How to add a host server to wazuh dashboard

[Jithin Davis]

Hi

\can you let me know the steps to add a host server(were manager is installed) to the dashboard. This is a linux(ubuntu server).We are able to add additional servers in the network, but unable to add the hostserver to the wazuh dashboard.

Is it possible?

Thanks

[Christian Bassey]

Hi Jithin,

Thank you for using Wazuh!

The server where the manager is installed is already added to the Wazuh dashboard. Security events and other data for it can be found by filtering for the agent ID 000 on the Wazuh dashboard.

I hope this helps. Best.

[Jithin Davis]

Hi Christian

Thanks for the reply,

But i am unable to find the agent with the ID 000 in my dashboard, I am attaching the screenshot for your reference.

Expecting a reply from you

Thanks

[Christian Bassey]

Hi Jithin,

Please navigate to modules > security events. 

- Switch from the dashboard tab to the events tab.

- On the left hand side, you would see options you can filter by. 

- Scroll to the agents.id option and click on it. You would see all your agent IDs and the ID 000. Select it to view your manager events.

Best.

[Jithin Davis]

Hi all

I am still unable to see the agent id 000, please see the screenshot below

Any assistance would be helpful,

[Christian Bassey]

Hi Jithin,


You can also add a filter, select the field to filter by as agent.id and its value is 000

Best.

[Jithin Davis]

Hi Christian

Thanks for the reply

But still unable to see the values by filtering

I have checked this via backend too

I can see the 000 is available in agent_control list (please see the screenshot) Is there any way to add the same to available agents, Please see the screenshot below


Thanks

[Christian Bassey]

Hi Jithin,

What version of Wazuh are you running? 

Additionally you can try to filter  by the hostname of your Wazuh server.

[Jithin Davis]

Hi Christian,

Thanks for the reply,

I have filtered using the "agent_name" but still there is no values, Please see the screenshot attached

The version details is listed below

WAZUH_VERSION="v4.2.1"
Kibana version: "version": "7.10.2",

Any help would be appreciated. 

Thanks

[Christian Bassey]

Hi Jithin, 

What sort of architecture are you running?

Is this a fresh install of 4.2.1?

Can I see your ossec.conf? (please remove all sensitive information before sending it.)


Additionally, Please try to generate an event against the manager e.g failed SSH authentication and grep for its alert.

tail -f /var/ossec/logs/alerts/alerts.json | grep \"id\":\"000\"

[Jithin Davis]

Hi Christian

I have tried to generate an alert but its not showing while checking the logs, attaching screenshot

I can see all the results of attached servers

can't see any data of hostserver, Is there anything needs to be add on the ossec.conf file?

Note: I have forwarded the ossec.conf file in your personal wall

ANy help would be really appreciated

Thanks

[Christian Bassey]

Hi Jithin,

I saw the configuration file. I replied, but in the event you did not get that, the reply is below:

Hi Jithin,

Please lower the log alert level to 3, restart the manager and try to generate multiple failed ssh authentication alerts. I want to confirm that the reason why you are not seeing alerts from the manager is not because the alerts generated are lower than the log_alert_level threshold.
Change 
<log_alert_level>8</log_alert_level>
to
<log_alert_level>3</log_alert_level>

[Jithin Davis]

Hi Christian,

I really appreciate your kindness for following-up.

As per your suggestion, i have changed the log_alert_level value and tried a ssh authentication failure. I can see now the logs are generating in the alert.json file using the following command

tail -f /var/ossec/logs/alerts/alerts.json | grep \"id\":\"000\"

Please see the screenshot

But still there are no alerts generated in the dashboard, i have filtered again using agent_name and agent_id

Thanks

[Christian Bassey]

Hi Jithin,

It looks like alerts are being generated but are not getting sent to elasticsearch. Please run the commands below on the Wazuh manager and provide the output so we can see the status of filebeat.

systemctl status filebeat

filebeat test output

[Jithin Davis]

Hi Christian,

Thanks for the reply

filebeat service showing as active

I can see that the alerts are showing now for the hostserver,

Seems like changing <log_alert_level> fixed the issue

Thank you very much for your help...

However, can you let me know what could've caused this issue?

Once again thanks for your support

Regards
Jithin

[Christian Bassey]

Hi Jithin, 

Glad to know you can see alerts for the host server now.

The <log_alert_level> specifies the minimum level an alert should be for it to be sent to elasticsearch. In your case, the level was 8. 
I took a look at a hostserver in my lab and realized that under normal operation, the alerts from it were all under 8 which is why I suggested you modify the log alert level.

Best.

[Jithin Davis]

Hi Christian

Thanks for your reply

Is it advisable to keep the alert level 3?

Will it affect other servers?

Thanks

[Christian Bassey]

Alert level 3 is the default alert level Wazuh uses. I suggest you take a look at the alert level classification here and decide what minimum alert level will fit your environment.