wazuh

Install and configure Wazuh-HIDS client and server

Project URL RSS Feed Report issues

Module Stats

129,899 downloads

106 latest version

4.6 quality score

Version information

released Jun 27th 2019

This version is compatible with:

Puppet Enterprise 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x
Puppet >= 6.0.0 < 7.0.0
, , , , ,

Start using this module

Installation method

Add this module to your Puppetfile:

mod 'wazuh-wazuh', '3.9.2'

Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add wazuh-wazuh

Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install wazuh-wazuh --version 3.9.2

Tags: ossec, hids, wazuh, 48

Documentation

wazuh/wazuh — version 3.9.2 Jun 27th 2019

Wazuh Puppet module

This module installs and configure Wazuh agent and manager.

Documentation

Directory structure

wazuh-puppet/
├── CHANGELOG.md
├── checksums.json
├── files
│   └── ossec-logrotate.te
├── Gemfile
├── LICENSE.txt
├── manifests
│   ├── activeresponse.pp
│   ├── addlog.pp
│   ├── agent.pp
│   ├── command.pp
│   ├── elasticsearch.pp
│   ├── email_alert.pp
│   ├── filebeat.pp
│   ├── init.pp
│   ├── integration.pp
│   ├── kibana.pp
│   ├── manager.pp
│   ├── params_agent.pp
│   ├── params_elastic.pp
│   ├── params_manager.pp
│   ├── repo_elastic.pp
│   ├── repo.pp
│   ├── reports.pp
│   └── wazuh_api.pp
├── metadata.json
├── Rakefile
├── README.md
├── spec
│   ├── classes
│   │   ├── client_spec.rb
│   │   ├── init_spec.rb
│   │   └── server_spec.rb
│   └── spec_helper.rb
├── templates
│   ├── api
│   │   └── config.js.erb
│   ├── command.erb
│   ├── default_commands.erb
│   ├── elasticsearch_yml.erb
│   ├── email_alert.erb
│   ├── filebeat_yml.erb
│   ├── fragments
│   │   ├── _activeresponse.erb
│   │   ├── _auth.erb
│   │   ├── _cluster.erb
│   │   ├── _default_activeresponse.erb
│   │   ├── _integration.erb
│   │   ├── _localfile.erb
│   │   ├── _localfile_generation.erb
│   │   ├── _reports.erb
│   │   ├── _rootcheck.erb
│   │   ├── _ruleset.erb
│   │   ├── _sca.erb
│   │   ├── _syscheck.erb
│   │   ├── _wodle_cis_cat.erb
│   │   ├── _wodle_openscap.erb
│   │   ├── _wodle_osquery.erb
│   │   ├── _wodle_syscollector.erb
│   │   └── _wodle_vulnerability_detector.erb
│   ├── jvm_options.erb
│   ├── kibana_yml.erb
│   ├── local_decoder.xml.erb
│   ├── local_rules.xml.erb
│   ├── ossec_shared_agent.conf.erb
│   ├── process_list.erb
│   ├── wazuh_agent.conf.erb
│   └── wazuh_manager.conf.erb
├── tests
│   └── init.pp
└── VERSION

Branches

stable branch on correspond to the last Wazuh-Puppet stable version.
master branch contains the latest code, be aware of possible bugs on this branch.

Contribute

If you would like to contribute to our repository, please fork our Github repository and submit a pull request.

If you are not familiar with Github, you can also share them through our users mailing list, to which you can subscribe by sending an email to wazuh+subscribe@googlegroups.com.

Credits and thank you

This Puppet module has been authored by Nicolas Zin, and updated by Jonathan Gazeley and Michael Porter. Wazuh has forked it with the purpose of maintaining it. Thank you to the authors for the contribution.

License and copyright

Web References

Wazuh website

Change Log

All notable changes to this project will be documented in this file.

Wazuh Puppet v3.9.2_7.1.1

Added

Update to Wazuh version 3.9.2_7.1.1

Wazuh Puppet v3.9.1_7.1.0

Added

Created required files for Filebeat installation. (@jm404) #f36be695
Created required files for Elasticsearch installation. (@jm404) #890fb88
Created required files for Kibana installation. (@jm404) #ac31a02
Added configuration variables to make ossec.conf more flexible. (@jm404) #5631753
Now it's possible to install an agent without registering it. (@jm404) #63e1a13
Added support for Amazon-Linux-2. (@jm404) #823eeec

Changed

The server.pp manifest has been renamed to manager.pp. (@jm404) #f859f87
The client.pp manifest moved to agent.pp. (@jm404) #69fe628

Removed

Registration method export deleted due to security issues. (@jm404) #f77fe49
Eliminated inotify-tools . (@jm404) #628db1e
Deleted _common.erb fragment in order to give flexibility to Agent and Manager. (@jm404) #92114ea

[v3.9.1]

Added

Update to Wazuh version 3.9.1_6.8.0

[v3.9.0]

Added

Allow certificates to be defined by file path (#112)

Changed

Update to Wazuh version 3.9.0 (#118)

[v3.8.2]

Changed

Update to Wazuh version 3.8.2. (#107)

[v3.8.1]

Changed

Update to Wazuh version 3.8.1 (#104)

[v3.8.0]

Added

Feature/agent auth cert key (#98)
Install package even if repos are not managed by wazuh (#99)

Added

Updating params.pp and _common.erb so all the options of localfile can be used (#97)

[v3.7.2]

Added

Updating params.pp and _common.erb so all the options of localfile can be used (#97)

Fixed

Fixing process_list.erb performance (#94)
Update windows agent version (#96)

[v3.7.1]

Added

Add integration support. (#89)
Add support for who data. (#84)
Grouping agents. (#82)

Fixed

Fix firewall module and support excluding decoders and rules. (#81)

Changed

Updated metadata.json.
Changed addlog for command support. (#90)

v3.7.0-3701

Added

New repository management and content.
Add support for Wazuh 3.x. (#85)

Fixed

Fix username (puppet to puppetlabs). (#74)

Change Log old version.

2017-xx-xx support@wazuh.com - 2.0.23

Fixed issue #18 with the pull request #17. (thanks @lemrouch)
Fixed issue #29 puppetlabs/apt version 4 onwards breaks the installation of wazuh server (thanks @rafaelfc-olx)
Adding support for changing ossec_server_protocol with the pull request #30 (thanks @rafaelfc-olx)
Managing wazuh-api alongside with wazuh-manager with the pull request #31 (thanks @rafaelfc-olx)
Preventing Duplicated declaration issues regarding apt-transport-https package with the pull request #32 (thanks @rafaelfc-olx)
Adding support for changing the client protocol and validating the manager by CA with the pull request #34 (thanks @rafaelfc-olx)
Configuring wazuh-api from puppet with the pull request #35 (thanks @rafaelfc-olx)
Adding notify_time and time-reconnect options to client config with the pull request #36 (thanks @rafaelfc-olx)
New wazuh-winagent-v2.1.1-1.exe added.
Profile name for Centos 7 is not _server, it's _common like RHEL7 with the pull request #38 (thanks @juliovalcarcel)
Verifying if @wodle_openscap_content is defined, fixed #45 and #46
Set the same file permissions than the installed package, fixed #41
Adding the ability to set "type" attribute for "ignore" tag, fixed #19
Adding support to OracleLinux, Fixed #43
Add an option for the agent/manager class to manage the firewall automatically with puppetlabs/firewall

2017-05-27 support@wazuh.com - 2.0.22

Fixed issue #3. (Thanks for reporting it @ddholstad99)
Fixed issue #4. (Thanks for reporting it @elisiano)
Explicitly use the windows package provider pull request #11 (Thanks @damoxc)
Enable fedora 23/24/25 for pull request #9 (Thanks @ddholstad99)
Fix for issue Fix for #6 validate_cmd pull request #12 (Thanks @dakine1111)
Add $wodle_openscap_content parameter to server.pp pull request #12 (Thanks hex2a)
Added some changes in order to do this module compatible. (pull request #5 thanks elisano)

2017-04-24 Jose Luis Ruiz - 2.0.21

Fix apt deprecation warnings. (thanks @kdole)
Avoid warnings when storeconfigs are not available. (thanks @kdole)
Use default local_files setting. (thanks @kdole)
Making ossec server port configurable. (thanks @edge-records)
Allow custom agent configurations (thanks @ffleming)
Fixed issec #66 (thanks @thedawidbalut)
Adds options to control rootcheck feature. (thanks @netman2k)
Use puppet-selinux instead of jfryman-selinux (thanks @netman2k)
Allow custom ossec.conf in agent and server template (thanks @sam-wouters)
Fixed issue #71. (Thanks for reporting it @sc-chad)
Fixed issue #72. (Thanks for reporting it @sc-chad)
Clean code and added new OpenScap option (thanks @0x2A)
module refactored/adapted for wazuh 2.0 (thanks @0x2A)
New wazuh-agent-2.0.exe for Windows.

2016-12-08 Jose Luis Ruiz - 2.0.20

Fixed typo in the windows package, this type made the deploy fails under windows.

2016-12-08 Jose Luis Ruiz - 2.0.19

Compat with Older versions facter. (pull request #47 thanks @seefood)
Template paths as parameters. (pull request #48 thanks @seefood )
Client: allow configurable service_has_status, default to params. (pull request #51 thanks @josephholsten )
Added Yakketi to the supported distributions.
Modified activeresponse.erb to include <rules_id></rules_id> tags (pull request #56 thanks @MatthewRBruce)
Modified client.pp and server.pp to accept package versions as parameter. (pull request #57 thanks @MatthewRBruce)

2016-10-20 Jose Luis Ruiz - 2.0.18

Fixed 10_ossec.conf.erb template, "local_decoder" added to rules configuration

2016-10-18 Jose Luis Ruiz - 2.0.17

Fixed gpgkey path under CentOS and RHEL

2016-10-18 Jose Luis Ruiz - 2.0.16

Add local_decoder.xml and local_rules.xml templates

2016-10-15 Jose Luis Ruiz - 2.0.15

Add option to enable syslog output. (pull request #35 thanks @TravellingGUy )
Add Add Amazon Linux support. (pull request #37 thanks @seefood)
Hard-coded GPG key for RHEL-like systems. (pull request #37 thanks @tobowers)
Override package & service name for client installation. (pull request #43 thanks MrSecure)

2016-06-14 Jose Luis Ruiz - 2.0.14

Add prefilter to agent config. (pull request #32 thanks @cmblong )
Add function addlog to the agent. (issue #30 thanks @paul-cs)
Add the apt::key can set a proxy and the key add process could be done. (issue #34 thanks @drequena)

2016-06-14 Jose Luis Ruiz - 2.0.13

Adding xenial to the supported distributions.(pull request #31 thanks @stephen-kainos)

2016-05-04 Jose Luis Ruiz - 2.0.12

Jose Luis Ruiz jose@wazuh.com:

Add MariaDB support ( (pull reques #3 thanks @ialokin)
Permit admin to disable auto_ignore for files which change more than three times. (pull request #24 thanks @cmblong)
Change fqdn_rand(3000) to a variable to allow us to increase the number of available clients. (pull request #25 thanks @cmblong)
Can now set a minimal activeresponse entry containing just repeated_offenders by defining $ar_repeated_offenders in the wazuh::client. (pull request #26 thanks @ialokin)
Add variable to enable prefilter command. (pull request #27 thanks @cmblong)
Set service provider to redhat on Redhat systems. (pull request #28 thanks @cmblong))

2016-05-04 Jose Luis Ruiz - 2.0.11

Jose Luis Ruiz jose@wazuh.com:

Fix windows installation error in params. (pull request #20 thanks @cmblong)
Added support for repeated_offenders in activeresponse (pull request #21 thanks @ialokin)

2016-04-26 Jose Luis Ruiz - 2.0.10

Jose Luis Ruiz jose@wazuh.com:

Extra rules config to integrate Wazuh ruleset. (pull request #17 thanks @TravellingGUy)
Allow configuration of the email_maxperhour and email_idsname configuration items. (pull request #18 thanks @TravellingGUy)
Fix bug in client exported resources (pull request #19 thanks @scottcunningham)

2016-02-23 Jose Luis Ruiz - 2.0.9

Jose Luis Ruiz jose@wazuh.com:

Allow the agent identity to be modified. (pull request #10 thanks @damoxc)
prevent the agent-auth command being used. (pull request #11 thanks @damoxc)
Change log directory to only be readable by user and group. (pull request #12 thanks @damoxc)
Add the ability to configure a MySQL database with OSSEC server. (pull request #14 thanks @coreone)

2016-02-05 Jose Luis Ruiz - 2.0.8

Jose Luis Ruiz jose@wazuh.com:

Fix some typos with puppet-lint.

2016-02-05 Jose Luis Ruiz jose@wazuh.com - 2.0.7

Jose Luis Ruiz jose@wazuh.com:

Run agent-auth if client.keys doesn't exist an agent. (pull request #9 thanks @TravellingGuy)

2016-02-03 Jose Luis Ruiz jose@wazuh.com - 2.0.6

Jose Luis Ruiz jose@wazuh.com:

Add ability to manage epel repo to master/client configs (pull request #4 thanks @justicel)
The @path uses the puppet level path variable (pull request #5 thanks @justicel)
Allow whitelisting of IP addreses (thanks @chaordix)
Provides an option to tell the puppet module to not manage the client.keys file at all. (pull request #7 thanks @TravellingGuy)

2016-01-19 Jose Luis Ruiz jose@wazuh.com - 2.0.5

Jose Luis Ruiz jose@wazuh.com:

Add multiple email_to addresses
Adding support for server-hostname in agent config (pull request #3 thanks @alustenberg)
Adding ossec_scanpaths configuration thanks to @djjudas21 repository

2015-12-21 Jose Luis Ruiz jose@wazuh.com - 2.0.4

Jose Luis Ruiz jose@wazuh.com:

Add manage_repo option on client.pp (issue #2 reported by @cudgel)
Add new repo for RHEL5 and CentOS5 have different rpm signature.

2015-12-02 Jose Luis Ruiz jose@wazuh.com - 2.0.3

Jose Luis Ruiz jose@wazuh.com:

Fix server package name for Ubuntu (thanks to @HielkeJ for Pull request)
Add full fingerprint for Ubuntu and Debian (thanks to @HielkeJ for Pull request)

2015-10-13 Jose Luis Ruiz jose@wazuh.com - 2.0.2

Jose Luis Ruiz jose@wazuh.com:

Update Windows Agent to version 2.8.3
Update packaget to Ubuntu Vivid and Wily
Update packages to Debian Stretch and Sid

2015-10-13 Jose Luis Ruiz jose@wazuh.com - 2.0.1

Jose Luis Ruiz jose@wazuh.com:

Update Windows Agent to version 2.8.1
Fix a bug with the Windows Agent ID, now use for all systems fqdn_rand to generate the client.keys ID

2015-09-16 Jose Luis Ruiz jose@wazuh.com - 2.0.0

Jose Luis Ruiz jose@wazuh.com:

Update for all kind of Windows
Change repos to Wazuh, Inc.

2015-09-16 Michael Porter michael.porter@lightningsource.com - 2.0.0

Michael Porter michael.porter@lightningsource.com:

Allow skipping MySQL dependency, disabling active response, and executing rootcheck
Windows agent support
Use Puppet md5 support, instead of adding parser function
Utilize centralized agent configuration
Various clean-up and reorganization of Puppet module structure
Utilize 'hostname' instead of 'uniqueid' for agent ID, due to uniqueid not existing on Windows, and not necessarily being unique across the org on Linux