-
Notifications
You must be signed in to change notification settings - Fork 366
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #8100 from wazuh/merge-4.10-into-4.10.1
Merge 4.10 into 4.10.1
- Loading branch information
Showing
10 changed files
with
295 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
102 changes: 102 additions & 0 deletions
102
source/user-manual/capabilities/vulnerability-detection/FAQ.rst
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| .. Copyright (C) 2015, Wazuh, Inc. | ||
| .. meta:: | ||
| :description: Learn how to solve common issues with the Vulnerability Detection module in this section of the documentation. | ||
|
|
||
| Frequently Asked Questions (FAQs) | ||
| ================================= | ||
|
|
||
| This section provides solutions to common issues encountered during the configuration, installation, and operation of the Vulnerability Detection module. | ||
|
|
||
| Communication issues between the Wazuh server and the Wazuh indexer | ||
| ------------------------------------------------------------------- | ||
|
|
||
| .. list-table:: Issue description | ||
| :widths: 15 50 | ||
|
|
||
| * - Problem | ||
| - No vulnerabilities reported in the Wazuh dashboard, or the ``wazuh-states-vulnerabilities-*`` index has not been created. The manager logs might show messages like ``IndexerConnector initialization failed for index 'X', retrying until the connection is successful``. | ||
| * - Cause | ||
| - A misconfiguration in one of the following components: | ||
|
|
||
| - Vulnerability detector | ||
| - Indexer connector | ||
| - wazuh-keystore | ||
|
|
||
| Troubleshooting steps | ||
| ^^^^^^^^^^^^^^^^^^^^^ | ||
|
|
||
| Step 1: Check credentials and configuration | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| #. Ensure the wazuh-keystore is updated with correct admin username and password. For details, see the :doc:`wazuh-keystore </user-manual/reference/tools/wazuh-keystore>` documentation. | ||
| #. Verify the :doc:`indexer connector configuration </user-manual/reference/ossec-conf/indexer>` at ``/var/ossec/etc/ossec.conf``. Ensure: | ||
|
|
||
| - The ``<host>`` section contains the correct Wazuh indexer URL. The host FQDN/IP address must match the certificate details. | ||
| - The ``<ssl>`` section specifies the correct paths for the certificate, key, and CA files. | ||
|
|
||
| **Example configuration**: | ||
|
|
||
| .. code-block:: xml | ||
| :emphasize-lines: 4,8,10,11 | ||
| <indexer> | ||
| <enabled>yes</enabled> | ||
| <hosts> | ||
| <host>https://0.0.0.0:9200</host> | ||
| </hosts> | ||
| <ssl> | ||
| <certificate_authorities> | ||
| <ca>/etc/filebeat/certs/root-ca.pem</ca> | ||
| </certificate_authorities> | ||
| <certificate>/etc/filebeat/certs/filebeat.pem</certificate> | ||
| <key>/etc/filebeat/certs/filebeat-key.pem</key> | ||
| </ssl> | ||
| </indexer> | ||
| Step 2: Verify the connection | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| You can verify the connection to the Wazuh indexer using the ``curl`` command from the Wazuh server. | ||
|
|
||
| .. code-block:: console | ||
| # curl --cacert <ROOT_CA> --cert <CERTIFICATE_PEM> --key <CERTIFICATE_KEY> -u <USER>:<PASS> -XGET https://<INDEXER_IP_ADDRESS>:9200/_cluster/health | ||
| Where: | ||
|
|
||
| - ``<ROOT_CA>``, ``<CERTIFICATE_PEM>``, ``<CERTIFICATE_KEY>``: Certificate paths. | ||
| - ``<USER>`` and ``<PASS>``: Admin credentials. | ||
| - ``<INDEXER_IP_ADDRESS>``: IP address of the Wazuh indexer. | ||
|
|
||
| If this command fails, the vulnerability detector module won't be able to connect to the indexer. | ||
|
|
||
| To check if the issue is related to certificates, bypass certificate verification using the ``-k`` option: | ||
|
|
||
| .. code-block:: console | ||
| # curl -k -u <USER>:<PASS> -XGET https://<INDEXER_IP_ADDRESS>:9200/_cluster/health | ||
| A successful connection returns a result similar to the following: | ||
|
|
||
| .. code-block:: json | ||
| { | ||
| "cluster_name": "opensearch", | ||
| "status": "green", | ||
| "timed_out": false, | ||
| "number_of_nodes": 1, | ||
| "number_of_data_nodes": 1, | ||
| "discovered_master": true, | ||
| "discovered_cluster_manager": true, | ||
| "active_primary_shards": 9, | ||
| "active_shards": 9, | ||
| "relocating_shards": 0, | ||
| "initializing_shards": 0, | ||
| "unassigned_shards": 0, | ||
| "delayed_unassigned_shards": 0, | ||
| "number_of_pending_tasks": 0, | ||
| "number_of_in_flight_fetch": 0, | ||
| "task_max_waiting_in_queue_millis": 0, | ||
| "active_shards_percent_as_number": 100.0 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.