wazuh / wazuh-indexer

Wazuh indexer, the Wazuh search engine
https://opensearch.org/docs/latest/opensearch/index/
Apache License 2.0
11 stars 19 forks source link

Review Indexer repository for legacy modules #303

Closed AlexRuiz7 closed 2 months ago

AlexRuiz7 commented 4 months ago

Description

As part of the Legacy Removal epic, we need to ensure there are no references for legacy stuff.

Tasks

In this repository:

f-galland commented 4 months ago

We are still relying on the old ossec path only in our integrations' compose files and pipeline files:

$ grep -Ril ossec | grep -Ev '.jar$|.jmod$|.zip$|^.gradle|.tar.gz$'
integrations/splunk/logstash/pipeline/manager-to-splunk.conf
integrations/elastic/logstash/pipeline/manager-to-elastic.conf
integrations/docker/compose.manager-elastic.yml
integrations/docker/compose.manager-splunk.yml
integrations/docker/compose.manager-opensearch.yml
integrations/opensearch/logstash/pipeline/manager-to-opensearch.conf
integrations/tools/events-generator/wazuh-alerts/alerts.json
integrations/tools/events-generator/run.py

However, we cannot remove these until the manager itself stops using these directories.

f-galland commented 4 months ago

No references to the legacy modules whatsoever:

fede@tyner:~/src/wazuh-indexer (303-remove-legacy-references)
$ grep -REl 'wazuh-agentd|wazuh-agentlessd|wazuh-analysisd|wazuh-apid|wazuh-authd|wazuh-clusterd|wazuh-csyslogd|wazuh-db|wazuh-dbd|wazuh-execd|wazuh-integratord|wazuh-logcollector|wazuh-maild|wazuh-modulesd|wazuh-remoted|wazuh-reportd|wazuh-syscheckd'
fede@tyner:~/src/wazuh-indexer (303-remove-legacy-references)
AlexRuiz7 commented 2 months ago

Blocked until we know the new path for the alerts.json file in 5.0.0.

The references to ossec come from the path of this file in our development environments for the third-party integrations.

/var/ossec/logs/alerts/alerts.json
AlexRuiz7 commented 2 months ago

Integrations with the Manager will no longer exist for 5.0.0.

We can safely remove these environments.