Wazuh Ansible Deployment#

1
all:
2
  children:
3
    wazuh_cluster:
4
      children:
5
        wazuh_managers:
6
          hosts:
7
            wazuh-master:
8
              ansible_host: 10.0.1.10
9
              wazuh_node_type: master
10
              wazuh_cluster_key: "my_secure_cluster_key"
11
            wazuh-worker-01:
12
              ansible_host: 10.0.1.11
13
              wazuh_node_type: worker
14
            wazuh-worker-02:
15
              ansible_host: 10.0.1.12
16
              wazuh_node_type: worker
17

18
        wazuh_indexers:
19
          hosts:
20
            indexer-01:
21
              ansible_host: 10.0.2.10
22
              indexer_node_name: node-1
23
              indexer_cluster_initial_master_nodes:
24
                - node-1
25
                - node-2
26
                - node-3
27
            indexer-02:
28
              ansible_host: 10.0.2.11
29
              indexer_node_name: node-2
30
            indexer-03:
31
              ansible_host: 10.0.2.12
32
              indexer_node_name: node-3
33

34
        wazuh_dashboard:
35
          hosts:
36
            dashboard-01:
37
              ansible_host: 10.0.3.10
38

39
    wazuh_agents:
40
      children:
41
        linux_agents:
42
          hosts:
43
            web-server-01:
44
              ansible_host: 10.0.4.10
45
              wazuh_agent_name: web-server-01
46
              wazuh_agent_groups:
47
                - webservers
48
                - linux
49
            db-server-01:
50
              ansible_host: 10.0.4.20
51
              wazuh_agent_name: db-server-01
52
              wazuh_agent_groups:
53
                - databases
54
                - linux
55

56
        windows_agents:
57
          hosts:
58
            win-server-01:
59
              ansible_host: 10.0.5.10
60
              ansible_connection: winrm
61
              ansible_winrm_transport: ntlm
62
              ansible_winrm_server_cert_validation: ignore
63
              wazuh_agent_name: win-server-01
64
              wazuh_agent_groups:
65
                - windows
66
                - domain_controllers

1
---
2
- name: Add Wazuh repository GPG key
3
  rpm_key:
4
    key: https://packages.wazuh.com/key/GPG-KEY-WAZUH
5
    state: present
6
  when: ansible_os_family == "RedHat"
7

8
- name: Add Wazuh repository
9
  yum_repository:
10
    name: wazuh
11
    description: Wazuh repository
12
    baseurl: https://packages.wazuh.com/4.x/yum/
13
    gpgcheck: yes
14
    gpgkey: https://packages.wazuh.com/key/GPG-KEY-WAZUH
15
    enabled: yes
16
  when: ansible_os_family == "RedHat"
17

18
- name: Install Wazuh manager package
19
  package:
20
    name: wazuh-manager
21
    state: present
22
  notify: restart wazuh-manager
23

24
- name: Enable and start Wazuh manager service
25
  systemd:
26
    name: wazuh-manager
27
    enabled: yes
28
    state: started
29
    daemon_reload: yes

1
<ossec_config>
2
  <global>
3
    <jsonout_output>yes</jsonout_output>
4
    <alerts_log>yes</alerts_log>
5
    <logall>no</logall>
6
    <logall_json>no</logall_json>
7
    <email_notification>{{ wazuh_email_notification | default('no') }}</email_notification>
8
    <smtp_server>{{ wazuh_smtp_server | default('localhost') }}</smtp_server>
9
    <email_from>{{ wazuh_email_from | default('wazuh@company.com') }}</email_from>
10
    <email_to>{{ wazuh_email_to | default('security@company.com') }}</email_to>
11
    <email_maxperhour>{{ wazuh_email_maxperhour | default(12) }}</email_maxperhour>
12
    <email_log_source>alerts.log</email_log_source>
13
    <agents_disconnection_time>{{ wazuh_agents_disconnection_time | default('10m') }}</agents_disconnection_time>
14
    <agents_disconnection_alert_time>{{ wazuh_agents_disconnection_alert_time | default('0') }}</agents_disconnection_alert_time>
15
  </global>
16

17
  <alerts>
18
    <log_alert_level>{{ wazuh_log_alert_level | default(3) }}</log_alert_level>
19
    <email_alert_level>{{ wazuh_email_alert_level | default(12) }}</email_alert_level>
20
  </alerts>
21

22
  <!-- Cluster configuration -->
23
  {% if wazuh_cluster_enabled | default(false) %}
24
  <cluster>
25
    <name>{{ wazuh_cluster_name }}</name>
26
    <node_name>{{ inventory_hostname }}</node_name>
27
    <node_type>{{ wazuh_node_type }}</node_type>
28
    <key>{{ wazuh_cluster_key }}</key>
29
    <port>{{ wazuh_cluster_port | default(1516) }}</port>
30
    <bind_addr>{{ wazuh_cluster_bind_addr | default('0.0.0.0') }}</bind_addr>
31
    <nodes>
32
      <node>{{ wazuh_master_node }}</node>
33
    </nodes>
34
    <hidden>{{ wazuh_cluster_hidden | default('no') }}</hidden>
35
    <disabled>no</disabled>
36
  </cluster>
37
  {% endif %}
38

39
  <!-- Remote connections -->
40
  <remote>
41
    <connection>secure</connection>
42
    <port>{{ wazuh_authd_port | default(1514) }}</port>
43
    <protocol>tcp</protocol>
44
    <queue_size>{{ wazuh_queue_size | default(131072) }}</queue_size>
45
  </remote>
46

47
  <!-- Policy monitoring -->
48
  <rootcheck>
49
    <disabled>no</disabled>
50
    <check_files>yes</check_files>
51
    <check_trojans>yes</check_trojans>
52
    <check_dev>yes</check_dev>
53
    <check_sys>yes</check_sys>
54
    <check_pids>yes</check_pids>
55
    <check_ports>yes</check_ports>
56
    <check_if>yes</check_if>
57
    <frequency>{{ wazuh_rootcheck_frequency | default(43200) }}</frequency>
58
    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
59
    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
60
  </rootcheck>
61

62
  <!-- File integrity monitoring -->
63
  <syscheck>
64
    <disabled>no</disabled>
65
    <frequency>{{ wazuh_syscheck_frequency | default(43200) }}</frequency>
66
    <scan_on_start>yes</scan_on_start>
67
    <alert_new_files>yes</alert_new_files>
68
    <auto_ignore>no</auto_ignore>
69

70
    <!-- Directories to check -->
71
    {% for directory in wazuh_syscheck_directories %}
72
    <directories>{{ directory }}</directories>
73
    {% endfor %}
74

75
    <!-- Files/directories to ignore -->
76
    {% for ignore in wazuh_syscheck_ignore %}
77
    <ignore>{{ ignore }}</ignore>
78
    {% endfor %}
79

80
    <!-- File types to ignore -->
81
    <ignore type="sregex">.log$|.swp$</ignore>
82

83
    <!-- Check files configuration -->
84
    <whodata>
85
      <restart_audit>yes</restart_audit>
86
      <audit_key>{{ wazuh_audit_key | default('wazuh_fim') }}</audit_key>
87
      <startup_healthcheck>yes</startup_healthcheck>
88
    </whodata>
89
  </syscheck>
90

91
  <!-- Log analysis -->
92
  <localfile>
93
    <log_format>syslog</log_format>
94
    <location>/var/log/messages</location>
95
  </localfile>
96

97
  <localfile>
98
    <log_format>syslog</log_format>
99
    <location>/var/log/secure</location>
100
  </localfile>
101

102
  {% for custom_log in wazuh_custom_logs | default([]) %}
103
  <localfile>
104
    <log_format>{{ custom_log.format }}</log_format>
105
    <location>{{ custom_log.location }}</location>
106
    {% if custom_log.label is defined %}
107
    <label key="{{ custom_log.label }}">{{ custom_log.value }}</label>
108
    {% endif %}
109
  </localfile>
110
  {% endfor %}
111

112
  <!-- Active response -->
113
  <active-response>
114
    <disabled>no</disabled>
115
    <ca_store>etc/wpk_root.pem</ca_store>
116
    <ca_verification>yes</ca_verification>
117
  </active-response>
118

119
  <!-- Vulnerability detector -->
120
  <vulnerability-detector>
121
    <enabled>yes</enabled>
122
    <interval>12h</interval>
123
    <ignore_time>6h</ignore_time>
124
    <run_on_start>yes</run_on_start>
125

126
    <!-- Operating systems to scan -->
127
    {% for os in wazuh_vuln_detector_os | default(['ubuntu', 'redhat', 'centos']) %}
128
    <provider name="{{ os }}">
129
      <enabled>yes</enabled>
130
      <update_interval>1h</update_interval>
131
    </provider>
132
    {% endfor %}
133
  </vulnerability-detector>
134

135
  <!-- Integration with external systems -->
136
  {% if wazuh_integrations is defined %}
137
  {% for integration in wazuh_integrations %}
138
  <integration>
139
    <name>{{ integration.name }}</name>
140
    <hook_url>{{ integration.hook_url }}</hook_url>
141
    <level>{{ integration.level | default(10) }}</level>
142
    <alert_format>{{ integration.format | default('json') }}</alert_format>
143
    {% if integration.options is defined %}
144
    <options>{{ integration.options | to_json }}</options>
145
    {% endif %}
146
  </integration>
147
  {% endfor %}
148
  {% endif %}
149
</ossec_config>

1
---
2
- name: Configure Wazuh cluster
3
  template:
4
    src: cluster.conf.j2
5
    dest: /var/ossec/etc/cluster.conf
6
    owner: root
7
    group: wazuh
8
    mode: "0640"
9
  notify: restart wazuh-manager
10
  when: wazuh_cluster_enabled | default(false)
11

12
- name: Generate cluster key if master node
13
  shell: |
14
    openssl rand -hex 16 > /var/ossec/etc/cluster.key
15
  args:
16
    creates: /var/ossec/etc/cluster.key
17
  when:
18
    - wazuh_node_type == "master"
19
    - wazuh_cluster_key is not defined
20

21
- name: Read cluster key from master
22
  slurp:
23
    src: /var/ossec/etc/cluster.key
24
  register: cluster_key_content
25
  when: wazuh_node_type == "master"
26

27
- name: Set cluster key fact
28
  set_fact:
29
    wazuh_cluster_key: "{{ cluster_key_content.content | b64decode | trim }}"
30
  when: wazuh_node_type == "master"
31

32
- name: Distribute cluster key to workers
33
  copy:
34
    content: "{{ hostvars[wazuh_master_node]['wazuh_cluster_key'] }}"
35
    dest: /var/ossec/etc/cluster.key
36
    owner: root
37
    group: wazuh
38
    mode: "0640"
39
  when: wazuh_node_type == "worker"
40
  notify: restart wazuh-manager

1
cluster.name: {{ wazuh_cluster_name | default('wazuh-cluster') }}
2
node.name: {{ indexer_node_name }}
3
network.host: {{ ansible_default_ipv4.address }}
4
http.port: {{ indexer_http_port | default(9200) }}
5
transport.port: {{ indexer_transport_port | default(9300) }}
6

7
# Discovery
8
discovery.seed_hosts:
9
{% for host in groups['wazuh_indexers'] %}
10
  - {{ hostvars[host]['ansible_default_ipv4']['address'] }}:{{ indexer_transport_port | default(9300) }}
11
{% endfor %}
12

13
cluster.initial_master_nodes:
14
{% for node in indexer_cluster_initial_master_nodes %}
15
  - {{ node }}
16
{% endfor %}
17

18
# Security settings
19
plugins.security.ssl.transport.pemcert_filepath: {{ indexer_cert_path }}/{{ indexer_node_name }}.pem
20
plugins.security.ssl.transport.pemkey_filepath: {{ indexer_cert_path }}/{{ indexer_node_name }}-key.pem
21
plugins.security.ssl.transport.pemtrustedcas_filepath: {{ indexer_cert_path }}/root-ca.pem
22
plugins.security.ssl.transport.enforce_hostname_verification: true
23

24
plugins.security.ssl.http.enabled: true
25
plugins.security.ssl.http.pemcert_filepath: {{ indexer_cert_path }}/{{ indexer_node_name }}.pem
26
plugins.security.ssl.http.pemkey_filepath: {{ indexer_cert_path }}/{{ indexer_node_name }}-key.pem
27
plugins.security.ssl.http.pemtrustedcas_filepath: {{ indexer_cert_path }}/root-ca.pem
28

29
plugins.security.allow_unsafe_democertificates: false
30
plugins.security.allow_default_init_securityindex: true
31
plugins.security.authcz.admin_dn:
32
  - CN=admin,O=Wazuh,L=California,C=US
33

34
plugins.security.audit.type: internal_opensearch
35
plugins.security.enable_snapshot_restore_privilege: true
36
plugins.security.check_snapshot_restore_write_privileges: true
37
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
38

39
# Performance settings
40
indices.memory.index_buffer_size: {{ indexer_memory_buffer_size | default('10%') }}
41
thread_pool.search.size: {{ indexer_search_threads | default(ansible_processor_vcpus * 2) }}
42
thread_pool.search.queue_size: {{ indexer_search_queue_size | default(1000) }}
43
thread_pool.write.size: {{ indexer_write_threads | default(ansible_processor_vcpus) }}
44
thread_pool.write.queue_size: {{ indexer_write_queue_size | default(200) }}
45

46
# Path settings
47
path.data: {{ indexer_data_path | default('/var/lib/wazuh-indexer') }}
48
path.logs: {{ indexer_log_path | default('/var/log/wazuh-indexer') }}

1
---
2
- name: Include OS-specific variables
3
  include_vars: "{{ ansible_os_family }}.yml"
4

5
- name: Deploy Wazuh agent on Linux
6
  include_tasks: install-linux.yml
7
  when: ansible_system == "Linux"
8

9
- name: Deploy Wazuh agent on Windows
10
  include_tasks: install-windows.yml
11
  when: ansible_system == "Win32NT"
12

13
- name: Deploy Wazuh agent on macOS
14
  include_tasks: install-macos.yml
15
  when: ansible_system == "Darwin"
16

17
- name: Configure Wazuh agent
18
  include_tasks: configure.yml
19

20
- name: Register agent with manager
21
  include_tasks: register.yml

1
---
2
- name: Add Wazuh repository (Debian/Ubuntu)
3
  apt:
4
    deb: https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_{{ wazuh_agent_version }}_amd64.deb
5
  when: ansible_os_family == "Debian"
6

7
- name: Add Wazuh repository (RedHat/CentOS)
8
  yum:
9
    name: https://packages.wazuh.com/4.x/yum/wazuh-agent-{{ wazuh_agent_version }}.x86_64.rpm
10
    state: present
11
  when: ansible_os_family == "RedHat"
12

13
- name: Create Wazuh agent configuration
14
  template:
15
    src: ossec-agent.conf.j2
16
    dest: /var/ossec/etc/ossec.conf
17
    owner: root
18
    group: ossec
19
    mode: "0640"
20
  notify: restart wazuh-agent
21

22
- name: Import Wazuh manager SSL certificate
23
  copy:
24
    src: "{{ wazuh_ssl_cert_file }}"
25
    dest: /var/ossec/etc/sslmanager.cert
26
    owner: root
27
    group: ossec
28
    mode: "0640"

1
---
2
- name: Download Wazuh agent installer
3
  win_get_url:
4
    url: "https://packages.wazuh.com/4.x/windows/wazuh-agent-{{ wazuh_agent_version }}-1.msi"
5
    dest: "C:\\temp\\wazuh-agent.msi"
6

7
- name: Install Wazuh agent
8
  win_package:
9
    path: "C:\\temp\\wazuh-agent.msi"
10
    arguments: /q WAZUH_MANAGER="{{ wazuh_manager_ip }}" WAZUH_REGISTRATION_SERVER="{{ wazuh_manager_ip }}" WAZUH_AGENT_NAME="{{ wazuh_agent_name }}" WAZUH_AGENT_GROUP="{{ wazuh_agent_groups | join(',') }}"
11
    state: present
12

13
- name: Configure Windows agent
14
  win_template:
15
    src: ossec-agent-windows.conf.j2
16
    dest: "C:\\Program Files (x86)\\ossec-agent\\ossec.conf"
17
  notify: restart wazuh-agent-windows
18

19
- name: Start Wazuh agent service
20
  win_service:
21
    name: WazuhSvc
22
    state: started
23
    start_mode: auto

1
---
2
- name: Check if agent is already registered
3
  stat:
4
    path: /var/ossec/etc/client.keys
5
  register: client_keys_file
6

7
- name: Register agent with manager
8
  shell: |
9
    /var/ossec/bin/agent-auth -m {{ wazuh_manager_ip }} \
10
      -A {{ wazuh_agent_name }} \
11
      -G {{ wazuh_agent_groups | join(',') }} \
12
      {% if wazuh_agent_password is defined %}-P {{ wazuh_agent_password }}{% endif %}
13
  when: not client_keys_file.stat.exists
14
  notify: restart wazuh-agent
15

16
- name: Wait for agent to connect
17
  wait_for:
18
    path: /var/ossec/logs/ossec.log
19
    search_regex: "Connected to the server"
20
    timeout: 60
21
  when: not client_keys_file.stat.exists

1
<group name="web,attack">
2
  <!-- SQL Injection attempts -->
3
  <rule id="100001" level="10">
4
    <if_sid>31100</if_sid>
5
    <match>(?i)(union.*select|select.*from|insert.*into|delete.*from|drop.*table|update.*set)</match>
6
    <description>SQL injection attempt detected</description>
7
    <group>web,sql_injection,attack</group>
8
  </rule>
9

10
  <!-- XSS attempts -->
11
  <rule id="100002" level="8">
12
    <if_sid>31100</if_sid>
13
    <regex><script|javascript:|onerror=|onload=</regex>
14
    <description>Possible XSS attack detected</description>
15
    <group>web,xss,attack</group>
16
  </rule>
17

18
  <!-- Directory traversal -->
19
  <rule id="100003" level="7">
20
    <if_sid>31100</if_sid>
21
    <match>../</match>
22
    <description>Directory traversal attempt</description>
23
    <group>web,directory_traversal,attack</group>
24
  </rule>
25

26
  <!-- Rate limiting rule -->
27
  <rule id="100004" level="10" frequency="50" timeframe="60">
28
    <if_matched_sid>31100</if_matched_sid>
29
    <same_source_ip />
30
    <description>Multiple web requests from same IP (possible DoS)</description>
31
    <group>web,dos,attack</group>
32
  </rule>
33
</group>

1
<decoder name="custom-app">
2
  <program_name>^custom-app</program_name>
3
</decoder>
4

5
<decoder name="custom-app-json">
6
  <parent>custom-app</parent>
7
  <type>json</type>
8
  <regex>^(\S+) (\S+) ({.*})$</regex>
9
  <order>timestamp,level,json_message</order>
10
</decoder>
11

12
<decoder name="custom-app-fields">
13
  <parent>custom-app-json</parent>
14
  <regex>"user":"(\S+)".*"action":"(\S+)".*"status":"(\S+)"</regex>
15
  <order>user,action,status</order>
16
</decoder>

1
---
2
- name: Wazuh cluster health check
3
  hosts: wazuh_managers
4
  gather_facts: no
5

6
  tasks:
7
    - name: Check Wazuh manager service status
8
      systemd:
9
        name: wazuh-manager
10
      register: manager_service
11

12
    - name: Check cluster synchronization
13
      command: /var/ossec/bin/cluster_control -i
14
      register: cluster_info
15
      changed_when: false
16

17
    - name: Count connected agents
18
      shell: |
19
        /var/ossec/bin/agent_control -l | grep -c "Active"
20
      register: active_agents
21
      changed_when: false
22

23
    - name: Check disk usage
24
      shell: |
25
        df -h /var/ossec | tail -1 | awk '{print $5}' | sed 's/%//'
26
      register: disk_usage
27
      changed_when: false
28

29
    - name: Generate health report
30
      set_fact:
31
        health_report:
32
          hostname: "{{ inventory_hostname }}"
33
          service_status: "{{ manager_service.status.ActiveState }}"
34
          cluster_status: "{{ cluster_info.stdout | from_json }}"
35
          active_agents: "{{ active_agents.stdout }}"
36
          disk_usage: "{{ disk_usage.stdout }}%"
37

38
    - name: Alert if issues found
39
      mail:
40
        to: "{{ wazuh_admin_email }}"
41
        subject: "Wazuh Health Alert - {{ inventory_hostname }}"
42
        body: |
43
          Health check found issues:
44

45
          Service Status: {{ health_report.service_status }}
46
          Active Agents: {{ health_report.active_agents }}
47
          Disk Usage: {{ health_report.disk_usage }}
48
      when:
49
        - health_report.service_status != "active" or
50
          health_report.disk_usage | int > 80
51

52
- name: Check indexer cluster health
53
  hosts: wazuh_indexers
54
  gather_facts: no
55

56
  tasks:
57
    - name: Check cluster health
58
      uri:
59
        url: "https://{{ ansible_default_ipv4.address }}:9200/_cluster/health"
60
        user: admin
61
        password: "{{ indexer_admin_password }}"
62
        validate_certs: no
63
      register: cluster_health
64

65
    - name: Check indices health
66
      uri:
67
        url: "https://{{ ansible_default_ipv4.address }}:9200/_cat/indices/wazuh-*?format=json"
68
        user: admin
69
        password: "{{ indexer_admin_password }}"
70
        validate_certs: no
71
      register: indices_health
72

73
    - name: Alert on cluster issues
74
      mail:
75
        to: "{{ wazuh_admin_email }}"
76
        subject: "Wazuh Indexer Alert - Cluster Status {{ cluster_health.json.status }}"
77
        body: |
78
          Indexer cluster status: {{ cluster_health.json.status }}
79
          Number of nodes: {{ cluster_health.json.number_of_nodes }}
80
          Active shards: {{ cluster_health.json.active_shards }}
81
          Unassigned shards: {{ cluster_health.json.unassigned_shards }}
82
      when: cluster_health.json.status == "red"

1
---
2
- name: Backup Wazuh configuration and data
3
  hosts: wazuh_managers
4

5
  vars:
6
    backup_dir: "/backup/wazuh/{{ ansible_date_time.date }}"
7

8
  tasks:
9
    - name: Create backup directory
10
      file:
11
        path: "{{ backup_dir }}"
12
        state: directory
13
        mode: "0700"
14

15
    - name: Stop Wazuh manager for consistent backup
16
      systemd:
17
        name: wazuh-manager
18
        state: stopped
19
      when: wazuh_online_backup is not defined or not wazuh_online_backup
20

21
    - name: Backup Wazuh configuration
22
      archive:
23
        path:
24
          - /var/ossec/etc
25
          - /var/ossec/rules
26
          - /var/ossec/decoders
27
        dest: "{{ backup_dir }}/wazuh-config-{{ inventory_hostname }}.tar.gz"
28
        format: gz
29

30
    - name: Backup Wazuh database
31
      shell: |
32
        tar czf {{ backup_dir }}/wazuh-db-{{ inventory_hostname }}.tar.gz /var/ossec/queue/db/
33
      args:
34
        creates: "{{ backup_dir }}/wazuh-db-{{ inventory_hostname }}.tar.gz"
35

36
    - name: Backup agent keys
37
      copy:
38
        src: /var/ossec/etc/client.keys
39
        dest: "{{ backup_dir }}/client.keys-{{ inventory_hostname }}"
40
        remote_src: yes
41

42
    - name: Start Wazuh manager
43
      systemd:
44
        name: wazuh-manager
45
        state: started
46
      when: wazuh_online_backup is not defined or not wazuh_online_backup
47

48
    - name: Create backup manifest
49
      copy:
50
        content: |
51
          Backup Date: {{ ansible_date_time.date }}
52
          Backup Time: {{ ansible_date_time.time }}
53
          Hostname: {{ inventory_hostname }}
54
          Wazuh Version: {{ wazuh_version }}
55
          Total Agents: {{ groups['wazuh_agents'] | length }}
56

57
          Files:
58
          - wazuh-config-{{ inventory_hostname }}.tar.gz
59
          - wazuh-db-{{ inventory_hostname }}.tar.gz
60
          - client.keys-{{ inventory_hostname }}
61
        dest: "{{ backup_dir }}/manifest.txt"
62

63
    - name: Sync backup to remote storage
64
      synchronize:
65
        src: "{{ backup_dir }}"
66
        dest: "{{ backup_remote_path }}"
67
        mode: push
68
      when: backup_remote_path is defined
69

70
- name: Backup indexer data
71
  hosts: wazuh_indexers
72

73
  tasks:
74
    - name: Create indexer snapshot repository
75
      uri:
76
        url: "https://{{ ansible_default_ipv4.address }}:9200/_snapshot/backup"
77
        method: PUT
78
        user: admin
79
        password: "{{ indexer_admin_password }}"
80
        body_format: json
81
        body:
82
          type: fs
83
          settings:
84
            location: "/backup/indexer/{{ ansible_date_time.date }}"
85
        validate_certs: no
86

87
    - name: Create snapshot
88
      uri:
89
        url: "https://{{ ansible_default_ipv4.address }}:9200/_snapshot/backup/{{ ansible_date_time.epoch }}"
90
        method: PUT
91
        user: admin
92
        password: "{{ indexer_admin_password }}"
93
        body_format: json
94
        body:
95
          indices: "wazuh-*"
96
          include_global_state: false
97
        validate_certs: no

1
---
2
- name: Configure Slack integration for Wazuh alerts
3
  hosts: wazuh_managers
4

5
  vars:
6
    slack_webhook_url: "{{ vault_slack_webhook_url }}"
7

8
  tasks:
9
    - name: Install jq for JSON processing
10
      package:
11
        name: jq
12
        state: present
13

14
    - name: Create Slack integration script
15
      template:
16
        src: wazuh-slack-integration.sh.j2
17
        dest: /var/ossec/integrations/slack
18
        mode: "0750"
19
        owner: root
20
        group: wazuh
21

22
    - name: Configure Slack integration in ossec.conf
23
      blockinfile:
24
        path: /var/ossec/etc/ossec.conf
25
        marker: "<!-- {mark} ANSIBLE MANAGED SLACK INTEGRATION -->"
26
        insertbefore: "</ossec_config>"
27
        block: |
28
          <integration>
29
            <name>slack</name>
30
            <hook_url>{{ slack_webhook_url }}</hook_url>
31
            <level>10</level>
32
            <alert_format>json</alert_format>
33
            <options>{"channel": "#security-alerts"}</options>
34
          </integration>
35
      notify: restart wazuh-manager

1
---
2
- name: Configure Splunk forwarder for Wazuh
3
  hosts: wazuh_managers
4

5
  tasks:
6
    - name: Install Splunk Universal Forwarder
7
      unarchive:
8
        src: "{{ splunk_forwarder_url }}"
9
        dest: /opt
10
        remote_src: yes
11
        owner: splunk
12
        group: splunk
13

14
    - name: Configure Splunk forwarder inputs
15
      template:
16
        src: splunk-inputs.conf.j2
17
        dest: /opt/splunkforwarder/etc/system/local/inputs.conf
18

19
    - name: Configure Splunk forwarder outputs
20
      template:
21
        src: splunk-outputs.conf.j2
22
        dest: /opt/splunkforwarder/etc/system/local/outputs.conf
23

24
    - name: Start Splunk forwarder
25
      command: |
26
        /opt/splunkforwarder/bin/splunk start --accept-license
27
        /opt/splunkforwarder/bin/splunk enable boot-start

1
---
2
dependency:
3
  name: galaxy
4
driver:
5
  name: docker
6
platforms:
7
  - name: wazuh-manager
8
    image: centos:7
9
    pre_build_image: true
10
    privileged: true
11
    command: /sbin/init
12
    groups:
13
      - wazuh_managers
14

15
  - name: wazuh-indexer
16
    image: centos:7
17
    pre_build_image: true
18
    privileged: true
19
    command: /sbin/init
20
    groups:
21
      - wazuh_indexers
22

23
  - name: wazuh-agent-centos
24
    image: centos:7
25
    pre_build_image: true
26
    privileged: true
27
    command: /sbin/init
28
    groups:
29
      - wazuh_agents
30
      - linux_agents
31

32
  - name: wazuh-agent-ubuntu
33
    image: ubuntu:20.04
34
    pre_build_image: true
35
    privileged: true
36
    command: /sbin/init
37
    groups:
38
      - wazuh_agents
39
      - linux_agents
40

41
provisioner:
42
  name: ansible
43
  inventory:
44
    group_vars:
45
      all:
46
        wazuh_manager_ip: wazuh-manager
47
        wazuh_cluster_name: test-cluster
48

49
verifier:
50
  name: ansible

1
---
2
- name: Verify Wazuh deployment
3
  hosts: all
4
  gather_facts: no
5

6
  tasks:
7
    - name: Check if Wazuh service is running
8
      systemd:
9
        name: "{{ 'wazuh-manager' if inventory_hostname in groups['wazuh_managers'] else 'wazuh-agent' }}"
10
      register: wazuh_service
11
      failed_when: wazuh_service.status.ActiveState != "active"
12
      when: inventory_hostname != 'wazuh-indexer'
13

14
    - name: Verify manager API is accessible
15
      uri:
16
        url: "https://{{ ansible_default_ipv4.address }}:55000/security/user/authenticate"
17
        method: GET
18
        user: wazuh
19
        password: "{{ wazuh_api_password }}"
20
        validate_certs: no
21
      when: inventory_hostname in groups['wazuh_managers']
22

23
    - name: Verify agent connection
24
      delegate_to: wazuh-manager
25
      shell: |
26
        /var/ossec/bin/agent_control -l | grep "{{ inventory_hostname }}"
27
      when: inventory_hostname in groups['wazuh_agents']