OpenSearch and Wazuh Integration - Building a Comprehensive Security Analytics Platform#

1
# Pipeline stages with processing details
2
pipeline:
3
  - stage: collection
4
    components:
5
      - wazuh_agent:
6
          functions:
7
            - log_collection
8
            - file_integrity_monitoring
9
            - system_calls_monitoring
10
            - command_monitoring
11
          output: raw_events
12

13
  - stage: normalization
14
    components:
15
      - wazuh_manager:
16
          functions:
17
            - decode_events
18
            - extract_fields
19
            - normalize_timestamps
20
            - enrich_metadata
21
          output: normalized_events
22

23
  - stage: analysis
24
    components:
25
      - analysis_engine:
26
          functions:
27
            - rule_matching
28
            - correlation
29
            - threat_intelligence
30
            - anomaly_detection
31
          output: alerts
32

33
  - stage: indexing
34
    components:
35
      - opensearch:
36
          functions:
37
            - document_parsing
38
            - field_mapping
39
            - indexing
40
            - replication
41
          output: searchable_data
42

43
  - stage: visualization
44
    components:
45
      - dashboards:
46
          functions:
47
            - query_execution
48
            - aggregation
49
            - visualization
50
            - reporting
51
          output: insights

1
#!/bin/bash
2
# Generate complete certificate chain for Wazuh-OpenSearch deployment
3

4
set -e
5

6
# Configuration
7
CERT_DIR="/etc/wazuh-certificates"
8
DAYS_VALID=3650
9
KEY_SIZE=4096
10
COUNTRY="US"
11
STATE="California"
12
CITY="San Francisco"
13
ORG="Security Organization"
14
OU="Security Operations"
15

16
# Create certificate directory
17
mkdir -p ${CERT_DIR}/{ca,server,client}
18

19
# Generate Root CA
20
echo "Generating Root CA..."
21
openssl genrsa -out ${CERT_DIR}/ca/root-ca-key.pem ${KEY_SIZE}
22
openssl req -new -x509 -sha256 -days ${DAYS_VALID} \
23
    -key ${CERT_DIR}/ca/root-ca-key.pem \
24
    -out ${CERT_DIR}/ca/root-ca.pem \
25
    -subj "/C=${COUNTRY}/ST=${STATE}/L=${CITY}/O=${ORG}/OU=${OU}/CN=Wazuh Root CA"
26

27
# Generate Intermediate CA
28
echo "Generating Intermediate CA..."
29
openssl genrsa -out ${CERT_DIR}/ca/intermediate-ca-key.pem ${KEY_SIZE}
30
openssl req -new -sha256 \
31
    -key ${CERT_DIR}/ca/intermediate-ca-key.pem \
32
    -out ${CERT_DIR}/ca/intermediate-ca.csr \
33
    -subj "/C=${COUNTRY}/ST=${STATE}/L=${CITY}/O=${ORG}/OU=${OU}/CN=Wazuh Intermediate CA"
34

35
# Sign Intermediate CA
36
openssl x509 -req -days ${DAYS_VALID} -sha256 \
37
    -in ${CERT_DIR}/ca/intermediate-ca.csr \
38
    -CA ${CERT_DIR}/ca/root-ca.pem \
39
    -CAkey ${CERT_DIR}/ca/root-ca-key.pem \
40
    -CAcreateserial \
41
    -out ${CERT_DIR}/ca/intermediate-ca.pem \
42
    -extensions v3_intermediate_ca \
43
    -extfile <(cat <<EOF
44
[v3_intermediate_ca]
45
subjectKeyIdentifier = hash
46
authorityKeyIdentifier = keyid:always,issuer
47
basicConstraints = critical, CA:true, pathlen:0
48
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
49
EOF
50
)
51

52
# Create certificate chain
53
cat ${CERT_DIR}/ca/intermediate-ca.pem ${CERT_DIR}/ca/root-ca.pem > ${CERT_DIR}/ca/ca-chain.pem
54

55
# Function to generate server certificates
56
generate_server_cert() {
57
    local name=$1
58
    local cn=$2
59
    local san=$3
60

61
    echo "Generating certificate for ${name}..."
62

63
    # Generate private key
64
    openssl genrsa -out ${CERT_DIR}/server/${name}-key.pem ${KEY_SIZE}
65

66
    # Generate CSR
67
    openssl req -new -sha256 \
68
        -key ${CERT_DIR}/server/${name}-key.pem \
69
        -out ${CERT_DIR}/server/${name}.csr \
70
        -subj "/C=${COUNTRY}/ST=${STATE}/L=${CITY}/O=${ORG}/OU=${OU}/CN=${cn}"
71

72
    # Sign certificate
73
    openssl x509 -req -days ${DAYS_VALID} -sha256 \
74
        -in ${CERT_DIR}/server/${name}.csr \
75
        -CA ${CERT_DIR}/ca/intermediate-ca.pem \
76
        -CAkey ${CERT_DIR}/ca/intermediate-ca-key.pem \
77
        -CAcreateserial \
78
        -out ${CERT_DIR}/server/${name}.pem \
79
        -extensions v3_server \
80
        -extfile <(cat <<EOF
81
[v3_server]
82
subjectKeyIdentifier = hash
83
authorityKeyIdentifier = keyid,issuer
84
basicConstraints = CA:FALSE
85
keyUsage = critical, digitalSignature, keyEncipherment
86
extendedKeyUsage = serverAuth, clientAuth
87
subjectAltName = ${san}
88
EOF
89
)
90

91
    # Create full chain
92
    cat ${CERT_DIR}/server/${name}.pem ${CERT_DIR}/ca/ca-chain.pem > ${CERT_DIR}/server/${name}-chain.pem
93
}
94

95
# Generate OpenSearch node certificates
96
for i in {1..6}; do
97
    generate_server_cert "opensearch-node${i}" \
98
        "opensearch-node${i}.domain.com" \
99
        "DNS:opensearch-node${i}.domain.com,DNS:opensearch-node${i},IP:10.0.1.${i}"
100
done
101

102
# Generate OpenSearch admin certificate
103
generate_server_cert "opensearch-admin" \
104
    "opensearch-admin.domain.com" \
105
    "DNS:opensearch-admin.domain.com,DNS:localhost,IP:127.0.0.1"
106

107
# Generate Wazuh certificates
108
generate_server_cert "wazuh-manager" \
109
    "wazuh-manager.domain.com" \
110
    "DNS:wazuh-manager.domain.com,DNS:wazuh,IP:10.0.2.1"
111

112
generate_server_cert "wazuh-dashboard" \
113
    "wazuh-dashboard.domain.com" \
114
    "DNS:wazuh-dashboard.domain.com,DNS:dashboard,IP:10.0.2.2"
115

116
# Set appropriate permissions
117
chmod 400 ${CERT_DIR}/ca/*-key.pem
118
chmod 400 ${CERT_DIR}/server/*-key.pem
119
chmod 444 ${CERT_DIR}/ca/*.pem
120
chmod 444 ${CERT_DIR}/server/*.pem
121

122
echo "Certificate generation complete!"

1
# opensearch.yml - Master node configuration
2
cluster.name: wazuh-security-cluster
3
node.name: opensearch-master-1
4
node.roles: [master]
5

6
network.host: 10.0.4.1
7
discovery.seed_hosts:
8
  - 10.0.4.1
9
  - 10.0.4.2
10
  - 10.0.4.3
11
cluster.initial_master_nodes:
12
  - opensearch-master-1
13
  - opensearch-master-2
14
  - opensearch-master-3
15

16
# Security settings
17
plugins.security.ssl.transport.pemcert_filepath: certificates/opensearch-node1.pem
18
plugins.security.ssl.transport.pemkey_filepath: certificates/opensearch-node1-key.pem
19
plugins.security.ssl.transport.pemtrustedcas_filepath: certificates/ca-chain.pem
20
plugins.security.ssl.transport.enforce_hostname_verification: true
21
plugins.security.ssl.transport.resolve_hostname: true
22

23
plugins.security.ssl.http.enabled: true
24
plugins.security.ssl.http.pemcert_filepath: certificates/opensearch-node1.pem
25
plugins.security.ssl.http.pemkey_filepath: certificates/opensearch-node1-key.pem
26
plugins.security.ssl.http.pemtrustedcas_filepath: certificates/ca-chain.pem
27

28
plugins.security.allow_unsafe_democertificates: false
29
plugins.security.allow_default_init_securityindex: false
30
plugins.security.authcz.admin_dn:
31
  - "CN=opensearch-admin.domain.com,OU=Security Operations,O=Security Organization,L=San Francisco,ST=California,C=US"
32

33
plugins.security.audit.type: internal_opensearch
34
plugins.security.enable_snapshot_restore_privilege: true
35
plugins.security.check_snapshot_restore_write_privileges: true
36
plugins.security.restapi.roles_enabled:
37
  ["all_access", "security_rest_api_access"]
38

39
# Performance tuning
40
indices.memory.index_buffer_size: 20%
41
indices.queries.cache.size: 15%
42
indices.fielddata.cache.size: 30%
43
thread_pool.search.size: 50
44
thread_pool.search.queue_size: 1000
45
thread_pool.write.size: 30
46
thread_pool.write.queue_size: 500
47

48
# Cluster routing
49
cluster.routing.allocation.disk.threshold_enabled: true
50
cluster.routing.allocation.disk.watermark.low: 85%
51
cluster.routing.allocation.disk.watermark.high: 90%
52
cluster.routing.allocation.disk.watermark.flood_stage: 95%

1
<!-- ossec.conf - Wazuh Manager configuration -->
2
<ossec_config>
3
  <global>
4
    <jsonout_output>yes</jsonout_output>
5
    <alerts_log>yes</alerts_log>
6
    <logall>no</logall>
7
    <logall_json>no</logall_json>
8
    <email_notification>no</email_notification>
9
    <smtp_server>smtp.domain.com</smtp_server>
10
    <email_from>wazuh@domain.com</email_from>
11
    <email_to>security@domain.com</email_to>
12
    <email_maxperhour>12</email_maxperhour>
13
    <queue_size>131072</queue_size>
14
  </global>
15

16
  <cluster>
17
    <name>wazuh-cluster</name>
18
    <node_name>wazuh-master</node_name>
19
    <node_type>master</node_type>
20
    <key>5f4dcc3b5aa765d61d8327deb882cf99</key>
21
    <port>1516</port>
22
    <bind_addr>0.0.0.0</bind_addr>
23
    <nodes>
24
      <node>10.0.2.1</node>
25
      <node>10.0.2.2</node>
26
      <node>10.0.2.3</node>
27
    </nodes>
28
    <hidden>no</hidden>
29
    <disabled>no</disabled>
30
  </cluster>
31

32
  <remote>
33
    <connection>secure</connection>
34
    <port>1514</port>
35
    <protocol>tcp</protocol>
36
    <queue_size>131072</queue_size>
37
  </remote>
38

39
  <alerts>
40
    <log_alert_level>3</log_alert_level>
41
    <email_alert_level>7</email_alert_level>
42
  </alerts>
43

44
  <command>
45
    <name>firewall-drop</name>
46
    <executable>firewall-drop</executable>
47
    <timeout_allowed>yes</timeout_allowed>
48
  </command>
49

50
  <active-response>
51
    <command>firewall-drop</command>
52
    <location>local</location>
53
    <level>7</level>
54
    <timeout>600</timeout>
55
  </active-response>
56

57
  <!-- OpenSearch output configuration -->
58
  <integration>
59
    <name>opensearch</name>
60
    <enabled>yes</enabled>
61
    <url>https://10.0.4.8:9200</url>
62
    <username>wazuh_indexer</username>
63
    <password>SecurePassword123!</password>
64
    <indices>
65
      <alerts>wazuh-alerts-*</alerts>
66
      <archives>wazuh-archives-*</archives>
67
    </indices>
68
    <ssl>
69
      <certificate>/etc/wazuh/certificates/wazuh-manager.pem</certificate>
70
      <key>/etc/wazuh/certificates/wazuh-manager-key.pem</key>
71
      <ca>/etc/wazuh/certificates/ca-chain.pem</ca>
72
    </ssl>
73
  </integration>
74
</ossec_config>

1
// Index lifecycle policy
2
{
3
  "policy": {
4
    "phases": {
5
      "hot": {
6
        "min_age": "0ms",
7
        "actions": {
8
          "rollover": {
9
            "max_primary_shard_size": "50GB",
10
            "max_age": "7d"
11
          },
12
          "set_priority": {
13
            "priority": 100
14
          }
15
        }
16
      },
17
      "warm": {
18
        "min_age": "7d",
19
        "actions": {
20
          "shrink": {
21
            "number_of_shards": 1
22
          },
23
          "forcemerge": {
24
            "max_num_segments": 1
25
          },
26
          "set_priority": {
27
            "priority": 50
28
          },
29
          "allocate": {
30
            "node_type": "warm"
31
          }
32
        }
33
      },
34
      "cold": {
35
        "min_age": "30d",
36
        "actions": {
37
          "set_priority": {
38
            "priority": 0
39
          },
40
          "freeze": {},
41
          "allocate": {
42
            "node_type": "cold"
43
          },
44
          "searchable_snapshot": {
45
            "snapshot_repository": "s3_repository"
46
          }
47
        }
48
      },
49
      "delete": {
50
        "min_age": "90d",
51
        "actions": {
52
          "delete": {}
53
        }
54
      }
55
    }
56
  }
57
}

1
// Optimized index template for Wazuh alerts
2
{
3
  "index_patterns": ["wazuh-alerts-*"],
4
  "priority": 100,
5
  "template": {
6
    "settings": {
7
      "number_of_shards": 3,
8
      "number_of_replicas": 1,
9
      "index.refresh_interval": "10s",
10
      "index.translog.durability": "async",
11
      "index.translog.sync_interval": "10s",
12
      "index.codec": "best_compression",
13
      "index.merge.scheduler.max_thread_count": 2,
14
      "index.merge.policy.max_merged_segment": "5gb"
15
    },
16
    "mappings": {
17
      "properties": {
18
        "@timestamp": {
19
          "type": "date",
20
          "format": "date_time_no_millis"
21
        },
22
        "agent": {
23
          "properties": {
24
            "id": {
25
              "type": "keyword"
26
            },
27
            "name": {
28
              "type": "keyword"
29
            },
30
            "ip": {
31
              "type": "ip"
32
            }
33
          }
34
        },
35
        "rule": {
36
          "properties": {
37
            "id": {
38
              "type": "keyword"
39
            },
40
            "level": {
41
              "type": "short"
42
            },
43
            "description": {
44
              "type": "text",
45
              "fields": {
46
                "keyword": {
47
                  "type": "keyword",
48
                  "ignore_above": 256
49
                }
50
              }
51
            }
52
          }
53
        },
54
        "data": {
55
          "type": "object",
56
          "enabled": true
57
        }
58
      }
59
    }
60
  }
61
}

1
# Prometheus alert rules
2
groups:
3
  - name: wazuh_alerts
4
    interval: 30s
5
    rules:
6
      - alert: WazuhManagerDown
7
        expr: up{job="wazuh-manager"} == 0
8
        for: 5m
9
        labels:
10
          severity: critical
11
        annotations:
12
          summary: "Wazuh Manager is down"
13
          description: "Wazuh Manager {{ $labels.instance }} has been down for more than 5 minutes."
14

15
      - alert: HighAlertRate
16
        expr: rate(wazuh_alerts_total[5m]) > 100
17
        for: 10m
18
        labels:
19
          severity: warning
20
        annotations:
21
          summary: "High alert rate detected"
22
          description: "Alert rate is {{ $value }} alerts/sec"
23

24
  - name: opensearch_alerts
25
    interval: 30s
26
    rules:
27
      - alert: OpenSearchClusterRed
28
        expr: opensearch_cluster_health_status{color="red"} == 1
29
        for: 5m
30
        labels:
31
          severity: critical
32
        annotations:
33
          summary: "OpenSearch cluster is RED"
34
          description: "OpenSearch cluster health is RED for more than 5 minutes"
35

36
      - alert: HighJVMMemoryUsage
37
        expr: opensearch_jvm_memory_used_bytes / opensearch_jvm_memory_max_bytes > 0.9
38
        for: 10m
39
        labels:
40
          severity: warning
41
        annotations:
42
          summary: "High JVM memory usage"
43
          description: "JVM memory usage is {{ $value | humanizePercentage }}"

1
#!/bin/bash
2
# Automated backup script for Wazuh-OpenSearch stack
3

4
set -e
5

6
# Configuration
7
BACKUP_DIR="/backup"
8
S3_BUCKET="s3://wazuh-backups"
9
RETENTION_DAYS=30
10
DATE=$(date +%Y%m%d-%H%M%S)
11

12
# Create backup directories
13
mkdir -p ${BACKUP_DIR}/{wazuh,opensearch,config}/${DATE}
14

15
# Backup Wazuh configuration
16
echo "Backing up Wazuh configuration..."
17
tar czf ${BACKUP_DIR}/wazuh/${DATE}/wazuh-config.tar.gz \
18
    /var/ossec/etc \
19
    /var/ossec/rules \
20
    /var/ossec/decoders \
21
    /var/ossec/lists
22

23
# Backup Wazuh agent keys
24
echo "Backing up agent keys..."
25
cp /var/ossec/etc/client.keys ${BACKUP_DIR}/wazuh/${DATE}/
26

27
# Backup OpenSearch configuration
28
echo "Backing up OpenSearch configuration..."
29
tar czf ${BACKUP_DIR}/opensearch/${DATE}/opensearch-config.tar.gz \
30
    /etc/opensearch \
31
    /usr/share/opensearch/config
32

33
# Create OpenSearch snapshot
34
echo "Creating OpenSearch snapshot..."
35
curl -X PUT "https://localhost:9200/_snapshot/backup_repo/${DATE}?wait_for_completion=true" \
36
    -H 'Content-Type: application/json' \
37
    -u admin:admin \
38
    --cacert /etc/opensearch/ca.pem \
39
    -d '{
40
      "indices": "wazuh-*",
41
      "include_global_state": true,
42
      "metadata": {
43
        "taken_by": "automated_backup",
44
        "taken_because": "scheduled_backup"
45
      }
46
    }'
47

48
# Sync to S3
49
echo "Syncing to S3..."
50
aws s3 sync ${BACKUP_DIR}/ ${S3_BUCKET}/ --exclude "*.tmp"
51

52
# Clean up old local backups
53
echo "Cleaning up old backups..."
54
find ${BACKUP_DIR} -type d -mtime +${RETENTION_DAYS} -exec rm -rf {} \;
55

56
# Verify backup
57
echo "Verifying backup..."
58
if aws s3 ls ${S3_BUCKET}/${DATE}/ > /dev/null 2>&1; then
59
    echo "Backup completed successfully"
60
else
61
    echo "Backup verification failed"
62
    exit 1
63
fi
64

65
# Send notification
66
curl -X POST https://slack.webhook.url \
67
    -H 'Content-Type: application/json' \
68
    -d "{\"text\":\"Wazuh-OpenSearch backup completed successfully for ${DATE}\"}"