Wazuh - Revision history

Cpalmer at 17:22, 3 November 2023

2023-11-03T17:22:11Z

← Older revision		Revision as of 17:22, 3 November 2023
Line 13:		Line 13:
	# If this command worked you are done. If this command fails you need to remove the agent from the list.		# If this command worked you are done. If this command fails you need to remove the agent from the list.
	* Get Wazuh running on a 24pintech computer that does not have it installed		* Get Wazuh running on a 24pintech computer that does not have it installed
	# In file explorer navigate to Cisco Curriculum ~~in Midgard~~ (Q:)		# In file explorer navigate to Cisco Curriculum (P:) in this PC
	# Copy the Deployed Applications folder and paste it in C:		# Copy the '''Deployed Applications''' folder and paste it in C:
	# Change the folder name to DeployedApplications		# (NOTE) If the computer doesn't have Cisco Curriculum (P:) you will have to get a thumbdrive with the file '''Deployed Applications'''
			#Change the folder name to '''DeployedApplications'''
	#Run Windows PowerShell as '''ADMIN'''		#Run Windows PowerShell as '''ADMIN'''
	# Enter: <code>'''cd c:\DeployedApplications'''</code>		# Enter: <code>'''cd c:\DeployedApplications'''</code>
	# Enter the command: <code>'''.\wazuh-agent-4.4.1-1.msi /q WAZUH_MANAGER="10.21.25.12" WAZUH_REGISTRATION_SERVER="10.21.25.12" WAZUH_REGISTRATION_PASSWORD="password"'''</code>		# Enter the command: <code>'''.\wazuh-agent-4.4.1-1.msi /q WAZUH_MANAGER="10.21.25.12" WAZUH_REGISTRATION_SERVER="10.21.25.12" WAZUH_REGISTRATION_PASSWORD="password"'''</code>
			#Make sure that your command has the same version of Wazuh as the Wazuh Agent in '''DeployedApplications'''
	'''Wazuh Agent''' '''Mac Configuration'''		'''Wazuh Agent''' '''Mac Configuration'''
	* Log in to the computer with the '''24pintech''' account. You may also open this wiki page on that computer to copy and paste commands.		* Log in to the computer with the '''24pintech''' account. You may also open this wiki page on that computer to copy and paste commands.

Bchamberlain: changed the version number of the wazuh agent

2023-07-11T17:06:22Z

changed the version number of the wazuh agent

Show changes

Monsterhouse: /* Step 4: Change the IP */

2023-04-28T15:21:33Z

Step 4: Change the IP

← Older revision		Revision as of 15:21, 28 April 2023
Line 114:		Line 114:
	# Open the menu in the top right of the screen. Go to Wired Connected and then open Wired Settings. Click on the gear on the Connected option and go to IPv4.		# Open the menu in the top right of the screen. Go to Wired Connected and then open Wired Settings. Click on the gear on the Connected option and go to IPv4.
	#Set the '''IPv4 Method''' to '''Manual'''. You will now need to set the Address to "'''10.21.25.12'''". You must use this IP for all of the agents to automatically connect to your new server. Set the Netmask to "'''255.255.255.0'''". Set the gateway to "'''10.21.25.1'''". Set the DNS to "'''10.21.25.3, 10.21.25.4'''". To the right there is a picture of how the settings should look to use as a reference. Everything should be exactly the same. Once you are done hit '''Apply''' in the top right.		#Set the '''IPv4 Method''' to '''Manual'''. You will now need to set the Address to "'''10.21.25.12'''". You must use this IP for all of the agents to automatically connect to your new server. Set the Netmask to "'''255.255.255.0'''". Set the gateway to "'''10.21.25.1'''". Set the DNS to "'''10.21.25.3, 10.21.25.4'''". To the right there is a picture of how the settings should look to use as a reference. Everything should be exactly the same. Once you are done hit '''Apply''' in the top right.
	#On the previous screen turn '''Connected''' off and then back on to ~~make sure~~ the		#On the previous screen turn '''Connected''' off and then back on. This should have applied the settings from last step.
	#
			==== Step 5: Verify Connectivity ====

			# Go to the Wazuh servers web page. To access it enter '''<nowiki>https://10.21.25.12</nowiki>''' into your search bar.
			# For the username ender "'''admin'''" and for the password type in what you set the password as in step 3. You should now have access to the dashboard.
			# Check to see if agents are connecting. If agents have connected you are done with the installation process and are now ready to begin monitoring.

			==== Troubleshooting: ====
			Type in the command <code>'''sudo apt install net-tools'''</code> and now enter the command <code>'''ifconfig'''</code> to see the IP. If the IP is anything besides '''10.21.25.12''' then you messed up in step 4. If necessary you can google a different tutorial in changing the IP online that may be more in depth.
			#

	#		#

Monsterhouse: /* Step 4: Change the IP */

2023-04-27T21:58:11Z

Step 4: Change the IP

← Older revision		Revision as of 21:58, 27 April 2023
Line 113:		Line 113:

	# Open the menu in the top right of the screen. Go to Wired Connected and then open Wired Settings. Click on the gear on the Connected option and go to IPv4.		# Open the menu in the top right of the screen. Go to Wired Connected and then open Wired Settings. Click on the gear on the Connected option and go to IPv4.
	#Set the '''IPv4 Method'''		#Set the '''IPv4 Method''' to '''Manual'''. You will now need to set the Address to "'''10.21.25.12'''". You must use this IP for all of the agents to automatically connect to your new server. Set the Netmask to "'''255.255.255.0'''". Set the gateway to "'''10.21.25.1'''". Set the DNS to "'''10.21.25.3, 10.21.25.4'''". To the right there is a picture of how the settings should look to use as a reference. Everything should be exactly the same. Once you are done hit '''Apply''' in the top right.
			#On the previous screen turn '''Connected''' off and then back on to make sure the
	#		#

Monsterhouse: /* Step 4: Change the IP */

2023-04-27T21:46:45Z

Step 4: Change the IP

← Older revision		Revision as of 21:46, 27 April 2023
Line 1:		Line 1:
	Wazuh is the SIEM software that is used to make sure that all of our computers are up to standard in terms of system health and to monitor any security events. The Wazuh server lives on Valhalla in an Ubuntu virtual machine called Gustavo which was named after the manager of Los Pollos Hermanos in the television series Breaking Bad. There are also agents that are deployed onto each device which collect necessary information that will be needed to make a full report on any issues that may be occurring on said system. All of the data is then processed and sent to the manager which takes all of the data and organizes it into one source. It also utilizes Elasticstack which visualizes all of the data the manager has so that everything going on in 24Pintech's systems can be monitored without much hassle.		Wazuh is the SIEM software that is used to make sure that all of our computers are up to standard in terms of system health and to monitor any security events. The Wazuh server lives on Valhalla in an Ubuntu virtual machine called McGill which is named after Chuck McGill from Better Call Saul. The previous Wazuh server which was replaced due to instability was called Gustavo which was named after the manager of Los Pollos Hermanos and a kingpin in a criminal syndicate in the television series Breaking Bad. There are also agents that are deployed onto each device which collect necessary information that will be needed to make a full report on any issues that may be occurring on said system. All of the data is then processed and sent to the manager which takes all of the data and organizes it into one source. It also utilizes Elasticstack which visualizes all of the data the manager has so that everything going on in 24Pintech's systems can be monitored without much hassle.

	ㅤ		ㅤ
Line 97:		Line 97:
	#Put Desktop Ubuntu on the virtual machine. You will likely be using version 22.04 which is already on the 24PinTech shared storage however you should search and verify that this is still the recommended version of Linux. You should also use Desktop Ubuntu rather than Server Ubuntu because you lose a lot of functionality that is key to running Wazuh effectively if you use Server Ubuntu.		#Put Desktop Ubuntu on the virtual machine. You will likely be using version 22.04 which is already on the 24PinTech shared storage however you should search and verify that this is still the recommended version of Linux. You should also use Desktop Ubuntu rather than Server Ubuntu because you lose a lot of functionality that is key to running Wazuh effectively if you use Server Ubuntu.
	#Set up Linux on the image by simply going through the setup. Be sure to read what you are doing and do not just click through it.		#Set up Linux on the image by simply going through the setup. Be sure to read what you are doing and do not just click through it.
			[[File:Wired Settings Config.png\|thumb\|Settings for IPv4]]

	==== Step 2: Install Wazuh ====		==== Step 2: Install Wazuh ====
Line 112:		Line 113:

	# Open the menu in the top right of the screen. Go to Wired Connected and then open Wired Settings. Click on the gear on the Connected option and go to IPv4.		# Open the menu in the top right of the screen. Go to Wired Connected and then open Wired Settings. Click on the gear on the Connected option and go to IPv4.
			#Set the '''IPv4 Method'''
	#		#

Monsterhouse: /* Step 3: Change the password */

2023-04-27T15:02:42Z

Step 3: Change the password

← Older revision		Revision as of 15:02, 27 April 2023
Line 101:		Line 101:
	'''''Note: You may open this wiki page on the server using Firefox and copy and paste commands instead of typing them manually.'''''		'''''Note: You may open this wiki page on the server using Firefox and copy and paste commands instead of typing them manually.'''''

	# In a terminal window type this command: <code>sudo curl -sO <nowiki>https://packages.wazuh.com/4.4/wazuh-install.sh</nowiki> && sudo bash ./wazuh-install.sh -a</code>		# In a terminal window type this command: <code>'''sudo curl -sO <nowiki>https://packages.wazuh.com/4.4/wazuh-install.sh</nowiki> && sudo bash ./wazuh-install.sh -a'''</code>
	# You will likely need to wait 5-15 minutes or potentially longer for this command to run. Just be patient.		# You will likely need to wait 5-15 minutes or potentially longer for this command to run. Just be patient.

	==== Step 3: Change the password ====		==== Step 3: Change the password ====

	# Enter this command: <code>sudo curl -so wazuh-passwords-tool.sh <nowiki>https://packages.wazuh.com/4.4/wazuh-passwords-tool.sh</nowiki></code>		# Enter this command: <code>'''sudo curl -so wazuh-passwords-tool.sh <nowiki>https://packages.wazuh.com/4.4/wazuh-passwords-tool.sh</nowiki>'''</code>
	# Enter this command and '''change the text in the brackets to the chosen password''': <code>sudo bash wazuh-passwords-tool.sh -u admin -p [PASSWORD]</code>		# Enter this command and '''change the text in the brackets to the chosen password''': <code>'''sudo bash wazuh-passwords-tool.sh -u admin -p [PASSWORD]'''</code>

			==== Step 4: Change the IP ====

			# Open the menu in the top right of the screen. Go to Wired Connected and then open Wired Settings. Click on the gear on the Connected option and go to IPv4.
			#

	#		#
	== Wazuh Commands: ==		== Wazuh Commands: ==

	====<u>Agent Config (Agent Side)</u>====		====<u>Agent Config (Agent Side).</u> ====

	* <code>'''net stop wazuh'''</code>		* <code>'''net stop wazuh'''</code>

Monsterhouse: /* Step 2: Install Wazuh */

2023-04-26T20:01:18Z

Step 2: Install Wazuh

← Older revision		Revision as of 20:01, 26 April 2023
Line 91:		Line 91:

	==== Step 1: Create a new server ====		==== Step 1: Create a new server ====
	~~Creating~~ the new server in ESXi for Wazuh to run on. '''''Note that you should have approval from a leader of the systems team or Chamberlain before you make a new server.'''''		Create the new server in ESXi for Wazuh to run on. '''''Note that you should have approval from a leader of the systems team or Chamberlain before you make a new server.'''''

	# First you need to name the server. All Wazuh servers are to be named after Breaking Bad/Better Call Saul characters. Currently we have already decided that if McGill ever needs to be replaced the server that fills its place should be named Schrader.		# First you need to name the server. All Wazuh servers are to be named after Breaking Bad/Better Call Saul characters. Currently we have already decided that if McGill ever needs to be replaced the server that fills its place should be named Schrader.
Line 99:		Line 99:

	==== Step 2: Install Wazuh ====		==== Step 2: Install Wazuh ====
	~~This step is ridiculously easy~~ and ~~fast~~.		'''''Note: You may open this wiki page on the server using Firefox and copy and paste commands instead of typing them manually.'''''

			# In a terminal window type this command: <code>sudo curl -sO <nowiki>https://packages.wazuh.com/4.4/wazuh-install.sh</nowiki> && sudo bash ./wazuh-install.sh -a</code>
			# You will likely need to wait 5-15 minutes or potentially longer for this command to run. Just be patient.

			==== Step 3: Change the password ====

			# Enter this command: <code>sudo curl -so wazuh-passwords-tool.sh <nowiki>https://packages.wazuh.com/4.4/wazuh-passwords-tool.sh</nowiki></code>
			# Enter this command and '''change the text in the brackets to the chosen password''': <code>sudo bash wazuh-passwords-tool.sh -u admin -p [PASSWORD]</code>

	#		#
	== Wazuh Commands: ==		== Wazuh Commands: ==

Monsterhouse: /* Step 1: Create a new server */

2023-04-26T19:28:38Z

Step 1: Create a new server

← Older revision		Revision as of 19:28, 26 April 2023
Line 95:		Line 95:
	# First you need to name the server. All Wazuh servers are to be named after Breaking Bad/Better Call Saul characters. Currently we have already decided that if McGill ever needs to be replaced the server that fills its place should be named Schrader.		# First you need to name the server. All Wazuh servers are to be named after Breaking Bad/Better Call Saul characters. Currently we have already decided that if McGill ever needs to be replaced the server that fills its place should be named Schrader.
	#Give it 4-8 CPU cores, 8 Gb of ram, and 250 Gb of storage.		#Give it 4-8 CPU cores, 8 Gb of ram, and 250 Gb of storage.
	#Put Desktop Ubuntu on the virtual machine. You will likely be using version 22.04 however you should search and verify that this is still the recommended version of Linux. You should also use Desktop Ubuntu rather than Server Ubuntu because you lose a lot of functionality that is key to running Wazuh effectively if you use Server Ubuntu.		#Put Desktop Ubuntu on the virtual machine. You will likely be using version 22.04 which is already on the 24PinTech shared storage however you should search and verify that this is still the recommended version of Linux. You should also use Desktop Ubuntu rather than Server Ubuntu because you lose a lot of functionality that is key to running Wazuh effectively if you use Server Ubuntu.
	#		#Set up Linux on the image by simply going through the setup. Be sure to read what you are doing and do not just click through it.

			==== Step 2: Install Wazuh ====
			This step is ridiculously easy and fast.
			#
	== Wazuh Commands: ==		== Wazuh Commands: ==

Monsterhouse at 19:22, 26 April 2023

2023-04-26T19:22:45Z

← Older revision		Revision as of 19:22, 26 April 2023
Line 91:		Line 91:

	==== Step 1: Create a new server ====		==== Step 1: Create a new server ====
	Creating the new server in ESXi for Wazuh to run on. Note that you should have approval from a leader of the systems team or Chamberlain before you make a new server.		Creating the new server in ESXi for Wazuh to run on. '''''Note that you should have approval from a leader of the systems team or Chamberlain before you make a new server.'''''

	# Give it 4-8 CPU cores, 8 Gb of ram, and 250 Gb of storage.		# First you need to name the server. All Wazuh servers are to be named after Breaking Bad/Better Call Saul characters. Currently we have already decided that if McGill ever needs to be replaced the server that fills its place should be named Schrader.
	#Put Desktop Ubuntu on the virtual machine. You will likely be using version 22.04 however you should search and verify that this is still the recommended version of Linux. You should also use Desktop Ubuntu rather than Server Ubuntu because you lose a lot of functionality that is key to running Wazuh effectively if you use Server Ubuntu		#Give it 4-8 CPU cores, 8 Gb of ram, and 250 Gb of storage.
			#Put Desktop Ubuntu on the virtual machine. You will likely be using version 22.04 however you should search and verify that this is still the recommended version of Linux. You should also use Desktop Ubuntu rather than Server Ubuntu because you lose a lot of functionality that is key to running Wazuh effectively if you use Server Ubuntu.
	#		#
	== Wazuh Commands: ==		== Wazuh Commands: ==

Monsterhouse: /* Creating a new Wazuh Server */

2023-04-25T21:59:23Z

Creating a new Wazuh Server

← Older revision		Revision as of 21:59, 25 April 2023
Line 91:		Line 91:

	==== Step 1: Create a new server ====		==== Step 1: Create a new server ====
	Creating the new server in ~~ESXI is as easy as follows~~		Creating the new server in ESXi for Wazuh to run on. Note that you should have approval from a leader of the systems team or Chamberlain before you make a new server.

	~~# Give it 4-8 CPU cores~~

			# Give it 4-8 CPU cores, 8 Gb of ram, and 250 Gb of storage.
			#Put Desktop Ubuntu on the virtual machine. You will likely be using version 22.04 however you should search and verify that this is still the recommended version of Linux. You should also use Desktop Ubuntu rather than Server Ubuntu because you lose a lot of functionality that is key to running Wazuh effectively if you use Server Ubuntu
			#
	== Wazuh Commands: ==		== Wazuh Commands: ==