CyberMind-FR
7d87bfbc92
New package secubox-wazuh-manager provides complete SIEM stack: - Wazuh Manager: Agent management, log analysis, threat detection - Wazuh Indexer: OpenSearch-based alert storage - Wazuh Dashboard: Web UI for visualization (port 5601) Features: - Automated LXC container deployment with Debian 12 - HAProxy integration with waf_bypass for dashboard - Agent management commands (list, info, remove) - API access and token generation - Log viewing for all components - Shell access for administration CLI: wazuh-managerctl with install/start/stop/status/configure-haproxy Requirements: 4GB+ RAM, 20GB+ storage for production use Complements secubox-app-wazuh agent for full SIEM deployment. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
65 lines
1.4 KiB
Bash
65 lines
1.4 KiB
Bash
#!/bin/sh /etc/rc.common
|
|
# Wazuh Manager LXC init script
|
|
|
|
START=95
|
|
STOP=10
|
|
USE_PROCD=1
|
|
|
|
CONTAINER_NAME="wazuh"
|
|
LXC_PATH="/srv/lxc"
|
|
|
|
start_service() {
|
|
local enabled
|
|
config_load wazuh-manager
|
|
config_get enabled main enabled '0'
|
|
config_get CONTAINER_NAME main container_name 'wazuh'
|
|
config_get LXC_PATH main lxc_path '/srv/lxc'
|
|
|
|
[ "$enabled" != "1" ] && return 0
|
|
|
|
# Check if container exists
|
|
if [ ! -d "$LXC_PATH/$CONTAINER_NAME/rootfs" ]; then
|
|
logger -t wazuh-manager "Container not installed. Run: wazuh-managerctl install"
|
|
return 1
|
|
fi
|
|
|
|
# Start container
|
|
if ! lxc-info -n "$CONTAINER_NAME" -s 2>/dev/null | grep -q RUNNING; then
|
|
lxc-start -n "$CONTAINER_NAME" -d
|
|
sleep 5
|
|
logger -t wazuh-manager "Wazuh Manager container started"
|
|
fi
|
|
}
|
|
|
|
stop_service() {
|
|
config_load wazuh-manager
|
|
config_get CONTAINER_NAME main container_name 'wazuh'
|
|
|
|
if lxc-info -n "$CONTAINER_NAME" -s 2>/dev/null | grep -q RUNNING; then
|
|
lxc-stop -n "$CONTAINER_NAME"
|
|
logger -t wazuh-manager "Wazuh Manager container stopped"
|
|
fi
|
|
}
|
|
|
|
reload_service() {
|
|
stop_service
|
|
sleep 2
|
|
start_service
|
|
}
|
|
|
|
service_triggers() {
|
|
procd_add_reload_trigger "wazuh-manager"
|
|
}
|
|
|
|
status() {
|
|
config_load wazuh-manager
|
|
config_get CONTAINER_NAME main container_name 'wazuh'
|
|
|
|
if lxc-info -n "$CONTAINER_NAME" -s 2>/dev/null | grep -q RUNNING; then
|
|
echo "Wazuh Manager: RUNNING"
|
|
lxc-info -n "$CONTAINER_NAME"
|
|
else
|
|
echo "Wazuh Manager: STOPPED"
|
|
fi
|
|
}
|