Integrations maintenance request [Month 12]

[mcasas993]

Description

The Wazuh Indexer team is responsible for the maintenance of the third-party integrations hosted in the wazuh/wazuh-indexer repository. We must ensure these integrations work under new releases of the third-party software (Splunk, Elastic, Logstash, …) and our own.

For that, we need to:

• Create a pull request that upgrades the components to the latest version.
• Update our testing environments to verify the integrations work under new versions.
• Test the integrations, checking that:
• The Docker Compose project starts without errors.
• The data arrives to the destination.
• All the dashboards can be imported successfully.
• All the dashboards are populated with data.
• Finally, upgrade the compatibility matrix in integrations/README.md with the new versions.

Note

• For Logstash, we use the logstash-oss image.
• For Wazuh Indexer and Wazuh Dashboard, we use the opensearch and opensearch-dashboards images. These must match the opensearch version that we support (e.g: for Wazuh 4.9.0 it is OpenSearch 2.13.0).

Issues

• List here the detected issues

[mcasas993]

Wazuh Indexer Splunk integration

Built Docker compose

docker compose -f compose.indexer-splunk.yml up -d                   
[+] Running 12/12
 ✔ splunk Pulled                                                                                                                                                                                      47.2s 
   ✔ a09bb1026942 Pull complete                                                                                                                                                                        2.9s 
   ✔ 59de139ab4a7 Pull complete                                                                                                                                                                        2.9s 
   ✔ 240852bc4e7c Pull complete                                                                                                                                                                       11.5s 
   ✔ 570e3b526dc7 Pull complete                                                                                                                                                                       11.5s 
   ✔ 4bd60e134244 Pull complete                                                                                                                                                                       11.6s 
   ✔ d0501d93737f Pull complete                                                                                                                                                                       39.7s 
   ✔ 4f4fb700ef54 Pull complete                                                                                                                                                                       39.7s 
   ✔ e1b7b6f16b3d Pull complete                                                                                                                                                                       43.9s 
   ✔ dcabfc195708 Pull complete                                                                                                                                                                       43.9s 
   ✔ 74f154f0ed61 Pull complete                                                                                                                                                                       43.9s 
   ✔ de8d9d75b1c5 Pull complete                                                                                                                                                                       44.0s 
[+] Running 8/8
 ✔ Container splunk-integration-generate-certs-config-1  Exited                                                                                                                                        1.3s 
 ✔ Container splunk-integration-wazuh-certs-generator-1  Exited                                                                                                                                        4.0s 
 ✔ Container splunk-integration-wazuh.indexer-1          Healthy                                                                                                                                      46.5s 
 ✔ Container splunk-integration-generator-1              Exited                                                                                                                                        4.0s 
 ✔ Container splunk-integration-wazuh.dashboard-1        Started                                                                                                                                       3.7s 
 ✔ Container splunk-integration-events-generator-1       Started                                                                                                                                      46.7s 
 ✔ Container splunk-integration-splunk-1                 Healthy                                                                                                                                      55.7s 
 ✔ Container splunk-integration-logstash-1               Started                       

-Splunk version

• Wazuh-malware-detection-v1.0

• Wazuh-incident-response-v1.0

• Wazuh-docker-listener-v1.0

• Wazuh-security-events-v1.0

• Wazuh-pci-dss-v1.0

• Wazuh-amazon-aws-v1.0

• Wazuh-vulnerabilities-v1.0

[mcasas993]

Wazuh indexer OpenSearch integration

• Wazuh-amazon-aws-v1.0

• Wazuh-docker-listener-v1.0

• Wazuh-incident-response-v1.0

• Wazuh-malware-detection-v1.0

• Wazuh-pci-dss-v1.0

-Wazuh-security-events-v1.0

-Wazuh-vulnerabilities-v1.0

[mcasas993]

Wazuh Indexer Elastic Stack integration

• Elastic version
  

• Wazuh-amazon-aws-v1.0
  

• Wazuh-security-events-v1.0
  

• Wazuh-vulnerabilities-v1.0
  

• Wazuh-pci-dss-v1.0
  

• Wazuh-incident-response-v1.0
  

• Wazuh-docker-listener-v1.0
  

• Wazuh-malware-detection-v1.0
  

[mcasas993]

Because the dashboard did not work in the Splunk integration I tried again several times.

I stopped all the docker images that were generated, deleted them and recreated them.

I did not manage to see data in any of the Splunk dashboards again.

The only error I found within the docker containers was within the splunk-integration-logstash-1 container:
[2024-12-20T16:28:00,367][ERROR][logstash.outputs.http ][main][a926e49c792ce0b380eac5676e5aeda3b074fa7c29d7182b845bf0c89b29cc2c] Encountered non-2xx HTTP code 400 {:response_code=>400, :url=>“https://splunk:8088/services/collector/raw”, :event=>#<LogStash::Event:0x3002948c>}

Same error repeatedly with different Events

[AlexRuiz7]

Wazuh to Splunk Integration

• The Docker Compose project starts and runs.
• The dashboards could be imported successfully.
• Every dashboard plots data.

Details