Test Splunk App package for Wazuh 4.x

[BraulioV]

The development is about to end soon and it must satisfy the checks defined here before its official release.

Here you can see a summary of the current status:

OS/Browser	ToDo	In progress	OK	KO	Total	Coverage	who
Firefox/Chrome Linux	150	0	142	8	150	0.94%	@pacoqack @frankeros and @eze9252 (@wazuh/frontend & @wazuh/qa )
Safari macOS	150	0	142	8	150	0.94%	@pacoqack (@wazuh/qa)
Edge Windows	1	0	117	15	145	91.03%	@okynos (@wazuh/cicd) @maumrsms (@wazuh/operations )

Use cases

• [x] Audit @pacoqack
• [x] AWS Wodle @pacoqack
• [x] Brute force @pacoqack
• [x] Docker @pacoqack
• [x] Emotet @pacoqack
• [x] FIM @pacoqack
• [x] IP Reputation@pacoqack
• [x] Netcat @pacoqack
• [x] Osquery@pacoqack
• [x] Shellshock @pacoqack
• [x] SQL Injection @pacoqack
• [x] Slack @pacoqack
• [x] Suricata @pacoqack
• [x] Trojan @pacoqack
• [x] Virustotal @pacoqack
• [x] Vulnerability Detector @pacoqack
• [x] Yara @pacoqack
• [x] Windows Defender @pacoqack
• [x] Diamorphine rootkit @pacoqack

Others

• [x] Build a testing OVA for Splunk @pacoqack
• [x] Bring up the testing environment @wazuh/cicd
• [x] Add another worker and build a wazuh cluster in the environment (@pacoqack )
• [x] Force different event generation in the agents connected to the environment (@pacoqack)

The AWS resources have been deployed by @wazuh-cloud-cicd according to https://github.com/wazuh/wazuh-automation/issues/474

[spothound]

I'm working on building a new OVA with Wazuh and Splunk installed so we could easily deploy testing instances for this issue.

update: The OVA is available, we've pushed it to S3 and the link is shared at slack.

[spothound]

We've detected a problem with the current Splunk app when attempting to connect to Wazuh's API: https://github.com/wazuh/wazuh-splunk/issues/956

[spothound]

We're going to add another worker to the testing environment to build a wazuh cluster in order to test cluster-related features.

Also, we need to add some agents to this environment.

[okynos]

Problem detected https://github.com/wazuh/wazuh-splunk/issues/1002

[spothound]

Missing dashboard https://github.com/wazuh/wazuh-splunk/issues/1003

[okynos]

Error inside interactive guide https://github.com/wazuh/wazuh-splunk/issues/1005

[okynos]

Splunk cannot authenticate https://github.com/wazuh/wazuh-splunk/issues/1008

[spothound]

https://github.com/wazuh/wazuh-splunk/issues/1006

[spothound]

https://github.com/wazuh/wazuh-splunk/issues/1007

[spothound]

https://github.com/wazuh/wazuh-splunk/issues/1004

[spothound]

https://github.com/wazuh/wazuh-splunk/issues/1009 problem with cluster daemon status when changing worker.

[okynos]

Error on details section https://github.com/wazuh/wazuh-splunk/issues/1010

[okynos]

Error on filter by never_connected https://github.com/wazuh/wazuh-splunk/issues/1011

[okynos]

Search by incomplete name https://github.com/wazuh/wazuh-splunk/issues/1012

[okynos]

Unknown version search https://github.com/wazuh/wazuh-splunk/issues/1013

[okynos]

Action buttons glitch https://github.com/wazuh/wazuh-splunk/issues/1014