wazuh / wazuh-kubernetes

Wazuh - Wazuh Kubernetes
https://wazuh.com/
GNU General Public License v2.0
261 stars 162 forks source link

kubernetes wazuh server supporting "Auditing-kubernetes with wazuh" #328

Open victorrodriguez1984 opened 1 year ago

victorrodriguez1984 commented 1 year ago

I am starting test https://wazuh.com/blog/auditing-kubernetes-with-wazuh/ but my implementation is in kubernetes and it is not able to enable systemctl wazuh.webhook and other required. it is supported on this platform? does anybody tested it?

DOC https://wazuh.com/blog/auditing-kubernetes-with-wazuh/

 Create a systemd service at /lib/systemd/system/wazuh-webhook.service:
[Unit]
Description=Wazuh webhook
Wants=network-online.target
After=network.target network-online.target
[Service]
ExecStart=/var/ossec/framework/python/bin/python3 /var/ossec/integrations/custom-webhook.py
Restart=on-failure
[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable wazuh-webhook.service
systemctl start wazuh-webhook.service

K8S Environment daemons

root@wazuh-manager-master-0:/# /etc/init.d/wazuh-manager status
wazuh-clusterd not running...
wazuh-modulesd not running...
wazuh-monitord not running...
wazuh-logcollector not running...
wazuh-remoted not running...
wazuh-syscheckd not running...
wazuh-analysisd not running...
wazuh-maild not running...
wazuh-execd not running...
wazuh-db not running...
wazuh-authd not running...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
wazuh-apid not running...
root@wazuh-manager-master-0:/# 

I opened a question on slack channel and received a suggestion to manage here... https://wazuh.slack.com/archives/C0A933R8E/p1676047707005229

victorrodriguez1984 commented 1 year ago

Any update?

DevFontes commented 6 months ago

Any update? I cant read the post

https://wazuh.slack.com/archives/C0A933R8E/p1676047707005229

DevFontes commented 6 months ago

https://wazuh.slack.com/archives/C0A933R8E/p1713894827255559?thread_ts=1713786744.493399&cid=C0A933R8E

KubenSec commented 7 hours ago

Any news ? Can you post it here ?