search

wazuh / wazuh-docker

Wazuh - Docker containers
https://wazuh.com
Other
611 stars 338 forks source link

Enable additional Wazuh modules via Dashboard environment variables #1346

Closed BAStos525 closed 10 hours ago

BAStos525 commented 1 month ago

In this README section it's written that Wazuh modules could be enabled/disabled via environment variables. By the way, when setting such vars EXTENSIONS_AWS, EXTENSIONS_DOCKER... to =true in docker-compose file, they are still not enabled in Dashboard. Only the default ones modules like EXTENSIONS_AUDIT, EXTENSIONS_NIST are on.

CarlosALgit commented 1 week ago

Update Report

I deployed an environment with Docker trying to replicate the issues encountered. I'm currently checking the path of the issues to try to solve them.

CarlosALgit commented 1 week ago

Update Report

I've had issues trying to replicate the problem to see the modules displayed on the new 4.8.0 Dashboard. I'm currently in the process of understanding how the Docker deployment works.

CarlosALgit commented 1 week ago

Update Report

I've been learning how to check that an integration is working correctly on a Wazuh AIO installed with the assistant.

Then I deployed the Docker environment activating - EXTENSIONS_VIRUSTOTAL=true on the docker-compose.yml file for the dashboard. Then, I checked the environment variables on the Dashboard container and it was setted to true:

bash-5.2$ printenv | grep EXTENSIONS_VIRUSTOTAL
EXTENSIONS_VIRUSTOTAL=true

Then I went to the manager container to check the ossec.conf file but the integration for VirusTotal does not appear.

I tried to follow the code flow but I have found it impossible to understand when the change is being made to ossec.conf in order to add the integration module.

teddytpc1 commented 2 days ago

@Enaraque, the modules are now enabled by default from version 4.9.0. So, we should remove all these variables.