Ansible : Playbook Wazuh

The aim of this project is to deploy the Wazuh Server and agent on a Vagrant instance based on Linux.

Getting Started

These instructions will get you a copy of the project up and running on your local machine for development and testing purposes.

Prerequisites

What things you need to run this Ansible playbook :

• Vagrant must be installed on your computer
• Update the Vagrant file based on your computer (CPU, memory), if needed
• You must have download the ubuntu Xenial64 vagrant box :

$ vagrant box add https://app.vagrantup.com/ubuntu/boxes/xenial64

• The Elasticsearch database needed by the Wazuh Server is not provisioned by this playbook, it has to be done before running it
• The Kibana web console needed by the Wazuh Server is not provisioned by this playbook, it has to be done before running it
• In distrbuted mode, all the remote servers have to be up and running and the Ansible host file updated

Usage

A good point with Vagrant is that you can create, update and destroy all architecture easily with some commands.

Be aware that you need to be in the Vagrant directory to be able to run the commands.

Build Environment

Vagrant needs to init the project to run and build it :

$ vagrant up

After build, you can check which virtual machine Vagrant has created :

$ vagrant status

If all run like it is expected, you should see something like this :

$ vagrant status

Current machine states:

wazuh-server01                   running (virtualbox)
wazuh-agent01                    running (virtualbox)

Deployment

This playbook has some dependencies to other roles that must be downloaded before executing the playbook :

$ ansible-galaxy install -r requirements.yml

This command should download the Java, NodeJS roles from Wikitops Github account to the local role path.

To deploy Solr on Vagrant, you just have to run the Ansible playbook wazuh.yml with this command :

$ ansible-playbook wazuh.yml

If eveything run as expected, you should have Wazuh installed and running on your Vagrant instances. The Elastic stack should be configured. In Kibana, a new section named Wazuh should appear.

Destroy

To destroy on what Vagrant has created, just run this command :

$ vagrant destroy

Author

Member of Wikitops : https://www.wikitops.io/

Licence

This project is licensed under the Apache License, Version 2.0. For the full text of the license, see the LICENSE file.