updated admin password

ansible-playbook.yml

@@ -58,7 +58,6 @@
         value: '1'
         sysctl_set: true
         state: present
-        reload: true
 
     - name: Enable source valid mark on host
       ansible.posix.sysctl:
@@ -236,6 +235,25 @@
         mode: preserve
         force: true
 
+    - name: Check for stale Wazuh certificate residue
+      ansible.builtin.stat:
+        path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
+      register: wazuh_cert_residue
+
+    - name: Remove stale Wazuh certificate directories
+      ansible.builtin.file:
+        path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
+        state: absent
+      when: wazuh_cert_residue.stat.exists and wazuh_cert_residue.stat.isdir
+
+    - name: Recreate Wazuh certificates directory
+      ansible.builtin.file:
+        path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
     - name: Generate Wazuh certificates
       ansible.builtin.command: podman run --rm -e CERT_TOOL_VERSION=4.14 -v /opt/apps/wazuh/config/certs.yml:/config/certs.yml:z -v /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates:z docker.io/wazuh/wazuh-certs-generator:0.0.3
       args:
@@ -292,7 +310,7 @@
         env:
           INDEXER_URL: "https://wazuh.indexer:9200"
           INDEXER_USERNAME: "admin"
-          INDEXER_PASSWORD: "SecretPassword"
+          INDEXER_PASSWORD: "*WD*oW9m6iKf4hDovy7BbMmhLxC9D?Tv"
           FILEBEAT_SSL_VERIFICATION_MODE: "full"
           SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem"
           SSL_CERTIFICATE: "/etc/ssl/filebeat.pem"
@@ -313,6 +331,8 @@
           - "wazuh_logs:/var/ossec/logs"
           - "wazuh_queue:/var/ossec/queue"
           - "wazuh_var_multigroups:/var/ossec/var/multigroups"
+          - "wazuh_integrations:/var/ossec/integrations"
+          - "wazuh_agentless:/var/ossec/agentless"
           - "wazuh_active_response:/var/ossec/active-response/bin"
           - "wazuh_wodles:/var/ossec/wodles"
           - "filebeat_etc:/etc/filebeat"

wazuh-docker/config/wazuh_cluster/wazuh_manager.conf

@@ -1,10 +1,24 @@
 <ossec_config>
   <global>
-    <agents_disconnection_time>15m</agents_disconnection_time>
+    <jsonout_output>yes</jsonout_output>
+    <alerts_log>yes</alerts_log>
+    <logall>no</logall>
+    <logall_json>no</logall_json>
+    <email_notification>no</email_notification>
+    <smtp_server>smtp.example.wazuh.com</smtp_server>
+    <email_from>wazuh@example.wazuh.com</email_from>
+    <email_to>recipient@example.wazuh.com</email_to>
+    <email_maxperhour>12</email_maxperhour>
+    <email_log_source>alerts.log</email_log_source>
+    <agents_disconnection_time>10m</agents_disconnection_time>
     <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
-    <update_check>yes</update_check>
   </global>
 
+  <alerts>
+    <log_alert_level>3</log_alert_level>
+    <email_alert_level>12</email_alert_level>
+  </alerts>
+
   <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
   <logging>
     <log_format>plain</log_format>
@@ -20,6 +34,8 @@
   <!-- Policy monitoring -->
   <rootcheck>
     <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
     <check_dev>yes</check_dev>
     <check_sys>yes</check_sys>
     <check_pids>yes</check_pids>
@@ -29,12 +45,31 @@
     <!-- Frequency that rootcheck is executed - every 12 hours -->
     <frequency>43200</frequency>
 
-    <skip_nfs>yes</skip_nfs>
+    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
 
-    <ignore>/var/lib/containerd</ignore>
+    <skip_nfs>yes</skip_nfs>
-    <ignore>/var/lib/docker/overlay2</ignore>
   </rootcheck>
 
+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <!-- Osquery integration -->
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
   <!-- System inventory -->
   <wodle name="syscollector">
     <disabled>no</disabled>
@@ -46,15 +81,9 @@
     <packages>yes</packages>
     <ports all="yes">yes</ports>
     <processes>yes</processes>
-    <users>yes</users>
-    <groups>yes</groups>
-    <services>yes</services>
-    <browser_extensions>yes</browser_extensions>
 
     <!-- Database synchronization settings -->
     <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
       <max_eps>10</max_eps>
     </synchronization>
   </wodle>
@@ -63,13 +92,7 @@
     <enabled>yes</enabled>
     <scan_on_start>yes</scan_on_start>
     <interval>12h</interval>
-
+    <skip_nfs>yes</skip_nfs>
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
-      <max_eps>10</max_eps>
-    </synchronization>
   </sca>
 
   <vulnerability-detection>
@@ -99,6 +122,8 @@
     <!-- Frequency that syscheck is executed default every 12 hours -->
     <frequency>43200</frequency>
 
+    <scan_on_start>yes</scan_on_start>
+
     <!-- Generate alert when new file detected -->
     <alert_new_files>yes</alert_new_files>
 
@@ -138,12 +163,13 @@
     <process_priority>10</process_priority>
 
     <!-- Maximum output throughput -->
-    <max_eps>50</max_eps>
+    <max_eps>100</max_eps>
 
     <!-- Database synchronization settings -->
     <synchronization>
       <enabled>yes</enabled>
       <interval>5m</interval>
+      <max_interval>1h</max_interval>
       <max_eps>10</max_eps>
     </synchronization>
   </syscheck>
@@ -238,6 +264,13 @@
     <rule_dir>etc/rules</rule_dir>
   </ruleset>
 
+  <rule_test>
+    <enabled>yes</enabled>
+    <threads>1</threads>
+    <max_sessions>64</max_sessions>
+    <session_timeout>15m</session_timeout>
+  </rule_test>
+
   <!-- Configuration for wazuh-authd -->
   <auth>
     <disabled>no</disabled>
@@ -270,19 +303,9 @@
 </ossec_config>
 
 <ossec_config>
-  <localfile>
-    <log_format>journald</log_format>
-    <location>journald</location>
-  </localfile>
-
-  <localfile>
-    <log_format>audit</log_format>
-    <location>/var/log/audit/audit.log</location>
-  </localfile>
-
   <localfile>
     <log_format>syslog</log_format>
     <location>/var/ossec/logs/active-responses.log</location>
   </localfile>
 
-</ossec_config>
+</ossec_config>

wazuh-docker/config/wazuh_dashboard/opensearch_dashboards.yml

@@ -2,7 +2,7 @@ server.host: 0.0.0.0
 server.port: 5601
 opensearch.hosts: https://wazuh.indexer:9200
 opensearch.ssl.verificationMode: certificate
-opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
+opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
 opensearch_security.multitenancy.enabled: false
 opensearch_security.readonly_mode.roles: ["kibana_read_only"]
 server.ssl.enabled: true

wazuh-docker/config/wazuh_indexer/internal_users.yml

@@ -11,7 +11,7 @@ _meta:
 ## Demo users
 
 admin:
-  hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO"
+  hash: "$2y$12$xa.54OUnJ5V0F/MqXb0QleEgJ5lJSkrKwhpSbFkIRDljfOcPM41dq"
   reserved: true
   backend_roles:
   - "admin"

wazuh-docker/config/wazuh_indexer/wazuh.indexer.yml

@@ -6,6 +6,7 @@ path.logs: /var/log/wazuh-indexer
 discovery.type: single-node
 http.port: 9200-9299
 transport.tcp.port: 9300-9399
+compatibility.override_main_response_version: true
 plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
 plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
 plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem