jeudi 27 janvier 2022

KIBANA - WAZUH pattern index

I hope you all doing well. I get an project to install wazuh as FIM on linux, AIX and windows. I managed to install Manager and all agents on all systems and I can see all three connected on the Kibana web as agents.

I created test file on the linux agent and I can find it also on web interface, so servers are connected. Here is test file found in wazuh inventory tab

But, I am not recieving any logs if I modify this test file.

This is my settings in ossec.conf under syscheck on agent server>

<directories>/var/ossec/etc/test</directories>
<directories report_changes="yes" check_all="yes" realtime="yes">/var/ossec/etc/test</directories>

And now I ma also strugling to understand meanings of index patterns, index templates and fields. I dont understand what they are and why we need to set it.

My settings on manager server - /usr/share/kibana/data/wazuh/config/wazuh.yml

alerts.sample.prefix: 'wazuh-alerts-*'
pattern: 'wazuh-alerts-*'

On the kibana web I also have this error when I am trying to check ,,events,, -the are no logs in the events.

Error: The field "timestamp" associated with this object no longer exists in the index pattern. Please use another field.
    at FieldParamType.config.write.write (http://MYIP:5601/42959/bundles/plugin/data/kibana/data.plugin.js:1:627309)
    at http://MYIP:5601/42959/bundles/plugin/data/kibana/data.plugin.js:1:455052
    at Array.forEach (<anonymous>)
    at writeParams (http://MYIP:5601/42959/bundles/plugin/data/kibana/data.plugin.js:1:455018)
    at AggConfig.write (http://MYIP:5601/42959/bundles/plugin/data/kibana/data.plugin.js:1:355081)
    at AggConfig.toDsl (http://MYIP:5601/42959/bundles/plugin/data/kibana/data.plugin.js:1:355960)
    at http://MYIP:5601/42959/bundles/plugin/data/kibana/data.plugin.js:1:190748
    at Array.forEach (<anonymous>)
    at agg_configs_AggConfigs.toDsl (http://MYIP:5601/42959/bundles/plugin/data/kibana/data.plugin.js:1:189329)
    at http://MYIP:5601/42959/bundles/plugin/wazuh/4.2.5-4206-1/wazuh.chunk.6.js:55:1397640

I will be greatfull for your help couse my boss is pushing on me and I never worked with wazuh application before :) Thank you very much

Aucun commentaire:

Enregistrer un commentaire