| Port details on branch 2023Q4 |
- wazuh-manager Security tool to monitor and check logs and intrusions (manager)
- 4.5.4 security
 =0      4.5.4Version of this port present on the latest quarterly branch. - Maintainer: acm@FreeBSD.org
- Port Added: 2023-10-23 19:18:05
- Last Update: 2023-10-24 01:50:39
- Commit Hash: 89b330c
- License: GPLv2
- WWW:
- https://wazuh.com/
- Description:
- Wazuh is a free and open source platform used for threat prevention, detection,
and response. It is capable of protecting workloads across on-premises,
virtualized, containerized, and cloud-based environments.
Wazuh solution consists of an endpoint security agent, deployed to the
monitored systems, and a management server, which collects and analyzes data
gathered by the agents. Besides, Wazuh has been fully integrated with the
Elastic Stack, providing a search engine and data visualization tool that
allows users to navigate through their security alerts.
  ¦  ¦  ¦  ¦ 
- Manual pages:
- FreshPorts has no man page information for this port.
- pkg-plist: as obtained via:
make generate-plist - Dependency lines:
-
- wazuh-manager>0:security/wazuh-manager
- Conflicts:
- CONFLICTS:
- To install the port:
- cd /usr/ports/security/wazuh-manager/ && make install clean
- To add the package, run one of these commands:
- pkg install security/wazuh-manager
- pkg install wazuh-manager
NOTE: If this package has multiple flavors (see below), then use one of them instead of the name specified above.- PKGNAME: wazuh-manager
- Flavors: there is no flavor information for this port.
- ONLY_FOR_ARCHS: amd64 aarch64
- distinfo:
- TIMESTAMP = 1697737169
SHA256 (wazuh-4.5.4/cJSON.tar.gz) = 678d796318da57d5f38075e74bbb3b77375dc3f8bb49da341ad1b43c417e8cc1
SIZE (wazuh-4.5.4/cJSON.tar.gz) = 27863
No package information for this port in our database- Sometimes this happens. Not all ports have packages. Perhaps there is a build error. Check the fallout link:
- Dependencies
- NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.
- Build dependencies:
-
- cmake : devel/cmake-core
- autoconf>=2.71 : devel/autoconf
- gmake>=4.3 : devel/gmake
- python3.9 : lang/python39
- perl5>=5.34<5.35 : lang/perl5.34
- Test dependencies:
-
- python3.9 : lang/python39
- Runtime dependencies:
-
- python3.9 : lang/python39
- perl5>=5.34<5.35 : lang/perl5.34
- Library dependencies:
-
- libgdbm.so : databases/gdbm
- libnghttp2.so : www/libnghttp2
- libreadline.so.8 : devel/readline
- libsqlite3.so : databases/sqlite3
- This port is required by:
- for Run
-
- security/wazuh-server
Configuration Options:- ===> The following configuration options are available for wazuh-manager-4.5.4:
INOTIFY=off: Kevent based real time monitoring
PRELUDE=off: Sensor support from Prelude SIEM
ZEROMQ=off: ZeroMQ support
====> Options available for the group DATABASE
MYSQL=off: MySQL database support
PGSQL=off: PostgreSQL database support
===> Use 'make config' to modify these settings
- Options name:
- security_wazuh-manager
- USES:
- cpe gmake perl5 python:3.9 readline shebangfix sqlite:3 uidfix
- pkg-message:
- For install:
- Wazuh Manager was installed
1) Copy /etc/locatime to /var/ossec/etc directory
# cp /etc/localtime /var/ossec/etc
2) You must edit /var/ossec/etc/ossec.conf.sample for your setup and rename/copy
it to ossec.conf.
Take a look wazuh manager configuration at the following url:
https://documentation.wazuh.com/current/user-manual/manager/index.html
3) You can find additional useful files installed at
# /var/ossec/packages_files/manager_installation_scripts
4) Do not forget generate auth certificate
# openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 \
-subj "/C=US/ST=California/CN=Wazuh/" \
-keyout /var/ossec/etc/sslmanager.key -out /var/ossec/etc/sslmanager.cert
# chmod 640 /var/ossec/etc/sslmanager.key
# chmod 640 /var/ossec/etc/sslmanager.cert
5) FreeBSD SCA files can be downloaded from the following
# fetch https://people.freebsd.org/~acm/ports/wazuh/wazuh-freebsd-sca.tar.gz
Extract and put them to /var/ossec/etc/ruleset/sca. Do not forget change permissions
# chown root:wazuh /var/ossec/ruleset/sca/cis_freebsd*.yml
# chmod 640 /var/ossec/ruleset/sca/cis_freebsd*.yml
6) Aditional decoders and rules files can be download from:
# fetch https://people.freebsd.org/~acm/ports/wazuh/0600-freebsd_decoders.xml
# fetch https://people.freebsd.org/~acm/ports/wazuh/1000-freebsd_rules.xml
# cp 0600-freebsd_decoders.xml /var/ossec/ruleset/decoders
# cp 1000-freebsd_rules.xml /var/ossec/ruleset/rules
Do not forget change permissions
# chown root:wazuh /var/ossec/ruleset/decoders/0600-freebsd_decoders.xml
# chmod 640 /var/ossec/ruleset/decoders/0600-freebsd_decoders.xml
# chown root:wazuh /var/ossec/ruleset/rules/1000-freebsd_rules.xml
# chmod 640 /var/ossec/ruleset/rules/1000-freebsd_rules.xml
These decoders and rules are used for extract /var/log/userlog entries from
FreeBSD agents. It is necessary add a localfile entry to /var/ossec/etc/ossec.conf
<localfile>
<log_format>syslog</log_format>
<location>/var/log/userlog</location>
</localfile>
7) Add Wazuh manager to /etc/rc.conf
# sysrc wazuh_manager_enable="YES"
or
# service wazuh-manager enable
8) Start Wazuh manager
# service wazuh-manager start
9) Enjoy it ;)
- Master Sites:
|
As an Amazon Associate I earn from qualifying purchases.
