Managing Multiple Wazuh Clusters with Cross-Cluster Search#

1
flowchart TB
2
    subgraph "Traditional Centralized SIEM"
3
        C1[Customer A Data] --> S1[Central SIEM]
4
        C2[Customer B Data] --> S1
5
        C3[Customer C Data] --> S1
6
        S1 --> D1[Single Dashboard]
7
    end
8

9
    subgraph "Challenges"
10
        CH1[Data Residency Issues]
11
        CH2[Bandwidth Costs]
12
        CH3[Single Point of Failure]
13
        CH4[Compliance Concerns]
14
        CH5[Performance Bottlenecks]
15
    end
16

17
    S1 --> CH1
18
    S1 --> CH2
19
    S1 --> CH3
20
    S1 --> CH4
21
    S1 --> CH5
22

23
    style CH1 fill:#ff6b6b
24
    style CH2 fill:#ff6b6b
25
    style CH3 fill:#ff6b6b
26
    style CH4 fill:#ff6b6b
27
    style CH5 fill:#ff6b6b

1
flowchart TB
2
    subgraph "CCS Architecture"
3
        subgraph "Customer A Environment"
4
            A1[Wazuh Agents] --> A2[Wazuh Server A]
5
            A2 --> A3[Wazuh Indexer A]
6
            A3 --> |Data Stays Local| A4[(Local Storage)]
7
        end
8

9
        subgraph "Customer B Environment"
10
            B1[Wazuh Agents] --> B2[Wazuh Server B]
11
            B2 --> B3[Wazuh Indexer B]
12
            B3 --> |Data Stays Local| B4[(Local Storage)]
13
        end
14

15
        subgraph "SOC Environment"
16
            CCS1[CCS Indexer] --> CCS2[CCS Dashboard]
17
            CCS1 -.->|Query Only| A3
18
            CCS1 -.->|Query Only| B3
19
        end
20
    end
21

22
    style A4 fill:#51cf66
23
    style B4 fill:#51cf66
24
    style CCS2 fill:#4dabf7

1
flowchart LR
2
    subgraph "Network Topology"
3
        subgraph "SOC Network (192.168.186.0/24)"
4
            CCS[CCS Environment<br/>192.168.186.60]
5
        end
6

7
        subgraph "Customer A Network (192.168.10.0/24)"
8
            CA_S[Wazuh Server<br/>192.168.10.100]
9
            CA_I[Wazuh Indexer<br/>192.168.10.101]
10
            CA_S --> CA_I
11
        end
12

13
        subgraph "Customer B Network (192.168.20.0/24)"
14
            CB_S[Wazuh Server<br/>192.168.20.100]
15
            CB_I[Wazuh Indexer<br/>192.168.20.101]
16
            CB_S --> CB_I
17
        end
18

19
        CCS -.->|Port 9300<br/>TLS| CA_I
20
        CCS -.->|Port 9300<br/>TLS| CB_I
21
    end

1
PUT _cluster/settings
2
{
3
  "persistent": {
4
    "cluster.remote": {
5
      "ca-wazuh-indexer-1": {
6
        "seeds": ["192.168.10.101:9300"]
7
      },
8
      "cb-wazuh-indexer-1": {
9
        "seeds": ["192.168.20.101:9300"]
10
      }
11
    }
12
  }
13
}

1
GET ca-wazuh-indexer-1:wazuh-alerts-*/_search
2
{
3
  "query": {
4
    "match_all": {}
5
  },
6
  "size": 1
7
}

1
# Automated certificate rotation script
2
#!/bin/bash
3
CERT_DIR="/etc/wazuh-indexer/certs"
4
DAYS_BEFORE_EXPIRY=30
5

6
# Check certificate expiration
7
for cert in $CERT_DIR/*.pem; do
8
  if openssl x509 -checkend $((DAYS_BEFORE_EXPIRY * 24 * 3600)) \
9
     -noout -in "$cert"; then
10
    echo "$cert is expiring soon"
11
    # Trigger certificate renewal process
12
  fi
13
done

1
# Role-based access per cluster
2
roles:
3
  cluster_a_analyst:
4
    cluster_permissions:
5
      - "cluster:monitor/remote/info"
6
    index_permissions:
7
      - index_patterns:
8
          - "ca-wazuh-indexer-1:wazuh-alerts-*"
9
        allowed_actions:
10
          - "read"
11
          - "search"
12

13
  cluster_b_analyst:
14
    cluster_permissions:
15
      - "cluster:monitor/remote/info"
16
    index_permissions:
17
      - index_patterns:
18
          - "cb-wazuh-indexer-1:wazuh-alerts-*"
19
        allowed_actions:
20
          - "read"
21
          - "search"

1
{
2
  "visualization": {
3
    "title": "Cross-Cluster Alert Distribution",
4
    "visState": {
5
      "type": "pie",
6
      "params": {
7
        "addTooltip": true,
8
        "addLegend": true,
9
        "legendPosition": "right"
10
      },
11
      "aggs": [
12
        {
13
          "id": "1",
14
          "type": "count",
15
          "schema": "metric"
16
        },
17
        {
18
          "id": "2",
19
          "type": "terms",
20
          "schema": "segment",
21
          "params": {
22
            "field": "_index",
23
            "size": 10,
24
            "order": "desc",
25
            "orderBy": "1"
26
          }
27
        }
28
      ]
29
    }
30
  }
31
}

1
flowchart TB
2
    subgraph "MSSP SOC"
3
        SOC1[Tier 1 Analyst] --> DASH[CCS Dashboard]
4
        SOC2[Tier 2 Analyst] --> DASH
5
        SOC3[Incident Response] --> DASH
6
    end
7

8
    subgraph "Customer Environments"
9
        DASH -.->|Monitor| C1[Banking Customer]
10
        DASH -.->|Monitor| C2[Healthcare Customer]
11
        DASH -.->|Monitor| C3[Retail Customer]
12
    end
13

14
    subgraph "Benefits"
15
        B1[Unified Monitoring]
16
        B2[Data Isolation]
17
        B3[Scalable Growth]
18
        B4[Compliance Ready]
19
    end
20

21
    style B1 fill:#51cf66
22
    style B2 fill:#51cf66
23
    style B3 fill:#51cf66
24
    style B4 fill:#51cf66

1
# Global CCS configuration
2
cluster.remote:
3
  us-east-cluster:
4
    seeds: ["10.0.1.100:9300"]
5
    skip_unavailable: true
6

7
  eu-west-cluster:
8
    seeds: ["10.1.1.100:9300"]
9
    skip_unavailable: true
10

11
  apac-cluster:
12
    seeds: ["10.2.1.100:9300"]
13
    skip_unavailable: true

1
# Automated cluster onboarding script
2
#!/bin/bash
3
CLUSTER_NAME=$1
4
CLUSTER_IP=$2
5

6
# Add to CCS configuration
7
curl -X PUT "https://192.168.186.60:9200/_cluster/settings" \
8
  -H "Content-Type: application/json" \
9
  -d '{
10
    "persistent": {
11
      "cluster.remote.'$CLUSTER_NAME'": {
12
        "seeds": ["'$CLUSTER_IP':9300"]
13
      }
14
    }
15
  }'
16

17
# Create index pattern
18
curl -X POST "https://192.168.186.60:5601/api/saved_objects/index-pattern" \
19
  -H "Content-Type: application/json" \
20
  -H "kbn-xsrf: true" \
21
  -d '{
22
    "attributes": {
23
      "title": "'$CLUSTER_NAME':wazuh-alerts-*",
24
      "timeFieldName": "timestamp"
25
    }
26
  }'

1
GET _nodes/stats/transport
2
{
3
  "nodes": {
4
    "...": {
5
      "transport": {
6
        "remote": {
7
          "ca-wazuh-indexer-1": {
8
            "success_count": 15234,
9
            "failure_count": 2,
10
            "avg_response_time": "45ms"
11
          }
12
        }
13
      }
14
    }
15
  }
16
}

1
# Enable CCS audit logging
2
PUT _cluster/settings
3
{
4
  "persistent": {
5
    "plugins.security.audit.type": "internal_opensearch",
6
    "plugins.security.audit.config.disabled_rest_categories": [],
7
    "plugins.security.audit.config.disabled_transport_categories": []
8
  }
9
}