Merge pull request #1162 from wazuh/1159-update-configuration-to-new-…

…vulnerability-detector-and-indexer Updated configuration to new VD and indexer
wazuh · Dec 19, 2023 · 2821f87 · 2821f87
2 parents 853ea75 + f08c893
commit 2821f87
Show file tree

Hide file tree

Showing 3 changed files with 43 additions and 96 deletions.
diff --git a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml
@@ -6,7 +6,7 @@ wazuh_template_branch: v4.8.0
 filebeat_node_name: node-1
 
 filebeat_output_indexer_hosts:
-  - "localhost:9200"
+  - "localhost"
 
 filebeat_module_package_name: wazuh-filebeat-0.4.tar.gz
 filebeat_module_package_path: /tmp/

diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml
@@ -144,69 +144,22 @@ wazuh_manager_sca:
   time: ''
 
 ## Vulnerability Detector
-wazuh_manager_vulnerability_detector:
-  enabled: 'no'
-  interval: '5m'
-  min_full_scan_interval: '6h'
-  run_on_start: 'yes'
-  providers:
-    - enabled: 'no'
-      os:
-        - 'trusty'
-        - 'xenial'
-        - 'bionic'
-        - 'focal'
-        - 'jammy'
-      update_interval: '1h'
-      name: '"canonical"'
-    - enabled: 'no'
-      os:
-        - 'buster'
-        - 'bullseye'
-        - 'bookworm'
-      update_interval: '1h'
-      name: '"debian"'
-    - enabled: 'no'
-      os:
-        - '5'
-        - '6'
-        - '7'
-        - '8'
-        - '9'
-      update_interval: '1h'
-      name: '"redhat"'
-    - enabled: 'no'
-      os:
-        - '8'
-        - '9'
-      update_interval: '1h'
-      name: '"almalinux"'
-    - enabled: 'no'
-      os:
-        - 'amazon-linux'
-        - 'amazon-linux-2'
-        - 'amazon-linux-2023'
-      update_interval: '1h'
-      name: '"alas"'
-    - enabled: 'no'
-      os:
-        - '11-server'
-        - '11-desktop'
-        - '12-server'
-        - '12-desktop'
-        - '15-server'
-        - '15-desktop'
-      update_interval: '1h'
-      name: '"suse"'
-    - enabled: 'no'
-      update_interval: '1h'
-      name: '"arch"'
-    - enabled: 'no'
-      update_interval: '1h'
-      name: '"msu"'
-    - enabled: 'no'
-      update_interval: '1h'
-      name: '"nvd"'
+filebeat_node_name: node-1
+filebeat_output_indexer_hosts:
+  - "localhost"
+filebeat_output_indexer_port: 9200
+indexer_security_user: admin
+indexer_security_password: changeme
+filebeat_ssl_dir: /etc/pki/filebeat
+
+wazuh_manager_vulnerability_detection:
+  enabled: 'yes'
+  indexer_status: 'yes'
+  feed_update_interval: '60m'
+
+wazuh_manager_indexer:
+  enabled: 'yes'
+  hosts: "{{ filebeat_output_indexer_hosts }}"
 
 ## Syscheck
 wazuh_manager_syscheck:
@@ -448,7 +401,8 @@ wazuh_manager_config_defaults:
   osquery: '{{ wazuh_manager_osquery }}'
   syscollector: '{{ wazuh_manager_syscollector }}'
   sca: '{{ wazuh_manager_sca }}'
-  vulnerability_detector: '{{ wazuh_manager_vulnerability_detector }}'
+  vulnerability_detection: '{{ wazuh_manager_vulnerability_detection }}'
+  indexer: '{{ wazuh_manager_indexer }}'
   log_level: '{{ wazuh_manager_log_level }}'
   email_level: '{{ wazuh_manager_email_level }}'
   localfiles: '{{ wazuh_manager_localfiles }}'

diff --git a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2
@@ -258,37 +258,30 @@
   {% endif %}
   </sca>
 
-  <vulnerability-detector>
-  {% if wazuh_manager_config.vulnerability_detector.enabled is defined %}
-    <enabled>{{ wazuh_manager_config.vulnerability_detector.enabled }}</enabled>
-  {% endif %}
-  {% if wazuh_manager_config.vulnerability_detector.interval is defined %}
-    <interval>{{ wazuh_manager_config.vulnerability_detector.interval }}</interval>
-  {% endif %}
-  {% if wazuh_manager_config.vulnerability_detector.min_full_scan_interval is defined %}
-    <min_full_scan_interval>{{ wazuh_manager_config.vulnerability_detector.min_full_scan_interval }}</min_full_scan_interval>
-  {% endif %}
-  {% if wazuh_manager_config.vulnerability_detector.run_on_start is defined %}
-    <run_on_start>{{ wazuh_manager_config.vulnerability_detector.run_on_start }}</run_on_start>
-  {% endif %}
-  {% if wazuh_manager_config.vulnerability_detector.providers is defined %}
-  {% for provider_ in wazuh_manager_config.vulnerability_detector.providers %}
-    <provider name={{ provider_.name }}>
-      {% if provider_.enabled is defined %}
-      <enabled>{{ provider_.enabled }}</enabled>
-      {% endif %}
-      {% if provider_.os is defined %}
-      {% for os_ in provider_.os %}
-      <os>{{ os_ }}</os>
-      {% endfor %}
-      {% endif %}
-      {% if provider_.update_interval is defined %}
-      <update_interval>{{ provider_.update_interval }}</update_interval>
-      {% endif %}
-    </provider>
-  {% endfor %}
-  {% endif %}
-  </vulnerability-detector>
+  <vulnerability-detection>
+    <enabled>{{ wazuh_manager_config.vulnerability_detection.enabled }}</enabled>
+    <indexer-status>{{ wazuh_manager_config.vulnerability_detection.indexer_status }}</indexer-status>
+    <feed-update-interval>{{ wazuh_manager_config.vulnerability_detection.feed_update_interval }}</feed-update-interval>
+  </vulnerability-detection>
+
+  <indexer>
+    <enabled>{% if wazuh_manager_config.vulnerability_detection.enabled == 'yes' or wazuh_manager_config.indexer.enabled == 'yes' %}yes{% else %}no{% endif %}</enabled>
+    <hosts>
+    {% for item in wazuh_manager_config.indexer.hosts %} 
+      <host>https://{{ item }}:{{ filebeat_output_indexer_port }}</host> 
+    {% endfor %} 
+    </hosts>
+
+    <username>{{ indexer_security_user }}</username> 
+    <password>{{ indexer_security_password }}</password> 
+    <ssl> 
+      <certificate_authorities> 
+        <ca>{{ filebeat_ssl_dir }}/root-ca.pem</ca> 
+      </certificate_authorities> 
+      <certificate>{{ filebeat_ssl_dir }}/{{ filebeat_node_name }}.pem</certificate> 
+      <key>{{ filebeat_ssl_dir }}/{{ filebeat_node_name }}-key.pem</key> 
+    </ssl> 
+  </indexer>
 
   <!-- File integrity monitoring -->
   <syscheck>