A cookbook to install & configure wazuh manager & agent. No ELK stack configuration though.
First of all, see attributes for possible configuration options. Also, see Wazuh Reference docs
Simply include recipe[wazuh::server]
into your run_list after you set the desired attributes.
It will install:
- wazuh-manger and its components
- Wazuh API nodejs app
- Filebeat for shipping logs and events to ELK stack.
You will need to create SSL certificated by yourself if you want to enable TLS
Let's say you already have a set of certificates for your setup. You should create the data bag called wazuh::tls
. Name keys as a corresponding TLS certificate file names.
E.g. if you've set some attribute to /var/ossec/etc/manager.crt
name the key inside wazuh::tls
data bag manager.crt
(basename() is used to get the content of a file, so use different file names for different certificates)
HTTP basic auth for Wazuh API app requires htpasswd
file. It is generated using wazuh::htpasswd
data bag. Set key users
to a Hash like { "user": "passwd"}, { "user": "passwd"}, ...