Opensearch anomaly detection plugin

[Tomasz Buziak]

Hi,

In the article below, there is Anomaly Detection - OpenSearch Plugin. 
https://varularora.medium.com/how-the-new-version-of-wazuh-4-3-is-more-user-friendly-28b0eccbdea7

How can it be added to Wazuh? I use 4.3.6.

[Jesus Linares]

Hi,

As you know, the Wazuh indexer and dashboard are based on OpenSearch and OpenSearch Dashboards. Since we didn't implement a full integration with the Anomaly detection plugin, we disabled it by default. If you want to enable it, you need to re-install it again in the Wazuh dashboard.

This is the guide of OpenSearch Dashboards to manage plugins: https://opensearch.org/docs/latest/dashboards/install/plugins/.

I hope it helps.

[Tomasz Buziak]

Unfortunately, the plugin download address is invalid.

root@wazuh-1:~# sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin list

alertingD...@1.2.0.0
ganttChart...@1.2.0.0
indexManagem...@1.2.0.0
reportsD...@1.2.0.0
securityD...@1.2.0.0
wa...@4.3.6-4307

root@wazuh-1:~# sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin install opensearch-anomaly-detection
Found previous install attempt. Deleting...
Attempting to transfer from opensearch-anomaly-detection
Attempting to transfer from https://artifacts.opensearch.org/downloads/kibana-plugins/opensearch-anomaly-detection/opensearch-anomaly-detection-1.2.0.zip

Plugin installation was unsuccessful due to error "No valid url specified."

AccessDeniedAccess DeniedB994DEER3XTMT202EUGGR1DYhYgnK/dC6AFwJuguvSedjfoIBvzDnqnyEwy6qNj5lFG5FxRznxHU8oQMQ4deAjEPwqU=

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/265dc2bd-9365-44f1-980f-dc8404a19366n%40googlegroups.com.

[Jesus Linares]

Yes, I got the same error:

Attempting to transfer from opensearch-anomaly-detection
Attempting to transfer from https://artifacts.opensearch.org/downloads/kibana-plugins/opensearch-anomaly-detection/opensearch-anomaly-detection-1.2.0.zip
Plugin installation was unsuccessful due to error "No valid url specified.

It looks like the artifact is missing. You could open an issue in their repository: https://github.com/opensearch-project/OpenSearch-Dashboards.

I hope it helps.

[Jesus Linares]

Hi,

Please, try the following commands:

• /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin install https://ci.opensearch.org/ci/dbc/bundle-build-dashboards/1.2.0/512/linux/x64/builds/plugins/anomalyDetectionDashboards-1.2.0.zip
• systemctl restart wazuh-dashboard

I hope it helps.

[Tomasz Buziak]

It works, thank you very much.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/82d5b909-ee69-4c88-9721-79398a9138c6n%40googlegroups.com.