Documentation: Always consult the development documentation for the current stage tag at this link. Be careful because some of the description steps might refer to a current version in production, always navigate using the current development documention for the stage under test. Also, visit the following pre-release package guide to understand how to modify certain links and urls for the correct testing of the development packages.
Test Requirements: Ensure your test comprehensively includes a full stack and agent/s deployment as per the Deployment requirements, detailing the machine OS, installed version, and revision.
Deployment Options: While deployments can be local (using VMs, Vagrant, etc) or on the aws-dev account, opt for local deployments when feasible. For AWS access, coordinate with the DevOps team through this link.
External Accounts: If tests require third-party accounts (e.g., GitHub, Azure, AWS, GCP), request the necessary access through the DevOps team here.
Alerts: Every test should generate a minimum of one end-to-end alert, from the agent to the dashboard, irrespective of test type.
Multi-node Testing: For multi-node wazuh-manager tests, ensure agents are connected to both workers and the master node.
Package Verification: Use the pre-release package that matches the current TAG you're testing. Confirm its version and revision.
Filebeat Errors: If you encounter errors with Filebeat during testing, refer to this Slack discussion for insights and resolutions.
Known Issues: Familiarize yourself with previously reported issues in the Known Issues section. This helps in identifying already recognized errors during testing.
Reporting New Issues: Any new errors discovered during testing that aren't listed under Known Issues should be reported. Assign the issue to the corresponding team (QA if unsure), add the Release testing objective and Urgent priority. Communicate these to the team and QA via the c-release Slack channel.
Test Conduct: It's imperative to be thorough in your testing, offering enough detail for reviewers. Incomplete tests might necessitate a redo.
Documentation Feedback: Encountering documentation gaps, unclear guidelines, or anything that disrupts the testing or UX? Open an issue, especially if it's not listed under Known Issues. Please answer the feedback section, this is a mandatory step.
Format: If this is your first time doing this, refer to the format (but not necessarily the content, as it may vary) of previous E2E tests, here you have an example https://github.com/wazuh/wazuh/issues/13994.
Status and completion: Change the issue status within your team project accordingly. Once you finish testing and write the conclusions, move it to Pending review and notify the @wazuh/devel-agent-div2 team via Slack using the c-release channel. Beware that the reviewers might request additional information or task repetitions.
For reviewers: Please move the issue to Pending final review and notify via Slack using the same thread if everything is ok, otherwise, perform an issue update with the requested changes and move it to On hold, increase the review_cycles in the team project by one and notify the issue assignee via Slack using the same thread.
For the conclusions and the issue testing and updates, use the following legend:
Status legend
🟢 All checks passed
🟡 Found a known issue
🔴 Found a new error
Issue delivery and completion
Initial delivery: The issue's assignee must complete the testing and deliver the results by Jul 24, 2024 and notify the @wazuh/devel-agent-div2 team via Slack using the c-release channel
Review: The @wazuh/devel-agent-div2 team will assign a reviewer and add it to the review_assignee field in the project. The reviewer must then review the test steps and results. Ensure that all iteration cycles are completed by Jul 25, 2024 date (issue must be in Pending final review status) and notify the QA team via Slack using the c-release channel.
Auditor: The QA team must audit, validate the results, and close the issue by Jul 26, 2024.
We value your feedback. Please provide insights on your testing experience.
Was the testing guideline clear? Were there any ambiguities?
The test guideline was clear. But the use cases only mention the configuration on the manager, not on agents. Even though it's possible, it's not clear for testing purposes
Did you face any challenges not covered by the guideline?
The testing guideline did not contain instruction on how to modify links to access the dev packages.
Suggestions for improvement:
In the use cases, mention that it's better to test in an agent, not in the server as stated
Append the following configuration to the /var/ossec/etc/ossec.conf file on the Wazuh server:
Reviewers validation
The criteria for completing this task is based on the validation of the conclusions and the test results by all reviewers.
All the checkboxes below must be marked in order to close this issue.
Quickstart installation 🟢
The `Debian 11` OS is not in the recommended systems. Needed to use `-i` to ignore this check.
Command used for installation 4.9.0:
```command
curl -sO https://packages-dev.wazuh.com/4.9/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -i
```
```command
root@bullseye:~# curl -sO https://packages-dev.wazuh.com/4.9/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -i
23/07/2024 21:21:12 INFO: Starting Wazuh installation assistant. Wazuh version: 4.9.0
23/07/2024 21:21:12 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/07/2024 21:21:12 INFO: The recommended systems are: Red Hat Enterprise Linux 7, 8, 9; CentOS 7, 8; Amazon Linux 2; Ubuntu 16.04, 18.04, 20.04, 22.04.
23/07/2024 21:21:12 WARNING: The current system does not match with the list of recommended systems. The installation may not work properly.
23/07/2024 21:21:16 WARNING: Hardware checks ignored.
23/07/2024 21:21:19 INFO: Wazuh web interface port will be 443.
23/07/2024 21:21:26 INFO: Wazuh development repository added.
23/07/2024 21:21:26 INFO: --- Configuration files ---
23/07/2024 21:21:26 INFO: Generating configuration files.
23/07/2024 21:21:27 INFO: Generating the root certificate.
23/07/2024 21:21:27 INFO: Generating Admin certificates.
23/07/2024 21:21:27 INFO: Generating Wazuh indexer certificates.
23/07/2024 21:21:27 INFO: Generating Filebeat certificates.
23/07/2024 21:21:27 INFO: Generating Wazuh dashboard certificates.
23/07/2024 21:21:28 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
23/07/2024 21:21:28 INFO: --- Wazuh indexer ---
23/07/2024 21:21:28 INFO: Starting Wazuh indexer installation.
23/07/2024 21:21:41 INFO: Wazuh indexer installation finished.
23/07/2024 21:21:41 INFO: Wazuh indexer post-install configuration finished.
23/07/2024 21:21:41 INFO: Starting service wazuh-indexer.
23/07/2024 21:22:09 INFO: wazuh-indexer service started.
23/07/2024 21:22:09 INFO: Initializing Wazuh indexer cluster security settings.
23/07/2024 21:26:23 INFO: Wazuh indexer cluster security configuration initialized.
23/07/2024 21:26:23 INFO: Wazuh indexer cluster initialized.
23/07/2024 21:26:23 INFO: --- Wazuh server ---
23/07/2024 21:26:23 INFO: Starting the Wazuh manager installation.
23/07/2024 21:28:21 INFO: Wazuh manager installation finished.
23/07/2024 21:28:21 INFO: Wazuh manager vulnerability detection configuration finished.
23/07/2024 21:28:21 INFO: Starting service wazuh-manager.
23/07/2024 21:28:54 INFO: wazuh-manager service started.
23/07/2024 21:28:54 INFO: Starting Filebeat installation.
23/07/2024 21:29:18 INFO: Filebeat installation finished.
23/07/2024 21:29:53 INFO: Filebeat post-install configuration finished.
23/07/2024 21:29:56 INFO: Starting service filebeat.
23/07/2024 21:30:12 INFO: filebeat service started.
23/07/2024 21:30:12 INFO: --- Wazuh dashboard ---
23/07/2024 21:30:12 INFO: Starting Wazuh dashboard installation.
23/07/2024 21:41:09 INFO: Wazuh dashboard installation finished.
23/07/2024 21:41:17 INFO: Wazuh dashboard post-install configuration finished.
23/07/2024 21:41:17 INFO: Starting service wazuh-dashboard.
23/07/2024 21:41:18 INFO: wazuh-dashboard service started.
23/07/2024 21:41:20 INFO: Updating the internal users.
23/07/2024 21:41:38 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
23/07/2024 21:42:23 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
23/07/2024 21:43:57 INFO: Initializing Wazuh dashboard web application.
23/07/2024 21:43:58 INFO: Wazuh dashboard web application initialized.
23/07/2024 21:43:58 INFO: --- Summary ---
23/07/2024 21:43:58 INFO: You can access the web interface https://:443
User: admin
Password: nMhiJ+zakXyRB*pO9nscYYzqO48bZI9x
23/07/2024 21:43:58 INFO: Installation finished.
```
Verify installation 🟢
```command
root@bullseye:~# dpkg -l | grep wazuh
ii wazuh-dashboard 4.9.0-1 amd64 Wazuh dashboard is a user interface and visualization tool for security-related data. This Wazuh central component enables exploring, visualizing, and analyzing the stored security alerts generated by the Wazuh server. Wazuh dashboard enables inspecting the status and managing the configurations of the Wazuh cluster and agents as well as creating and managing users and roles. In addition, it allows testing the ruleset and making calls to the Wazuh API. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-dashboard.html
ii wazuh-indexer 4.9.0-1 amd64 Wazuh indexer is a near real-time full-text search and analytics engine that gathers security-related data into one platform.
ii wazuh-manager 4.9.0-1 amd64 Wazuh helps you to gain security visibility into your infrastructure by monitoring hosts at an operating system and application level. It provides the following capabilities: log analysis, file integrity monitoring, intrusions detection and policy and compliance monitoring
```
Manager verification 🟢
```command
root@bullseye:~# /var/ossec/bin/wazuh-control status
wazuh-clusterd not running...
wazuh-modulesd is running...
wazuh-monitord is running...
wazuh-logcollector is running...
wazuh-remoted is running...
wazuh-syscheckd is running...
wazuh-analysisd is running...
wazuh-maild not running...
wazuh-execd is running...
wazuh-db is running...
wazuh-authd is running...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
wazuh-apid is running...
```
Dashboard verification 🟢
![image](https://github.com/user-attachments/assets/78fe205a-9f8e-45b8-8637-92a953442cfc)
![image](https://github.com/user-attachments/assets/aa53021e-aa0d-40db-bfdf-5ce05275e2af)
![image](https://github.com/user-attachments/assets/1b97092e-4074-4c77-af00-bdab5f3a5f80)
End-to-End (E2E) Testing Guideline
Release testing
objective andUrgent
priority. Communicate these to the team and QA via the c-release Slack channel.For the conclusions and the issue testing and updates, use the following legend:
Status legend
Issue delivery and completion
review_assignee
field in the project. The reviewer must then review the test steps and results. Ensure that all iteration cycles are completed by Jul 25, 2024 date (issue must be inPending final review
status) and notify the QA team via Slack using the c-release channel.Deployment requirements
Test description
https://documentation-dev.wazuh.com/v4.9.0-alpha3/cloud-security/office365/index.html Test different use cases on Office 365 events and check that alerts are generated and make sense.
The documentation asks to configure the SharePoint subscription, but use the following instead: The services added were the following:
Known issues
There are no known issues.
Conclusions
Feedback
We value your feedback. Please provide insights on your testing experience.
Reviewers validation
The criteria for completing this task is based on the validation of the conclusions and the test results by all reviewers.
All the checkboxes below must be marked in order to close this issue.