Module settings are not persistent between updates

[jesuslinares]

The Wazuh WUI allows configuring your modules:

This configuration is saved in a file:
New installation:

cat /usr/share/kibana/data/wazuh/config/wazuh-registry.json
{"name":"Wazuh App","app-version":"4.2.7","revision":"4209-1","installationDate":"2022-05-31T12:10:50.999Z","lastRestart":"2022-05-31T12:10:50.999Z","hosts":{}} 

After login:

cat /usr/share/kibana/data/wazuh/config/wazuh-registry.json
{"name":"Wazuh App","app-version":"4.2.7","revision":"4209-1","installationDate":"2022-05-31T11:13:00.479Z","lastRestart":"2022-05-31T11:13:00.479Z","hosts":{"1":{"cluster_info":{"status":"enabled","manager":"wazuh-manager-master-0","node":"wazuh-manager-master-0","cluster":"w7t5o2zptnbu"},"extensions":{"audit":true,"pci":true,"gdpr":true,"hipaa":true,"nist":true,"tsc":true,"oscap":false,"ciscat":false,"aws":false,"gcp":false,"virustotal":false,"osquery":false,"docker":false}}}}

If I configure my modules (so, the settings are saved in the wazuh-registry.json file) and update Kibana, the configuration is lost.

[Desvelao]

Research

I got to replicate the problem and this could be related to upgrading (changing) the Wazuh plugin.

When the Wazuh plugin starts, there is a task to check the wazuh-registry.json file exists. If this exists, it checks the values for the Wazuh plugin version and the revision matches with the current Wazuh plugin installed. If not, then the wazuh-registry.json file is rebuilt, without taking into account the module visibility configuration for the existent hosts.

Quick fix

When rebuilding the wazuh-registry.json file due to changing the Wazuh plugin, the hosts key should use the value in the current wazuh-registry.json file instead of an empty object definition. This approach fixes the problem, but it creates another when these extensions change, for example, a new Wazuh plugin version added a new extension. This extension won't have any value in the wazuh-registry.json file and the UI could fail or don't behave as expected.

Best solution

Migrate the host extensions to match with the supported or expected extensions in the installed Wazuh plugin.

[Desvelao]

Solved in #4359.