mirror of
https://github.com/valitydev/wazuh-kibana-app.git
synced 2024-11-07 10:18:57 +00:00
374 lines
15 KiB
JavaScript
374 lines
15 KiB
JavaScript
import cron from 'node-cron';
|
|
import needle from 'needle';
|
|
import getPath from'../util/get-path';
|
|
import colors from 'ansicolors';
|
|
import log from './logger';
|
|
import { ElasticWrapper } from './lib/elastic-wrapper';
|
|
import monitoringTemplate from './integration-files/monitoring-template';
|
|
|
|
export default (server, options) => {
|
|
const blueWazuh = colors.blue('wazuh');
|
|
const index_pattern = "wazuh-monitoring-3.x-*";
|
|
const index_prefix = "wazuh-monitoring-3.x-";
|
|
|
|
// Elastic JS Client
|
|
const wzWrapper = new ElasticWrapper(server);
|
|
|
|
// Initialize
|
|
let agentsArray = [];
|
|
|
|
let fDate = new Date().toISOString().replace(/T/, '-').replace(/\..+/, '').replace(/-/g, '.').replace(/:/g, '').slice(0, -7);
|
|
let todayIndex = index_prefix + fDate;
|
|
let packageJSON = {};
|
|
|
|
// Read Wazuh App package file
|
|
try {
|
|
packageJSON = require('../package.json');
|
|
} catch (error) {
|
|
log('[monitoring]', error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'error'], 'Could not read the Wazuh package file due to ' + error.message || error);
|
|
}
|
|
|
|
// Check status and get agent status array
|
|
const checkStatus = async (apiEntry, maxSize, offset) => {
|
|
try {
|
|
if (!maxSize) {
|
|
throw new Error('You must provide a max size')
|
|
}
|
|
|
|
const payload = {
|
|
offset: offset ? offset: 0,
|
|
limit : (250 < maxSize) ? 250 : maxSize
|
|
};
|
|
|
|
const options = {
|
|
headers: {
|
|
'wazuh-app-version': packageJSON.version
|
|
},
|
|
username: apiEntry.user,
|
|
password: apiEntry.password,
|
|
rejectUnauthorized: !apiEntry.insecure
|
|
};
|
|
|
|
const response = await needle('get', `${getPath(apiEntry)}/agents`, payload, options);
|
|
|
|
if (!response.error && response.body.data.items) {
|
|
agentsArray = agentsArray.concat(response.body.data.items);
|
|
if ((payload.limit + payload.offset) < maxSize) {
|
|
return checkStatus(apiEntry, response.body.data.totalItems, payload.limit + payload.offset);
|
|
} else {
|
|
await saveStatus();
|
|
}
|
|
} else {
|
|
throw new Error('Can not access Wazuh API')
|
|
}
|
|
|
|
return;
|
|
|
|
} catch (error) {
|
|
log('[monitoring][checkStatus]', error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'error'], error.message || error);
|
|
}
|
|
};
|
|
|
|
// Check API status twice and get agents total items
|
|
const checkAndSaveStatus = async apiEntry => {
|
|
try{
|
|
const payload = {
|
|
'offset': 0,
|
|
'limit': 1
|
|
};
|
|
|
|
const options = {
|
|
headers: {
|
|
'wazuh-app-version': packageJSON.version
|
|
},
|
|
username: apiEntry.user,
|
|
password: apiEntry.password,
|
|
rejectUnauthorized: !apiEntry.insecure
|
|
};
|
|
|
|
const response = await needle('get', `${getPath(apiEntry)}/agents`, payload, options)
|
|
|
|
if (!response.error && response.body.data && response.body.data.totalItems) {
|
|
checkStatus(apiEntry, response.body.data.totalItems);
|
|
} else {
|
|
log('[monitoring][checkAndSaveStatus]', 'Wazuh API credentials not found or are not correct. Open the app in your browser and configure it to start monitoring agents.');
|
|
server.log([blueWazuh, 'monitoring', 'error'], 'Wazuh API credentials not found or are not correct. Open the app in your browser and configure it to start monitoring agents.');
|
|
}
|
|
return;
|
|
} catch(error){
|
|
log('[monitoring][checkAndSaveStatus]',error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'error'], error.message || error);
|
|
}
|
|
};
|
|
|
|
// Load Wazuh API credentials from Elasticsearch document
|
|
const loadCredentials = async apiEntries => {
|
|
try {
|
|
if (typeof apiEntries === 'undefined' || !('hits' in apiEntries)) return;
|
|
|
|
const filteredApis = apiEntries.hits.filter((element, index, self) =>
|
|
index === self.findIndex((t) => (
|
|
t._source.api_user === element._source.api_user &&
|
|
t._source.api_password === element._source.api_password &&
|
|
t._source.url === element._source.url &&
|
|
t._source.api_port === element._source.api_port
|
|
))
|
|
);
|
|
|
|
for(let element of filteredApis) {
|
|
let apiEntry = {
|
|
'user': element._source.api_user,
|
|
'password': Buffer.from(element._source.api_password, 'base64').toString("ascii"),
|
|
'url': element._source.url,
|
|
'port': element._source.api_port,
|
|
'insecure': element._source.insecure
|
|
};
|
|
if (apiEntry.error) {
|
|
log('[monitoring][loadCredentials]', apiEntry.error || apiEntry);
|
|
server.log([blueWazuh, 'monitoring', 'error'], `Error getting wazuh-api data: ${apiEntry.error}`);
|
|
break;
|
|
}
|
|
await checkAndSaveStatus(apiEntry);
|
|
}
|
|
return { result: 'ok' }
|
|
} catch(error){
|
|
log('[monitoring][loadCredentials]',error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'error'], error.message || error);
|
|
}
|
|
};
|
|
|
|
// Get API configuration from elastic and callback to loadCredentials
|
|
const getConfig = async () => {
|
|
try {
|
|
const data = await wzWrapper.getWazuhAPIEntries();
|
|
|
|
if (data.hits.total > 0) {
|
|
return data.hits;
|
|
}
|
|
|
|
log('[monitoring][getConfig]','no credentials');
|
|
return {
|
|
error : 'no credentials',
|
|
error_code: 1
|
|
};
|
|
|
|
} catch (error){
|
|
log('[monitoring][getConfig]',error.message || error);
|
|
return {
|
|
error : 'no elasticsearch',
|
|
error_code: 2
|
|
};
|
|
}
|
|
};
|
|
|
|
// fetchAgents on demand
|
|
const fetchAgentsExternal = async () => {
|
|
try {
|
|
const data = await getConfig();
|
|
return loadCredentials(data);
|
|
} catch(error){
|
|
return Promise.reject(error);
|
|
}
|
|
};
|
|
|
|
// Configure Kibana patterns.
|
|
const configureKibana = async () => {
|
|
try {
|
|
log('[monitoring][configureKibana]', `Creating index pattern: ${index_pattern}`, 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], `Creating index pattern: ${index_pattern}`);
|
|
|
|
await wzWrapper.createMonitoringIndexPattern(index_pattern);
|
|
|
|
log('[monitoring][configureKibana]', `Created index pattern: ${index_pattern}`, 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], `Created index pattern: ${index_pattern}`);
|
|
|
|
return;
|
|
} catch(error) {
|
|
log('[monitoring][configureKibana]',error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'error'], 'Error creating index-pattern due to ' + error);
|
|
}
|
|
};
|
|
|
|
// Creating wazuh-monitoring index
|
|
const createIndex = async todayIndex => {
|
|
try {
|
|
await wzWrapper.createIndexByName(todayIndex);
|
|
log('[monitoring][createIndex]', 'Successfully created today index.', 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], 'Successfully created today index.');
|
|
await insertDocument(todayIndex);
|
|
return;
|
|
} catch (error) {
|
|
log('[monitoring][createIndex]', error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'error'], `Could not create ${todayIndex} index on elasticsearch due to ` + error.message || error);
|
|
}
|
|
};
|
|
|
|
// Inserting one document per agent into Elastic. Bulk.
|
|
const insertDocument = async todayIndex => {
|
|
try {
|
|
let body = '';
|
|
if (agentsArray.length > 0) {
|
|
let managerName = agentsArray[0].name;
|
|
|
|
for(let element of agentsArray) {
|
|
body += '{ "index": { "_index": "' + todayIndex + '", "_type": "wazuh-agent" } }\n';
|
|
let date = new Date(Date.now()).toISOString();
|
|
element["@timestamp"] = date;
|
|
element["host"] = managerName;
|
|
body += JSON.stringify(element) + "\n";
|
|
}
|
|
if (body === '') return;
|
|
|
|
const response = await wzWrapper.pushBulkAnyIndex(todayIndex,body);
|
|
|
|
agentsArray.length = 0;
|
|
}
|
|
return;
|
|
} catch (error) {
|
|
log('[monitoring][insertDocument]', error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'error'], 'Error inserting agent data into elasticsearch. Bulk request failed due to ' + error.message || error);
|
|
}
|
|
};
|
|
|
|
// Save agent status into elasticsearch, create index and/or insert document
|
|
const saveStatus = async () => {
|
|
try {
|
|
fDate = new Date().toISOString().replace(/T/, '-').replace(/\..+/, '').replace(/-/g, '.').replace(/:/g, '').slice(0, -7);
|
|
todayIndex = index_prefix + fDate;
|
|
|
|
const result = await wzWrapper.checkIfIndexExists(todayIndex);
|
|
|
|
result ? await insertDocument(todayIndex) : await createIndex(todayIndex);
|
|
|
|
return;
|
|
|
|
} catch (error) {
|
|
log('[monitoring][saveStatus]', `Could not check if the index ${todayIndex} exists due to ${error.message || error}`);
|
|
server.log([blueWazuh, 'monitoring', 'error'], `Could not check if the index ${todayIndex} exists due to ` + error);
|
|
}
|
|
};
|
|
|
|
const createWazuhMonitoring = async () => {
|
|
try{
|
|
|
|
try{
|
|
await wzWrapper.deleteMonitoring();
|
|
|
|
log('[monitoring][createWazuhMonitoring]', 'Successfully deleted old wazuh-monitoring pattern.', 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], "Successfully deleted old wazuh-monitoring pattern.");
|
|
} catch (error) {
|
|
log('[monitoring][createWazuhMonitoring]', 'No need to delete old wazuh-monitoring pattern.', 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], "No need to delete old wazuh-monitoring pattern.");
|
|
}
|
|
|
|
await configureKibana();
|
|
return;
|
|
}catch(error){
|
|
return Promise.reject(error);
|
|
}
|
|
}
|
|
|
|
const checkTemplate = async () => {
|
|
try {
|
|
log('[monitoring][checkTemplate]', 'Updating wazuh-monitoring template...', 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], "Updating wazuh-monitoring template...");
|
|
const data = await wzWrapper.putMonitoringTemplate(monitoringTemplate);
|
|
return;
|
|
} catch(error){
|
|
log('[monitoring][checkTemplate]', 'Something went wrong updating wazuh-monitoring template...' + error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'info'], "Something went wrong updating wazuh-monitoring template..." + error.message || error);
|
|
return Promise.reject(error);
|
|
}
|
|
}
|
|
|
|
|
|
// Main. First execution when installing / loading App.
|
|
const init = async () => {
|
|
try {
|
|
|
|
log('[monitoring][init]', 'Creating/Updating wazuh-agent template...', 'info');
|
|
await checkTemplate();
|
|
|
|
log('[monitoring][init]', 'Creating today index...', 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], 'Creating today index...');
|
|
|
|
await saveStatus();
|
|
|
|
const patternId = 'index-pattern:' + index_pattern;
|
|
|
|
// Checks if wazuh-monitoring index pattern is already created, if it fails create it
|
|
try{
|
|
log('[monitoring][init]', 'Checking if wazuh-monitoring pattern exists...', 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], 'Checking if wazuh-monitoring pattern exists...');
|
|
await wzWrapper.getIndexPatternUsingGet(patternId);
|
|
} catch (error) {
|
|
log('[monitoring][init]', 'Didn\'t find wazuh-monitoring pattern for Kibana v6.x. Proceeding to create it...','info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], "Didn't find wazuh-monitoring pattern for Kibana v6.x. Proceeding to create it...");
|
|
return createWazuhMonitoring();
|
|
}
|
|
|
|
log('[monitoring][init]', 'Skipping wazuh-monitoring pattern creation. Already exists.', 'info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], 'Skipping wazuh-monitoring creation. Already exists.');
|
|
|
|
return;
|
|
|
|
} catch (error) {
|
|
server.log([blueWazuh, 'monitoring', 'error'], error.message || error);
|
|
log('[monitoring][init]', error.message || error);
|
|
return;
|
|
}
|
|
};
|
|
|
|
// Check Elasticsearch Server status and Kibana index presence
|
|
const checkElasticsearchServer = async () => {
|
|
try {
|
|
const data = await wzWrapper.checkIfIndexExists(wzWrapper.WZ_KIBANA_INDEX);
|
|
|
|
if (data) {
|
|
const pluginsData = await server.plugins.elasticsearch.waitUntilReady();
|
|
return pluginsData;
|
|
}
|
|
return Promise.reject(data);
|
|
} catch(error){
|
|
log('[monitoring][checkElasticsearchServer]',error.message || error);
|
|
return Promise.reject(error);
|
|
}
|
|
}
|
|
|
|
// Wait until Kibana server is ready
|
|
const checkKibanaStatus = async () => {
|
|
try {
|
|
log('[monitoring][checkKibanaStatus]','Waiting for Kibana and Elasticsearch servers to be ready...','info');
|
|
server.log([blueWazuh, 'monitoring', 'info'], 'Waiting for Kibana and Elasticsearch servers to be ready...');
|
|
await checkElasticsearchServer();
|
|
await init();
|
|
return;
|
|
} catch(error) {
|
|
log('[monitoring][checkKibanaStatus]',error.message || error);
|
|
server.log([blueWazuh, 'monitoring', 'info'], 'Waiting for Kibana and Elasticsearch servers to be ready...','info');
|
|
setTimeout(() => checkKibanaStatus(), 3000);
|
|
}
|
|
};
|
|
|
|
// Check Kibana index and if it is prepared, start the initialization of Wazuh App.
|
|
if(!options) checkKibanaStatus();
|
|
|
|
const cronTask = async () => {
|
|
try {
|
|
agentsArray = [];
|
|
const data = await getConfig();
|
|
await loadCredentials(data);
|
|
return;
|
|
} catch (error) {
|
|
log('[monitoring][cronTask]',error.message || error);
|
|
server.log([blueWazuh, 'monitoring [cronTask]', 'error'], error.message || error)
|
|
}
|
|
}
|
|
if(!options) cronTask()
|
|
// Cron tab for getting agent status.
|
|
if(!options) cron.schedule('0 */10 * * * *', cronTask, true);
|
|
return fetchAgentsExternal;
|
|
};
|