Closed fdalmaup closed 1 year ago
I have modified the solaris/solaris11/SPECS/template_agent.json
file to have all the AWS module files. Without these changes, the built packages did not contain the rest of the files required for the module to work.
After the changes, the Solaris 11 package was successfully built and its installation was tested:
root@solaris-vagrant:/var/ossec/wodles/aws# ls -l
total 110
-rwxr-x--- 1 root wazuh 0 Sep 1 22:19 __init__.py
-rwxr-x--- 1 root wazuh 16489 Sep 1 22:19 aws_tools.py
-rwxr-x--- 1 root wazuh 9407 Sep 1 22:19 aws-s3
drwxr-x--- 2 root wazuh 12 Sep 1 22:32 buckets_s3
drwxr-x--- 2 root wazuh 6 Sep 1 22:32 services
drwxr-x--- 2 root wazuh 6 Sep 1 22:32 subscribers
-rwxr-x--- 1 root wazuh 22836 Sep 1 22:32 wazuh_integration.py
root@solaris-vagrant:/var/ossec/wodles/aws# ls -l buckets_s3/
total 187
-rwxr-x--- 1 root wazuh 462 Sep 1 22:32 __init__.py
-rwxr-x--- 1 root wazuh 41203 Sep 1 22:32 aws_bucket.py
-rwxr-x--- 1 root wazuh 1889 Sep 1 22:32 cloudtrail.py
-rwxr-x--- 1 root wazuh 8844 Sep 1 22:32 config.py
-rwxr-x--- 1 root wazuh 4353 Sep 1 22:32 guardduty.py
-rwxr-x--- 1 root wazuh 5729 Sep 1 22:32 load_balancers.py
-rwxr-x--- 1 root wazuh 9151 Sep 1 22:32 server_access.py
-rwxr-x--- 1 root wazuh 2718 Sep 1 22:32 umbrella.py
-rwxr-x--- 1 root wazuh 10934 Sep 1 22:32 vpcflow.py
-rwxr-x--- 1 root wazuh 2897 Sep 1 22:32 waf.py
root@solaris-vagrant:/var/ossec/wodles/aws# ls -l services/
total 78
-rwxr-x--- 1 root wazuh 166 Sep 1 22:32 __init__.py
-rwxr-x--- 1 root wazuh 5955 Sep 1 22:32 aws_service.py
-rwxr-x--- 1 root wazuh 24429 Sep 1 22:32 cloudwatchlogs.py
-rwxr-x--- 1 root wazuh 6373 Sep 1 22:32 inspector.py
root@solaris-vagrant:/var/ossec/wodles/aws# ls -l subscribers/
total 43
-rwxr-x--- 1 root wazuh 201 Sep 1 22:32 __init__.py
-rwxr-x--- 1 root wazuh 10400 Sep 1 22:32 s3_log_handler.py
-rwxr-x--- 1 root wazuh 1795 Sep 1 22:32 sqs_message_processor.py
-rwxr-x--- 1 root wazuh 6214 Sep 1 22:32 sqs_queue.py
The module was tested using Python 3.7.6 giving the following results:
root@vagrant:/# cat /etc/release
Oracle Solaris 11.4 X86
Copyright (c) 1983, 2018, Oracle and/or its affiliates. All rights reserved.
Assembled 16 August 2018
root@vagrant:/# /var/ossec/wodles/aws/aws-s3 -b wazuh-aws-wodle-cloudtrail -t cloudtrail -s 2021-Dec-01 -p dev -d2
DEBUG: +++ Debug mode on - Level: 2
DEBUG: Generating default configuration for retries: mode standard - max_attempts 10
DEBUG: +++ Table does not exist; create
DEBUG: +++ Working on 123456789123 - us-west-1
DEBUG: +++ Marker: AWSLogs/123456789123/CloudTrail/us-west-1/2021/12/01
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2021/12/01/123456789123_CloudTrail_us-west-1_20211201T0000Z_VZJxNKcpNdyJysGy.json.gz
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2021/12/01/123456789123_CloudTrail_us-west-1_20211201T0000Z_ZKdiPZvOQPGUJMUh.json.gz
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2021/12/01/123456789123_CloudTrail_us-west-1_20211201T0000Z_ZsQHQAHDMsYfvPHx.json.gz
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2021/12/01/123456789123_CloudTrail_us-west-1_20211201T0000Z_wcnIRHvPJuYpSXZr.json.gz
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2021/12/23/123456789123_CloudTrail_us-west-1_20211223T0000Z_HASDOtJxgfdNInHa.json.gz
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2022/01/25/123456789123_CloudTrail_us-west-1_20220125T0000Z_HASDOtJxgfdNInHa.json.gz
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2022/02/11/123456789123_CloudTrail_us-west-1_20220211T0000Z_HASDOtJxgfdNInHa.json.gz
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2022/03/30/123456789123_CloudTrail_us-west-1_20220330T0000Z_HASDoKlxgfdNInHa.json.gz
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2022/03/30/123456789123_CloudTrail_us-west-1_20220330T0000Z_HASDoKlxgfdNInHa.json.zip
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2022/03/30/123456789123_CloudTrail_us-west-1_20220330T0000Z_HASDoKlxgfdkdIOa.json.txt
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2022/03/30/123456789123_CloudTrail_us-west-1_20220330T0002Z_HASDoKlxgfdNInHa.json.zip
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2023/04/06/123456789123_CloudTrail_us-west-1_20230406T0002Z_HASDoKlxgfdNInHa.json
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2023/04/06/123456789123_CloudTrail_us-west-1_20230406T0002Z_HASDoKlxgfdNInHb.json
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2023/04/11/123456789123_CloudTrail_us-west-1_20230411T1755Z_2CqtXDyI0zFiYm1J.json
DEBUG: ++ Found new log: AWSLogs/123456789123/CloudTrail/us-west-1/2023/09/06/123456789123_CloudTrail_us-west-1_20230906T1755Z_2CqtXDyI0zFiYm1J.json
DEBUG: +++ DB Maintenance
DEBUG: +++ Working on 123123456789 - us-west-1
DEBUG: +++ Marker: AWSLogs/123123456789/CloudTrail/us-west-1/2021/12/01
DEBUG: ++ Found new log: AWSLogs/123123456789/CloudTrail/us-west-1/2021/12/23/123456789123_CloudTrail_us-west-1_20211223T0000Z_HASDOtJxgfdNInHa.json.gz
DEBUG: ++ Found new log: AWSLogs/123123456789/CloudTrail/us-west-1/2021/12/23/123456789123_CloudTrail_us-west-1_20211223T0000Z_HASDOtJxxxxxxxxx.json.gz
DEBUG: +++ DB Maintenance
DEBUG: +++ Working on 789123123456 - us-west-1
DEBUG: +++ Marker: AWSLogs/789123123456/CloudTrail/us-west-1/2021/12/01
DEBUG: ++ Found new log: AWSLogs/789123123456/CloudTrail/us-west-1/2023/01/25/123456789123_CloudTrail_us-west-1_20211223T0000Z_HASDOtJxxxxxxxxx.json.gz
DEBUG: +++ DB Maintenance
It was needed to compile the mentioned Python version since it is not native to Solaris 11 and certain bugs that could not be solved arose. This led to not being able to install the pyarrow
and numpy
packages and therefore the need to comment out the sections of code that used them to perform this manual test. The errors found were:
DEB
and RPM
packages were correctly generated and simple module tests were performed to verify the expected behavior.
Description
As part of https://github.com/wazuh/wazuh/issues/13388, the AWS module is being refactored in order to get quality unit tests. Some structural changes are being made to it, separating the module into different files in order to have a more maintainable and cohesive code.
Tasks
wazuh-packages
files (e.g.solaris/solaris11/SPECS/template_agent.json
)