasClass("width")?"width":"height"}_getParent(){let e;a.isElement(this._config.parent)?(e=this._config.parent,"undefined"!=typeof this._config.parent.jquery&&(e=this._config.parent[0])):e=document.querySelector(this._config.parent);var t=`[data-toggle="collapse"][data-parent="${this._config.parent}"]`,t=[].slice.call(e.querySelectorAll(t));return d.default(t).each((e,t)=>{this._addAriaAndCollapsedClass(l._getTargetFromElement(t),[t])}),e}_addAriaAndCollapsedClass(e,t){e=d.default(e).hasClass(G);t.length&&d.default(t).toggleClass(Z,!e).attr("aria-expanded",e)}static _getTargetFromElement(e){e=a.getSelectorFromElement(e);return e?document.querySelector(e):null}static _jQueryInterface(n){return this.each(function(){var e=d.default(this);let t=e.data(s);var i={...z,...e.data(),..."object"==typeof n&&n?n:{}};if(!t&&i.toggle&&"string"==typeof n&&/show|hide/.test(n)&&(i.toggle=!1),t||(t=new l(this,i),e.data(s,t)),"string"==typeof n){if("undefined"==typeof t[n])throw new TypeError(`No method named "${n}"`);t[n]()}})}}d.default(document).on("click.bs.collapse.data-api",ee,function(e){"A"===e.currentTarget.tagName&&e.preventDefault();const i=d.default(this);e=a.getSelectorFromElement(this),e=[].slice.call(document.querySelectorAll(e));d.default(e).each(function(){var e=d.default(this),t=e.data(s)?"toggle":i.data();l._jQueryInterface.call(e,t)})}),d.default.fn[i]=l._jQueryInterface,d.default.fn[i].Constructor=l,d.default.fn[i].noConflict=()=>(d.default.fn[i]=Y,l._jQueryInterface);var te="undefined"!=typeof window&&"undefined"!=typeof document&&"undefined"!=typeof navigator,ie=function(){for(var e=["Edge","Trident","Firefox"],t=0;t=i.clientWidth&&e>=i.clientHeight})).length?o:s)[0].key+((t=e.split("-")[1])?"-"+t:""))}function we(e,t,i,n){n=3l[e]&&!n.escapeWithReference&&(i=Math.min(d[t],l[e]-("right"===e?d.width:d.height))),p({},t,i)}};return t.forEach(function(e){var t=-1!==["left","top"].indexOf(e)?"primary":"secondary";d=m({},d,f[t](e))}),e.offsets.popper=d,e},priority:["left","right","top","bottom"],padding:5,boundariesElement:"scrollParent"},keepTogether:{order:400,enabled:!0,fn:function(e){var t=(i=e.offsets).popper,i=i.reference,n=e.placement.split("-")[0],o=Math.floor,s=(n=-1!==["top","bottom"].indexOf(n))?"right":"bottom",r=n?"left":"top",n=n?"width":"height";return t[s]o(i[s])&&(e.offsets.popper[r]=o(i[s])),e}},arrow:{order:500,enabled:!0,fn:function(e,t){if(Pe(e.instance.modifiers,"arrow","keepTogether")){t=t.element;if("string"==typeof t){if(!(t=e.instance.popper.querySelector(t)))return e}else if(!e.instance.popper.contains(t))return console.warn("WARNING: `arrow.element` must be child of its popper element!"),e;var i=e.placement.split("-")[0],n=e.offsets,o=n.popper,n=n.reference,i=-1!==["left","right"].indexOf(i),s=i?"height":"width",r=i?"Top":"Left",a=r.toLowerCase(),l=i?"left":"top",i=i?"bottom":"right",d=Ee(t)[s],i=(n[i]-do[i]&&(e.offsets.popper[a]+=n[a]+d-o[i]),e.offsets.popper=g(e.offsets.popper),n[a]+n[s]/2-d/2),n=h(e.instance.popper),f=parseFloat(n["margin"+r]),n=parseFloat(n["border"+r+"Width"]),r=i-e.offsets.popper[a]-f-n,r=Math.max(Math.min(o[s]-d,r),0);e.arrowElement=t,e.offsets.arrow=(p(i={},a,Math.round(r)),p(i,l,""),i)}return e},element:"[x-arrow]"},flip:{order:600,enabled:!0,fn:function(d,f){if(!(De(d.instance.modifiers,"inner")||d.flipped&&d.placement===d.originalPlacement)){var h=be(d.instance.popper,d.instance.reference,f.padding,f.boundariesElement,d.positionFixed),c=d.placement.split("-")[0],u=Te(c),p=d.placement.split("-")[1]||"",g=[];switch(f.behavior){case He:g=[c,u];break;case Be:g=Me(c);break;case qe:g=Me(c,!0);break;default:g=f.behavior}g.forEach(function(e,t){if(c!==e||g.length===t+1)return d;c=d.placement.split("-")[0],u=Te(c);var e=d.offsets.popper,i=d.offsets.reference,n=Math.floor,i="left"===c&&n(e.right)>n(i.left)||"right"===c&&n(e.left)n(i.top)||"bottom"===c&&n(e.top)n(h.right),r=n(e.top)n(h.bottom),n="left"===c&&o||"right"===c&&s||"top"===c&&r||"bottom"===c&&e,a=-1!==["top","bottom"].indexOf(c),l=!!f.flipVariations&&(a&&"start"===p&&o||a&&"end"===p&&s||!a&&"start"===p&&r||!a&&"end"===p&&e),s=!!f.flipVariationsByContent&&(a&&"start"===p&&s||a&&"end"===p&&o||!a&&"start"===p&&e||!a&&"end"===p&&r),o=l||s;(i||n||o)&&(d.flipped=!0,(i||n)&&(c=g[t+1]),o&&(p="end"===(e=p)?"start":"start"===e?"end":e),d.placement=c+(p?"-"+p:""),d.offsets.popper=m({},d.offsets.popper,Ce(d.instance.popper,d.offsets.reference,d.placement)),d=Se(d.instance.modifiers,d,"flip"))})}return d},behavior:"flip",padding:5,boundariesElement:"viewport",flipVariations:!1,flipVariationsByContent:!1},inner:{order:700,enabled:!1,fn:function(e){var t=e.placement,i=t.split("-")[0],n=(o=e.offsets).popper,o=o.reference,s=-1!==["left","right"].indexOf(i),r=-1===["top","left"].indexOf(i);return n[s?"left":"top"]=o[i]-(r?n[s?"width":"height"]:0),e.placement=Te(t),e.offsets.popper=g(n),e}},hide:{order:800,enabled:!0,fn:function(e){if(Pe(e.instance.modifiers,"hide","preventOverflow")){var t=e.offsets.reference,i=Ne(e.instance.modifiers,function(e){return"preventOverflow"===e.name}).boundaries;if(t.bottomi.right||t.top>i.bottom||t.right{e.preventDefault(),e.stopPropagation(),this.toggle()})}_getConfig(e){return e={...this.constructor.Default,...d.default(this._element).data(),...e},a.typeCheckConfig(b,e,this.constructor.DefaultType),e}_getMenuElement(){var e;return this._menu||(e=E._getParentFromElement(this._element))&&(this._menu=e.querySelector(Ze)),this._menu}_getPlacement(){var e=d.default(this._element.parentNode);let t="bottom-start";return e.hasClass("dropup")?t=d.default(this._menu).hasClass(Je)?"top-end":"top-start":e.hasClass("dropright")?t="right-start":e.hasClass("dropleft")?t="left-start":d.default(this._menu).hasClass(Je)&&(t="bottom-end"),t}_detectNavbar(){return 0(e.offsets={...e.offsets,...this._config.offset(e.offsets,this._element)||{}},e):e.offset=this._config.offset,e}_getPopperConfig(){var e={placement:this._getPlacement(),modifiers:{offset:this._getOffset(),flip:{enabled:this._config.flip},preventOverflow:{boundariesElement:this._config.boundary}}};return"static"===this._config.display&&(e.modifiers.applyStyle={enabled:!1}),{...e,...this._config.popperConfig}}static _jQueryInterface(i){return this.each(function(){let e=d.default(this).data($e);var t="object"==typeof i?i:null;if(e||(e=new E(this,t),d.default(this).data($e,e)),"string"==typeof i){if("undefined"==typeof e[i])throw new TypeError(`No method named "${i}"`);e[i]()}})}static _clearMenus(i){if(!i||3!==i.which&&("keyup"!==i.type||9===i.which)){var n=[].slice.call(document.querySelectorAll(Xe));for(let e=0,t=n.length;ed.default(e).is(":visible"));if(0!==i.length){let e=i.indexOf(t.target);38===t.which&&0{e.stopPropagation()}),d.default.fn[b]=E._jQueryInterface,d.default.fn[b].Constructor=E,d.default.fn[b].noConflict=()=>(d.default.fn[b]=Ve,E._jQueryInterface);const T="modal",it="bs.modal",C="."+it;const nt=d.default.fn[T],ot={backdrop:!0,keyboard:!0,focus:!0,show:!0},st={backdrop:"(boolean|string)",keyboard:"boolean",focus:"boolean",show:"boolean"},rt=(C,C,"hidden"+C),at="show"+C,lt=(C,"focusin"+C),dt="resize"+C,ft="click.dismiss"+C,ht="keydown.dismiss"+C,ct=(C,"mousedown.dismiss"+C);C;const ut="modal-open",N="fade",pt="show",gt="modal-static";const mt=".fixed-top, .fixed-bottom, .is-fixed, .sticky-top",_t=".sticky-top";class S{constructor(e,t){this._config=this._getConfig(t),this._element=e,this._dialog=e.querySelector(".modal-dialog"),this._backdrop=null,this._isShown=!1,this._isBodyOverflowing=!1,this._ignoreBackdropClick=!1,this._isTransitioning=!1,this._scrollbarWidth=0}static get VERSION(){return"4.6.0"}static get Default(){return ot}toggle(e){return this._isShown?this.hide():this.show(e)}show(e){var t;this._isShown||this._isTransitioning||(d.default(this._element).hasClass(N)&&(this._isTransitioning=!0),t=d.default.Event(at,{relatedTarget:e}),d.default(this._element).trigger(t),this._isShown)||t.isDefaultPrevented()||(this._isShown=!0,this._checkScrollbar(),this._setScrollbar(),this._adjustDialog(),this._setEscapeEvent(),this._setResizeEvent(),d.default(this._element).on(ft,'[data-dismiss="modal"]',e=>this.hide(e)),d.default(this._dialog).on(ct,()=>{d.default(this._element).one("mouseup.dismiss.bs.modal",e=>{d.default(e.target).is(this._element)&&(this._ignoreBackdropClick=!0)})}),this._showBackdrop(()=>this._showElement(e)))}hide(e){e&&e.preventDefault(),this._isShown&&!this._isTransitioning&&(e=d.default.Event("hide.bs.modal"),d.default(this._element).trigger(e),this._isShown)&&!e.isDefaultPrevented()&&(this._isShown=!1,(e=d.default(this._element).hasClass(N))&&(this._isTransitioning=!0),this._setEscapeEvent(),this._setResizeEvent(),d.default(document).off(lt),d.default(this._element).removeClass(pt),d.default(this._element).off(ft),d.default(this._dialog).off(ct),e?(e=a.getTransitionDurationFromElement(this._element),d.default(this._element).one(a.TRANSITION_END,e=>this._hideModal(e)).emulateTransitionEnd(e)):this._hideModal())}dispose(){[window,this._element,this._dialog].forEach(e=>d.default(e).off(C)),d.default(document).off(lt),d.default.removeData(this._element,it),this._config=null,this._element=null,this._dialog=null,this._backdrop=null,this._isShown=null,this._isBodyOverflowing=null,this._ignoreBackdropClick=null,this._isTransitioning=null,this._scrollbarWidth=null}handleUpdate(){this._adjustDialog()}_getConfig(e){return e={...ot,...e},a.typeCheckConfig(T,e,st),e}_triggerBackdropTransition(){var e=d.default.Event("hidePrevented.bs.modal");if(d.default(this._element).trigger(e),!e.isDefaultPrevented()){const t=this._element.scrollHeight>document.documentElement.clientHeight,i=(t||(this._element.style.overflowY="hidden"),this._element.classList.add(gt),a.getTransitionDurationFromElement(this._dialog));d.default(this._element).off(a.TRANSITION_END),d.default(this._element).one(a.TRANSITION_END,()=>{this._element.classList.remove(gt),t||d.default(this._element).one(a.TRANSITION_END,()=>{this._element.style.overflowY=""}).emulateTransitionEnd(this._element,i)}).emulateTransitionEnd(i),this._element.focus()}}_showElement(e){var t=d.default(this._element).hasClass(N),i=this._dialog?this._dialog.querySelector(".modal-body"):null;this._element.parentNode&&this._element.parentNode.nodeType===Node.ELEMENT_NODE||document.body.appendChild(this._element),this._element.style.display="block",this._element.removeAttribute("aria-hidden"),this._element.setAttribute("aria-modal",!0),this._element.setAttribute("role","dialog"),d.default(this._dialog).hasClass("modal-dialog-scrollable")&&i?i.scrollTop=0:this._element.scrollTop=0,t&&a.reflow(this._element),d.default(this._element).addClass(pt),this._config.focus&&this._enforceFocus();const n=d.default.Event("shown.bs.modal",{relatedTarget:e});i=()=>{this._config.focus&&this._element.focus(),this._isTransitioning=!1,d.default(this._element).trigger(n)};t?(e=a.getTransitionDurationFromElement(this._dialog),d.default(this._dialog).one(a.TRANSITION_END,i).emulateTransitionEnd(e)):i()}_enforceFocus(){d.default(document).off(lt).on(lt,e=>{document!==e.target&&this._element!==e.target&&0===d.default(this._element).has(e.target).length&&this._element.focus()})}_setEscapeEvent(){this._isShown?d.default(this._element).on(ht,e=>{this._config.keyboard&&27===e.which?(e.preventDefault(),this.hide()):this._config.keyboard||27!==e.which||this._triggerBackdropTransition()}):this._isShown||d.default(this._element).off(ht)}_setResizeEvent(){this._isShown?d.default(window).on(dt,e=>this.handleUpdate(e)):d.default(window).off(dt)}_hideModal(){this._element.style.display="none",this._element.setAttribute("aria-hidden",!0),this._element.removeAttribute("aria-modal"),this._element.removeAttribute("role"),this._isTransitioning=!1,this._showBackdrop(()=>{d.default(document.body).removeClass(ut),this._resetAdjustments(),this._resetScrollbar(),d.default(this._element).trigger(rt)})}_removeBackdrop(){this._backdrop&&(d.default(this._backdrop).remove(),this._backdrop=null)}_showBackdrop(e){var t,i=d.default(this._element).hasClass(N)?N:"";this._isShown&&this._config.backdrop?(this._backdrop=document.createElement("div"),this._backdrop.className="modal-backdrop",i&&this._backdrop.classList.add(i),d.default(this._backdrop).appendTo(document.body),d.default(this._element).on(ft,e=>{this._ignoreBackdropClick?this._ignoreBackdropClick=!1:e.target===e.currentTarget&&("static"===this._config.backdrop?this._triggerBackdropTransition():this.hide())}),i&&a.reflow(this._backdrop),d.default(this._backdrop).addClass(pt),e&&(i?(i=a.getTransitionDurationFromElement(this._backdrop),d.default(this._backdrop).one(a.TRANSITION_END,e).emulateTransitionEnd(i)):e())):!this._isShown&&this._backdrop?(d.default(this._backdrop).removeClass(pt),i=()=>{this._removeBackdrop(),e&&e()},d.default(this._element).hasClass(N)?(t=a.getTransitionDurationFromElement(this._backdrop),d.default(this._backdrop).one(a.TRANSITION_END,i).emulateTransitionEnd(t)):i()):e&&e()}_adjustDialog(){var e=this._element.scrollHeight>document.documentElement.clientHeight;!this._isBodyOverflowing&&e&&(this._element.style.paddingLeft=this._scrollbarWidth+"px"),this._isBodyOverflowing&&!e&&(this._element.style.paddingRight=this._scrollbarWidth+"px")}_resetAdjustments(){this._element.style.paddingLeft="",this._element.style.paddingRight=""}_checkScrollbar(){var e=document.body.getBoundingClientRect();this._isBodyOverflowing=Math.round(e.left+e.right){var i=t.style.paddingRight,n=d.default(t).css("padding-right");d.default(t).data("padding-right",i).css("padding-right",parseFloat(n)+this._scrollbarWidth+"px")}),d.default(t).each((e,t)=>{var i=t.style.marginRight,n=d.default(t).css("margin-right");d.default(t).data("margin-right",i).css("margin-right",parseFloat(n)-this._scrollbarWidth+"px")}),e=document.body.style.paddingRight,t=d.default(document.body).css("padding-right"),d.default(document.body).data("padding-right",e).css("padding-right",parseFloat(t)+this._scrollbarWidth+"px")),d.default(document.body).addClass(ut)}_resetScrollbar(){var e=[].slice.call(document.querySelectorAll(mt)),e=(d.default(e).each((e,t)=>{var i=d.default(t).data("padding-right");d.default(t).removeData("padding-right"),t.style.paddingRight=i||""}),[].slice.call(document.querySelectorAll(_t))),e=(d.default(e).each((e,t)=>{var i=d.default(t).data("margin-right");"undefined"!=typeof i&&d.default(t).css("margin-right",i).removeData("margin-right")}),d.default(document.body).data("padding-right"));d.default(document.body).removeData("padding-right"),document.body.style.paddingRight=e||""}_getScrollbarWidth(){var e=document.createElement("div"),t=(e.className="modal-scrollbar-measure",document.body.appendChild(e),e.getBoundingClientRect().width-e.clientWidth);return document.body.removeChild(e),t}static _jQueryInterface(i,n){return this.each(function(){let e=d.default(this).data(it);var t={...ot,...d.default(this).data(),..."object"==typeof i&&i?i:{}};if(e||(e=new S(this,t),d.default(this).data(it,e)),"string"==typeof i){if("undefined"==typeof e[i])throw new TypeError(`No method named "${i}"`);e[i](n)}else t.show&&e.show(n)})}}d.default(document).on("click.bs.modal.data-api",'[data-toggle="modal"]',function(e){let t;var i=a.getSelectorFromElement(this),i=(i&&(t=document.querySelector(i)),d.default(t).data(it)?"toggle":{...d.default(t).data(),...d.default(this).data()});"A"!==this.tagName&&"AREA"!==this.tagName||e.preventDefault();const n=d.default(t).one(at,e=>{e.isDefaultPrevented()||n.one(rt,()=>{d.default(this).is(":visible")&&this.focus()})});S._jQueryInterface.call(d.default(t),i,this)}),d.default.fn[T]=S._jQueryInterface,d.default.fn[T].Constructor=S,d.default.fn[T].noConflict=()=>(d.default.fn[T]=nt,S._jQueryInterface);const vt=["background","cite","href","itemtype","longdesc","poster","src","xlink:href"];_={"*":["class","dir","id","lang","role",/^aria-[\w-]*$/i],a:["target","href","title","rel"],area:[],b:[],br:[],col:[],code:[],div:[],em:[],hr:[],h1:[],h2:[],h3:[],h4:[],h5:[],h6:[],i:[],img:["src","srcset","alt","title","width","height"],li:[],ol:[],p:[],pre:[],s:[],small:[],span:[],sub:[],sup:[],strong:[],u:[],ul:[]};const bt=/^(?:(?:https?|mailto|ftp|tel|file):|[^#&/:?]*(?:[#/?]|$))/gi,yt=/^data:(?:image\/(?:bmp|gif|jpeg|jpg|png|tiff|webp)|video\/(?:mpeg|mp4|ogg|webm)|audio\/(?:mp3|oga|ogg|opus));base64,[\d+/a-z]+=*$/i;function wt(e,i,t){if(0===e.length)return e;if(t&&"function"==typeof t)return t(e);var t=(new window.DOMParser).parseFromString(e,"text/html"),n=Object.keys(i),o=[].slice.call(t.body.querySelectorAll("*"));for(let e=0,t=o.length;e{!function(e,t){var i=e.nodeName.toLowerCase();if(-1!==t.indexOf(i))return-1===vt.indexOf(i)||Boolean(e.nodeValue.match(bt)||e.nodeValue.match(yt));var n=t.filter(e=>e instanceof RegExp);for(let e=0,t=n.length;e
',trigger:"hover focus",title:"",delay:0,html:!1,selector:!1,placement:"top",offset:0,container:!1,fallbackPlacement:"flip",boundary:"scrollParent",customClass:"",sanitize:!0,sanitizeFn:null,whiteList:_,popperConfig:null},kt="show",It={HIDE:"hide"+A,HIDDEN:"hidden"+A,SHOW:"show"+A,SHOWN:"shown"+A,INSERTED:"inserted"+A,CLICK:"click"+A,FOCUSIN:"focusin"+A,FOCUSOUT:"focusout"+A,MOUSEENTER:"mouseenter"+A,MOUSELEAVE:"mouseleave"+A},xt="fade",Lt="show",jt="hover",Ft="focus";class O{constructor(e,t){if("undefined"==typeof Ue)throw new TypeError("Bootstrap's tooltips require Popper (https://popper.js.org)");this._isEnabled=!0,this._timeout=0,this._hoverState="",this._activeTrigger={},this._popper=null,this.element=e,this.config=this._getConfig(t),this.tip=null,this._setListeners()}static get VERSION(){return"4.6.0"}static get Default(){return Ot}static get NAME(){return D}static get DATA_KEY(){return Et}static get Event(){return It}static get EVENT_KEY(){return A}static get DefaultType(){return Dt}enable(){this._isEnabled=!0}disable(){this._isEnabled=!1}toggleEnabled(){this._isEnabled=!this._isEnabled}toggle(t){if(this._isEnabled)if(t){var i=this.constructor.DATA_KEY;let e=d.default(t.currentTarget).data(i);e||(e=new this.constructor(t.currentTarget,this._getDelegateConfig()),d.default(t.currentTarget).data(i,e)),e._activeTrigger.click=!e._activeTrigger.click,e._isWithActiveTrigger()?e._enter(null,e):e._leave(null,e)}else d.default(this.getTipElement()).hasClass(Lt)?this._leave(null,this):this._enter(null,this)}dispose(){clearTimeout(this._timeout),d.default.removeData(this.element,this.constructor.DATA_KEY),d.default(this.element).off(this.constructor.EVENT_KEY),d.default(this.element).closest(".modal").off("hide.bs.modal",this._hideModalHandler),this.tip&&d.default(this.tip).remove(),this._isEnabled=null,this._timeout=null,this._hoverState=null,this._activeTrigger=null,this._popper&&this._popper.destroy(),this._popper=null,this.element=null,this.config=null,this.tip=null}show(){if("none"===d.default(this.element).css("display"))throw new Error("Please use show on visible elements");var e,t,i=d.default.Event(this.constructor.Event.SHOW);this.isWithContent()&&this._isEnabled&&(d.default(this.element).trigger(i),t=a.findShadowRoot(this.element),t=d.default.contains(null!==t?t:this.element.ownerDocument.documentElement,this.element),!i.isDefaultPrevented())&&t&&(i=this.getTipElement(),t=a.getUID(this.constructor.NAME),i.setAttribute("id",t),this.element.setAttribute("aria-describedby",t),this.setContent(),this.config.animation&&d.default(i).addClass(xt),t="function"==typeof this.config.placement?this.config.placement.call(this,i,this.element):this.config.placement,t=this._getAttachment(t),this.addAttachmentClass(t),e=this._getContainer(),d.default(i).data(this.constructor.DATA_KEY,this),d.default.contains(this.element.ownerDocument.documentElement,this.tip)||d.default(i).appendTo(e),d.default(this.element).trigger(this.constructor.Event.INSERTED),this._popper=new Ue(this.element,i,this._getPopperConfig(t)),d.default(i).addClass(Lt),d.default(i).addClass(this.config.customClass),"ontouchstart"in document.documentElement&&d.default(document.body).children().on("mouseover",null,d.default.noop),e=()=>{this.config.animation&&this._fixTransition();var e=this._hoverState;this._hoverState=null,d.default(this.element).trigger(this.constructor.Event.SHOWN),"out"===e&&this._leave(null,this)},d.default(this.tip).hasClass(xt)?(t=a.getTransitionDurationFromElement(this.tip),d.default(this.tip).one(a.TRANSITION_END,e).emulateTransitionEnd(t)):e())}hide(e){const t=this.getTipElement();var i=d.default.Event(this.constructor.Event.HIDE),n=()=>{this._hoverState!==kt&&t.parentNode&&t.parentNode.removeChild(t),this._cleanTipClass(),this.element.removeAttribute("aria-describedby"),d.default(this.element).trigger(this.constructor.Event.HIDDEN),null!==this._popper&&this._popper.destroy(),e&&e()};d.default(this.element).trigger(i),i.isDefaultPrevented()||(d.default(t).removeClass(Lt),"ontouchstart"in document.documentElement&&d.default(document.body).children().off("mouseover",null,d.default.noop),this._activeTrigger.click=!1,this._activeTrigger[Ft]=!1,this._activeTrigger[jt]=!1,d.default(this.tip).hasClass(xt)?(i=a.getTransitionDurationFromElement(t),d.default(t).one(a.TRANSITION_END,n).emulateTransitionEnd(i)):n(),this._hoverState="")}update(){null!==this._popper&&this._popper.scheduleUpdate()}isWithContent(){return Boolean(this.getTitle())}addAttachmentClass(e){d.default(this.getTipElement()).addClass(Ct+"-"+e)}getTipElement(){return this.tip=this.tip||d.default(this.config.template)[0],this.tip}setContent(){var e=this.getTipElement();this.setElementContent(d.default(e.querySelectorAll(".tooltip-inner")),this.getTitle()),d.default(e).removeClass("fade show")}setElementContent(e,t){"object"==typeof t&&(t.nodeType||t.jquery)?this.config.html?d.default(t).parent().is(e)||e.empty().append(t):e.text(d.default(t).text()):this.config.html?(this.config.sanitize&&(t=wt(t,this.config.whiteList,this.config.sanitizeFn)),e.html(t)):e.text(t)}getTitle(){let e=this.element.getAttribute("data-original-title");return e=e||("function"==typeof this.config.title?this.config.title.call(this.element):this.config.title)}_getPopperConfig(e){return{...{placement:e,modifiers:{offset:this._getOffset(),flip:{behavior:this.config.fallbackPlacement},arrow:{element:".arrow"},preventOverflow:{boundariesElement:this.config.boundary}},onCreate:e=>{e.originalPlacement!==e.placement&&this._handlePopperPlacementChange(e)},onUpdate:e=>this._handlePopperPlacementChange(e)},...this.config.popperConfig}}_getOffset(){var e={};return"function"==typeof this.config.offset?e.fn=e=>(e.offsets={...e.offsets,...this.config.offset(e.offsets,this.element)||{}},e):e.offset=this.config.offset,e}_getContainer(){return!1===this.config.container?document.body:a.isElement(this.config.container)?d.default(this.config.container):d.default(document).find(this.config.container)}_getAttachment(e){return At[e.toUpperCase()]}_setListeners(){this.config.trigger.split(" ").forEach(e=>{var t;"click"===e?d.default(this.element).on(this.constructor.Event.CLICK,this.config.selector,e=>this.toggle(e)):"manual"!==e&&(t=e===jt?this.constructor.Event.MOUSEENTER:this.constructor.Event.FOCUSIN,e=e===jt?this.constructor.Event.MOUSELEAVE:this.constructor.Event.FOCUSOUT,d.default(this.element).on(t,this.config.selector,e=>this._enter(e)).on(e,this.config.selector,e=>this._leave(e)))}),this._hideModalHandler=()=>{this.element&&this.hide()},d.default(this.element).closest(".modal").on("hide.bs.modal",this._hideModalHandler),this.config.selector?this.config={...this.config,trigger:"manual",selector:""}:this._fixTitle()}_fixTitle(){var e=typeof this.element.getAttribute("data-original-title");!this.element.getAttribute("title")&&"string"==e||(this.element.setAttribute("data-original-title",this.element.getAttribute("title")||""),this.element.setAttribute("title",""))}_enter(e,t){var i=this.constructor.DATA_KEY;(t=t||d.default(e.currentTarget).data(i))||(t=new this.constructor(e.currentTarget,this._getDelegateConfig()),d.default(e.currentTarget).data(i,t)),e&&(t._activeTrigger["focusin"===e.type?Ft:jt]=!0),d.default(t.getTipElement()).hasClass(Lt)||t._hoverState===kt?t._hoverState=kt:(clearTimeout(t._timeout),t._hoverState=kt,t.config.delay&&t.config.delay.show?t._timeout=setTimeout(()=>{t._hoverState===kt&&t.show()},t.config.delay.show):t.show())}_leave(e,t){var i=this.constructor.DATA_KEY;(t=t||d.default(e.currentTarget).data(i))||(t=new this.constructor(e.currentTarget,this._getDelegateConfig()),d.default(e.currentTarget).data(i,t)),e&&(t._activeTrigger["focusout"===e.type?Ft:jt]=!1),t._isWithActiveTrigger()||(clearTimeout(t._timeout),t._hoverState="out",t.config.delay&&t.config.delay.hide?t._timeout=setTimeout(()=>{"out"===t._hoverState&&t.hide()},t.config.delay.hide):t.hide())}_isWithActiveTrigger(){for(const e in this._activeTrigger)if(this._activeTrigger[e])return!0;return!1}_getConfig(e){const t=d.default(this.element).data();return Object.keys(t).forEach(e=>{-1!==St.indexOf(e)&&delete t[e]}),"number"==typeof(e={...this.constructor.Default,...t,..."object"==typeof e&&e?e:{}}).delay&&(e.delay={show:e.delay,hide:e.delay}),"number"==typeof e.title&&(e.title=e.title.toString()),"number"==typeof e.content&&(e.content=e.content.toString()),a.typeCheckConfig(D,e,this.constructor.DefaultType),e.sanitize&&(e.template=wt(e.template,e.whiteList,e.sanitizeFn)),e}_getDelegateConfig(){var e={};if(this.config)for(const t in this.config)this.constructor.Default[t]!==this.config[t]&&(e[t]=this.config[t]);return e}_cleanTipClass(){var e=d.default(this.getTipElement()),t=e.attr("class").match(Nt);null!==t&&t.length&&e.removeClass(t.join(""))}_handlePopperPlacementChange(e){this.tip=e.instance.popper,this._cleanTipClass(),this.addAttachmentClass(this._getAttachment(e.placement))}_fixTransition(){var e=this.getTipElement(),t=this.config.animation;null===e.getAttribute("x-placement")&&(d.default(e).removeClass(xt),this.config.animation=!1,this.hide(),this.show(),this.config.animation=t)}static _jQueryInterface(n){return this.each(function(){var e=d.default(this);let t=e.data(Et);var i="object"==typeof n&&n;if((t||!/dispose|hide/.test(n))&&(t||(t=new O(this,i),e.data(Et,t)),"string"==typeof n)){if("undefined"==typeof t[n])throw new TypeError(`No method named "${n}"`);t[n]()}})}}d.default.fn[D]=O._jQueryInterface,d.default.fn[D].Constructor=O,d.default.fn[D].noConflict=()=>(d.default.fn[D]=Tt,O._jQueryInterface);const k="popover",Pt="bs.popover",I="."+Pt,Rt=d.default.fn[k],Mt="bs-popover",Ht=new RegExp(`(^|\\s)${Mt}\\S+`,"g"),Bt={...O.Default,placement:"right",trigger:"click",content:"",template:''},qt={...O.DefaultType,content:"(string|element|function)"},Wt={HIDE:"hide"+I,HIDDEN:"hidden"+I,SHOW:"show"+I,SHOWN:"shown"+I,INSERTED:"inserted"+I,CLICK:"click"+I,FOCUSIN:"focusin"+I,FOCUSOUT:"focusout"+I,MOUSEENTER:"mouseenter"+I,MOUSELEAVE:"mouseleave"+I};class Qt extends O{static get VERSION(){return"4.6.0"}static get Default(){return Bt}static get NAME(){return k}static get DATA_KEY(){return Pt}static get Event(){return Wt}static get EVENT_KEY(){return I}static get DefaultType(){return qt}isWithContent(){return this.getTitle()||this._getContent()}addAttachmentClass(e){d.default(this.getTipElement()).addClass(Mt+"-"+e)}getTipElement(){return this.tip=this.tip||d.default(this.config.template)[0],this.tip}setContent(){var e=d.default(this.getTipElement());this.setElementContent(e.find(".popover-header"),this.getTitle());let t=this._getContent();"function"==typeof t&&(t=t.call(this.element)),this.setElementContent(e.find(".popover-body"),t),e.removeClass("fade show")}_getContent(){return this.element.getAttribute("data-content")||this.config.content}_cleanTipClass(){var e=d.default(this.getTipElement()),t=e.attr("class").match(Ht);null!==t&&0(d.default.fn[k]=Rt,Qt._jQueryInterface);const x="scrollspy",Ut="bs.scrollspy",$t="."+Ut;const Vt=d.default.fn[x],Yt={offset:10,method:"auto",target:""},zt={offset:"number",method:"string",target:"(string|element)"};$t,$t;$t;const L="active",Kt=".nav, .list-group",Gt=".nav-link",Jt=".list-group-item",Xt="position";class j{constructor(e,t){this._element=e,this._scrollElement="BODY"===e.tagName?window:e,this._config=this._getConfig(t),this._selector=`${this._config.target} ${Gt},`+`${this._config.target} ${Jt},`+this._config.target+" .dropdown-item",this._offsets=[],this._targets=[],this._activeTarget=null,this._scrollHeight=0,d.default(this._scrollElement).on("scroll.bs.scrollspy",e=>this._process(e)),this.refresh(),this._process()}static get VERSION(){return"4.6.0"}static get Default(){return Yt}refresh(){var e=this._scrollElement===this._scrollElement.window?"offset":Xt;const n="auto"===this._config.method?e:this._config.method,o=n===Xt?this._getScrollTop():0;this._offsets=[],this._targets=[],this._scrollHeight=this._getScrollHeight(),[].slice.call(document.querySelectorAll(this._selector)).map(e=>{let t;e=a.getSelectorFromElement(e);if(t=e?document.querySelector(e):t){var i=t.getBoundingClientRect();if(i.width||i.height)return[d.default(t)[n]().top+o,e]}return null}).filter(e=>e).sort((e,t)=>e[0]-t[0]).forEach(e=>{this._offsets.push(e[0]),this._targets.push(e[1])})}dispose(){d.default.removeData(this._element,Ut),d.default(this._scrollElement).off($t),this._element=null,this._scrollElement=null,this._config=null,this._selector=null,this._offsets=null,this._targets=null,this._activeTarget=null,this._scrollHeight=null}_getConfig(t){if("string"!=typeof(t={...Yt,..."object"==typeof t&&t?t:{}}).target&&a.isElement(t.target)){let e=d.default(t.target).attr("id");e||(e=a.getUID(x),d.default(t.target).attr("id",e)),t.target="#"+e}return a.typeCheckConfig(x,t,zt),t}_getScrollTop(){return this._scrollElement===window?this._scrollElement.pageYOffset:this._scrollElement.scrollTop}_getScrollHeight(){return this._scrollElement.scrollHeight||Math.max(document.body.scrollHeight,document.documentElement.scrollHeight)}_getOffsetHeight(){return this._scrollElement===window?window.innerHeight:this._scrollElement.getBoundingClientRect().height}_process(){var t=this._getScrollTop()+this._config.offset,e=this._getScrollHeight(),i=this._config.offset+e-this._getOffsetHeight();if(this._scrollHeight!==e&&this.refresh(),i<=t)e=this._targets[this._targets.length-1],this._activeTarget!==e&&this._activate(e);else if(this._activeTarget&&t=this._offsets[e]&&("undefined"==typeof this._offsets[e+1]||te+`[data-target="${t}"],${e}[href="${t}"]`),e=d.default([].slice.call(document.querySelectorAll(e.join(","))));(e.hasClass("dropdown-item")?(e.closest(".dropdown").find(".dropdown-toggle").addClass(L),e):(e.addClass(L),e.parents(Kt).prev(Gt+", "+Jt).addClass(L),e.parents(Kt).prev(".nav-item").children(Gt))).addClass(L),d.default(this._scrollElement).trigger("activate.bs.scrollspy",{relatedTarget:t})}_clear(){[].slice.call(document.querySelectorAll(this._selector)).filter(e=>e.classList.contains(L)).forEach(e=>e.classList.remove(L))}static _jQueryInterface(i){return this.each(function(){let e=d.default(this).data(Ut);var t="object"==typeof i&&i;if(e||(e=new j(this,t),d.default(this).data(Ut,e)),"string"==typeof i){if("undefined"==typeof e[i])throw new TypeError(`No method named "${i}"`);e[i]()}})}}d.default(window).on("load.bs.scrollspy.data-api",()=>{var t=[].slice.call(document.querySelectorAll('[data-spy="scroll"]'));for(let e=t.length;e--;){var i=d.default(t[e]);j._jQueryInterface.call(i,i.data())}}),d.default.fn[x]=j._jQueryInterface,d.default.fn[x].Constructor=j,d.default.fn[x].noConflict=()=>(d.default.fn[x]=Vt,j._jQueryInterface);const Zt="bs.tab";Zt;const ei=d.default.fn.tab;const ti="active",ii=".active",ni="> li > .active";class F{constructor(e){this._element=e}static get VERSION(){return"4.6.0"}show(){if(!(this._element.parentNode&&this._element.parentNode.nodeType===Node.ELEMENT_NODE&&d.default(this._element).hasClass(ti)||d.default(this._element).hasClass("disabled"))){let e,i;var t=d.default(this._element).closest(".nav, .list-group")[0],n=a.getSelectorFromElement(this._element),o=(t&&(o="UL"===t.nodeName||"OL"===t.nodeName?ni:ii,i=(i=d.default.makeArray(d.default(t).find(o)))[i.length-1]),d.default.Event("hide.bs.tab",{relatedTarget:this._element})),s=d.default.Event("show.bs.tab",{relatedTarget:i});i&&d.default(i).trigger(o),d.default(this._element).trigger(s),s.isDefaultPrevented()||o.isDefaultPrevented()||(n&&(e=document.querySelector(n)),this._activate(this._element,t),s=()=>{var e=d.default.Event("hidden.bs.tab",{relatedTarget:this._element}),t=d.default.Event("shown.bs.tab",{relatedTarget:i});d.default(i).trigger(e),d.default(this._element).trigger(t)},e?this._activate(e,e.parentNode,s):s())}}dispose(){d.default.removeData(this._element,Zt),this._element=null}_activate(e,t,i){const n=(!t||"UL"!==t.nodeName&&"OL"!==t.nodeName?d.default(t).children(ii):d.default(t).find(ni))[0];var t=i&&n&&d.default(n).hasClass("fade"),o=()=>this._transitionComplete(e,n,i);n&&t?(t=a.getTransitionDurationFromElement(n),d.default(n).removeClass("show").one(a.TRANSITION_END,o).emulateTransitionEnd(t)):o()}_transitionComplete(e,t,i){var n;t&&(d.default(t).removeClass(ti),(n=d.default(t.parentNode).find("> .dropdown-menu .active")[0])&&d.default(n).removeClass(ti),"tab"===t.getAttribute("role"))&&t.setAttribute("aria-selected",!1),d.default(e).addClass(ti),"tab"===e.getAttribute("role")&&e.setAttribute("aria-selected",!0),a.reflow(e),e.classList.contains("fade")&&e.classList.add("show"),e.parentNode&&d.default(e.parentNode).hasClass("dropdown-menu")&&((n=d.default(e).closest(".dropdown")[0])&&(t=[].slice.call(n.querySelectorAll(".dropdown-toggle")),d.default(t).addClass(ti)),e.setAttribute("aria-expanded",!0)),i&&i()}static _jQueryInterface(i){return this.each(function(){var e=d.default(this);let t=e.data(Zt);if(t||(t=new F(this),e.data(Zt,t)),"string"==typeof i){if("undefined"==typeof t[i])throw new TypeError(`No method named "${i}"`);t[i]()}})}}d.default(document).on("click.bs.tab.data-api",'[data-toggle="tab"], [data-toggle="pill"], [data-toggle="list"]',function(e){e.preventDefault(),F._jQueryInterface.call(d.default(this),"show")}),d.default.fn.tab=F._jQueryInterface,d.default.fn.tab.Constructor=F,d.default.fn.tab.noConflict=()=>(d.default.fn.tab=ei,F._jQueryInterface);const oi="toast",si="bs.toast";t="."+si;const ri=d.default.fn[oi],ai="click.dismiss"+t,li="show",di="showing",fi={animation:"boolean",autohide:"boolean",delay:"number"},hi={animation:!0,autohide:!0,delay:500};class ci{constructor(e,t){this._element=e,this._config=this._getConfig(t),this._timeout=null,this._setListeners()}static get VERSION(){return"4.6.0"}static get DefaultType(){return fi}static get Default(){return hi}show(){var e,t=d.default.Event("show.bs.toast");d.default(this._element).trigger(t),t.isDefaultPrevented()||(this._clearTimeout(),this._config.animation&&this._element.classList.add("fade"),t=()=>{this._element.classList.remove(di),this._element.classList.add(li),d.default(this._element).trigger("shown.bs.toast"),this._config.autohide&&(this._timeout=setTimeout(()=>{this.hide()},this._config.delay))},this._element.classList.remove("hide"),a.reflow(this._element),this._element.classList.add(di),this._config.animation?(e=a.getTransitionDurationFromElement(this._element),d.default(this._element).one(a.TRANSITION_END,t).emulateTransitionEnd(e)):t())}hide(){var e;this._element.classList.contains(li)&&(e=d.default.Event("hide.bs.toast"),d.default(this._element).trigger(e),e.isDefaultPrevented()||this._close())}dispose(){this._clearTimeout(),this._element.classList.contains(li)&&this._element.classList.remove(li),d.default(this._element).off(ai),d.default.removeData(this._element,si),this._element=null,this._config=null}_getConfig(e){return e={...hi,...d.default(this._element).data(),..."object"==typeof e&&e?e:{}},a.typeCheckConfig(oi,e,this.constructor.DefaultType),e}_setListeners(){d.default(this._element).on(ai,'[data-dismiss="toast"]',()=>this.hide())}_close(){var e,t=()=>{this._element.classList.add("hide"),d.default(this._element).trigger("hidden.bs.toast")};this._element.classList.remove(li),this._config.animation?(e=a.getTransitionDurationFromElement(this._element),d.default(this._element).one(a.TRANSITION_END,t).emulateTransitionEnd(e)):t()}_clearTimeout(){clearTimeout(this._timeout),this._timeout=null}static _jQueryInterface(n){return this.each(function(){var e=d.default(this);let t=e.data(si);var i="object"==typeof n&&n;if(t||(t=new ci(this,i),e.data(si,t)),"string"==typeof n){if("undefined"==typeof t[n])throw new TypeError(`No method named "${n}"`);t[n](this)}})}}d.default.fn[oi]=ci._jQueryInterface,d.default.fn[oi].Constructor=ci,d.default.fn[oi].noConflict=()=>(d.default.fn[oi]=ri,ci._jQueryInterface),e.Alert=n,e.Button=o,e.Collapse=l,e.Dropdown=E,e.Modal=S,e.Popover=Qt,e.Scrollspy=j,e.Tab=F,e.Toast=ci,e.Tooltip=O,e.Util=a,Object.defineProperty(e,"__esModule",{value:!0})}); diff --git a/source/_variables/redirect_same_release.py b/source/_variables/redirect_same_release.py index 026226be7a..1cfcb4c732 100644 --- a/source/_variables/redirect_same_release.py +++ b/source/_variables/redirect_same_release.py @@ -3,6 +3,20 @@ # Important: the redirect is relative to the old path redirectSameRelease = { + '4.7': { + '/cloud-service/cold-storage/index.html': + '/cloud-service/archive-data/index.html', + '/cloud-service/cold-storage/access.html': + '/cloud-service/archive-data/access.html', + '/cloud-service/cold-storage/configuration.html': + '/cloud-service/archive-data/configuration.html', + '/cloud-service/cold-storage/filename-format.html': + '/cloud-service/archive-data/filename-format.html', + '/cloud-service/getting-started/register-agents.html': + '/cloud-service/getting-started/enroll-agents.html', + '/user-manual/capabilities/osquery.html': + '/user-manual/capabilities/malware-detection/osquery.html', + }, '4.6': { '/cloud-security/azure/activity-services/active-directory/index.html': '/cloud-security/azure/activity-services/entra/index.html', diff --git a/source/cloud-security/amazon/services/supported-services/security-lake.rst b/source/cloud-security/amazon/services/supported-services/security-lake.rst index c9f51b6d0c..a11fe5d83f 100644 --- a/source/cloud-security/amazon/services/supported-services/security-lake.rst +++ b/source/cloud-security/amazon/services/supported-services/security-lake.rst @@ -219,7 +219,7 @@ More information about the different authentication methods can be found in the Visualizing alerts in Wazuh dashboard ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Once you set the configuration and restart the manager, you can visualize the Amazon Security Lake alerts in the Wazuh dashboard. To do this, go to the **Security events** module. Apply the filter ``rule.groups: amazon_security_lake`` for an easier visualization. +Once you set the configuration and restart the manager, you can visualize the Amazon Security Lake alerts in the Wazuh dashboard. To do this, go to the **Threat Hunting** module. Apply the filter ``rule.groups: amazon_security_lake`` for an easier visualization. .. thumbnail:: /images/aws/security-lake-1.png :align: center diff --git a/source/cloud-security/gcp/prerequisites/credentials.rst b/source/cloud-security/gcp/prerequisites/credentials.rst index e2877e66be..ef69dc6f34 100644 --- a/source/cloud-security/gcp/prerequisites/credentials.rst +++ b/source/cloud-security/gcp/prerequisites/credentials.rst @@ -48,7 +48,12 @@ Within the **Service Accounts** section, create a new service account and add th Creating a private key ---------------------- -After creating a service account, add a new key to it. To do this, click **Create Key**, select **JSON**, and click **Create** to complete the action. +After creating a service account, add a new key to it following these steps: + +#. Go to the **KEYS** tab. +#. Click on the **ADD KEY** dropdown menu and select **Create new key**. +#. For the key type, select **JSON**. +#. Click on **Create**. .. thumbnail:: /images/cloud-security/gcp/gcp-account-key.png :align: center diff --git a/source/cloud-security/gcp/prerequisites/pubsub.rst b/source/cloud-security/gcp/prerequisites/pubsub.rst index ecf8e669ce..ad7dd69d6b 100644 --- a/source/cloud-security/gcp/prerequisites/pubsub.rst +++ b/source/cloud-security/gcp/prerequisites/pubsub.rst @@ -17,14 +17,26 @@ In this section, we see how to create a topic, a subscription, and a sink to ful Create a topic -------------- -Every publishing application sends messages to topics. Wazuh will retrieve the logs from this topic. +Every publishing application sends messages to topics. To create a topic, follow these steps. Wazuh will retrieve logs from this topic. + +#. Go to the **Pub/Sub** service. +#. Click on **CREATE TOPIC**. +#. Set a **Topic ID** and click **CREATE**. + +.. note:: + + Leave the **Add a default subscription** box checked to create a default subscription associated with this topic. To create a customized one, uncheck it and go to the next section. .. thumbnail:: /images/cloud-security/gcp/gcp-topic.png :align: center :width: 100% -Create a subscription ---------------------- +Create a custom subscription +---------------------------- + +.. note:: + + If you selected to create a default subscription in the step above, you can skip this section. Follow the steps below to fill in the **Create subscription** form: diff --git a/source/cloud-service/account-billing/billing-faq.rst b/source/cloud-service/account-billing/billing-faq.rst index 0db4db6a7e..3abd187ece 100644 --- a/source/cloud-service/account-billing/billing-faq.rst +++ b/source/cloud-service/account-billing/billing-faq.rst @@ -14,6 +14,8 @@ Billing FAQ - `Where can I see the next payment for an environment?`_ +- `What happens to my payments if I want to upgrade or downgrade a setting?`_ + - `How do I view previous receipts and billing history?`_ - `How can I configure who receives receipts and billing notifications?`_ @@ -34,17 +36,22 @@ Each environment is charged monthly, according to the environment's beginning da Is my credit card information safe? ----------------------------------- -Your credit card information is sent securely to our billing provider, `Stripe `_, and stored with them. +Your credit card information is sent securely to our billing provider, `Stripe `_, and stored there. Where can I see the next payment for an environment? ---------------------------------------------------- -Go to :doc:`See your billing cycle and history ` section to learn how to view the billing details of your environments. +Go to the :doc:`See your billing cycle and history ` section to learn how to view the billing details of your environments. + +What happens to my payments if I want to upgrade or downgrade a setting? +------------------------------------------------------------------------ + +If you choose to upgrade a setting, you need to make an immediate prorated payment. The upgrade becomes effective immediately, albeit leading to an increased price for your environment. Conversely, when downgrading a setting, the change takes effect in the subsequent billing cycle, with your price adjusted accordingly. See *Adjusting environment settings* for further details. How do I view previous receipts and billing history? ---------------------------------------------------- -Go to :doc:`See your billing cycle and history ` section to learn how to download the overview of all invoices issued for your account. +Go to the :doc:`See your billing cycle and history ` section to learn how to download an overview of all invoices issued for your account. How can I configure who receives receipts and billing notifications? -------------------------------------------------------------------- @@ -55,7 +62,7 @@ Go to :doc:`Update billing and operational contacts `_. +Credit or debit card payments are supported. To learn more about Wazuh supported cards, see the certified payment processor list of card brands in the `Stripe documentation `_. Can I get a refund? @@ -66,7 +73,7 @@ Charges are nonrefundable, but if you want to cease using an environment, you ca What is included in my Wazuh Cloud environment? ----------------------------------------------- -A full set-up of Wazuh, according to your tier, and a standard or premium support service. +A full set-up of Wazuh, according to your setting, and a standard or premium support service. How can I request more information? ----------------------------------- diff --git a/source/cloud-service/account-billing/billing-history.rst b/source/cloud-service/account-billing/billing-history.rst index 76ea7855c8..be0c9aa200 100644 --- a/source/cloud-service/account-billing/billing-history.rst +++ b/source/cloud-service/account-billing/billing-history.rst @@ -8,17 +8,17 @@ See your billing cycle and history ================================== -Information about your current billing cycle, outstanding payments, and billing receipts are available from the Wazuh Cloud Console. The billing cycle is the period between the last billing date and the current billing date, while your billing history shows an overview of all invoices issued for your account. +Information about your current billing cycle, outstanding payments, and billing receipts is available from the Wazuh Cloud Console. The billing cycle is the period between the last billing date and the current billing date, while your billing history shows an overview of all invoices issued for your account. To see your current billing cycle information: 1. Log in to the `Wazuh Cloud Console `_. -2. Go to the **Account** section and select **Summary**. +2. Go to the **Account** section and select **Summary** under **Billing**. - You can see the details about the upcoming billing for your active environments under the Current billing cycle. + You can see the details about the upcoming billing for your active environments under the current billing cycle. To see your billing history: 1. Log in to the `Wazuh Cloud Console `_. -2. Go to the **Account** section and select **Billing**. +2. Go to the **Account** section, select **Billing** and select **Invoices**. 3. Click the invoice to download a PDF with your billing history details. \ No newline at end of file diff --git a/source/cloud-service/account-billing/manage-billing-details.rst b/source/cloud-service/account-billing/manage-billing-details.rst index 597b4feed0..1255bbf7a5 100644 --- a/source/cloud-service/account-billing/manage-billing-details.rst +++ b/source/cloud-service/account-billing/manage-billing-details.rst @@ -10,9 +10,9 @@ Manage your billing details If you want to continue using your environment beyond the trial period, you need to add credit card details to your Wazuh Cloud account. Your credit card information is sent securely to our billing provider and stored with them. -.. note:: + .. note:: - A trial environment is converted to a paid environment when the trial expires. If you do not add your credit card information before the expiration date, your environment is deleted, and all data is permanently erased. Make sure to add your credit card before the end of the trial period. + A trial environment is converted to a paid environment when the trial expires. If you do not add your credit card information before the expiration date, your environment is deleted, and all data is permanently erased. Make sure to add your credit card before the end of the trial period. Add your billing details ------------------------ @@ -23,13 +23,17 @@ To add the billing details: 2. Go to the **Account** section and select **Billing**. -3. In Payment method, select **Add billing information**. +3. In Payment method section, select **Add billing information**. 4. Fill in the form with your billing details. 5. Click **Save** to confirm the payment method. -You can stop upcoming charges by :ref:`canceling your environments `. Please take into account that the cancellation cannot be undone once you do it and that all your data will be completely deleted. +You can stop upcoming charges by :ref:`canceling your environments `. + + .. note:: + + Please take into account that the cancellation cannot be undone once you do it and that all your data will be completely deleted. Remove your billing details --------------------------- diff --git a/source/cloud-service/account-billing/stop-charges.rst b/source/cloud-service/account-billing/stop-charges.rst index e96f0ac693..a337b43676 100644 --- a/source/cloud-service/account-billing/stop-charges.rst +++ b/source/cloud-service/account-billing/stop-charges.rst @@ -8,14 +8,14 @@ Stop charges for an environment =============================== -You can always cancel an environment you no longer need. When performing this action, the environment is removed at the end of the billing cycle with no new or additional charges incurred. +You can always cancel an environment you no longer need. When performing this action, the environment is removed at the end of the billing cycle, with no new or additional charges incurred. To stop being charged for an environment: 1. Log in to the `Wazuh Cloud Console `_. -2. Go to the **Environments** and select the environment you want to cancel. +2. Go to the **Environments** page and select the environment you want to cancel. 3. Click **Cancel environment** and confirm the cancellation. .. warning:: - The cancellation cannot be undone and all data is completely deleted with this action. \ No newline at end of file + Cancellation cannot be undone, and all data is permanently deleted with this action. \ No newline at end of file diff --git a/source/cloud-service/account-billing/update-billing.rst b/source/cloud-service/account-billing/update-billing.rst index a96aa39c8f..b00a057b83 100644 --- a/source/cloud-service/account-billing/update-billing.rst +++ b/source/cloud-service/account-billing/update-billing.rst @@ -10,9 +10,9 @@ Update billing and operational contacts You can specify billing and operational contacts in addition to the primary email address of your account. -.. note:: - - Billing and operational contacts are only for notification purposes, they cannot be used to log in to Wazuh Cloud Console. To access the Wazuh Cloud Console, you must use the primary email address for your account. + .. note:: + + Billing and operational contacts are only for notification purposes, they cannot be used to log in to the Wazuh Cloud Console. To access the Wazuh Cloud Console, you must use the primary email address for your account. To update billing and operational contacts: diff --git a/source/cloud-service/account-billing/user-settings.rst b/source/cloud-service/account-billing/user-settings.rst index 306739b3b1..d5ea1a5561 100644 --- a/source/cloud-service/account-billing/user-settings.rst +++ b/source/cloud-service/account-billing/user-settings.rst @@ -8,12 +8,12 @@ Edit user settings =================== -You can edit your account setting preferences such as email address and password from the Wazuh Cloud Console. You can also enable multi-factor authentication to increase security and see login method alternatives. +You can edit your account preferences, such as email address and password from the Wazuh Cloud Console. You can also enable multi-factor authentication to increase security and see login method alternatives. Configure your user profile --------------------------- -You can configure your name, last name, company name, country, phone number, and website anytime. Make sure to have the fields *Company*, and *Country* filled in as this information is required to create an environment. +You can configure your name, last name, company name, country, phone number, and website anytime. 1. Log in to the `Wazuh Cloud Console `_ and click the upper-right user icon to open the menu. 2. Go to **User settings**. @@ -46,7 +46,7 @@ If you know your current password: If you don’t know your current password: -1. On the log in page of the Wazuh Cloud Console, click **Forgot my password**. +1. Click on **Forgot my password** on the login page of the Wazuh Cloud Console. 2. Enter the primary email address for your account and click **Reset password**. An email is sent to your address with a link to reset the password. diff --git a/source/cloud-service/apis/authentication.rst b/source/cloud-service/apis/authentication.rst index 205a6641a3..89605f5b07 100644 --- a/source/cloud-service/apis/authentication.rst +++ b/source/cloud-service/apis/authentication.rst @@ -25,9 +25,9 @@ To obtain an API key: 5. Copy the generated API key and store it in a safe place. -.. note:: + .. note:: - The API key has no expiration date, so it can be used indefinitely. You might also have multiple API keys for different purposes and you can revoke them when you no longer need them. + The API key has no expiration date, so it can be used indefinitely. You might also have multiple API keys for different purposes, and you can revoke them when you no longer need them. To revoke an API key: diff --git a/source/cloud-service/apis/index.rst b/source/cloud-service/apis/index.rst index c5f9ea2ed3..4b0c8eb2e2 100644 --- a/source/cloud-service/apis/index.rst +++ b/source/cloud-service/apis/index.rst @@ -8,9 +8,9 @@ Wazuh Cloud API =============== -Wazuh Cloud provides a Wazuh Cloud API that allows you to perform some operations with your cloud environments such as downloading the cold storage. +Wazuh Cloud provides a Wazuh Cloud API that allows you to perform some operations with your cloud environments, such as downloading archive data. -The information in this section covers: +This section provides information on the following: .. toctree:: :maxdepth: 1 diff --git a/source/cloud-service/cold-storage/access.rst b/source/cloud-service/archive-data/access.rst similarity index 75% rename from source/cloud-service/cold-storage/access.rst rename to source/cloud-service/archive-data/access.rst index 6276e1e442..c2af1f176f 100644 --- a/source/cloud-service/cold-storage/access.rst +++ b/source/cloud-service/archive-data/access.rst @@ -1,29 +1,29 @@ .. Copyright (C) 2015, Wazuh, Inc. .. meta:: - :description: Wazuh provides two types of storage for your indexed data: hot storage and cold storage. Learn more about cold storage access in this section. + :description: Wazuh provides two types of storage for your data: indexed and archive. Learn more about the archive data in this section. -.. _cloud_cold_storage_access: +.. _cloud_archive_data_access: Access ====== -To access your cold storage, you need an AWS token that grants permission on the AWS S3 bucket of your environment. This token can be generated using the Wazuh Cloud API. +To access your archive data, you need an AWS token that grants permission on the AWS S3 bucket of your environment. This token can be generated using the Wazuh Cloud API. -.. note:: - See the :doc:`Wazuh Cloud CLI ` section to learn how to list and download your cold storage automatically. + .. note:: + See the :doc:`Wazuh Cloud CLI ` section to learn how to list and download your archive data automatically. -The following example describes the steps to follow to list the files of your cold storage: +The following example describes the steps to follow to list the files of your archive data: 1. Before your start using the Wazuh Cloud API, you need an API key. To generate your API key, see the :ref:`Authentication ` section. -2. Use the ``POST /storage/token`` endpoint of the :cloud-api-ref:`Wazuh Cloud API ` to get the AWS token and access the cold storage of a specific environment. In this example, we generate an AWS token valid for 3600 seconds for environment `0123456789ab`. +2. Use the ``POST /storage/token`` endpoint of the :cloud-api-ref:`Wazuh Cloud API ` to get the AWS token and access the archive data of a specific environment. In this example, we generate an AWS token valid for 3600 seconds for environment `0123456789ab`. .. code-block:: - curl -XPOST https://api.cloud.wazuh.com/v2/storage/token -H "x-api-key: " -H "Content-Type: application/json" --data ' + curl -XPOST https://api.cloud.wazuh.com/v2/storage/token -H "x-api-key: " -H "Content-Type: application/json" --data ' { "environment_cloud_id": "0123456789ab", "token_expiration": "3600" @@ -61,4 +61,4 @@ The following example describes the steps to follow to list the files of your co $ aws --profile wazuh_cloud_storage --region us-east-1 s3 ls wazuh-cloud-cold-us-east-1/0123456789ab -You now have access to your cold storage. +You now have access to your archive data. diff --git a/source/cloud-service/archive-data/configuration.rst b/source/cloud-service/archive-data/configuration.rst new file mode 100644 index 0000000000..f31b52f809 --- /dev/null +++ b/source/cloud-service/archive-data/configuration.rst @@ -0,0 +1,25 @@ +.. Copyright (C) 2015, Wazuh, Inc. + +.. meta:: + :description: Wazuh provides two types of storage for your data: indexed and archive. Learn more about the archive data in this section. + + +Configuration +============= + +Your environment is configured by default to send Wazuh output files to archive data. + + +There are two Wazuh output files in JSON format: + +- ``/var/ossec/logs/archives/archives.json``: If you set ``logall_json`` to ``yes``, Wazuh stores all events in this file and sends it to archive data, regardless of whether they triggered an alert. + +- ``/var/ossec/logs/alerts/alerts.json``: This file contains only events that tripped a rule with high enough priority, according to a configurable threshold. This is always sent to archive data. + +Both files are delivered to archive data as soon as they are rotated and compressed. This process usually takes between 10 and 30 minutes from the moment the event is received. + +The oldest files in the archive data are rotated based on the **archive data** setting. + +.. note:: + + Files with a ``.log`` extension are never sent to archive data. diff --git a/source/cloud-service/cold-storage/filename-format.rst b/source/cloud-service/archive-data/filename-format.rst similarity index 94% rename from source/cloud-service/cold-storage/filename-format.rst rename to source/cloud-service/archive-data/filename-format.rst index 95b50ca63d..20fa3f78ea 100644 --- a/source/cloud-service/cold-storage/filename-format.rst +++ b/source/cloud-service/archive-data/filename-format.rst @@ -1,22 +1,21 @@ .. Copyright (C) 2015, Wazuh, Inc. .. meta:: - :description: Wazuh provides two types of storage for your indexed data: hot and cold storage. Learn more about the cold storage filename format in this section. + :description: Wazuh provides two types of storage for your data: indexed and archive. Learn more about the archive data in this section. -.. _cloud_cold_storage_format: Filename format =============== -The files are stored in a directory structure that indicates the date and time the file was delivered to the cold storage. +The files are stored in a directory structure that indicates the date and time the file was delivered to the archive data. The main path follows this format: -``wazuh-cloud-cold-//[/]///`` +``wazuh-cloud-cold-//[/]///`` Each file has the following name: -``_[_]__.`` +``_[_]__.`` The files include the following fields: diff --git a/source/cloud-service/archive-data/index.rst b/source/cloud-service/archive-data/index.rst new file mode 100644 index 0000000000..05e33a46a6 --- /dev/null +++ b/source/cloud-service/archive-data/index.rst @@ -0,0 +1,37 @@ +.. Copyright (C) 2015, Wazuh, Inc. + + +.. meta:: + :description: Wazuh provides two types of storage for your data: indexed and archive. Learn more about the archive data in this section. + +Archive data +============= + +Wazuh provides two types of storage for your data: + +- **Indexed data**, formerly known as hot storage. +- **Archive data**, formerly known as cold storage. + +When Wazuh ingests and indexes events from agents, the data becomes searchable and analyzable in the Wazuh WUI. This information is stored in indexed data, which is limited by your :ref:`indexed data retention and indexed data capacity ` (formerly known as tier) settings. Simultaneously, the data is sent to archive data with a maximum delay of 30 minutes after initial processing by Wazuh. Archive data is stored in an AWS S3 bucket, allowing you to store logs for extended periods and meet compliance requirements. Additionally, you can reindex the data to other environments for further investigations. + +Environment example for data storage +------------------------------------ + +This example environment is configured with the following settings: + +- Indexed data retention: 3 months +- Indexed data capacity (formerly known as tier): 100 GB +- Archive data: 1 year + +Assuming that Wazuh ingests 5GB of data daily, with 20% of events generating alerts, it indexes 1GB per day. In this scenario, the indexed data can retain alerts for up to 100 days (1GB per day - 100GB), but it will be rotated to maintain only 3 months of data as specified in the indexed data retention setting. However, all information from the past year is still accessible in the archive data according to the archive data setting. + +This configuration ensures that recent alerts are readily available in the indexed data, while older data is securely stored in the archive data for compliance and historical purposes. + +For more information about the archive data feature in the Wazuh Cloud service, please refer to the following sections: + +.. toctree:: + :maxdepth: 1 + + configuration + filename-format + access diff --git a/source/cloud-service/cli/index.rst b/source/cloud-service/cli/index.rst index 0d2614bd34..452f7723d4 100644 --- a/source/cloud-service/cli/index.rst +++ b/source/cloud-service/cli/index.rst @@ -76,10 +76,10 @@ A non-default location can be specified for the config file by setting the `WAZU Examples -------- -Getting S3 token for cold storage -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Getting S3 token for archive data +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -This command generates an AWS token to access the cold storage of the environment with Cloud ID `012345678ab`. +This command generates an AWS token to access the archive data of the environment with Cloud ID `012345678ab`. .. code-block:: console @@ -94,10 +94,10 @@ This command generates an AWS token to access the cold storage of the environmen aws_secret_access_key = A...E aws_session_token = F...Q== -Listing cold storage -^^^^^^^^^^^^^^^^^^^^ +Listing archive data +^^^^^^^^^^^^^^^^^^^^^ -This command lists the cold storage files of the environment `012345678ab` between the specified dates. +This command lists the archive data files of the environment `012345678ab` between the specified dates. .. code-block:: console @@ -109,10 +109,10 @@ This command lists the cold storage files of the environment `012345678ab` betwe Environment '012345678ab' files from 2021-05-07 to 2021-05-07: 012345678ab/output/alerts/2021/05/07/012345678ab_output_alerts_20210507T1040_mXSoDTf5Pgyr8b8D.json.gz -Downloading cold storage -^^^^^^^^^^^^^^^^^^^^^^^^ +Downloading archive data +^^^^^^^^^^^^^^^^^^^^^^^^^ -This command downloads in the `/home/test` directory the cold storage files of the environment `012345678ab` between the specified dates. +This command downloads in the `/home/test` directory the archive data files of the environment `012345678ab` between the specified dates. .. code-block:: console diff --git a/source/cloud-service/cold-storage/configuration.rst b/source/cloud-service/cold-storage/configuration.rst deleted file mode 100644 index 865a903dad..0000000000 --- a/source/cloud-service/cold-storage/configuration.rst +++ /dev/null @@ -1,25 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Wazuh provides two types of storage for your indexed data: hot storage and cold storage. Learn more about the cold storage configuration in this section. - -.. _cloud_cold_storage_configuration: - -Configuration -============= - -Your environment is configured by default to send Wazuh output files to cold storage. - - -There are two types of Wazuh output files: - -- The file ``/var/ossec/logs/archives/archives.json`` contains all events whether they tripped a rule or not. This is sent to cold storage if the setting ``logall_json`` is set to ``yes``. -- The file ``/var/ossec/logs/alerts/alerts.json`` contains only events that tripped a rule with high enough priority, according to a configurable threshold. This is always sent to cold storage. - -Both files are delivered to cold storage as soon as they are rotated and compressed. This process usually takes between 10 to 30 minutes from the moment the event is received. - -There is no limit on the amount of data stored in the cold storage, but the time limit is one year. After this period of time, the data is removed. - -.. note:: - - Files with a ``.log`` extension are never sent to cold storage. diff --git a/source/cloud-service/cold-storage/index.rst b/source/cloud-service/cold-storage/index.rst deleted file mode 100644 index c58b41119a..0000000000 --- a/source/cloud-service/cold-storage/index.rst +++ /dev/null @@ -1,27 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. _cloud_your_environment_accessing_cold_storage: - -.. meta:: - :description: Wazuh provides two types of storage for your indexed data: hot storage and cold storage. Learn more about the cold storage in this section. - -Cold storage -============ - -Wazuh provides two types of storage for your indexed data: hot storage and cold storage. - -Wazuh ingests and indexes the events sent by the agents, making the data searchable and analyzable on the Wazuh WUI. This information is available in hot storage and is limited by the :ref:`tier `. At the same time, data is sent to cold storage, with a delay of a maximum of 30 minutes since it is first processed by Wazuh. The cold storage is an AWS S3 bucket to store your logs for longer periods of time and meet compliance requirements. Also, you can reindex the data to other environments for investigations. - -This is an example of how Wazuh manages the storing of data: - -Let's suppose that an environment with a tier of 100GB has 50 agents connected. Wazuh ingests 5GB on a daily basis and, assuming that 20% of events generate an alert, indexes 1GB per day. In this scenario, the hot storage contains 100 days of alerts (1 GB per day). When that 100 GB of data is exceeded, the oldest data is rotated. All information is still accessible in cold storage. - - -Read the following sections to learn more about Wazuh Cloud service's cold storage: - -.. toctree:: - :maxdepth: 1 - - configuration - filename-format - access diff --git a/source/cloud-service/getting-started/access-wazuh-wui.rst b/source/cloud-service/getting-started/access-wazuh-wui.rst index 3f0392df13..91ec9f4f3c 100644 --- a/source/cloud-service/getting-started/access-wazuh-wui.rst +++ b/source/cloud-service/getting-started/access-wazuh-wui.rst @@ -7,22 +7,22 @@ Access Wazuh WUI ================ -The Wazuh WUI is a flexible and intuitive web interface. Through this WUI, you have access to the tools for mining and visualizing events, giving you a comprehensive insight into your monitored systems. +The Wazuh dashboard has a flexible and intuitive web interface. Through this WUI, you have access to visualizations that give you a comprehensive insight into your monitored endpoints. -Follow these steps to access Wazuh WUI: +Follow these steps to access Wazuh dashboard: #. Log in to the `Wazuh Cloud Console `_. -#. On the **Environments** page, select the environment you want to access. +#. Select the environment you want to access from the **Environments** page. #. Click **Open Wazuh** to open Wazuh WUI. #. Choose from one of these methods to log in: - - Log in with the default credentials. You can download them by clicking **Default credentials** on the Environments page. Then, use the `Wazuh WUI - Username` and `Wazuh WUI - Password` to log in. + - Log in with the default credentials. You can view them by clicking the **Manage** button and selecting **Default credentials** on the environments page. These credentials will grant you access to the Wazuh WUI. - If Single sign-on (SSO) is enabled, use your own account. - - You can also log in with any user you already created in Wazuh WUI. + - You can also log in with any user you created in Wazuh WUI. It is highly recommended for security reasons to change the default password and create your own users. -.. note:: You can access the Wazuh WUI directly using the URL *https://.cloud.wazuh.com*, where ```` is the Cloud ID of your environment. + .. note:: You can access the Wazuh WUI directly using the URL *https://.cloud.wazuh.com*, where ```` is the Cloud ID of your environment. If you have any questions about the Wazuh Cloud, see the :doc:`Cloud service FAQ `. @@ -30,4 +30,4 @@ If you have any questions about the Wazuh Cloud, see the :doc:`Cloud service FAQ Next steps ---------- -Your Wazuh Cloud environment is ready, and you can install a Wazuh agent on every endpoint to be monitored. To learn how to install agents, check the :ref:`Register agents ` section. \ No newline at end of file +Your Wazuh Cloud environment is ready, and you can install the Wazuh agent on the endpoint you want to monitor. Check out the :ref:`Enroll agents ` section to learn how to install agents. \ No newline at end of file diff --git a/source/cloud-service/getting-started/register-agents.rst b/source/cloud-service/getting-started/enroll-agents.rst similarity index 54% rename from source/cloud-service/getting-started/register-agents.rst rename to source/cloud-service/getting-started/enroll-agents.rst index 2a90aae8da..10e169af5f 100644 --- a/source/cloud-service/getting-started/register-agents.rst +++ b/source/cloud-service/getting-started/enroll-agents.rst @@ -4,24 +4,23 @@ :description: Learn more about how to get started with Wazuh Cloud Service. Explore the potential of Wazuh Cloud with your 14-day free trial. -Register agents -=============== +Enroll agents +============= -To start using Wazuh, you need to install a Wazuh agent on your endpoint and register it in your environment. +To start using Wazuh, you need to install a Wazuh agent on your endpoint and enroll it in your environment. -Follow these steps to register an agent: +Follow these steps to enroll an agent: #. Log into the Wazuh WUI. -#. Click **Endpoints Summary**. +#. Click the upper-left **Wazuh** icon and then **Agents**. -#. Click **Deploy a new agent**. +#. Click **Deploy new agent**. -#. Follow the steps described in Wazuh WUI. +#. Follow the steps described on the **Deploy a new agent** page. -.. note:: + .. note:: - Agents must use **TCP** to communicate with your environment. - + Wazuh agents use TCP to communicate with your environment. If you have any questions about the Wazuh Cloud, see the :doc:`Cloud service FAQ `. diff --git a/source/cloud-service/getting-started/index.rst b/source/cloud-service/getting-started/index.rst index f3d11c2bc1..69069fc757 100644 --- a/source/cloud-service/getting-started/index.rst +++ b/source/cloud-service/getting-started/index.rst @@ -8,9 +8,12 @@ Getting started =============== -To get started with Wazuh Cloud, you need to create a Wazuh Cloud account and set up your environment, a deployment that contains all the Wazuh components ready to be used. Creating an environment is streamlined for you. Installing and updating the Wazuh components and defining scalability are all handled by Wazuh Cloud. Once your environment is ready, you need to access the Wazuh WUI and deploy the Wazuh agent to your endpoints. +A Wazuh Cloud environment is a deployment that contains all the Wazuh components ready to be used. To get started with Wazuh Cloud, you need to create a Wazuh Cloud account and set up your environment. + +The installation and update of the Wazuh components and defining scalability are all handled by the Wazuh Cloud. Once your environment is ready, you must access the Wazuh dashboard and deploy the Wazuh agent to your endpoints. + +Learn how to get started with Wazuh Cloud in the sections below. -Learn how to get started with Wazuh Cloud in the below sections. .. toctree:: @@ -20,5 +23,5 @@ Learn how to get started with Wazuh Cloud in the below sections. sign-up-trial access-wazuh-wui - register-agents + enroll-agents starting-faq diff --git a/source/cloud-service/getting-started/sign-up-trial.rst b/source/cloud-service/getting-started/sign-up-trial.rst index 9c48989de5..9a2fee9903 100644 --- a/source/cloud-service/getting-started/sign-up-trial.rst +++ b/source/cloud-service/getting-started/sign-up-trial.rst @@ -6,18 +6,20 @@ Sign up for a trial =================== -Wazuh provides a 14-day free trial for you to create a cloud environment and explore the Wazuh Cloud service. +Wazuh provides a 14-day free trial to create a cloud environment and explore the Wazuh Cloud service. Follow the next steps to create your trial environment. Sign up ------- -To sign up for a free trial, all you need is an email address: +To sign up for a free trial, do the following. -#. Go to our `Wazuh Cloud Console `_ page. +#. Go to our Wazuh Cloud Console `Login `_ page. -#. Enter your email address and password. +#. Fill in the required information and click the **Create account** button. + +#. Verify your email address. Now you are ready to create your first :ref:`environment `. @@ -26,26 +28,24 @@ Create environment Follow these steps to quickly set up and run your environment: -#. From the `Wazuh Cloud Console `_, click **Start your free trial**. +#. From the `Wazuh Cloud Console `_, click the **Start your free trial** button. #. Configure your environment: #. Give your environment a name. - #. Choose a :ref:`tier ` to define the size in bytes of the indexed events. You can use this `estimation tool `_ to calculate the Wazuh Cloud data tier. - - .. note:: During the 14-day trial period, the tier limit is 100GB. Then, after your first payment, the full tier becomes unlocked. For testing purposes, 100 GB is more than enough to get an insight into Wazuh Cloud. - - #. Select the :ref:`region ` where your environment gets hosted. If you are not sure what to pick, select one that is the closest to your location since this typically reduces latency for indexing and search requests. + #. Select the :ref:`region ` to host your environment. If you are not sure what to pick, select a region that is the closest to your location since this typically reduces latency for indexing and search requests. - #. Choose the support plan that best suits your needs. + #. Fill in the use case. This information helps us understand why our users utilize our service, allowing us to improve it accordingly. - #. Complete your user profile. This step is only shown when there is missing information on your profile. + #. Choose from the available settings by selecting one of three predefined profiles: **Small**, **Medium**, or **Large**. If these presets don't align with your needs, opt for the Custom option to configure settings individually. For more details about the settings and their functionality, see the :doc:`Settings ` section. - To edit your user profile information, see the :ref:`Edit user settings ` section. + .. note:: Thoughout the 14-day trial period, some settings are limited. However, they do not prevent you from exploring and using the Wazuh Cloud platform. All restrictions are removed after you make the initial payment. + + #. Select between monthly or annual payments. If you choose the monthly option, you will be billed on a monthly basis, whereas the annual option entails a single payment per year. -#. Click **View the summary** and then **Create** to build your environment. This process might take a moment. +#. Click on **Start your free trial** to build your environment. This process might take a few minutes. -Once the environment is ready, you can :ref:`access the Wazuh WUI ` and register the agents. +Once the environment is ready, access the :ref:`Wazuh dashboard ` and enroll the Wazuh agents. If you have any questions about the Wazuh Cloud, see the :doc:`Cloud service FAQ `. diff --git a/source/cloud-service/getting-started/starting-faq.rst b/source/cloud-service/getting-started/starting-faq.rst index 94953fc73a..8081b14e18 100644 --- a/source/cloud-service/getting-started/starting-faq.rst +++ b/source/cloud-service/getting-started/starting-faq.rst @@ -21,67 +21,119 @@ Cloud service FAQ - `Is it PCI DDS compliant?`_ +- `Is it SOC 2 compliant?`_ + - `How can I get support?`_ - `Where is Wazuh Cloud hosted?`_ +- `What is a profile?`_ + +- `What is a setting?`_ + +- `What is the indexed data?`_ + +- `What is the archive data?`_ + - `What is a tier?`_ - `What happens if the tier limit is reached?`_ -- `Can I cancel at any time?`_ +- `What happens if the indexed data capacity setting is reached?`_ + +- `How is indexed data rotated?`_ -- `How can I get help?`_ +- `What happens if the average/peak EPS is exceeded?`_ + +- `Can I cancel at any time?`_ What is Wazuh Cloud? -------------------- -Wazuh Cloud hosts and manages all the Wazuh components in one integrated platform, you simply need to access your environment and deploy the Wazuh agent to your endpoints. Wazuh provides protection with *Security Information and Event Management* (SIEM) and *Endpoint Detection and Response* (EDR). +Wazuh Cloud provides a comprehensive solution by hosting and managing all Wazuh components within a single integrated platform. Wazuh cloud allows you to create your environment and enroll Wazuh agents. By leveraging Wazuh, you gain access to security capabilities, including Security Information and Event Management (SIEM) and Extended Detection and Response (XDR). Can I try it for free? ---------------------- -Yes, Wazuh provides a free trial for you to create a cloud environment and access the Wazuh Cloud. You can :ref:`sign up for a 14-day free trial `, and no credit card information is required to complete this process. +Yes, Wazuh provides a free trial to create a cloud environment and access the Wazuh Cloud service. You can :ref:`sign up for a 14-day free trial `, and no credit card information is required to complete this process. + Will I be charged when my trial is over? ---------------------------------------- -No, Wazuh does not request credit card information to start your trial. Charges are only applied if you decide to keep using the service beyond the trial period. +No, Wazuh does not request credit card information to start your trial. Charges are only applied if you keep using the service beyond the trial period. Is it PCI DDS compliant? ------------------------ Yes, the Wazuh Cloud platform is validated as PCI DSS Level 1 Service Provider compliant. +Is it SOC 2 compliant? +---------------------- + +Yes, the Wazuh Cloud platform is compliant with SOC 2 standards. + .. _cloud_getting-started_support: How can I get support? ---------------------- -Every environment includes support after the first payment. +Every environment includes support after the first payment. You can contact the Wazuh team anytime through the Help section on your Wazuh Cloud Console. You can also fill out `this form `_ to get help from the Wazuh team. Where is Wazuh Cloud hosted? ---------------------------- Wazuh Cloud is hosted on Amazon Web Services (AWS). +What is a profile? +------------------ + +A profile refers to predefined settings available for configuring your Wazuh Cloud environment. We offer three profiles: Small, Medium, and Large. They provide ready-to-use environment templates that cater to different needs and requirements. If none of these predefined profiles meet your specific requirements, you can configure your settings individually. + +What is a setting? +------------------ + +In the context of Wazuh Cloud, a setting refers to each configuration option available for a cloud environment. These settings determine the limitations and functionalities of an environment. For example, the "Active Agents" setting specifies the maximum number of active agents allowed in your environment. Note that the settings chosen for an environment directly impact its pricing, as they affect the resources allocated and functionalities available. + +What is the indexed data? +------------------------- + +The indexed data, previously known as hot storage, includes the data available on the Wazuh dashboard, which corresponds to the information Wazuh indexed. This information becomes searchable and analyzable as soon as Wazuh ingests and indexes the events sent by the agents. + +What is the archive data? +-------------------------- + +The data generated by Wazuh is archive in an AWS S3 bucket for long-term storage purposes. Unlike the indexed data, this archive data is not searchable or analyzable. It simply consists of a collection of compressed files. For more information, please see the :ref:`Archive data ` section. + What is a tier? --------------- -The tier is the size limitation, in bytes, of the hot storage. +The concept of a tier, which represents the size limitation, in bytes, of the indexed data (formerly known as hot storage), is no longer used. It has been replaced by the *indexed data capacity* setting. What happens if the tier limit is reached? ------------------------------------------ -The oldest events are removed from your index when the tier limit is reached. This data is available in cold storage for you to access. See the :ref:`Cold storage ` section to learn more about data logging and storage. +See :ref:`What happens if the indexed data capacity setting is reached? `. + +.. _cloud_starting_faq_data_reached: + +What happens if the indexed data capacity setting is reached? +------------------------------------------------------------- + +When the selected **indexed data capacity** is reached, the oldest events will be automatically removed from your index regardless of the **index data time**. This data is available in archive data for you to access. See the :ref:`Archive data ` section to learn more about data logging and storage. + +How is indexed data rotated? +---------------------------- + +Data rotation is determined by two conditions: the indexed data retention and the indexed data capacity. For instance, if you have set a 3-month indexed data retention and a 100GB indexed data capacity, and you consume the entire 100GB within the first month, the data will start rotating. Similarly, even if you have not utilized all 100GB, the data from the first month will be rotated by the fourth month if only 20GB is used. + +What happens if the average/peak EPS is exceeded? +---------------------------------------------------- + +If you send more events per second than allowed by the **average/peak EPS** setting, events start queuing, and if the queue becomes full, the incoming events will be discarded, which may lead to potential event loss. Can I cancel at any time? ------------------------- Yes, you can cancel at any time with no penalty. You can keep using your environment until the end of your :doc:`current billing cycle `, and no future charges are incurred after this period. - -How can I get help? -------------------- - -You can contact the Wazuh team anytime through the **Help** section on your Wazuh Cloud Console. You can also fill out `this form `_ to get help from the Wazuh team. \ No newline at end of file diff --git a/source/cloud-service/glossary.rst b/source/cloud-service/glossary.rst index e1f2d53234..5873984b17 100644 --- a/source/cloud-service/glossary.rst +++ b/source/cloud-service/glossary.rst @@ -14,11 +14,17 @@ Here is a list of terms related to Wazuh Cloud. - `Cloud ID`_ -- `Cold storage`_ - - `Environment`_ -- `Hot storage`_ +- `Archive data`_ + +- `Indexed data`_ + +- `Tier`_ + +- `Setting`_ + +- `Profile`_ - `Region`_ @@ -26,7 +32,6 @@ Here is a list of terms related to Wazuh Cloud. - `Wazuh Cloud CLI`_ -- `Tier`_ Cloud Console @@ -41,13 +46,6 @@ Cloud ID The Cloud ID is a unique ID for your environment on Wazuh Cloud. It is used for multiple purposes, such as Wazuh WUI access or the agent registration process. -.. _cloud_glossary_cold_storage: - -Cold storage ------------- - -It is the data containing the output generated by Wazuh, such as alerts or archives. It is an AWS S3 bucket to store your logs for a longer time and meet compliance requirements. - .. _cloud_glossary_environment: Environment @@ -55,14 +53,42 @@ Environment An environment is a deployment that contains all the Wazuh components ready to use and running on Wazuh Cloud. +.. _cloud_glossary_archive_data: + +Archive data +---------------------------------------------- + +Formerly known as cold storage, it's the data containing the output generated by Wazuh, such as alerts and archives. It's an AWS S3 bucket to store your logs for a longer time and meet compliance requirements. + .. _cloud_glossary_hot_storage: -Hot storage ------------ +Indexed data +-------------------------------------------- -It is the data available on the Wazuh WUI corresponding to the information indexed by Wazuh. This information is available as soon as Wazuh ingests and indexes the events sent by the agents, making the data searchable and analyzable. +Formerly known as hot storage, it's the data available on the Wazuh dashboard corresponding to the information indexed by Wazuh. This information is available as soon as Wazuh ingests and indexes the events sent by the agents, making the data searchable and analyzable. -Hot storage use is calculated using the primary shards of ``wazuh-*`` indices. +Indexed data is calculated using the primary shards of ``wazuh-*`` indices. + +.. _cloud_glossary_tier: + +Tier +---- + +The concept of a tier, which represents the size limitation, in bytes, of the indexed data (formerly known as hot storage), is no longer used. It has been replaced by the *indexed data capacity* setting. + +.. _cloud_glossary_setting: + +Setting +------- + +In the context of Wazuh Cloud, a setting refers to each configuration option available for a cloud environment. These settings determine the limitations, functionalities, and pricing of an environment. + +.. _cloud_glossary_profile: + +Profile +------- + +A profile refers to predefined settings that you can choose from when configuring your Wazuh Cloud environment. We have three profiles available: Small, Medium, and Large. These profiles are designed to simplify the process by providing preconfigured settings that cater to different needs and requirements. If none of the predefined profiles meet your specific requirements, you can configure your settings individually. .. _cloud_glossary_region: @@ -92,17 +118,11 @@ Available regions: Wazuh Cloud API --------------- -The Wazuh Cloud API is an application programming interface used to interact with Wazuh Cloud. The Wazuh Cloud API is used, for example, to provide access to an environment's cold storage. +The Wazuh Cloud API is an application programming interface used to interact with Wazuh Cloud. The Wazuh Cloud API is used, for example, to provide access to an environment's archive data. .. _cloud_glossary_wazuh_cloud_cli: Wazuh Cloud CLI --------------- -The Wazuh Cloud Command Line Interface is a tool that enables you to interact with Wazuh Cloud using commands in your command-line shell. - -.. _cloud_glossary_tier: - -Tier ----- -The tier is the size limitation, in bytes, of the hot storage. When the tier is reached, the oldest events are removed from your index. Events removed from your index are still available in cold storage. You can use this `estimation tool `_ to calculate the Wazuh Cloud data tier. +The Wazuh Cloud Command Line Interface is a tool that enables you to interact with Wazuh Cloud using commands in your command-line shell. \ No newline at end of file diff --git a/source/cloud-service/index.rst b/source/cloud-service/index.rst index 4b395da6bc..5673454ea1 100644 --- a/source/cloud-service/index.rst +++ b/source/cloud-service/index.rst @@ -5,14 +5,16 @@ .. _cloud_service: -Cloud service -============= +Wazuh Cloud service +=================== -Wazuh protects your enterprise with Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR). Wazuh Cloud hosts and manages all the Wazuh components in one integrated platform. You can create and tailor your cloud environment to meet specific needs and upgrade it to the most appropriate tier. The setting up of a Wazuh Cloud environment is streamlined: installing and updating the Wazuh components and defining scalability are all handled by Wazuh Cloud. +Wazuh is a free and open source platform that offers unified Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) capabilities. It protects workloads across on-premises, virtualized, cloud, and containerized environments. The Wazuh platform can be deployed in your on-premises and cloud environment or by using our Wazuh Cloud service. -We provide a free trial for you to create a cloud environment and explore the Wazuh Cloud service. +The Wazuh Cloud service hosts and manages all the Wazuh components in one integrated platform. You can create and tailor your cloud environment to meet your specific needs. The Wazuh Cloud service is streamlined for quick and easy deployment of Wazuh. It handles installation, scaling, and updates of the Wazuh components. -Learn more about Wazuh Cloud in the below sections. +We provide a free trial to create your cloud environment and explore the Wazuh Cloud service. + +Learn more about Wazuh Cloud in the sections below. .. toctree:: :titlesonly: @@ -22,7 +24,7 @@ Learn more about Wazuh Cloud in the below sections. getting-started/index your-environment/index account-billing/index - cold-storage/index + archive-data/index apis/index cli/index glossary diff --git a/source/cloud-service/your-environment/agents-without-internet.rst b/source/cloud-service/your-environment/agents-without-internet.rst index fae506d340..a446287b57 100644 --- a/source/cloud-service/your-environment/agents-without-internet.rst +++ b/source/cloud-service/your-environment/agents-without-internet.rst @@ -34,7 +34,7 @@ To achieve this configuration, follow these steps: 3. Configure NGINX. - #. Add the following lines to the HTTP section in your NGINX configuration, located in ``/etc/nginx/nginx.conf``. + #. Add the following lines to the HTTP section in your NGINX configuration, located in the ``/etc/nginx/nginx.conf`` file. This configuration enables Nginx to extract and use the real client IP address from the X-Forwarded-For header and sets restrictions on which real IP addresses are accepted as valid. .. code-block:: @@ -45,16 +45,16 @@ To achieve this configuration, follow these steps: set_real_ip_from nginx_ip; } - #. Add the following block to the end of the NGINX configuration. + #. Add the following block to the end of the NGINX configuration file ``/etc/nginx/nginx.conf`` and replace ```` with the Cloud ID of your environment. This configuration enables stream proxying, where incoming traffic on specific ports is forwarded to the corresponding upstream servers (master or mycluster). This is based on the port numbers, 1515 and 1514 specified in the listen directive. .. code-block:: stream { upstream master { - server .cloud.wazuh.com:1515; + server .cloud.wazuh.com:1515; } upstream mycluster { - server .cloud.wazuh.com:1514; + server .cloud.wazuh.com:1514; } server { listen nginx_ip:1515; @@ -65,22 +65,20 @@ To achieve this configuration, follow these steps: proxy_pass mycluster; } } - - Make sure to replace ```` with the Cloud ID of your environment. - #. Restart NGINX with ``systemctl restart nginx``. + #. Run the command to restart NGINX: ``systemctl restart nginx``. - #. Register your agent but replace the *WAZUH_MANAGER_IP* value (``nginx_ip``) with the NGINX instance IP address. To learn more on how to register agents, see the :ref:`Register agents ` section. + #. Enroll your agent with the IP address of the NGINX instance. To learn more about registering agents, see the :ref:`Enroll agents ` section. Example: .. code-block:: - WAZUH_MANAGER_IP=nginx_ip WAZUH_PROTOCOL="tcp" \ - WAZUH_PASSWORD="xxxx" \ + WAZUH_MANAGER_IP= WAZUH_PROTOCOL="tcp" \ + WAZUH_PASSWORD="" \ yum install wazuh-agent|WAZUH_AGENT_RPM_PKG_INSTALL| - In this example, make sure to replace ```` with your actual password. + Replace with your Wazuh server enrollment password. Using AWS Private Link ---------------------- @@ -105,7 +103,7 @@ In case your agents are located in AWS, you can access our Wazuh Cloud service s 5. After the endpoint is created, Wazuh approves the connection and sends a notification when it is ready to use. -6. You can now register your agent but replace the *WAZUH_MANAGER_IP* value (``vpce-.vpce-svc-..vpce.amazonaws.com``) with the endpoint's DNS. +6. You can now enroll your Wazuh agent but replace the *WAZUH_MANAGER_IP* value with the endpoint's DNS (``vpce-.vpce-svc-..vpce.amazonaws.com``). If the agents are located in a different region than your endpoint, use VPC Peerings to connect them to the endpoint service. @@ -114,7 +112,7 @@ In case your agents are located in AWS, you can access our Wazuh Cloud service s .. code-block:: WAZUH_MANAGER_IP=vpce-.vpce-svc-..vpce.amazonaws.com WAZUH_PROTOCOL="tcp" \ - WAZUH_PASSWORD="xxxx" \ + WAZUH_PASSWORD=">" \ yum install wazuh-agent|WAZUH_AGENT_RPM_PKG_INSTALL| - In this example, make sure to replace ```` with your actual password. + In this example, make sure to replace ```` with your actual password. diff --git a/source/cloud-service/your-environment/cancel-environment.rst b/source/cloud-service/your-environment/cancel-environment.rst index 21863fe5fc..4092cfccad 100644 --- a/source/cloud-service/your-environment/cancel-environment.rst +++ b/source/cloud-service/your-environment/cancel-environment.rst @@ -11,7 +11,7 @@ Cancellation To cancel your environment: 1. Log in to the `Wazuh Cloud Console `_. - 2. Go to **Environments** and select your environment. + 2. Go to the **Environments** page and select your environment. 3. Click **Cancel environment** to confirm this action. The environment is removed at the end of the billing cycle. diff --git a/source/cloud-service/your-environment/configure-email.rst b/source/cloud-service/your-environment/configure-email.rst index 3047194cff..caaeeca8eb 100644 --- a/source/cloud-service/your-environment/configure-email.rst +++ b/source/cloud-service/your-environment/configure-email.rst @@ -12,9 +12,9 @@ Wazuh can be :ref:`configured to send email alerts ` to one This configuration requires an SMTP and you can use your own SMTP or the Wazuh Cloud SMTP. -.. note:: + .. note:: - If your SMTP requires authentication, you need to open a ticket through the **Help** section of your Wazuh Cloud Console to configure it. + If your SMTP requires authentication, you need to open a ticket through the **Help** section of your Wazuh Cloud Console to configure it. The Wazuh Cloud SMTP is limited to 100 emails per hour, regardless of the ``email_maxperhour`` setting. To enable the Wazuh Cloud SMTP, configure the following settings: diff --git a/source/cloud-service/your-environment/index.rst b/source/cloud-service/your-environment/index.rst index 8af8eb8937..9673da6867 100644 --- a/source/cloud-service/your-environment/index.rst +++ b/source/cloud-service/your-environment/index.rst @@ -8,14 +8,16 @@ Your environment ================ -The Wazuh Cloud environment contains all the Wazuh components running on Wazuh Cloud and is ready for you to use. +The Wazuh Cloud environment contains all the Wazuh components ready for you to use. -Learn more about your environment in the below sections. +Learn more about your environment in the sections below. .. toctree:: :maxdepth: 1 manage-auth + settings + limits cancel-environment monitor-environment-usage send-syslog-data diff --git a/source/cloud-service/your-environment/limits.rst b/source/cloud-service/your-environment/limits.rst new file mode 100644 index 0000000000..e9e123cac1 --- /dev/null +++ b/source/cloud-service/your-environment/limits.rst @@ -0,0 +1,35 @@ +.. Copyright (C) 2015, Wazuh, Inc. + +.. meta:: + :description: Learn about Wazuh Cloud limits. + +Limits +====== + +The Wazuh Cloud service sets predefined limits for specific key metrics that affect your environment performance and capacity. These limits cannot be directly configured by users. If an environment reaches these limits, there might be restrictions in normal service functioning. In case of any issues arising from these limitations, contact the Wazuh support team for assistance and guidance for resolution. + + +Limit definitions +----------------- + +The following are the limits associated with specific functionalities and APIs in the Wazuh Cloud service. + +Dashboards, visualizations, and queries +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +This limit governs the concurrent execution of dashboards, visualizations, and queries, affecting their efficiency and performance impact. While Wazuh Cloud ensures optimal performance and responsiveness, it's important to note that the quality and efficiency of user-created queries, visualizations, and dashboards also play a significant role. Users are responsible for creating well-optimized queries and visualizations to maximize the effectiveness and efficiency of their operations within the Wazuh interface. + +API rate limits +^^^^^^^^^^^^^^^ + +All our APIs incorporate a rate limit to prevent abuse and ensure optimal performance and stability. This limit sets the maximum allowable number of requests per second for specific APIs. Although reaching this limit is extremely rare, they serve as a safeguard to protect the system and maintain a smooth experience for all users. + +The following APIs have rate limits: + +- **Agent registration**: This limit controls the maximum rate of registration requests processed per second, ensuring a seamless onboarding process for agents connecting to the Wazuh Cloud environment. + +- **Wazuh API**: This limit specifies the maximum requests allowable per second to the Wazuh API, ensuring its stability and availability. + +- **Indexer API**: This limit sets the maximum requests allowed per second to the Wazuh Indexer API, enabling efficient retrieval and manipulation of indexed data. + +- **Access to the Archive data**: This limit sets the maximum requests processed per second for accessing archive data, ensuring efficient retrieval when necessary. diff --git a/source/cloud-service/your-environment/manage-auth.rst b/source/cloud-service/your-environment/manage-auth.rst index 4da4797606..055b94fcad 100644 --- a/source/cloud-service/your-environment/manage-auth.rst +++ b/source/cloud-service/your-environment/manage-auth.rst @@ -8,17 +8,17 @@ Authentication and authorization ================================ -You can use the native support for managing and authenticating users, or integrate with external user management systems. +You can use the native support for managing and authenticating users or integrate with external user management systems. -.. note:: - - You cannot log in to Wazuh WUI of your environment with your Wazuh Cloud account. To log in to Wazuh WUI, use the default credentials you downloaded from the Wazuh Cloud Console page or the credentials of any user you already created in Wazuh WUI. + .. note:: + + You cannot log in to the Wazuh WUI of your environment with your Wazuh Cloud account credentials. To log in to Wazuh WUI, use the default credentials from the Wazuh Cloud Console page or the credentials of any user you already created in Wazuh WUI. Native support for users and roles ---------------------------------- -The Wazuh WUI allows you to add users, create roles, and map roles to users. +The Wazuh WUI allows you to add users, create roles, and map roles to users. The following sections highlight more on this. - `Creating an internal user and mapping it to Wazuh`_ - `Creating and setting a Wazuh admin user`_ @@ -30,19 +30,19 @@ Creating an internal user and mapping it to Wazuh Follow these steps to create an internal user and map it to its appropriate role. -#. :ref:`Log into your WUI ` as administrator. +#. Log into your :ref:`Wazuh dashboard ` as administrator. #. Click the upper-left menu icon **☰** to open the options, go to **Indexer/dashboard management** > **Security**, and then **Internal users** to open the internal users' page. #. Click **Create internal user**, complete the empty fields with the requested information, and click **Create** to complete the action. -#. To map the user to the appropriate role, follow these steps: +#. Follow these steps to map the user to the appropriate role: - #. Click the upper-left menu icon **☰** to open the options, go to **Indexer/dashboard management** > **Security**, select **Roles** to open the page, and click the name of the role selected to open the window. + #. Click the upper-left menu icon **☰** to open the options, go to **Indexer/dashboard management** > **Security**, select **Roles** to open the page, and click the role name selected to open the window. #. Select the **Mapped users** tab and click **Manage mapping**. #. Add the user you created in the previous steps and click **Map** to confirm the action. -#. To map the user with Wazuh, follow these steps: +#. Follow these steps to map the user with Wazuh: #. Click the upper-left menu icon **☰** to open the options, go to **Server management** > **Security**, and then **Roles mapping** to open the page. #. Click **Create Role mapping** and complete the empty fields with the following parameters: @@ -59,13 +59,13 @@ Creating and setting a Wazuh admin user Follow these steps to create an internal user, create a new role mapping, and give administrator permissions to the user. -#. :ref:`Log into your WUI ` as administrator. +#. Log into your :ref:`Wazuh dashboard ` as administrator. #. Click the upper-left menu icon **☰** to open the options, go to **Indexer/dashboard management** > **Security**, and then **Internal users** to open the internal users' page. #. Click **Create internal user**, complete the empty fields with the requested information, and click **Create** to complete the action. -#. To map the user to the appropriate role, follow these steps: +#. Follow these steps to map the user to the appropriate role: #. Click the upper-left menu icon **☰** to open the options, go to **Indexer/dashboard management** > **Security**, and then **Roles** to open the roles page. @@ -81,7 +81,7 @@ Follow these steps to create an internal user, create a new role mapping, and gi .. note:: Reserved roles are restricted for any permission customizations. You can create a custom role with the same permissions or duplicate a reserved role for further customization. -#. To map the user with Wazuh, follow these steps: +#. Follow these steps to map the user with Wazuh: #. Click the upper-left menu icon **☰** to open the options, go to **Server management** > **Security**, and then **Roles mapping** to open the page. #. Click **Create Role mapping** and complete the empty fields with the following parameters: @@ -99,13 +99,13 @@ Creating and setting a Wazuh read-only user Follow these steps to create an internal user, create a new role mapping, and give read-only permissions to the user. -#. :ref:`Log into your WUI ` as administrator. +#. Log into your :ref:`WUI ` as administrator. #. Click the upper-left menu icon **☰** to open the options, go to **Indexer/dashboard management** > **Security**, and then **Internal users** to open the internal users' page. #. Click **Create internal user**, complete the empty fields with the requested information, and click **Create** to complete the action. -#. To map the user to the appropriate role, follow these steps: +#. Follow these steps to map the user to the appropriate role: #. Click the upper-left menu icon **☰** to open the options, go to **Indexer/dashboard management** > **Security**, and then **Roles** to open the roles page. @@ -125,7 +125,7 @@ Follow these steps to create an internal user, create a new role mapping, and gi #. Add the user you created in the previous steps and click **Map** to confirm the action. -#. To map the user with Wazuh, follow these steps: +#. Follow these steps to map the user with Wazuh: #. Click the upper-left menu icon **☰** to open the options, go to **Server management** > **Security**, and then **Roles mapping** to open the page. diff --git a/source/cloud-service/your-environment/monitor-environment-usage.rst b/source/cloud-service/your-environment/monitor-environment-usage.rst index 277c74a722..07677b566d 100644 --- a/source/cloud-service/your-environment/monitor-environment-usage.rst +++ b/source/cloud-service/your-environment/monitor-environment-usage.rst @@ -8,11 +8,58 @@ Monitor usage ============= -To see your environment usage: +This section provides details on using your environment, helping you to optimize its performance. + +Viewing environment usage metrics +--------------------------------- + +To see metrics of your Wazuh Cloud environment, follow these steps: 1. Log in to the `Wazuh Cloud Console `_. -2. Go to **Environments** and select your environment. -3. Click **Metrics**. +2. Go to the **Environments** page and select your specific environment. +3. Click on the **Metrics** tab. -Metrics and environment usage data are displayed on the Metrics tab. + +Agents metric +------------- + +The ``agents`` metric shows the number of Wazuh agents in the ``active``, ``disconnected``, ``never connected``, and ``pending`` states. It also displays the limit of active agents, which is configurable through the :ref:`active agents ` setting. + + +Exceeding the active agents limit might cause operational issues and decrease system stability. Though the system can handle a temporary surplus of active agents, we advise immediate action. + + - Upgrade the :ref:`active agents ` setting to match the actual count + - Reduce active agents. + + This ensures a smooth operation and stability of your environment. + + +Data indexed metric +------------------- + +The ``data indexed`` metric presents a histogram showing the usage of indexed data over time. The x-axis represents time, while the y-axis indicates the volume of data in gigabytes consumed by your indexed data. Additionally, this metric displays the date of the oldest indexed alert. + +This metric allows you to monitor and evaluate if the :ref:`indexed data capacity and indexed data retention ` settings are sufficient for your needs. The environment automatically rotates data when the used bytes exceed the indexed data capacity or when the date of the alerts surpasses the indexed data retention. + +When the environment age is less than the indexed data retention setting, your oldest indexed alert should match the environment age. Otherwise, it should match the indexed data retention. In both cases, your configuration is correct, and no action is needed. If not, it indicates premature data rotation. In this case, we recommend increasing the :ref:`indexed data capacity ` setting or refining your rule configurations to filter out less critical events, reducing the indexed data. + +Your oldest indexed alert will never be dated beyond the indexed data retention setting because alerts are rotated in such cases. + +Monitoring this metric allows you to ensure that your indexed data storage aligns with your needs. You can take actions, such as upgrading or downgrading the settings, to maintain optimal storage and retention of data. + +*Events dropped over time* and *Events processed vs dropped* metrics +-------------------------------------------------------------------- + +The "Events Dropped Over Time" metric displays a histogram of events that have been lost or dropped over a specific period. These events are dropped because the rate of incoming events exceeds the limit set by the average/peak EPS setting, causing the event queues to become full and resulting in event loss. + +The "Events Processed vs. Dropped" pie chart provides a visual comparison between the number of events that were successfully processed and those that were dropped due to exceeding the average/peak EPS setting. + +If you observe a consistent pattern of event drops over time, it's an indication that your environment may need an adjustment to accommodate the higher event rate. Consider increasing the :ref:`average/peak EPS ` setting to avoid ongoing event drops. + +- **Review agent configuration**: Examine the settings of your agents. Some agents might be sending an excessive number of events. Adjust their configurations to send fewer events or implement filters to send only critical events, effectively managing the event rate. + +- **Adjust the agent leaky bucket**: Consider implementing a "leaky bucket" strategy in your agent configuration. The leaky bucket algorithm enables control over the rate of events sent to the Wazuh Cloud environment. Configuring the leaky bucket helps smooth out the event flow, preventing sudden spikes that might cause event drops. + +Implementing these agent-level adjustments can complement your strategy, ensuring that your environment operates within the defined event processing rate. This helps reducing the risk of event loss while maintaining efficient event processing. + diff --git a/source/cloud-service/your-environment/send-syslog-data.rst b/source/cloud-service/your-environment/send-syslog-data.rst index 880cb2a2de..d87fd345b3 100644 --- a/source/cloud-service/your-environment/send-syslog-data.rst +++ b/source/cloud-service/your-environment/send-syslog-data.rst @@ -8,9 +8,9 @@ Forward syslog events ===================== -Wazuh agents can run on a wide range of operative systems, but when it is not possible due to software incompatibilities or business restrictions, you can forward syslog events to your environment. This is a common use case for network devices such as routers or firewalls. +Wazuh agents can run on a wide range of operating systems, but when it is not possible due to software incompatibilities or business restrictions, you can forward syslog events to your environment. This is a common use case for network devices such as routers or firewalls. -Since every communication with your environment is performed through the Wazuh agent, you have to configure the agent to forward the syslog events. To do so, you have these options: +Since every communication with your environment is performed through the Wazuh agent, you must configure the agent to forward the syslog events. To do so, you have these options: - `Rsyslog on Linux`_ @@ -19,9 +19,9 @@ Since every communication with your environment is performed through the Wazuh a Rsyslog on Linux ^^^^^^^^^^^^^^^^ -Use rsyslog on a Linux host with a Wazuh agent to log to a file and send those logs to the environment. +Use rsyslog on a Linux endpoint with a Wazuh agent to log to a file and send those logs to the environment. -#. Configure rsyslog to receive syslog events and enable the TCP or UDP settings by editing ``/etc/rsyslog.conf``. +#. Configure rsyslog to receive syslog events and enable the TCP or UDP settings by editing the ``/etc/rsyslog.conf`` file. - For TCP: @@ -39,28 +39,28 @@ Use rsyslog on a Linux host with a Wazuh agent to log to a file and send those l Make sure to review your firewall/SELinux configuration to allow this communication. -#. Configure rsyslog to forward events to a file by editing ``/etc/rsyslog.conf``. +#. Configure rsyslog to forward events to a file by editing the ``/etc/rsyslog.conf`` file. .. code-block:: # Storing Messages from a Remote System into a specific File - if $fromhost-ip startswith 'xxx.xxx.xxx.' then /var/log/ + if $fromhost-ip startswith 'REMOTE_DEVICE_IP' then /var/log/ & ~ - To perform the following steps, make sure to replace ```` with the name chosen for this log. + To perform the following steps, make sure to replace with the name chosen for this log. -#. Deploy a Wazuh agent on the same host that has rsyslog. +#. Deploy a Wazuh agent on the same endpoint with rsyslog installed. -#. Configure the agent to read the syslog output file by editing ``/var/ossec/etc/ossec.conf``. +#. Configure the agent to read the syslog output file by editing the ``/var/ossec/etc/ossec.conf`` file. .. code-block:: XML syslog - /var/log/ + /var/log/ -#. Restart rsyslog and the Wazuh agent. +#. Run the commands below to restart rsyslog and the Wazuh agent: .. code-block:: console @@ -70,7 +70,7 @@ Use rsyslog on a Linux host with a Wazuh agent to log to a file and send those l Logstash on Windows ^^^^^^^^^^^^^^^^^^^ -Use Logstash on a Windows host with a Wazuh agent to receive syslog, log to a file, and send those logs to the environment. +Use Logstash on a Windows endpoint with a Wazuh agent to receive syslog, log to a file, and send those logs to the environment. #. Install Logstash. @@ -92,25 +92,23 @@ Use Logstash on a Windows host with a Wazuh agent to receive syslog, log to a fi output { file { - path => "C:\logstash\logs\file_name.log" + path => "C:\logstash\logs\" codec => "line" } } - To perform the following steps, make sure to replace ``file_name.log`` with the name chosen for this log. + Ensure to replace with the name chosen for this log. -#. Deploy a Wazuh agent on the same host that has Logstash. +#. Deploy a Wazuh agent on the same endpoint that has Logstash. -#. Configure the agent to read the Logstash output file. - - Edit ``C:\Program Files (x86)\ossec-agent\ossec.conf`` by adding the following configuration: +#. Configure the Wazuh agent to read the Logstash output file by adding the following configuration to the ``C:\Program Files (x86)\ossec-agent\ossec.conf`` file: .. code-block:: XML syslog - C:\logstash\logs\file_name.log + C:\logstash\logs\ diff --git a/source/cloud-service/your-environment/settings.rst b/source/cloud-service/your-environment/settings.rst new file mode 100644 index 0000000000..732cb439b2 --- /dev/null +++ b/source/cloud-service/your-environment/settings.rst @@ -0,0 +1,90 @@ +.. Copyright (C) 2015, Wazuh, Inc. + +.. meta:: + :description: Learn about Wazuh Cloud settings. + +Settings +======== + +Every cloud environment is configured based on specific settings that define its limitations and pricing. We offer six settings, comprising four basic and two advanced settings. The advanced settings are automatically calculated based on the basic settings but can be modified if needed. + +To monitor the behavior of your environment and check if the configured values of the settings are being reached, see the :doc:`Monitor usage section `. section. + +Understanding environment settings +---------------------------------- + +.. _cloud_settings_active_agents: + +Active agents +^^^^^^^^^^^^^ + +This basic setting sets the maximum count of active Wazuh agents that the environment can support. Please note that while registering an unlimited number of Wazuh agents is possible, the active agent count is limited by this setting. + +If the maximum number of active agents is reached, the environment might start to malfunction, causing instability with agent connections. Although the system can temporarily handle exceeding the active agent limit, appropriate measures will be taken if the situation persists. + +.. _cloud_settings_indexed_data: + +Indexed data +^^^^^^^^^^^^ + +The indexed data was previously known as hot storage. It includes the data available on the Wazuh dashboard, which corresponds to the information indexed by Wazuh. This information becomes searchable and analyzable as soon as Wazuh ingests and indexes the events sent by the agents. + +Two settings define the behavior of the indexed data: + +- Indexed data retention: It determines the maximum duration for which data remains indexed. This is a basic setting. + +- Indexed data capacity: It defines the maximum size, in bytes, of the indexed data. This setting is equivalent to what was previously called a "tier." This is an advanced setting, and the interface provides a suggestion when selecting the Indexed data retention. + +Data remains indexed until either the indexed data retention or the indexed data capacity is reached. In other words, once either of the settings' values is reached, data rotation will occur (removing the oldest data) until the settings' conditions are met. + + +.. _cloud_settings_archive_data: + +Archive data +^^^^^^^^^^^^^ + +This basic setting, previously known as cold storage, defines the duration for which the analyzed data generated by Wazuh is stored in an AWS S3 bucket for long-term storage purposes. Unlike the indexed data, this data isn't searchable or analyzable. It simply consists of a collection of compressed files. + +When the specified time is reached, data beyond that time range will be deleted. + +.. _cloud_support_type: + +Support plan +^^^^^^^^^^^^ + +This setting indicates whether the support level is premium or standard. + +.. _cloud_settings_data_ingestion_rate: + +Average/Peak EPS +^^^^^^^^^^^^^^^^^^^ + +It represents the average and the maximum number of events per second (EPS) that the environment can analyze. This is an advanced setting, and the interface provides a suggestion when selecting the Active agents setting. + +If the ingestion rate is exceeding the peak EPS, events will start to queue. However, if the queue becomes full, the incoming events will be discarded, which may lead to potential event loss. The queuing mechanism is automatically managed by the cloud service, ensuring optimal resource utilization. + +The environment is configured with the `limits eps option `_ using the following parameters: + +- timeframe = 1 seconds +- maximum = Peak EPS / number of server nodes + +The number of server nodes is automatically determined by the cloud service based on the workload. For instance, if the Average/Peak EPS setting is 100/500 EPS and there is a cluster of 2 nodes at the current time, each node can process up to 250 events per second (500 peak EPS / 2 server nodes). + +.. _cloud_settings_adjust: + +Adjusting environment settings +------------------------------ + +Managing your environment settings is crucial to meeting your evolving needs and optimizing the performance of your cloud environment. While some settings can be determined upfront, such as the number of active agents, indexed data retention, archive data, and support plan, it's important to note that these requirements may change over time. + +Advanced settings might be more challenging to determine in advance. While the interface provides recommendations based on our experience, your specific workload might differ. Hence, we recommend deploying, monitoring, and adjusting the settings as needed to align with your evolving requirements. + +To effectively monitor and adapt your environment, you have the option to modify your settings by opening a support ticket. Here's how the process works: + +- **Upgrading a setting**: If you need to raise a setting, you will be charged a prorated amount based on the remaining time in your billing cycle. The change will be implemented immediately after the payment is made. Please note that your next billing cycle will reflect the increased cost of the enhancement. + +- **Downgrading a setting**: If you want to lower a setting, the change will take effect in the next billing cycle, resulting in a reduced cost. + +Before any changes or payments are made, we will confirm the adjustments with you to ensure accuracy and alignment with your requirements. + +By monitoring your environment and making necessary adjustments to the settings, you can ensure that your cloud environment remains optimized and aligned with your evolving needs. diff --git a/source/cloud-service/your-environment/technical-faq.rst b/source/cloud-service/your-environment/technical-faq.rst index d0e574cf49..21d71d0a93 100644 --- a/source/cloud-service/your-environment/technical-faq.rst +++ b/source/cloud-service/your-environment/technical-faq.rst @@ -14,23 +14,31 @@ Technical FAQ - `What happens if the tier limit is reached?`_ -- `Can I move data from cold to hot storage?`_ +- `What happens if indexed data capacity setting is reached?`_ + +- `Can I index the archive data again?`_ - `What if I need to change the size of my tier?`_ +- `What if I need to upgrade or downgrade a setting?`_ + +- `What happens if active agents setting is reached?`_ + +- `What happens if average/peak EPS setting is reached?`_ + - `How do I get SSH access to my environment?`_ - `How can I update my environment?`_ - `Can I send syslog data directly to the environment?`_ -- `Can I send data directly to the Elasticsearch of my environment?`_ +- `Can I send data directly to the Wazuh indexer of my environment?`_ - `Can I integrate with my Single Sign-On (SSO) method (LDAP, Okta, Active Directories)?`_ - `Do I have access to Wazuh API?`_ -- `Do I have access to Elasticsearch API?`_ +- `Do I have access to Wazuh indexer API?`_ - `How can I forward my logs to another solution or SOC?`_ @@ -41,7 +49,7 @@ Technical FAQ How can I send data to my environment? -------------------------------------- -All the communications are performed through Wazuh agents once they are registered into the environment. +All the communications are performed through Wazuh agents once they are registered to the environment. Is it possible to change the URL to access the environment? ----------------------------------------------------------- @@ -51,17 +59,42 @@ It is possible to get a new URL by opening a support ticket through the **Help** What happens if the tier limit is reached? ------------------------------------------ -When the tier limit is reached, the oldest events are removed from your index. This data is available in cold storage for you to access. To learn more about data logging and storage, see the :ref:`Cold storage ` section. +See :ref:`See What happens if *indexed data capacity* setting is reached? ` + + +.. _cloud_technical_faq_size_reached: + +What happens if indexed data capacity setting is reached? +--------------------------------------------------------- + +When the selected indexed data capacity is reached, the oldest events will be automatically removed from your index regardless of the index data time. This data is available in archive data for you to access. See the :ref:`Archive data ` section to learn more about data logging and storage. -Can I move data from cold to hot storage? ------------------------------------------ +Can I index the archive data again? +------------------------------------ -It is possible to download the data from the cold storage and reindex it into your local environments, but at this moment it is not possible to reindex it in your cloud environment. +It's possible to download the data from the archive data and re-index it into your local environments. However, it isn't possible to re-index it in your cloud environment. What if I need to change the size of my tier? --------------------------------------------- -You can upgrade or downgrade the tier by contacting the Wazuh team through the **Help** section of your Wazuh Cloud Console. +See :ref:`What if I need to upgrade or downgrade a setting? ` + +.. _cloud_technical_faq_change_setting: + +What if I need to upgrade or downgrade a setting? +------------------------------------------------- + +You can upgrade or downgrade a setting by contacting the Wazuh team through the **Help** section of your Wazuh Cloud Console. See also :ref:`Adjusting environment settings `. + +What happens if active agents setting is reached? +------------------------------------------------- + +If the maximum number of active agents is reached, the environment may start to malfunction, causing instability with agent connections. While the system can tolerate temporarily exceeding the limit of active agents, appropriate measures will be taken if the situation persists. + +What happens if average/peak EPS setting is reached? +------------------------------------------------------- + +If the data ingestion is exceeded, events start to queue. If the queue becomes full, Wazuh discards the incoming events, which might lead to event loss. The cloud service automatically manages the queuing mechanism, ensuring optimal resource usage. How do I get SSH access to my environment? ------------------------------------------ @@ -71,45 +104,44 @@ SSH access is not allowed for security reasons. Environments are managed from th How can I update my environment? -------------------------------- -Wazuh takes care of the updates so your environment gets the latest version of Wazuh with no downtime. +Wazuh takes care of the updates, so your environment gets the latest version of Wazuh with no downtime. Can I send syslog data directly to the environment? --------------------------------------------------- No, all the communications are performed through Wazuh agents once they are registered into the environment. However, you have alternative options. For more information on how to forward syslog events to your environment, see the :ref:`Forward syslog events ` section. -Can I send data directly to the Elasticsearch of my environment? ----------------------------------------------------------------------- +Can I send data directly to the Wazuh indexer of my environment? +---------------------------------------------------------------- No, all the communications are performed through Wazuh agents. Can I integrate with my Single Sign-On (SSO) method (LDAP, Okta, Active Directories)? ---------------------------------------------------------------------------------------- -Yes, you can access the Wazuh WUI of your environment through your SSO tool. To perform this action, you need to contact the Wazuh team through the **Help** section of your Wazuh Cloud Console. +Yes, you can access the Wazuh WUI of your environment through your SSO tool. To perform this action, you need to contact the Wazuh Support team through the **Help** section of your Wazuh Cloud Console. Do I have access to Wazuh API? ------------------------------ -You have access to the **Dev tools** through your Wazuh WUI where you can use the API. Wazuh API is not exposed, but you can contact the Wazuh team through the **Help** section of your Wazuh Cloud Console to allow Wazuh API access from a specific IP address. +You have access to the **Dev tools** through your Wazuh dashboard, where you can use the API. The Wazuh API is not exposed, but you can contact the Wazuh team through the **Help** section of your Wazuh Cloud Console to allow Wazuh API access from a specific IP address. -Do I have access to Elasticsearch API? +Do I have access to Wazuh indexer API? -------------------------------------- -Elasticsearch API is not accessible by default. If you want to access it, contact the Wazuh team through the **Help** section of your Wazuh Cloud Console to authorize the connection from a specific IP address. After authorization is granted, you have access to ``GET`` methods of the Elasticsearch API. - +The Wazuh indexer API is not accessible by default. If you want to access it, contact the Wazuh team through the **Help** section of your Wazuh Cloud Console to authorize the connection from a specific IP address. After authorization is granted, you have access to the ``GET`` methods of the Wazuh indexer API. How can I forward my logs to another solution or SOC? ----------------------------------------------------- -You can download your data from cold storage. Then, you can push it to other solutions or Security Operations Center (SOC). +You can download your data from archive data. Then, you can push it to other solutions or Security Operations Center (SOC). Is my environment shared with other customers? ---------------------------------------------- -No, your environment is isolated from other customers. That means that your account is the only one with access to your environment. +No, your environment is isolated from other customers. That means your account is the only one with access to your environment. What are the available regions? ------------------------------- diff --git a/source/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.rst b/source/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.rst index 9e671cbde0..b04931c72e 100644 --- a/source/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.rst +++ b/source/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.rst @@ -330,6 +330,8 @@ Here is an example of a manifest ``wazuh-agent.pp`` (please replace ``MANAGER_I .. code-block:: puppet node "puppet-agent.com" { + class { 'wazuh::repo': + } class { "wazuh::agent": wazuh_register_endpoint => "", wazuh_reporting_endpoint => "" diff --git a/source/deployment-options/offline-installation/step-by-step.rst b/source/deployment-options/offline-installation/step-by-step.rst index a515c31352..76a0a0fef1 100644 --- a/source/deployment-options/offline-installation/step-by-step.rst +++ b/source/deployment-options/offline-installation/step-by-step.rst @@ -93,11 +93,11 @@ Installing the Wazuh indexer #. For multi-node clusters, repeat the previous steps on every Wazuh indexer node. -#. When all Wazuh indexer nodes are running, run the Wazuh indexer ``indexer-security-init.sh`` script on `any Wazuh indexer node` to load the new certificates information and start the cluster. +#. When all Wazuh indexer nodes are running, run the Wazuh indexer ``indexer-init.sh`` script on `any Wazuh indexer node` to load the new certificates information and start the cluster. .. code-block:: console - # /usr/share/wazuh-indexer/bin/indexer-security-init.sh + # bash /usr/share/wazuh-indexer/bin/indexer-init.sh -i #. Run the following command to check that the installation is successful. Note that this command uses localhost, set your Wazuh indexer address if necessary. @@ -188,21 +188,6 @@ Filebeat must be installed and configured on the same server as the Wazuh manage cp ./wazuh-offline/wazuh-files/wazuh-template.json /etc/filebeat/ &&\ chmod go+r /etc/filebeat/wazuh-template.json -#. Edit ``/etc/filebeat/wazuh-template.json`` and change to ``"1"`` the value for ``"index.number_of_shards"`` for a single-node installation. This value can be changed based on the user requirement when performing a distributed installation. - - .. code-block:: none - :emphasize-lines: 5 - - { - ... - "settings": { - ... - "index.number_of_shards": "1", - ... - }, - ... - } - #. Edit the ``/etc/filebeat/filebeat.yml`` configuration file and replace the following value: .. include:: /_templates/installations/filebeat/opensearch/configure_filebeat.rst @@ -273,27 +258,6 @@ Filebeat must be installed and configured on the same server as the Wazuh manage talk to server... OK version: 7.10.2 - To check the number of shards that have been configured, you can run the following command. Note that this command uses localhost, set your Wazuh indexer address if necessary. - - .. code-block:: console - - # curl -k -u admin:admin "https://localhost:9200/_template/wazuh?pretty&filter_path=wazuh.settings.index.number_of_shards" - - Expand the output to see an example response. - - .. code-block:: none - :class: output collapsed - - { - "wazuh" : { - "settings" : { - "index" : { - "number_of_shards" : "1" - } - } - } - } - Your Wazuh server node is now successfully installed. Repeat the steps of this installation process stage for every Wazuh server node in your cluster, expand the **Wazuh cluster configuration for multi-node deployment** section below, and carry on then with configuring the Wazuh cluster. If you want a Wazuh server single-node cluster, everything is set and you can proceed directly with the Wazuh dashboard installation. diff --git a/source/images/aws/security-lake-1.png b/source/images/aws/security-lake-1.png index 0f872481b3..486c5f5d02 100644 Binary files a/source/images/aws/security-lake-1.png and b/source/images/aws/security-lake-1.png differ diff --git a/source/images/cloud-security/gcp/gcp-topic.png b/source/images/cloud-security/gcp/gcp-topic.png index 0f59a4b9f8..ae8b1add97 100644 Binary files a/source/images/cloud-security/gcp/gcp-topic.png and b/source/images/cloud-security/gcp/gcp-topic.png differ diff --git a/source/images/manual/malware/wazuh-yara-alerts.png b/source/images/manual/malware/wazuh-yara-alerts.png index 4ec621e6cc..360a0f0050 100644 Binary files a/source/images/manual/malware/wazuh-yara-alerts.png and b/source/images/manual/malware/wazuh-yara-alerts.png differ diff --git a/source/images/manual/mitre/dashboard-tab.png b/source/images/manual/mitre/dashboard-tab.png index 8350192a0f..7f5f296d32 100644 Binary files a/source/images/manual/mitre/dashboard-tab.png and b/source/images/manual/mitre/dashboard-tab.png differ diff --git a/source/images/manual/mitre/events-filters.png b/source/images/manual/mitre/events-filters.png index 7f77c158db..de22829e69 100644 Binary files a/source/images/manual/mitre/events-filters.png and b/source/images/manual/mitre/events-filters.png differ diff --git a/source/images/manual/mitre/events-tab.png b/source/images/manual/mitre/events-tab.png index 7da0c253ee..0bc1cde63f 100644 Binary files a/source/images/manual/mitre/events-tab.png and b/source/images/manual/mitre/events-tab.png differ diff --git a/source/images/manual/mitre/framework-tab.png b/source/images/manual/mitre/framework-tab.png index b4d46cffe0..d1711a74fd 100644 Binary files a/source/images/manual/mitre/framework-tab.png and b/source/images/manual/mitre/framework-tab.png differ diff --git a/source/images/manual/mitre/intelligence-tab.png b/source/images/manual/mitre/intelligence-tab.png index f20d51da30..76e43abdea 100644 Binary files a/source/images/manual/mitre/intelligence-tab.png and b/source/images/manual/mitre/intelligence-tab.png differ diff --git a/source/images/manual/mitre/mitre-att&ck-module.png b/source/images/manual/mitre/mitre-att&ck-module.png index e403b89400..132de2e0d4 100644 Binary files a/source/images/manual/mitre/mitre-att&ck-module.png and b/source/images/manual/mitre/mitre-att&ck-module.png differ diff --git a/source/images/manual/mitre/mitre-id-t1543.003-information.png b/source/images/manual/mitre/mitre-id-t1543.003-information.png index f4874c38f1..ef3e97680a 100644 Binary files a/source/images/manual/mitre/mitre-id-t1543.003-information.png and b/source/images/manual/mitre/mitre-id-t1543.003-information.png differ diff --git a/source/images/manual/mitre/visualize-the-alerts.png b/source/images/manual/mitre/visualize-the-alerts.png index 4344902f90..9d0c62d117 100644 Binary files a/source/images/manual/mitre/visualize-the-alerts.png and b/source/images/manual/mitre/visualize-the-alerts.png differ diff --git a/source/installation-guide/wazuh-dashboard/index.rst b/source/installation-guide/wazuh-dashboard/index.rst index 8cb2c12a73..932ff88eb5 100644 --- a/source/installation-guide/wazuh-dashboard/index.rst +++ b/source/installation-guide/wazuh-dashboard/index.rst @@ -12,7 +12,7 @@ With the Wazuh dashboard, users can visualize security events, detected vulnerab Check the requirements below and choose an installation method to start installing the Wazuh dashboard. -- :doc:`Wazuh installation assistant `: Install this component by running an assistant that automates the installation and configuration process. +- :doc:`Assisted installation `: Install this component by running an assistant that automates the installation and configuration process. - :doc:`Step-by-step installation `: Install this component following detailed step-by-step instructions. @@ -115,5 +115,5 @@ Other Chromium-based browsers might also work. Internet Explorer 11 is not suppo :hidden: :maxdepth: 1 - Wazuh installation assistant + Assisted installation Step-by-step installation diff --git a/source/installation-guide/wazuh-dashboard/installation-assistant.rst b/source/installation-guide/wazuh-dashboard/installation-assistant.rst index be3c997574..0d4fb325fb 100644 --- a/source/installation-guide/wazuh-dashboard/installation-assistant.rst +++ b/source/installation-guide/wazuh-dashboard/installation-assistant.rst @@ -1,23 +1,23 @@ .. Copyright (C) 2015, Wazuh, Inc. .. meta:: - :description: Learn how to install the Wazuh dashboard using the Wazuh installation assistant. The Wazuh dashboard is a flexible and intuitive web interface for mining and visualizing security events and archives. + :description: Learn how to install the Wazuh dashboard using the assisted installation method. The Wazuh dashboard is a flexible and intuitive web interface for mining and visualizing security events and archives. -Installing the Wazuh dashboard using the assistant -================================================== +Installing the Wazuh dashboard using the assisted installation method +===================================================================== -Install and configure the Wazuh dashboard with the aid of the Wazuh installation assistant. Wazuh dashboard is a flexible and intuitive web interface for mining and visualizing security events and archives. +Install and configure the Wazuh dashboard using the assisted installation method. Wazuh dashboard is a flexible and intuitive web interface for mining and visualizing security events and archives. Wazuh dashboard installation ----------------------------- -#. Download the Wazuh installation assistant. This step can be skipped if you have already installed Wazuh indexer on the same server. +#. Download the Wazuh installation assistant. You can skip this step if you have already installed Wazuh indexer on the same server. .. code-block:: console # curl -sO https://packages.wazuh.com/|WAZUH_CURRENT_MINOR|/wazuh-install.sh -#. Run the assistant with the option ``--wazuh-dashboard`` and the node name to install and configure the Wazuh dashboard. The node name must be the same one used in ``config.yml`` for the initial configuration, for example, ``dashboard``. +#. Run the Wazuh installation assistant with the option ``--wazuh-dashboard`` and the node name to install and configure the Wazuh dashboard. The node name must be the same one used in ``config.yml`` for the initial configuration, for example, ``dashboard``. .. note:: @@ -29,7 +29,7 @@ Wazuh dashboard installation The default Wazuh web user interface port is 443, used by the Wazuh dashboard. You can change this port using the optional parameter ``-p|--port ``. Some recommended ports are 8443, 8444, 8080, 8888, and 9000. - Once the assistant finishes the installation, the output shows the access credentials and a message that confirms that the installation was successful. + Once the Wazuh installation is completed, the output shows the access credentials and a message that confirms that the installation was successful. .. code-block:: none :emphasize-lines: 3,4 @@ -41,7 +41,7 @@ Wazuh dashboard installation INFO: Installation finished. - You now have installed and configured Wazuh. All passwords generated by the Wazuh installation assistant can be found in the ``wazuh-passwords.txt`` file inside the ``wazuh-install-files.tar`` archive. To print them, run the following command: + You now have installed and configured Wazuh. Find all passwords that the Wazuh installation assistant generated in the ``wazuh-passwords.txt`` file inside the ``wazuh-install-files.tar`` archive. To print them, run the following command: .. code-block:: console diff --git a/source/installation-guide/wazuh-indexer/index.rst b/source/installation-guide/wazuh-indexer/index.rst index ee3d38012c..500310e6cb 100644 --- a/source/installation-guide/wazuh-indexer/index.rst +++ b/source/installation-guide/wazuh-indexer/index.rst @@ -13,7 +13,7 @@ You can install the Wazuh indexer on a single host. Alternatively, you can insta Check the requirements below and choose an installation method to start installing the Wazuh indexer. -- :doc:`Wazuh installation assistant `: Install this component by running an assistant that automates the installation and configuration process. +- :doc:`Assisted installation `: Install this component by running an assistant that automates the installation and configuration process. - :doc:`Step-by-step installation `: Install this component following detailed step-by-step instructions. @@ -122,5 +122,5 @@ The Wazuh indexer can be installed as a single-node or as a multi-node cluster. :hidden: :maxdepth: 1 - Wazuh installation assistant + Assisted installation Step-by-step installation diff --git a/source/installation-guide/wazuh-indexer/installation-assistant.rst b/source/installation-guide/wazuh-indexer/installation-assistant.rst index cc4114037b..ed04a50ec5 100644 --- a/source/installation-guide/wazuh-indexer/installation-assistant.rst +++ b/source/installation-guide/wazuh-indexer/installation-assistant.rst @@ -1,13 +1,12 @@ .. Copyright (C) 2015, Wazuh, Inc. .. meta:: - :description: Learn how to install the Wazuh indexer using the Wazuh installation assistant. The Wazuh indexer is a highly scalable full-text search engine and offers advanced security, alerting, index management, deep performance analysis, and several other features. + :description: Learn how to install the Wazuh indexer using the assisted installation method. The Wazuh indexer is a highly scalable full-text search engine and offers advanced security, alerting, index management, deep performance analysis, and several other features. -Installing the Wazuh indexer using the assistant -================================================ - -Install and configure the Wazuh indexer as a single-node or multi-node cluster with the aid of the Wazuh installation assistant. The Wazuh indexer is a highly scalable full-text search engine. It offers advanced security, alerting, index management, deep performance analysis, and several other features. +Installing the Wazuh indexer using the assisted installation method +=================================================================== +Install and configure the Wazuh indexer as a single-node or multi-node cluster using the assisted installation method. The Wazuh indexer is a highly scalable full-text search engine. It offers advanced security, alerting, index management, deep performance analysis, and several other features. Wazuh indexer cluster installation ---------------------------------- @@ -68,7 +67,7 @@ Indicate your deployment configuration, create the SSL certificates to encrypt c ip: "" -#. Run the assistant with the option ``--generate-config-files`` to generate the Wazuh cluster key, certificates, and passwords necessary for installation. You can find these files in ``./wazuh-install-files.tar``. +#. Run the Wazuh installation assistant with the option ``--generate-config-files`` to generate the Wazuh cluster key, certificates, and passwords necessary for installation. You can find these files in ``./wazuh-install-files.tar``. .. code-block:: console @@ -91,7 +90,7 @@ Install and configure the Wazuh indexer nodes. # curl -sO https://packages.wazuh.com/|WAZUH_CURRENT_MINOR|/wazuh-install.sh -#. Run the assistant with the option ``--wazuh-indexer`` and the node name to install and configure the Wazuh indexer. The node name must be the same one used in ``config.yml`` for the initial configuration, for example, ``node-1``. +#. Run the Wazuh installation assistant with the option ``--wazuh-indexer`` and the node name to install and configure the Wazuh indexer. The node name must be the same one used in ``config.yml`` for the initial configuration, for example, ``node-1``. .. note:: Make sure that a copy of ``wazuh-install-files.tar``, created during the initial configuration step, is placed in your working directory. @@ -160,4 +159,4 @@ Testing the cluster installation Next steps ---------- -The Wazuh indexer is now successfully installed, and you can proceed with installing the Wazuh server. To perform this action, see the :doc:`Installing the Wazuh server using the installation assistant <../wazuh-server/installation-assistant>` section. +The Wazuh indexer is now successfully installed, and you can proceed with installing the Wazuh server. To perform this action, see the :doc:`../wazuh-server/installation-assistant` section. diff --git a/source/installation-guide/wazuh-server/index.rst b/source/installation-guide/wazuh-server/index.rst index 1a866741c7..c77c80d9e3 100644 --- a/source/installation-guide/wazuh-server/index.rst +++ b/source/installation-guide/wazuh-server/index.rst @@ -12,7 +12,7 @@ You can install the Wazuh server on a single host. Alternatively, you can instal Check the requirements below and choose an installation method to start installing the Wazuh server. -- :doc:`Wazuh installation assistant `: Install this component by running an assistant that automates the installation and configuration process. +- :doc:`Assisted installation `: Install this component by running an assistant that automates the installation and configuration process. - :doc:`Step-by-step installation `: Install this component following detailed step-by-step instructions. @@ -136,5 +136,5 @@ These two variables should be zero if the environment is working properly. If it :hidden: :maxdepth: 1 - Wazuh installation assistant + Assisted installation Step-by-step installation diff --git a/source/installation-guide/wazuh-server/installation-assistant.rst b/source/installation-guide/wazuh-server/installation-assistant.rst index c42c375d7c..3194c02fdc 100644 --- a/source/installation-guide/wazuh-server/installation-assistant.rst +++ b/source/installation-guide/wazuh-server/installation-assistant.rst @@ -1,13 +1,12 @@ .. Copyright (C) 2015, Wazuh, Inc. .. meta:: - :description: Learn how to install the Wazuh server using the Wazuh installation assistant. The Wazuh server is in charge of analyzing the data received from the agents and triggering alerts when threats or anomalies are detected. This central component includes the Wazuh manager and Filebeat. + :description: Learn how to install the Wazuh server using the assisted installation method. The Wazuh server analyzes the data received from the agents triggering alerts when it detects threats and anomalies. This central component includes the Wazuh manager and Filebeat. -Installing the Wazuh server using the assistant -=============================================== - -Install the Wazuh server as a single-node or multi-node cluster with the aid of the Wazuh installation assistant. The Wazuh server is in charge of analyzing the data received from the agents and triggering alerts when threats or anomalies are detected. This central component includes the Wazuh manager and Filebeat. +Installing the Wazuh server using the assisted installation method +================================================================== +Install the Wazuh server as a single-node or multi-node cluster using the assisted installation method. The Wazuh server analyzes the data received from the agents triggering alerts when it detects threats and anomalies. This central component includes the Wazuh manager and Filebeat. Wazuh server cluster installation --------------------------------- @@ -18,7 +17,7 @@ Wazuh server cluster installation # curl -sO https://packages.wazuh.com/|WAZUH_CURRENT_MINOR|/wazuh-install.sh -#. Run the assistant with the option ``--wazuh-server`` followed by the node name to install the Wazuh server. The node name must be the same one used in ``config.yml`` for the initial configuration, for example, ``wazuh-1``. +#. Run the Wazuh installation assistant with the option ``--wazuh-server`` followed by the node name to install the Wazuh server. The node name must be the same one used in ``config.yml`` for the initial configuration, for example, ``wazuh-1``. .. note:: Make sure that a copy of the ``wazuh-install-files.tar``, created during the initial configuration step, is placed in your working directory. diff --git a/source/integrations-guide/opensearch/index.rst b/source/integrations-guide/opensearch/index.rst index 2feec857d4..e873ae9352 100644 --- a/source/integrations-guide/opensearch/index.rst +++ b/source/integrations-guide/opensearch/index.rst @@ -201,6 +201,7 @@ We use the `Logstash keystore "/etc/logstash/templates/wazuh.json" template_name => "wazuh" template_overwrite => true + legacy_template => false } } @@ -215,7 +216,7 @@ We use the `Logstash keystore "/root-ca.pem"`` with ``ssl_certificate_verification => false``. - If you are using composable index templates and the _index_template API, set the optional parameter `legacy_template => false `__. + If you aren't using composable index templates and the _index_template API, remove the `legacy_template => false `__ parameter. Running Logstash ^^^^^^^^^^^^^^^^ @@ -404,6 +405,7 @@ We use the `Logstash keystore "/etc/logstash/templates/wazuh.json" template_name => "wazuh" template_overwrite => true + legacy_template => false } } @@ -416,7 +418,7 @@ We use the `Logstash keystore "/root-ca.pem"`` with ``ssl_certificate_verification => false``. - If you are using composable index templates and the _index_template API, set the optional parameter `legacy_template => false `__. + If you aren't using composable index templates and the _index_template API, remove the `legacy_template => false `__ parameter. #. By default the ``/var/ossec/logs/alerts/alerts.json`` file is owned by the ``wazuh`` user with restrictive permissions. You must add the ``logstash`` user to the ``wazuh`` group so it can read the file when running Logstash as a service: diff --git a/source/proof-of-concept-guide/block-malicious-actor-ip-reputation.rst b/source/proof-of-concept-guide/block-malicious-actor-ip-reputation.rst index 5eb847a552..1c9e09fc3e 100644 --- a/source/proof-of-concept-guide/block-malicious-actor-ip-reputation.rst +++ b/source/proof-of-concept-guide/block-malicious-actor-ip-reputation.rst @@ -89,11 +89,11 @@ Perform the following steps to install and configure an Apache web server. #. Unzip the contents of the Apache web server zip file and copy the extracted ``Apache24`` folder to the ``C:`` directory. -#. Navigate to the ``C:\Apache24\bin`` folder and run the following command in a PowerShell terminal with administrator privileges: +#. Navigate to the ``C:\Apache24\bin\`` folder and run the following command in a PowerShell terminal with administrator privileges: .. code-block:: powershell - > C:\Apache24\bin>httpd.exe + > .\httpd.exe The first time you run the Apache binary a Windows Defender Firewall pops up. diff --git a/source/proof-of-concept-guide/detect-remove-malware-virustotal.rst b/source/proof-of-concept-guide/detect-remove-malware-virustotal.rst index dcb9a9455a..0d05321fb9 100644 --- a/source/proof-of-concept-guide/detect-remove-malware-virustotal.rst +++ b/source/proof-of-concept-guide/detect-remove-malware-virustotal.rst @@ -195,8 +195,7 @@ Attack emulation .. code-block:: console - $ sudo cd /root - $ sudo curl -LO https://secure.eicar.org/eicar.com && ls -lah eicar.com + $ sudo curl -Lo /root/eicar.com https://secure.eicar.org/eicar.com && sudo ls -lah /root/eicar.com Visualize the alerts -------------------- @@ -373,7 +372,9 @@ Perform the following steps to configure Wazuh to monitor near real-time changes sys.exit(OS_INVALID) try: - os.remove(msg.alert["parameters"]["alert"]["data"]["virustotal"]["source"]["file"]) + file_path = msg.alert["parameters"]["alert"]["data"]["virustotal"]["source"]["file"] + if os.path.exists(file_path): + os.remove(file_path) write_debug_file(argv[0], json.dumps(msg.alert) + " Successfully removed threat") except OSError as error: write_debug_file(argv[0], json.dumps(msg.alert) + "Error removing threat") @@ -473,6 +474,12 @@ Perform the following steps on the Wazuh server to configure the VirusTotal inte Attack emulation ---------------- +#. Follow the next steps to temporarily turn off real-time Microsoft Defender antivirus protection in Windows Security: + + #. Click on the **Start** menu and type ``Windows Security`` to search for that app. + #. Select the **Windows Security app** from results, go to **Virus & threat protection**, and under **Virus & threat protection settings** select **Manage settings**. + #. Switch **Real-time protection** to **Off**. + #. Download an `EICAR test `__ file to the ``C:\Users\\Downloads`` directory on the Windows endpoint. .. code-block:: powershell diff --git a/source/release-notes/index-4x.rst b/source/release-notes/index-4x.rst index eeec4ef9e9..568bcb8ea0 100644 --- a/source/release-notes/index-4x.rst +++ b/source/release-notes/index-4x.rst @@ -13,6 +13,7 @@ Wazuh version Release date ============================================= ==================== :doc:`4.9.0 ` TBD :doc:`4.8.2 ` TBD +:doc:`4.8.1 ` TBD :doc:`4.8.0 ` TBD :doc:`4.7.2 ` 10 January 2024 :doc:`4.7.1 ` 20 December 2023 @@ -68,6 +69,7 @@ Wazuh version Release date 4.9.0 Release notes 4.8.2 Release notes + 4.8.1 Release notes 4.8.0 Release notes 4.7.2 Release notes 4.7.1 Release notes diff --git a/source/release-notes/index.rst b/source/release-notes/index.rst index d0fa490c17..90d06a3f8e 100644 --- a/source/release-notes/index.rst +++ b/source/release-notes/index.rst @@ -13,6 +13,7 @@ Wazuh version Release date ============================================== ==================== :doc:`4.9.0 ` TBD :doc:`4.8.2 ` TBD +:doc:`4.8.1 ` TBD :doc:`4.8.0 ` TBD :doc:`4.7.2 ` 10 January 2024 :doc:`4.7.1 ` 20 December 2023 diff --git a/source/release-notes/release-4-5-3.rst b/source/release-notes/release-4-5-3.rst index e1cfdcb195..56fafc852d 100644 --- a/source/release-notes/release-4-5-3.rst +++ b/source/release-notes/release-4-5-3.rst @@ -31,10 +31,24 @@ RESTful API - `#18493 `__ Added support for nested queries in the ``q`` API parameter. - `#18432 `__ Updated ``force`` flag message in the ``agent_upgrade`` CLI. +Security updates +---------------- + +This release fixes the following vulnerabilities: + +Agent +^^^^^ + +============== ======================================================== ============= +CVE Reference Description +============== ======================================================== ============= +CVE-2023-42463 `#19069 `__ Fixed a stack overflow hazard in ``wazuh-logcollector`` that could allow a local privilege escalation. Found by Keith Yeo (`@kyeojy `__). +============== ======================================================== ============= + Resolved issues --------------- -This release resolves known issues as the following: +This release resolves known issues as the following: Manager ^^^^^^^ @@ -55,7 +69,6 @@ Reference Description ======================================================== ============= `#18773 `__ Fixed a bug in the memory handle at the agent's data provider helper. `#18903 `__ Fixed a data mismatch in the OS name between the global and agents' databases. -`#19069 `__ Fixed an array limit check in ``wazuh-logcollector``. `#19286 `__ Fixed wrong Windows agent binaries metadata. `#19397 `__ Fixed error during the Windows agent upgrade. ======================================================== ============= @@ -121,4 +134,4 @@ More details about these changes are provided in the changelog of each component - `wazuh/wazuh-dashboard-plugins 7.16.x `_ - `wazuh/wazuh-dashboard-plugins 7.17.x `_ - `wazuh/wazuh-splunk `_ -- `wazuh/wazuh-packages `_ \ No newline at end of file +- `wazuh/wazuh-packages `_ diff --git a/source/release-notes/release-4-8-0.rst b/source/release-notes/release-4-8-0.rst index b2c09fd246..94d508b058 100644 --- a/source/release-notes/release-4-8-0.rst +++ b/source/release-notes/release-4-8-0.rst @@ -80,10 +80,9 @@ Wazuh dashboard ^^^^^^^^^^^^^^^ - `#5791 `__ Added remember server address check. -- `#6093 `__ Added a notification about new Wazuh updates and a button to check their availability. `#6256 `__ +- `#6093 `__ Added a notification about new Wazuh updates and a button to check their availability. `#6256 `__ `#6328 `__ - `#6083 `__ Added the ``ssl_agent_ca`` configuration to the **SSL Settings** form. -- `#5896 `__ Added global vulnerability dashboards. -- `#6179 `__ Added global vulnerability dashboards. `#6173 `__ `#6147 `__ +- `#5896 `__ Added global vulnerability dashboards. `#6179 `__ `#6173 `__ `#6147 `__ `#6231 `__ `#6246 `__ `#6321 `__ `#6338 `__ `#6356 `__ - `#5840 `__ Added an agent selector to the IT Hygiene module. - `#5840 `__ Moved the Wazuh menu into the side menu. `#6226 `__ - `#5840 `__ Removed the ``disabled_roles`` and ``customization.logo.sidebar`` settings. @@ -92,8 +91,13 @@ Wazuh dashboard - `#6035 `__ Improved the implementation of module dashboards. - `#6067 `__ Reorganized tabs order in all modules. - `#6174 `__ Removed the implicit filter of WQL language of the search bar UI. -- `#6176 `__ Added a redirection button to Endpoint Summary from IT Hygiene application. -- `#6176 `__ Removed the application menu in the IT Hygiene application. +- `#6176 `__ Added a redirection button to **Endpoint Summary** from **IT Hygiene** application. +- `#6176 `__ Removed the application menu in the **IT Hygiene** application. +- `#6373 `__ Changed the **API configuration** title to **API Connections**. +- `#6366 `__ Removed **Compilation date** field from the **Status** view. +- `#6361 `__ Removed ``WAZUH_REGISTRATION_SERVER`` variable from Windows agent deployment command. +- `#6354 `__ Added a dash character and a tooltip element to **Run as** in the API configuration table to indicate it's been disabled. +- `#6364 `__ Added tooltip element to **Most active agent** in **Details** in the **Endpoint summary** view and renamed a label element. Packages ^^^^^^^^ @@ -165,6 +169,11 @@ Reference Des `#6177 `__ Fixed exception in **Inventory** when agents don't have operating system information. `#6177 `__ Fixed pinned agent state in URL. `#6234 `__ Fixed invalid date format in **About** and **Agents** views. +`#6305 `__ Fixed issue with script to install agents on macOS if using the registration password deployment variable. +`#6327 `__ Fixed an issue preventing the use of a hostname as the **Server address** in **Deploy New Agent**. +`#6345 `__ Fixed unnecessary scrolling in the vulnerability **Inventory** table. +`#6342 `__ Fixed wrong **Queue Usage** values in **Server management** > **Statistics**. +`#6352 `__ Fixed **Statistics** view errors when cluster mode is disabled. ========================================================================= ============= Packages diff --git a/source/release-notes/release-4-8-1.rst b/source/release-notes/release-4-8-1.rst new file mode 100644 index 0000000000..4cd2038f3e --- /dev/null +++ b/source/release-notes/release-4-8-1.rst @@ -0,0 +1,28 @@ +.. Copyright (C) 2015, Wazuh, Inc. + +.. meta:: + :description: Wazuh 4.8.1 has been released. Check out our release notes to discover the changes and additions of this release. + +4.8.1 Release notes - TBD +========================= + +This section lists the changes in version 4.8.1. Every update of the Wazuh solution is cumulative and includes all enhancements and fixes from previous releases. + +What's new +---------- + +This release includes new features or enhancements as the following: + +Resolved issues +--------------- + +This release resolves known issues as the following: + +Changelogs +---------- + +More details about these changes are provided in the changelog of each component: + +- `wazuh/wazuh `__ +- `wazuh/wazuh-dashboard `__ +- `wazuh/wazuh-packages `__ diff --git a/source/user-manual/capabilities/index.rst b/source/user-manual/capabilities/index.rst index 89185d727a..efeab309b6 100644 --- a/source/user-manual/capabilities/index.rst +++ b/source/user-manual/capabilities/index.rst @@ -33,5 +33,4 @@ In this section you will find: system-inventory/index system-calls-monitoring/index agentless-monitoring/index - osquery policy-monitoring/index diff --git a/source/user-manual/capabilities/malware-detection/fim-yara.rst b/source/user-manual/capabilities/malware-detection/fim-yara.rst index 11e5aab613..abe556dab2 100644 --- a/source/user-manual/capabilities/malware-detection/fim-yara.rst +++ b/source/user-manual/capabilities/malware-detection/fim-yara.rst @@ -60,6 +60,38 @@ Perform the following steps to configure YARA and the FIM module on the monitore $ cd /usr/local/bin/yara-4.2.3/ $ sudo ./bootstrap.sh && sudo ./configure && sudo make && sudo make install && sudo make check +#. Test that YARA is running properly. + + .. code-block:: console + + $ yara + + Expected output: + + .. code-block:: none + :class: output + + yara: wrong number of arguments + Usage: yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID + + Try `--help` for more options + + If the error message below is displayed: + + .. code-block:: none + + /usr/local/bin/yara: error while loading shared libraries: libyara.so.9: cannot open shared object file: No such file or directory. + + This means that the loader doesn’t find the ``libyara`` library usually located in ``/usr/local/lib``. Add the ``/usr/local/lib`` path to the ``/etc/ld.so.conf`` loader configuration file to solve this. + + .. code-block:: console + + $ sudo su + # echo "/usr/local/lib" >> /etc/ld.so.conf + # ldconfig + + Switch back to the previous user. + #. Download YARA detection rules: .. code-block:: console @@ -206,12 +238,12 @@ Perform the following steps to configure Wazuh FIM to alert file changes in a mo .. code-block:: xml - + 550 /root/ File modified in /root directory. - + 554 /root/ File added to /root directory. @@ -247,7 +279,7 @@ Perform the following steps to configure Wazuh FIM to alert file changes in a mo yara_linux local - 100300,100301 + 100200,100201 @@ -264,8 +296,8 @@ Perform the following steps to configure Wazuh FIM to alert file changes in a mo - ````: This specifies where the command executes. Using the ``local`` value means the command executes on the Wazuh agent that reported the event. - ````: This represents the rule IDs that trigger the command: - - Rule ``100300``: File modified on the ``/root`` directory. - - Rule ``100301``: New file added to the ``/root`` directory. + - Rule ``100200``: File modified on the ``/root`` directory. + - Rule ``100201``: New file added to the ``/root`` directory. #. Restart the Wazuh manager to apply the configuration changes: @@ -282,12 +314,14 @@ To test that everything is working correctly, we use the *Mirai* and *Xbash* mal These malicious files are dangerous so use them for testing purposes only. Do not install them in production environments. -#. Download the malware samples to the ``/root/`` directory of the monitored endpoint: +#. Download the malware samples and move them into the ``/root/`` directory of the monitored endpoint. .. code-block:: console - $ sudo curl https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai --output /root/mirai - $ sudo curl https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash --output /root/Xbash + $ curl https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai --output ~/mirai + $ curl https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash --output ~/Xbash + $ sudo mv ~/mirai /root/ + $ sudo mv ~/Xbash /root/ Visualize the alerts ^^^^^^^^^^^^^^^^^^^^ diff --git a/source/user-manual/capabilities/malware-detection/index.rst b/source/user-manual/capabilities/malware-detection/index.rst index a80a56fe8e..a7a29c3cd3 100644 --- a/source/user-manual/capabilities/malware-detection/index.rst +++ b/source/user-manual/capabilities/malware-detection/index.rst @@ -28,4 +28,5 @@ Wazuh :doc:`log collection capability <../log-data-collection/index>` allows you fim-yara clam-av-logs-collection win-defender-logs-collection - custom-rules-malware-ioc \ No newline at end of file + custom-rules-malware-ioc + osquery \ No newline at end of file diff --git a/source/user-manual/capabilities/osquery.rst b/source/user-manual/capabilities/malware-detection/osquery.rst similarity index 98% rename from source/user-manual/capabilities/osquery.rst rename to source/user-manual/capabilities/malware-detection/osquery.rst index d2b650f04d..998d88b09f 100644 --- a/source/user-manual/capabilities/osquery.rst +++ b/source/user-manual/capabilities/malware-detection/osquery.rst @@ -126,10 +126,10 @@ And the osquery module must be enabled for the agents where the osquery is runni -To their ``/var/ossec/etc/ossec.conf`` file or through :doc:`centralized configuration <../reference/centralized-configuration>` +To their ``/var/ossec/etc/ossec.conf`` file or through :doc:`centralized configuration ` .. note:: - More options may be specified as shown in the :doc:`osquery configuration reference <../reference/ossec-conf/wodle-osquery>` + More options may be specified as shown in the :doc:`osquery configuration reference ` As you can see in this sample configuration, ``system_info``, ``high_load_average`` and ``low_free_memory`` queries will be executed every hour. diff --git a/source/user-manual/capabilities/malware-detection/virus-total-integration.rst b/source/user-manual/capabilities/malware-detection/virus-total-integration.rst index 119f87bfdc..6c64ee822d 100644 --- a/source/user-manual/capabilities/malware-detection/virus-total-integration.rst +++ b/source/user-manual/capabilities/malware-detection/virus-total-integration.rst @@ -97,7 +97,22 @@ For this use case, we show how to monitor the folder ``/media/user/software`` on .. include:: /_templates/common/restart_manager.rst -After restarting, FIM applies the new configuration and monitors the folder you specify in near real time. When FIM detects a new file in the monitored directory, Wazuh generates the alert below: +After restarting, FIM applies the new configuration and monitors the folder you specify in near real time. + +Test the configuration +^^^^^^^^^^^^^^^^^^^^^^ + +Now, you can download a malicious file on the endpoint in the monitored folder. + +.. warning:: + + Download the Eicar file here for testing purposes only. We recommend testing in a sandbox, not in a production environment. + +.. code-block:: console + + $ sudo curl -Lo /media/user/software/suspicious-file.exe https://secure.eicar.org/eicar.com + +When FIM detects a new file in the monitored directory, Wazuh generates the alert below: .. code-block:: json :class: output diff --git a/source/user-manual/reference/daemons/wazuh-modulesd.rst b/source/user-manual/reference/daemons/wazuh-modulesd.rst index 7d15f57a58..febc92c1be 100644 --- a/source/user-manual/reference/daemons/wazuh-modulesd.rst +++ b/source/user-manual/reference/daemons/wazuh-modulesd.rst @@ -51,7 +51,7 @@ The wazuh-modulesd program manages the Wazuh modules described below. .. topic:: Osquery wodle - The Osquery wodle provides the user with an operating system instrumentation tool that makes low-level operating system analytics and monitoring both efficient and intuitive using SQL-based queries. For more information, read through the documentation for :doc:`osquery integration <../../capabilities/osquery>`. + The Osquery wodle provides the user with an operating system instrumentation tool that makes low-level operating system analytics and monitoring both efficient and intuitive using SQL-based queries. For more information, read through the documentation for :doc:`osquery integration `. .. topic:: SCA module diff --git a/source/user-manual/ruleset/mitre.rst b/source/user-manual/ruleset/mitre.rst index 7d5afce0fb..882a1bd095 100644 --- a/source/user-manual/ruleset/mitre.rst +++ b/source/user-manual/ruleset/mitre.rst @@ -10,7 +10,7 @@ Created by the MITRE Corporation, MITRE ATT&CK is an acronym that stands for MIT The Wazuh integration with MITRE ATT&CK framework is provided through an out-of-the-box module on the Wazuh dashboard. It allows users to map alerts generated by Wazuh to specific tactics and techniques. This gives security teams a better understanding of the nature of the threats they are facing and helps them develop effective mitigation strategies. -The Wazuh MITRE ATT&CK module is accessible under the **THREAT DETECTION AND RESPONSE** section of the main page of the Wazuh dashboard. It is shipped with various functionalities to help enhance your threat detection. +The Wazuh MITRE ATT&CK module is accessible under the **THREAT INTELLIGENCE** section of the main page of the Wazuh dashboard. It is shipped with various functionalities to help enhance your threat detection. .. thumbnail:: /images/manual/mitre/mitre-att&ck-module.png :title: The Wazuh MITRE ATT&CK module @@ -127,7 +127,8 @@ Windows 11 Perform the following steps to configure the Wazuh agent to capture Sysmon logs and send them to the Wazuh server for analysis. #. Download `Sysmon `__ and the configuration file `sysmonconfig.xml `__. -#. Launch PowerShell with administrative privilege, and install Sysmon as follows: +#. Extract the contents of the ``Sysmon.zip`` file to a folder, and copy the ``sysmonconfig.xml`` configuration file to the same folder. +#. Launch PowerShell with administrative privilege, navigate to the folder used in the step above, and install Sysmon as follows: .. code-block:: powershell @@ -156,7 +157,7 @@ We download the `PsTools archive from the Microsoft Sysinternals ./psexec -i -s powershell /accepteula + > .\psexec -i -s powershell /accepteula Run the command below to confirm that the new instance of PowerShell is running as SYSTEM: @@ -175,7 +176,7 @@ Output is shown below: Visualize the alerts ^^^^^^^^^^^^^^^^^^^^ -We use filters on the **Security Module > MITRE ATT&CK> Events** tab of the Wazuh dashboard to query for specific MITRE IDs, tactics, or techniques, as shown in the figure below. +We use filters on the **MITRE ATT&CK> Events** tab of the Wazuh dashboard to query for specific MITRE IDs, tactics, or techniques, as shown in the figure below. .. thumbnail:: /images/manual/mitre/visualize-the-alerts.png :title: Visualize the alerts @@ -203,75 +204,75 @@ Click on the **JSON** tab to view the details of the alert in JSON format: { "agent": { - "ip": "172.20.10.3", - "name": "Windows11", - "id": "002" - }, - "manager": { - "name": "wazuh-server" - }, - "data": { - "win": { - "eventdata": { - "image": "C:\\\\Windows\\\\system32\\\\services.exe", - "targetObject": "HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PSEXESVC\\\\ObjectName", - "processGuid": "{45cd4aff-93d1-6501-0b00-000000000b00}", - "processId": "720", - "utcTime": "2023-10-16 12:12:15.759", - "ruleName": "technique_id=T1543,technique_name=Service Creation", - "details": "LocalSystem", - "eventType": "SetValue", - "user": "NT AUTHORITY\\\\SYSTEM" - }, - "system": { - "eventID": "13", - "keywords": "0x8000000000000000", - "providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", - "level": "4", - "channel": "Microsoft-Windows-Sysmon/Operational", - "opcode": "0", - "message": "\"Registry value set:\r\nRuleName: technique_id=T1543,technique_name=Service Creation\r\nEventType: SetValue\r\nUtcTime: 2023-10-16 12:12:15.759\r\nProcessGuid: {45cd4aff-93d1-6501-0b00-000000000b00}\r\nProcessId: 720\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\PSEXESVC\\ObjectName\r\nDetails: LocalSystem\r\nUser: NT AUTHORITY\\SYSTEM\"", - "version": "2", - "systemTime": "2023-10-16T12:12:15.7636688Z", - "eventRecordID": "118081", - "threadID": "3644", - "computer": "Windows11", - "task": "13", - "processID": "3140", - "severityValue": "INFORMATION", - "providerName": "Microsoft-Windows-Sysmon" - } - } - }, - "rule": { - "firedtimes": 4, - "mail": false, - "level": 10, - "description": "PsExec service running as NT AUTHORITY\\\\SYSTEM has been created on Windows11", - "groups": [ - "windows", - "sysmon" - ], - "mitre": { - "technique": [ - "Windows Service" - ], - "id": [ - "T1543.003" - ], - "tactic": [ - "Persistence", - "Privilege Escalation" - ] - }, - "id": "110011" - }, - "location": "EventChannel", - "decoder": { - "name": "windows_eventchannel" - }, - "id": "1694607138.3688437", - "timestamp": "2023-10-16T12:12:18.684+0000" + "ip": "10.0.2.15", + "name": "Windows_11", + "id": "001" + }, + "manager": { + "name": "wazuh-server" + }, + "data": { + "win": { + "eventdata": { + "image": "C:\\\\Windows\\\\system32\\\\services.exe", + "targetObject": "HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PSEXESVC\\\\Start", + "processGuid": "{08d76baf-2978-65a7-0b00-000000001300}", + "processId": "708", + "utcTime": "2024-01-16 15:54:26.456", + "details": "DWORD (0x00000004)", + "eventType": "SetValue", + "user": "NT AUTHORITY\\\\SYSTEM" + }, + "system": { + "eventID": "13", + "keywords": "0x8000000000000000", + "providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", + "level": "4", + "channel": "Microsoft-Windows-Sysmon/Operational", + "opcode": "0", + "message": "\"Registry value set:\r\nRuleName: -\r\nEventType: SetValue\r\nUtcTime: 2024-01-16 15:54:26.456\r\nProcessGuid: {08d76baf-2978-65a7-0b00-000000001300}\r\nProcessId: 708\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\PSEXESVC\\Start\r\nDetails: DWORD (0x00000004)\r\nUser: NT AUTHORITY\\SYSTEM\"", + "version": "2", + "systemTime": "2024-01-16T15:54:26.4581578Z", + "eventRecordID": "14864", + "threadID": "1812", + "computer": "Windows-11", + "task": "13", + "processID": "5908", + "severityValue": "INFORMATION", + "providerName": "Microsoft-Windows-Sysmon" + } + } + }, + "rule": { + "firedtimes": 18, + "mail": false, + "level": 10, + "description": "PsExec service running as NT AUTHORITY\\\\SYSTEM has been created on Windows-11", + "groups": [ + "windows", + "sysmon", + "privilege-escalation" + ], + "mitre": { + "technique": [ + "Windows Service" + ], + "id": [ + "T1543.003" + ], + "tactic": [ + "Persistence", + "Privilege Escalation" + ] + }, + "id": "110011" + }, + "location": "EventChannel", + "decoder": { + "name": "windows_eventchannel" + }, + "id": "1705420467.38720948", + "timestamp": "2024-01-16T15:54:27.447+0000" } The alerts display the MITRE ATT&CK ID and its associated tactics and techniques. This helps users quickly understand the nature of the attack and take appropriate actions. diff --git a/source/user-manual/user-administration/password-management.rst b/source/user-manual/user-administration/password-management.rst index ca9b5ccb2f..8192f8ede5 100644 --- a/source/user-manual/user-administration/password-management.rst +++ b/source/user-manual/user-administration/password-management.rst @@ -1,7 +1,7 @@ .. Copyright (C) 2015, Wazuh, Inc. .. meta:: - :description: Learn how to use the Wazuh passwords tool to manage your passwords and secure your Wazuh installation. + :description: Learn how to use the Wazuh passwords tool to manage your passwords and secure your Wazuh installation. Password management =================== @@ -12,24 +12,24 @@ Password management Learn how to use the Wazuh passwords tool to manage your passwords. This tool allows you to change the passwords of both the :doc:`Wazuh indexer ` users, also known as internal users, and the :doc:`Wazuh manager API ` users. -Among the Wazuh indexer users, it is worth mentioning the following: +Among the Wazuh indexer users, it is worth mentioning the following: -- *admin*: is the default administrator user. It's used to log in to the web interface and for communications between Filebeat and the Wazuh indexer. If you change the *admin* password, you must update it in Filebeat. +- *admin*: is the default administrator user. It's used to log in to the web interface and for communications between Filebeat and the Wazuh indexer. If you change the *admin* password, you must update it in Filebeat and the Wazuh server. -- *kibanaserver*: is used for communications between the Wazuh dashboard and the Wazuh indexer. If you change the *kibanaserver* password, you must update it in the Wazuh dashboard. +- *kibanaserver*: is used for communications between the Wazuh dashboard and the Wazuh indexer. If you change the *kibanaserver* password, you must update it in the Wazuh dashboard. On the other hand, the Wazuh manager API has two default users: -- *wazuh*: is the default Wazuh manager API administrator user. +- *wazuh*: is the default Wazuh manager API administrator user. -- *wazuh-wui*: is an admin user used for communications between Wazuh dashboard and the Wazuh manager API. If you change the *wazuh-wui* password, you must update it in the Wazuh dashboard. +- *wazuh-wui*: is an admin user used for communications between Wazuh dashboard and the Wazuh manager API. If you change the *wazuh-wui* password, you must update it in the Wazuh dashboard. -If you use the tool in an all-in-one deployment, it automatically updates the passwords where necessary. If you use it in a distributed environment, depending on the user whose password you change, you may have to update the password on other components. See :ref:`Changing the passwords in a distributed environment ` for more details. +If you use the tool in an all-in-one deployment, it automatically updates the passwords where necessary. If you use it in a distributed environment, depending on the user whose password you change, you may have to update the password on other components. See :ref:`Changing the passwords in a distributed environment ` for more details. -The passwords tool is embedded in the Wazuh indexer under ``/usr/share/wazuh-indexer/plugins/opensearch-security/tools/``. You can use the embedded version or download it with the following command: +The passwords tool is embedded in the Wazuh indexer under ``/usr/share/wazuh-indexer/plugins/opensearch-security/tools/``. You can use the embedded version or download it with the following command: .. code-block:: console - + # curl -so wazuh-passwords-tool.sh https://packages.wazuh.com/|WAZUH_CURRENT_MINOR|/wazuh-passwords-tool.sh @@ -52,7 +52,7 @@ All the available options to run the script are: | | If no password is specified, it will generate a random one. | +----------------------------------------------+-------------------------------------------------------------------------------------------------------------+ | -p / --password | Indicates the new password. Must be used with option -u. | -+----------------------------------------------+-------------------------------------------------------------------------------------------------------------+ ++----------------------------------------------+-------------------------------------------------------------------------------------------------------------+ | -c / --cert | Indicates route to the admin certificate. | +----------------------------------------------+-------------------------------------------------------------------------------------------------------------+ | -k / --certkey | Indicates route to the admin certificate key. | @@ -68,7 +68,7 @@ All the available options to run the script are: | | indexer_password: | | | | | | Wazuh API users must have this format: | -| | | +| | | | | # Description | | | api_username: | | | api_password: | @@ -81,23 +81,23 @@ All the available options to run the script are: Changing the password for single user ------------------------------------- -To change the password for a single Wazuh indexer user, run the script with the ``-u`` option and indicate the new password with the option ``-p``. The password must have a length between 8 and 64 characters and contain at least one upper case letter, one lower case letter, a number and one of the following symbols: ``.*+?-``. If no password is specified, the script will generate a random one. +To change the password for a single Wazuh indexer user, run the script with the ``-u`` option and indicate the new password with the option ``-p``. The password must have a length between 8 and 64 characters and contain at least one upper case letter, one lower case letter, a number and one of the following symbols: ``.*+?-``. If no password is specified, the script will generate a random one. .. code-block:: console - + # bash wazuh-passwords-tool.sh -u admin -p Secr3tP4ssw*rd .. code-block:: console - :class: output + :class: output INFO: Generating password hash WARNING: Password changed. Remember to update the password in the Wazuh dashboard and Filebeat nodes if necessary, and restart the services. -If you use the tool in an all-in-one deployment, it automatically updates the passwords where necessary. If you use it in a distributed environment, depending on the user whose password you change, you may have to update the password on other components. See :ref:`Changing the passwords in a distributed environment ` for more details. +If you use the tool in an all-in-one deployment, it automatically updates the passwords where necessary. If you use it in a distributed environment, depending on the user whose password you change, you may have to update the password on other components. See :ref:`Changing the passwords in a distributed environment ` for more details. -If you want to change the password for a Wazuh manager API user, run the script on a Wazuh server node and use option ``-A, --api``. Alternatively, you can change the Wazuh manager API passwords following the instructions in the :doc:`Securing the Wazuh API ` documentation. +If you want to change the password for a Wazuh manager API user, run the script on a Wazuh server node and use option ``-A, --api``. Alternatively, you can change the Wazuh manager API passwords following the instructions in the :doc:`Securing the Wazuh API ` documentation. Changing the passwords for all users @@ -106,11 +106,11 @@ Changing the passwords for all users To generate and change passwords for all the Wazuh indexer users, run the script with the ``-a`` option: .. code-block:: console - + # bash wazuh-passwords-tool.sh -a .. code-block:: console - :class: output + :class: output :emphasize-lines: 2,3 INFO: Wazuh API admin credentials not provided, Wazuh API passwords not changed. @@ -120,19 +120,19 @@ To generate and change passwords for all the Wazuh indexer users, run the script INFO: The password for user logstash is SUbk4KTmLl*geQbUg0c5tyfwahjDMhx5 INFO: The password for user readall is ?w*Itj1Lgz.5w.C7vOw0Kxi7G94G8bG* INFO: The password for user snapshotrestore is Z6UXgM8Sr0bfV.i*6yPPEUY3H6Du2rdz - WARNING: Wazuh indexer passwords changed. Remember to update the password in the Wazuh dashboard and Filebeat nodes if necessary, and restart the services. + WARNING: Wazuh indexer passwords changed. Remember to update the password in the Wazuh dashboard, Wazuh server, and Filebeat nodes if necessary, and restart the services. -If you use the tool in an all-in-one deployment, it automatically updates the passwords where necessary. If you use it in a distributed environment, you have to update the password on other components. See :ref:`Changing the passwords in a distributed environment ` for more details. +If you use the tool in an all-in-one deployment, it automatically updates the passwords where necessary. If you use it in a distributed environment, you have to update the password on other components. See :ref:`Changing the passwords in a distributed environment ` for more details. -On an all-in-one deployment, use options ``-a``, ``-au`` and ``-ap`` to also change the passwords for all the Wazuh indexer and the Wazuh manager API users. +On an all-in-one deployment, use options ``-a``, ``-au`` and ``-ap`` to also change the passwords for all the Wazuh indexer and the Wazuh manager API users. .. code-block:: console - - # sudo bash wazuh-passwords-tool.sh -a -au wazuh -ap KTb+Md+rR74J2yHfoGGnFGHGm03Gadyu + + # sudo bash wazuh-passwords-tool.sh -a -au wazuh -ap KTb+Md+rR74J2yHfoGGnFGHGm03Gadyu .. code-block:: console - :class: output + :class: output :emphasize-lines: 1,2,8,9 INFO: The password for user admin is Wkw+b2rM6BEOwUmGfr*m*i1ithWw.dg2 @@ -141,18 +141,18 @@ On an all-in-one deployment, use options ``-a``, ``-au`` and ``-ap`` to also cha INFO: The password for user logstash is wuabgegtKsQABems5RNJfV0AOmxT?81T INFO: The password for user readall is gKSuQFGG.Sa0L9gzJX5WZHPP3Y4Es+sU INFO: The password for user snapshotrestore is UdyI8ToXkgVCNOPfJ*FX*a5vybeB.rUw - WARNING: Wazuh indexer passwords changed. Remember to update the password in the Wazuh dashboard and Filebeat nodes if necessary, and restart the services. + WARNING: Wazuh indexer passwords changed. Remember to update the password in the Wazuh dashboard, Wazuh server, and Filebeat nodes if necessary, and restart the services. INFO: The password for Wazuh API user wazuh is zG0yTsAiettOXWEB79Aca1jbQ5.UeW3M INFO: The password for Wazuh API user wazuh-wui is JmKiaCBQo?4Ne0yrM4+n7kGdXGfCmVjO INFO: Updated wazuh-wui user password in wazuh dashboard. Remember to restart the service. - + Changing the passwords using a formatted file --------------------------------------------- -Use a formatted file to indicate the passwords and run the script with the ``-f`` option followed by the file path. Use the following pattern to indicate the users and passwords in the formatted file. +Use a formatted file to indicate the passwords and run the script with the ``-f`` option followed by the file path. Use the following pattern to indicate the users and passwords in the formatted file. For Wazuh indexer users: @@ -179,14 +179,14 @@ The options ``-au`` and ``-ap`` are necessary to change the passwords for the AP Changing the passwords in a distributed environment --------------------------------------------------- -Follow the instructions below to change the passwords for all the Wazuh indexer users as well as the Wazuh manager API users. +Follow the instructions below to change the passwords for all the Wazuh indexer users as well as the Wazuh manager API users. -#. On `any Wazuh indexer node`, use the Wazuh passwords tool to change the passwords of the Wazuh indexer users. +#. On `any Wazuh indexer node`, use the Wazuh passwords tool to change the passwords of the Wazuh indexer users. .. code-block:: console - + # /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh --change-all - + .. code-block:: console :class: output :emphasize-lines: 2,3 @@ -198,33 +198,35 @@ Follow the instructions below to change the passwords for all the Wazuh indexer INFO: The password for user logstash is nQg1Qw0nIQFZXUJc8r8+zHVrkelch33h INFO: The password for user readall is s0iWAei?RXObSDdibBfzSgXdhZCD9kH4 INFO: The password for user snapshotrestore is Mb2EHw8SIc1d.oz.nM?dHiPBGk7s?UZB - WARNING: Wazuh indexer passwords changed. Remember to update the password in the Wazuh dashboard and Filebeat nodes if necessary, and restart the services. + WARNING: Wazuh indexer passwords changed. Remember to update the password in the Wazuh dashboard, Wazuh server, and Filebeat nodes if necessary, and restart the services. -#. On your `Wazuh server master node`, download the Wazuh passwords tool and use it to change the passwords of the Wazuh API users. Replace ```` with the *wazuh* user password. +#. On your `Wazuh server master node`, download the Wazuh passwords tool and use it to change the passwords of the Wazuh API users. Replace ```` with the *wazuh* user password. .. code-block:: console - + # curl -sO https://packages.wazuh.com/|WAZUH_CURRENT_MINOR|/wazuh-passwords-tool.sh # bash wazuh-passwords-tool.sh --change-all --admin-user wazuh --admin-password - + .. code-block:: console :class: output INFO: The password for Wazuh API user wazuh is ivLOfmj7.jL6*7Ev?UJoFjrkGy9t6Je. INFO: The password for Wazuh API user wazuh-wui is fL+f?sFRPEv5pYRE559rqy9b6G4Z5pVi -#. On `all your Wazuh server nodes`, run the following command to update the `admin` password in the Filebeat keystore. Replace ```` with the random password generated in the first step. - +#. On `all your Wazuh server nodes`, run the following command to update the `admin` password in the Filebeat keystore and in the ``ossec.conf`` file for the Wazuh server. Replace ```` with the random password generated in the first step. + .. code-block:: console # echo | filebeat keystore add password --stdin --force + # sed -i 's/.*<\/password>/<\/password>/g' /var/ossec/etc/ossec.conf -#. Restart Filebeat to apply the change. +#. Restart Filebeat and the Wazuh server to apply the change. .. include:: /_templates/common/restart_filebeat.rst + .. include:: /_templates/common/restart_manager.rst .. note:: Repeat steps 3 and 4 on `every Wazuh server node`. - + #. On your `Wazuh dashboard node`, run the following command to update the `kibanaserver` password in the Wazuh dashboard keystore. Replace ```` with the random password generated in the first step. .. code-block:: console @@ -235,7 +237,7 @@ Follow the instructions below to change the passwords for all the Wazuh indexer .. code-block:: yaml :emphasize-lines: 6 - + hosts: - default: url: https://localhost