From a4ede738799a8fe9e3d2c0f9b9c37b7a3ab64636 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 20 Dec 2025 00:23:15 +0000 Subject: [PATCH] Add Wazuh security monitoring template - Created simplified single-node setup without certificate file mounts - Uses environment variables for credentials with password helpers - Configured dashboard, indexer, and manager services - Added metadata and logo Co-authored-by: Siumauricio <47042324+Siumauricio@users.noreply.github.com> --- blueprints/wazuh/docker-compose.yml | 86 ++++++++++++++++++++++++++++ blueprints/wazuh/template.toml | 24 ++++++++ blueprints/wazuh/wazuh.png | Bin 0 -> 8949 bytes meta.json | 18 ++++++ 4 files changed, 128 insertions(+) create mode 100644 blueprints/wazuh/docker-compose.yml create mode 100644 blueprints/wazuh/template.toml create mode 100644 blueprints/wazuh/wazuh.png diff --git a/blueprints/wazuh/docker-compose.yml b/blueprints/wazuh/docker-compose.yml new file mode 100644 index 00000000..a7fb0e9f --- /dev/null +++ b/blueprints/wazuh/docker-compose.yml @@ -0,0 +1,86 @@ +version: "3.8" +services: + wazuh.manager: + image: wazuh/wazuh-manager:4.14.1 + hostname: wazuh.manager + restart: always + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 655360 + hard: 655360 + environment: + - WAZUH_INDEXER_HOSTS=wazuh.indexer:9200 + - WAZUH_NODE_NAME=manager + - WAZUH_CLUSTER_NODES=wazuh.manager + - WAZUH_CLUSTER_BIND_ADDR=wazuh.manager + - INDEXER_USERNAME=${INDEXER_USERNAME} + - INDEXER_PASSWORD=${INDEXER_PASSWORD} + - API_USERNAME=${API_USERNAME} + - API_PASSWORD=${API_PASSWORD} + volumes: + - wazuh_api_configuration:/var/ossec/api/configuration + - wazuh_etc:/var/ossec/etc + - wazuh_logs:/var/ossec/logs + - wazuh_queue:/var/ossec/queue + - wazuh_var_multigroups:/var/ossec/var/multigroups + - wazuh_active_response:/var/ossec/active-response/bin + - wazuh_wodles:/var/ossec/wodles + + wazuh.indexer: + image: wazuh/wazuh-indexer:4.14.1 + hostname: wazuh.indexer + restart: always + environment: + - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g + - bootstrap.memory_lock=true + - network.host=wazuh.indexer + - node.name=wazuh.indexer + - cluster.initial_cluster_manager_nodes=wazuh.indexer + - node.max_local_storage_nodes=1 + - plugins.security.disabled=true + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data:/var/lib/wazuh-indexer + + wazuh.dashboard: + image: wazuh/wazuh-dashboard:4.14.1 + hostname: wazuh.dashboard + restart: always + environment: + - SERVER_HOST=0.0.0.0 + - SERVER_PORT=5601 + - OPENSEARCH_HOSTS=http://wazuh.indexer:9200 + - INDEXER_USERNAME=${INDEXER_USERNAME} + - INDEXER_PASSWORD=${INDEXER_PASSWORD} + - WAZUH_API_URL=https://wazuh.manager + - DASHBOARD_USERNAME=${DASHBOARD_USERNAME} + - DASHBOARD_PASSWORD=${DASHBOARD_PASSWORD} + - API_USERNAME=${API_USERNAME} + - API_PASSWORD=${API_PASSWORD} + depends_on: + - wazuh.indexer + - wazuh.manager + volumes: + - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config + - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom + +volumes: + wazuh_api_configuration: + wazuh_etc: + wazuh_logs: + wazuh_queue: + wazuh_var_multigroups: + wazuh_active_response: + wazuh_wodles: + wazuh-indexer-data: + wazuh-dashboard-config: + wazuh-dashboard-custom: diff --git a/blueprints/wazuh/template.toml b/blueprints/wazuh/template.toml new file mode 100644 index 00000000..00eb3bbe --- /dev/null +++ b/blueprints/wazuh/template.toml @@ -0,0 +1,24 @@ +[variables] +main_domain = "${domain}" +indexer_username = "admin" +indexer_password = "${password:32}" +dashboard_username = "kibanaserver" +dashboard_password = "${password:32}" +api_username = "wazuh-wui" +api_password = "${password:32}" + +[config] +env = [ + "INDEXER_USERNAME=${indexer_username}", + "INDEXER_PASSWORD=${indexer_password}", + "DASHBOARD_USERNAME=${dashboard_username}", + "DASHBOARD_PASSWORD=${dashboard_password}", + "API_USERNAME=${api_username}", + "API_PASSWORD=${api_password}" +] +mounts = [] + +[[config.domains]] +serviceName = "wazuh.dashboard" +port = 5601 +host = "${main_domain}" diff --git a/blueprints/wazuh/wazuh.png b/blueprints/wazuh/wazuh.png new file mode 100644 index 0000000000000000000000000000000000000000..6eb15f601456fc9a2a009838aba876a18b6ec1ce GIT binary patch literal 8949 zcmeIY=UY?T^FFK|5d;xY>0J?|N|De(Kt!Y|EryN>BGP*&2M`b`i6FgMC<1{%LJdt& zAe4ZJlmGz{36ch$P;58D~$%1k@g#Hmx)I!*5y*hUm@5WE7M*J77;))t~qvz-c0kZem7zxnDa zUuwCz=~W)>#wTW#-{-DKi&lxM-_oL(&k0z~do8G!RMu6EK;|$7JGG;?o5_`yD!Crk zS$w`yGO2G&*(L8>mOOQt!$AJa#V3R9(%=X0#1+MJ*TPHJoMQBcBJQX?Gx}$gU7P52 z=aA6Oc^ycljYD2>NV0OFiF|y0C)`85D@}f>`>o?^cwOR;XCZq|)0@gAdvjN+Z|T=# zM)aQXUl9@DRd!a&@qsMX0yzPbGQn@J@wqTO#abAxvn_MPw%MFd`JS@2=e3od2xr#JZYsm(J^S52Bo_ns>;sWul31Mu_U*C!>Qh-S}rui=kl*U6A+1Tu<=6v zX_>6mT6JX%*gD@o42fpQ%%N25;78R6&m7nHCONK*hL`Zzf8)8SwPrN}i9gR!=N+?; zc{e~}mm{d=f z)Ym__0*f=J&a++|QUK0%>D?UW6Lr<%e=~=&)&Opwypm+=y@n$fe$}!G(cC9vP_B0FmRdE;R8GOLZSiXlW{N){T_u1vT4{a`PkO1 zSMZX?O25h3ib4^`9{HP&idro!j`rv39n$$$iwNW{OHkO~K3#4UI?xsb-bM_X`49l8 zo&8=n_fkBtGHRuM;bp$ueMP8#vz~U%!qMk7L&erQ|JeFmLXYWVZTVyCl)|1}^mvWK z`$dVV-tc-eoAI+X$~^5K|me_3U=`#tw+0fF3U23o&;Ffqam z;G)BMsrHcA3oW^oF}3FvoFSqvtNm5|DTp%pY?Z?iyI__K=SSey-?J}MUCU-56S|o< zht)fDYR}W8=VIgn=Q~wyj@pPg&B57rwpYhY-wzY-w^o$+tGzpM8b9#pl`4CFA*2ZR z5C|8FX%Ei2IaNKU>1x4Ce{Fx6a=OI)-7E zmTJ|T@mVay>LAyr7rL9|a_H;Xe=17WKjqB~Y-GnCcRKKVtI%fM3n5Fwn+}WhIf{=8 zDjFEXFtxzA7LR8R+s~eCeprvG;%<##~@jayo5s|+F_s$L~%n}~lOgGP?7ZvCXhna3_>QzO$8QRnfm z18u?+U;AWk@A5vlnUzYGLP=u&@QEla|A`rLuyG*dtkK=Oae&&3?qjk;>=%7KNf})YDvWC;Bw7R~F zp~~qq36ArNv%186a(K7Yl)^;D>7ptu6O%ofYg>ICMc&BUiWI|fb}tYfYQB$l-;#ce z>lM4myW|ACy=M2Mx&G}3hB|Ucgy8`hwUSk6)q=V2G}foTtG_-!eM<`x`tge`P+ zc}RKlFyB+J$Ko&-gp|{;Rtp?|l~xwRKPN)nlAG*SiS(lOo7hQ==&@<0!<(%z&rA;Z zb+b_mNViw(GeYVLTL%00y&hoNw@Nt;8aH}Bgyf$0<3`bAXRi{3?L=a>20~s>nJ}__ zUEJI2-&Uw&zQ--?HO$LDT{a>_tr+t)ge z-r;&ThK-3sL8ezlQO7y~s4`||tKvqXLIxb!Z0@+7}kf*F;fUPNho}LUbo2b)&hdTNG5#xbzKHN}jQ~|q&goI?;!;M1x*Z+%RVOxoyvC74As6VCH(iXY)D z=mYW!?xg=zEb2j-4B))&CXYL~(hFs4YcH2Bd7%g1`b0MPRWrkuMhZxX_o=@QNm{HO zznIPh{_x{k0;-|)R+6rf>fSDeH>l15Lib1UrX3Ey;1HfYj@A>0BwYhPp9|@T1Eux< zxjd5CT%fp$>EQb*42pSKH4p3Rg4V1CUPhHWA9<3G3L{I zbO$>u@|r>w<_~_h=Cowcp{XKTXoDu{6Lg=&h2n`Ec9>b)(Yj&ZenTpxopesKUny)+ z9I{$&;~%`y19W*ZeG9D#*PYThJY7u_NYu0(5k*{D6v3db>?OlZ-FEo0mE zLCrX+MKpP+0f7~U>(aEQ_+7TZhGC)-5b)3C^mxM9l8LvGoCpVHjNivK+d+>?5iP|( ziA>jLvN0;Bgitn7G`QJDEe?-TdF*f-t)G<#a0G&U#l5}Ac=XKsdILEV6){e#=Oan+ zIyrI3nvfwt?_07sY;@c7V3E_H*GG(<;2RK<%h9#TYs|Eo?->7RQ^I?3Fx}tU0z2Je zQWyIk{MqJ(PfTVpdj2`dhVGY-cihjKI)^eDO9Ioo4P5lV!HCu#ovxte3n#~GEmfkZ zU0QI;XVfZmn^!`pEV=$8sgP9lvpYjILXM9&f84KG02LNa@BS|89R1bh=VV?UV0_>V)jwh$=c{CO5$6^mBdyye4De69j9ky z``YkghCyI_b2j}#VIkmfoT}Jr5?0i2j!tPM%q%MUt$|9e+^E3X9&S!p^~Dq0NG<DyX9a8qQUi z?3Xs!F{z#B)BR9;x{}viQ$TmnSE@4Lb?hagvf=dUbrMY`89Ys9&vdzX-9uld1NX!_ zKC=98_tG75UIA*g=G&R|%KmL(3G$~M48kv-a#f_A?sK71bQt&D(cYvmTsv9;<+uYd z-uc(B{$JcvqNd?={Gvp#6Chu~Sy(5q>_$r%nZ2HNx23Re!Rl&3neChpZ*UJUCSExu ztQuhWTL{3%hL22#hpudE7U2U^jCO03Z(<+U%SBYETm^LQN9#8_fVcOOLx?V7`xNg4 zoSbbii@#Gbe-+A2^g4vV1Tw*#{*8FtddEz%p8{v4qE3EwYkx3{n3tFm-v*PW+}v8^ zI#&_QBLBB=jSZxJZve-N5==Bsdb*3z{_tfpVd6mOQ8udHO{D|Yvk7ulCgX03J$p7< zoU5R3aP1Om?28k)fj~-_XgzD;zB%akPod{l&7=c*))rxl<0)=?f}T{&dI=9DM$`p7 zpl-gyw^-Mf{GV)9_273x1Km1DkzLe+g{ zjbG;6>PQYP_1CA%KHVy7)D-OeFl^X*xclioV(H%Y6$$b;tDK_O8zr{b&}Vr#0+15M zlb;E!?K>a678AE7t#-~4$l_R+xg#BomJ-fVcz4hG5=yb8Eo;hR)wkn8Y5aJ? z#nTaeV}_4(FLrr*VLUnEtBcsh~%;@4@W$TJ%P>iPt2Z9y@SP6krVm&sTCyv zBl}jazK~8EFm;1NOl96fVnm6zl^eBr`?C6S8Jd$Qr zWr>6OSjnhMmZsel7VC7;{O+JRJ$XA0?fc}Tws41lMLJ7$2ppI%^Y{&@;k{d=@kEVC zQib-PS7uJG{+Zi{lUn{qe-T>}+A4l7$e=P2=S1Q&-@OF@(p7G~ehYoc<8wDg9iw;T z?vL}vH?D84**wMs8~Y~vY11!nDGhR?T-v?~H2=Nlo%d1p6>;a3QwUr8(yFtJ;!BGjIQ^Y!N-QZ;ZHi>)WkQUpKTG<5OEcK<#PzVId`l zLe~j}8sXfi?w38};lCLveI;U^&zZ6H##dH3+~sys>U*K86VyQmjMGW?`Dz5X%K{kp zH^YpvR?*naE5};QEJj>oW`#AqI#ooNZp9k=9KRNv5l_7}5)krs6WP7E{YRg}(p}%tiT#MOSO+1k4>jJKaW*E8X7FNm z$K!)hV?FX(Mj8t?hl$9h&V7-}i16~@$(P4W@Z54CY;WGmLi!1#PNy#g_P)@ zI$mULMg?`0kwHyAZ;U-y{q50%0tbAz1?+1)MflM+2T6~@UE!R!7&`%nk*sU6t7Tlx zcKy&rhy>&~2qPmH^1Xpps@RmQXUWSysqdp00mu)Xima{ugT#yw(@i!X99=0hXnAXRk6@`#}Sx zrS{Kk_ndlh@va{@7Wa>Zw3BO66&pxw|0`{O;LaI9ji8{aJ~B+76plLFeK_B~OegJ) zN9$9z;$~1kHrZ^OTY`+7 zspoi2l~-{=KXdV@wIASOZ5iFEgK}4{azq?4ou8Ff)`|j+Dm^HmrUzTe!H?u z(FM3$YLF*nE?y|t7F7YC8J|DyWfHnk!eynFT(9;0?7EJ+^uQ=HF{Skk z{HQy75v+fi;d1`s$i_F8G^dg%S%d8&#vrrObm^G(t`8YFklUjaO7i$ygq=h!OtM@w z0-)WJYHh3}Y?>BmH}+n_Y0kwk`{&vyg|5aD9P>}XBhT~@qcoQT~=*ITW~K@ zri{l5qu&?kb7lC-yU3o!RX%I2p0YO_&sYriqk9`w9EWZ%)m1fL5qs6}whAr*V&&jZ59fzIUX__R1D#8s|=Z}NSdLGLI zRjNtMl%E7+!=HUwHEt6`W|vCy9Qc$HM&wWzy?=Q1`AAso)c-l9#lK7i%Obq{mAqZ5 zL&SuGfp}qO9=@)raERk!xo3W^c#g}#?>uMM{y~*~xd);QqZ#0`j3MCkfFX6jm=a92 z$#4(e7_sJgk3A~4K6EJY`?EU#5i+js++ghyM0xn=mKe}YKY{k(H#Co z^<1e>uva>$VRxYsodUp9n!eVZmP^CB|iufN%p3ej~FW;^AKyc&un`p+(BBdE%f74YSzx{!cg7;Y( zRv3D_zO$w8#_dZe(;(ZgpS9Je#TO_MzS9SJDL-kgH=q+F&Xg1RmdUy}x+`*jqwGr< z=I(V!_OBV>2kzSW%nKO>*}z!gLLA{oel@wF7^R1(Eb040aCJP~hl+hp&7~ZXFt?7X z_$}WEvEd~J3Y5fd&kCD&If`Xs@I#5R?+mwJ@A!0#Ay*oi;Q#|H$gG8KpOqZ5G_RL5))OWCTtUiVWvti+&h_*)%x^b?D z%b%eklD>!7c7=$a+Slumr&ZzXqpfA*5T6*$Ov`-60eV4XP!Rq0)6vM9N=qg^arbkr zb2khkUBthEU=-<-kjJYFTy_mHBgtzFYL;(`kJC)25%!Fx+;DP94g*P?pa zTaYl-LzDK_JM>R@(~PWT_I+4_oUR)G!#UW&_2pzy6;KZ!vU_us+`UmmXm$#VBdL?YRuDv{&<9rPx# literal 0 HcmV?d00001 diff --git a/meta.json b/meta.json index 358c0902..029f481f 100644 --- a/meta.json +++ b/meta.json @@ -6012,6 +6012,24 @@ "self-hosted" ] }, + { + "id": "wazuh", + "name": "Wazuh", + "version": "4.14.1", + "description": "Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities for endpoint and cloud workload protection.", + "logo": "wazuh.png", + "links": { + "github": "https://github.com/wazuh/wazuh", + "website": "https://wazuh.com/", + "docs": "https://documentation.wazuh.com/" + }, + "tags": [ + "security", + "monitoring", + "siem", + "xdr" + ] + }, { "id": "web-check", "name": "Web-Check",