wazuh-kibana-app/server/initialize.js

const needle = require('needle');

// Colors for console logging 
const colors    = require('ansicolors');
const blueWazuh = colors.blue('wazuh');

const OBJECTS_FILE = 'integration_files/objects_file.json';

module.exports = (server, options) => {

	// Elastic JS Client
	const elasticRequest = server.plugins.elasticsearch.getCluster('data');

	//const uiSettings = server.uiSettings();

	// Initialize variables
	let index_pattern = "wazuh-alerts-*";

	// External files template or objects


	// Initialize objects
	let objects     = {};
	let packageJSON =  {};

	// Read config from package JSON
	try {
		packageJSON = require('../package.json');
	} catch (e) {
		server.log([blueWazuh, 'initialize', 'error'], 'Could not read the Wazuh package file.');
	}

	// Save Wazuh App first set up for future executions
	const saveConfiguration = function (type) {
		let configuration = {
			"name": "Wazuh App",
			"app-version": packageJSON.version,
			"revision": packageJSON.revision,
			"installationDate": new Date().toISOString()
		};

		if (type == "install") {
			elasticRequest.callWithInternalUser('create', {
				index: ".wazuh-version",
				type: 'wazuh-version',
				id: 1,
				body: configuration
			}).then(
				function () {
					server.log([blueWazuh, 'initialize', 'info'], 'Wazuh configuration inserted');
				},
				function () {
					server.log([blueWazuh, 'initialize', 'error'], 'Could not insert Wazuh configuration');
				}
			);
		}
	};

	// Importing Wazuh built-in visualizations and dashboards
	const importObjects = function (id) {
		server.log([blueWazuh, 'initialize', 'info'], 'Importing objects (Searches, visualizations and dashboards) into Elasticsearch...');

		try {
			objects = require(OBJECTS_FILE);
		} catch (e) {
			server.log([blueWazuh, 'initialize', 'error'], 'Could not read the objects file.');
			server.log([blueWazuh, 'initialize', 'error'], 'Path: ' + OBJECTS_FILE);
			server.log([blueWazuh, 'initialize', 'error'], 'Exception: ' + e);
		}

		var body = '';
		objects.forEach(function (element) {
			body += '{ "index":  { "_index": ".kibana", "_type": "doc", "_id": "' + element._type + ':' + element._id + '" } }\n';
			var temp = {}
			var aux = JSON.stringify(element._source);
			aux = aux.replace("wazuh-alerts", id);
			aux = JSON.parse(aux);
			temp[element._type] = aux;
			if (temp[element._type].kibanaSavedObjectMeta.searchSourceJSON.index) temp[element._type].kibanaSavedObjectMeta.searchSourceJSON.index = id;
			temp["type"] = element._type;
			body += JSON.stringify(temp) + "\n";
		});
		elasticRequest.callWithInternalUser('bulk', {
			index: '.kibana',
			body: body
		}).then(function () {
			elasticRequest.callWithInternalUser('indices.refresh', {
				index: ['.kibana', index_pattern]
			});
			server.log([blueWazuh, 'initialize', 'info'], 'Templates, mappings, index patterns, visualizations, searches and dashboards were successfully installed. App ready to be used.');
		}, function (err) {
			server.log([blueWazuh, 'server', 'error'], 'Error importing objects into elasticsearch. Bulk request failed.');
		});
	};

	// Setting default index pattern
	const setDefaultKibanaSettings = function (id) {
		server.log([blueWazuh, 'initialize', 'info'], 'Setting Kibana default values: Index pattern, time picker and metaFields...');

		// Call the internal API and wait for the response
		var options = {
			headers: {
				'kbn-version': packageJSON.kibana.version
			},
			json: true
		}

		var body = {
			"value": id
		}

		needle('post', 'http://localhost:' + server.info.port + '/api/kibana/settings/defaultIndex', body, options).then(function (resp) {
			server.log([blueWazuh, 'initialize', 'info'], 'Wazuh index-pattern successfully set to default.');
		}).catch(function (err) {
			server.log([blueWazuh, 'error'], 'Could not default Wazuh index-pattern.');
		});
	};

	// Create index pattern
	const createIndexPattern = function () {
		server.log([blueWazuh, 'initialize', 'info'], 'Creating index pattern: ' + index_pattern);

		// Call the internal API and wait for the response
		var options = {
			headers: {
				'kbn-version': packageJSON.kibana.version
			},
			json: true
		}

		var body = {
			attributes: {
				title: index_pattern,
				timeFieldName: '@timestamp'
			}
		};

		needle('post', 'http://localhost:' + server.info.port + '/api/saved_objects/index-pattern', body, options).then(function (resp) {
			server.log([blueWazuh, 'initialize', 'info'], 'Successfully created index-pattern.');
			// Set the index-pattern as default in the Kibana configuration
			setDefaultKibanaSettings(resp.body.id);
			// Import objects (dashboards and visualizations) CAREFUL HERE, WE HAVE TO MANAGE SUCESIVE APP INITIATIONS!!!
			importObjects(resp.body.id);
		}).catch(function (err) {
			server.log([blueWazuh, 'initialize', 'error'], 'Error creating index-pattern.');
		});
	};

	// Configure Kibana status: Index pattern, default index pattern, default time, import dashboards.
	const configureKibana = function (type) {
		if (type == "install") {
			// Create Index Pattern > Set it as default > Set default time
			elasticRequest.callWithInternalUser('search', {
				index: '.kibana',
				type: 'index-pattern',
				q: 'title:"wazuh-alerts-*"'
			}).then(
				function (data) {
					if (data.hits.total >= 1) {
						server.log([blueWazuh, 'initialize', 'info'], 'Skipping index-pattern creation. Already exists.');
					} else {
						createIndexPattern();
					}
				},
				function (error) {
					server.log([blueWazuh, 'initialize', 'error'], 'Could not reach elasticsearch.');
				});
		}
		// Save Setup Info
		saveConfiguration(type);
	};

	// Init function. Check for "wazuh-version" document existance.
	const init = function () {
		elasticRequest.callWithInternalUser('indices.exists', {
			index: '.wazuh'
		}).then(
			function (result) {
				if (!result) {
					elasticRequest.callWithInternalUser('indices.create', {
						index: '.wazuh'
					}).then(
						function () {
							server.log([blueWazuh, 'initialize', 'info'], 'Index .wazuh created.');
						},
						function () {
							server.log([blueWazuh, 'initialize', 'error'], 'Error creating index .wazuh.');
						});
				}
			},
			function () {
				server.log([blueWazuh, 'initialize', 'error'], 'Could not check if the index .wazuh exists.');
			});
		elasticRequest.callWithInternalUser('get', {
			index: ".wazuh-version",
			type: "wazuh-version",
			id: "1"
		}).then(
			function (data) {
				server.log([blueWazuh, 'initialize', 'info'], 'Wazuh-configuration document already exists. Nothing to be done.');
			},
			function (data) {
				server.log([blueWazuh, 'initialize', 'info'], 'Wazuh-configuration document does not exist. Initializating configuration...');
				configureKibana("install");
			}
		);
	};

	// Wait until Kibana index is created / loaded and initialize Wazuh App
	const checkKibanaIndex = () => {
		elasticRequest
		.callWithInternalUser('exists', {
			index: ".kibana",
			id:    packageJSON.kibana.version,
			type:  "config"
		})
		.then((data) => server.plugins.elasticsearch.waitUntilReady())
		.then(() => init())
		.catch((error) => {
			server.log([blueWazuh, 'initialize', 'info'], 
						'Waiting index ".kibana" to be created and prepared....');
			setTimeout(() => checkKibanaIndex(), 3000);
		});
	};

	// Check Kibana index and if it is prepared, start the initialization of Wazuh App.
	checkKibanaIndex();
};