Wazuh is a security detection, visibility, and compliance open source project. It was born as a fork of OSSEC HIDS, later was integrated with Elastic Stack and OpenSCAP evolving into a more comprehensive solution. You can read more in https://wazuh.com/

Visualize and analyze Wazuh alerts stored in Elasticsearch using our Kibana app plugin.

• Obtain statistics per agent, search alerts and filter by using the different visualizations.
• View the Wazuh manager configuration.
• File integrity monitoring.

• Full documentation
• Wazuh installation guide
• Screenshots

• stable branch on correspond to the last Wazuh app stable version.
• master branch contains the latest code, be aware of possible bugs on this branch.

• Wazuh HIDS 3.9.3
• Wazuh RESTful API 3.9.3
• Kibana 7.2.0
• Elasticsearch 7.2.0

Install the app

• With sudo:

sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-3.9.3_7.2.0.zip

• Without sudo:

su -c '/usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-3.9.3_7.2.0.zip' kibana

Restart Kibana

• Systemd:

systemctl restart kibana

• SysV Init:

service kibana restart

Stop Kibana

• Systemd:

systemctl stop kibana

• SysV Init:

service kibana stop

Remove the app using kibana-plugin tool

/usr/share/kibana/bin/kibana-plugin remove wazuh

Remove generated bundles

rm -rf /usr/share/kibana/optimize/bundles

Update file permissions. This will avoid several errors prior to updating the app:

chown -R kibana:kibana /usr/share/kibana/optimize
chown -R kibana:kibana /usr/share/kibana/plugins

Install the app

• With sudo:

sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-3.9.3_7.2.0.zip

• Without sudo:

su -c '/usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-3.9.3_7.2.0.zip' kibana

Restart Kibana

• Systemd:

systemctl restart kibana

• SysV Init:

service kibana restart

If you want to contribute to our project please don't hesitate to send a pull request. You can also join our users mailing list, by sending an email to mailto:[email protected], to ask questions and participate in discussions.

• https://elastic.co
• https://material.angularjs.org
• https://angularjs.org
• https://nodejs.org
• https://npmjs.com

Copyright © 2019 Wazuh, Inc.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

Find more information about this on the LICENSE file.