Wazuh Indexer Install - Installing our SIEM Backend Storage

[@sowndarya6744]

Thanks a lot for these videos, I'm currently surviving my internship because of them!!

[@boolve]

You did spend a good piece of time explaining everything. Nice

[@cyberbrainfoodletseat8260]

Taylor, awesome stuff, amazing content that actually works if you follow. Big fan of Opensource.

[@TheMedtemo]

Best combination of best open source tools. Thanks for sharing 👍

[@racg1210]

What a great video Taylor, thank you so much for this

[@sq9176]

Thanks, buddy. Love your videos.

[@FrenchSparda]

Great !! Many thanks, I'll start to follow your vids and install all services needed. Merci !!

[@miguelsaiz8151]

Great video my friend

[@dareogunsola6561]

Running into an annoying issue where graylog cannot verify hostname. Getting this error: Unable to retrieve version from Elasticsearch node: Hostname not verified. Any pointers?

[@hackyourfuture]

hey taylor your videos are amazing.....thanks for sharing your knowledge 🚀🚀🚀

[@ramnathnair5743]

Thank you Taylor! really appreciated your time and effort.

[@jonbrandenburg9880]

I first want to say thank you for providing this content. I've watched the entire "World's Best Free SIEM Stack" series and it's been a huge help getting me started with more advanced collecting and analyzing of my logs. But before I go down the path you've provided, I'm wondering what a scaled back approach might look like. I'm working within a school district and my environment is fairly small. I have around 30 network devices, one firewall, VMWare with 3 hosts and15 VM's (Windows and Linux) and another 5 standalones on prem Windows servers. Then there is about 150 Windows and Mac devices. So, I guess I'm wondering if I can just take pieces of this and have a good enough working "SIEM" to help me detect, isolate, respond and clean up any type of security event that may occur? Or do I just install the full Wazuh Security Platform and that'll be good enough? Any thoughts or comments would be appreciated.

[@GordonSquared]

Very nice video.. Could I run these as vm's on one host? If so how much ram would i need? Not for large production just home lab

[@dibyendusdiary]

Thank you so much. it helps a lot.

[@javeriajameel7500]

Hello, Can anyone tell me is there any API to get stored alerts from wazuh indexer automatically?

[@oolyo6604]

Thank you Taylor for the video it was great as usual been watching wazuh videos from your channel and it helped me i have question bro I’m small company which can’t avoid market EDRs which one you would recommend elastic edr or wazuh?

[@gohpatrick1182]

One of the best Open Source video setup! Thanks for the video! What server are you running? VM in your local machine?

[@thecrazymouse7220]

Hope you are watching these notes... That was a speed session - and I have question.. I notice that when setting up these apps, it all defaults to the main drive your /usr profile is located. For the Indexer, I want to store all the data captured on to a second drive I have mounted. /dev/sdb (labeled: Data). In the opensearch.yml the two lines you skipped over, path.data and path.logs, are these the areas to change to force to that second drive? Would I change the /var/lib/wazuh-indexer to /dev/sdb/wazuh-indexer/data and /dev/sdb/wazuh-indexer/logs ?? Would that work? Since my main drive is small.. just looking at how to redirect data to the second drive. when looking at properties i think it is /media/ubuntu/Data Parent Folder...

[@daan99pl]

Taylor, no money in pocket? What environment do you need?

[@sintayehuseyoum7190]

very helpful

[@cybertester9344]

Great tutorial, love this series

[@kevinkinsey8138]

So if we already have Elasticsearch, do we need to drop it and use W.Indexer instead?

[@javimed9669]

Hi. You can use the Wazuh server 4.3+ along with Elastic Stack as an alternative deployment. Please check installation steps in Wazuh docs "Installing Wazuh with Elastic Stack basic license". As explained in the video, Wazuh indexer is Wazuh's own fork of OpenSearch (formerly OpenDistro, based on Elasticsearch).

[@jodayabi]

get confused why elasticsearch and not Opensearch. am i lost?

[@tharunkarthikeyan5695]

Hey Taylor, I have followed the steps as described in the video and medium post, but am encountering a problem in the last step. When I try to access my dashboard webpage, I am greeted with a message saying "Wazuh dashboard server is not ready yet". I have tried looking through blogs but the only solution I seem to reach is to run the systemctl restart wazuh-dashboard. It would be a great deal if you get help me out here. Thank you again for the video.

[@Jxsprlyh]

Any updates on this error? I received this error as well

[@chahiramaoua4944]

any updates @@Jxsprlyh ? i have the same error

[@austinpwr1]

I got past the "Wazuh dashboard server is not ready yet", but I am running into a issues Wazuh API offline in GUI. I have ran through this lab around 6 times now still same issue. I get an error check Wazuh API connection and Check alert index pattern. Has anyone resolve this yet..

[@stylishctf5146]

@@austinpwr1 how did u fix it ?

[@alfarashfidqy6571]

after following each steps carefully, i got wazuh-indexer and wazuh-dashboard running on systemctl, but when i hit the ip address, it says wazuh dashboard server is not ready yet. any solutions?

[@stylishctf5146]

did u fix it ?

[@alfarashfidqy6571]

@@stylishctf5146 yes. In my case, I didn’t point to the right certs. So i double check everything and point to the right certs, then it sorts itself out.

[@stylishctf5146]

@@alfarashfidqy6571 oh damn, i just reinstalled wazuh and everything and it's working now ahaha xD

[@jasonforry5466]

Hi Guys, I am looking to use this SIEM stack as a Capstone project. Is it expensive to launch? It doesnt need to be used for production....TIA

[@abhinavkohli4293]

i am also looking for using it as a project but it seems too advanced can u help me like where to start

[@datboyblu3]

Followed your guide and the official docs, however, I'm getting the following error message when installing the Indexer: "Unable to locate package wazuh-indexer". I'm running Ubuntu 22.04.3...Everything's been working great until this installation. Not sure what is wrong with my installation.

[@tester0083]

If you look at (26:19), he actually had the same problem. "apt-get update" and you'll be good.

[@datboyblu3]

Did the same thing, but I think it has to do with Wazuh not having an aarch64 build for the indexer @@tester0083

[@orhancevik1512]

please can someone help me, i get the error when i want to start the wazuh this error: controll process exited with error code, see system-ctl status wazuh-indexer service

[@icguarin23]

Hey have you found the solution?

[@chahiramaoua4944]

getting this error : Wazuh dashboard server is not ready yet indexer active and the dashbord is active :( any help plz

[@dannymiller3762]

I had this issue, not sure about yours, but I copied the wrong password when updating the kibanaserver password

[@ibrohimabdullaxujayev7876]

@@dannymiller3762 you need delete cookies,histories of web browser

[@iammodibhakth]

Hi Brother, I am facing below issue in graylog, i followed the same steps as you did in the videos. graylog searc tab - While retrieving data for this widget, the following error(s) occurred: Elasticsearch exception [type=illegal_argument_exception, reason=key [types] is not supported in the metadata section]. please help me out, from last 1 week i am triying.

[@taylorwalton_socfortress]

try commenting out `compatibility.override_main_response_version: true` in the wazuh-indexer config file and then restart the wazuh-indexer service reference: community.graylog.org/t/elasticsearch-exception-reason-key-types-is-not-supported-in-the-metadata-section/27468/6

[@iammodibhakth]

@@taylorwalton_socfortress Yes, i have doone changes, as mentioned in the above link. now graylog log shows that Elasticsearch version currently running (OpenSearch:2.6.0) is incompatible with the one Graylog was started with (Elasticsearch:7.10.2) - a restart is required

[@syedomairmasood6785]

Getting this error INFO: No current API selected INFO: Getting API hosts... INFO: API hosts found: 1 INFO: Checking API host id [default]... INFO: Could not connect to API id [default]: 3099 - ERROR3099 - Invalid credentials INFO: Removed [navigate] cookie ERROR: No API available to connect

[@YassineDalleji]

did u fix it broo ?

[@syedomairmasood6785]

@@YassineDalleji yes

[@syedomairmasood6785]

@@YassineDalleji but unfortunately i forgot what i did to resolve this issue

[@sabarivenkateshk9827]

Hey Taylor I got a error while doing gpg key part .. gpg: keyblock resource '/usr/share/keyrings/wazuh.gpg': Permission denied Thanks in advance :)

[@joelnicholasfrancis2700]

Same here Got any solutions?

[@tester0083]

make sure you are the root user. it is not enough to use sudo as a different user. type "sudo su" and then you will be root.