Upgrade 4.8.0 - Vulnerability Dashboard seems to have some issues

[syed saifulla]

Hi Team,

After Updating the Wazuh to 4.8.0, I am facing this issue with the Vulnerability dashboard.

Can someone, please help here.

[syed saifulla]

Team, Any Solution for this ?

[Lamya Imam]

Hello syed saifulla,

Could you please share the architecture of your deployment, whether the setup is an all-in-one deployment or a distributed environment?

Also, check the Wazuh keystore authentication with credentials, using the following command: 
/var/ossec/bin/wazuh-keystore -f indexer -k username -v <INDEXER_USERNAME>
/var/ossec/bin/wazuh-keystore -f indexer -k password -v <INDEXER_PASSWORD>

The default step-by-step installation credentials are admin: admin 
where  <INDEXER_USERNAME> = admin and  <INDEXER_PASSWORD> = your wazuh password

Let me know!

[syed saifulla]

It's an all-in-one deployment, Using Wazuh OVA. 

it was all fine till the upgrade. 

I did check the Credentials and Used the Wazuh password tools to change the Password and Also used the below cmd to update the credentials.

/var/ossec/bin/wazuh-keystore -f indexer -k username -v <INDEXER_USERNAME>
/var/ossec/bin/wazuh-keystore -f indexer -k password -v <INDEXER_PASSWORD>

Syed.

[Lamya Imam]

Hi Syed saifulla,

Could you please try and restart the Wazuh indexer and check if it's working now, using the command:
systemctl restart wazuh-indexer

Let me know if the issue persists!

Regards,

Lamya Imam Security Engineer, Operations

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/g0q5eTWCbGM/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/ff3bcd8f-3b14-416e-b5bb-7a0eb55d45adn%40googlegroups.com.

[syed saifulla]

Also, if you see the error, I guess it is something related to Indexer not sure. 

[syed saifulla]

tried it multiple times and also tried now, But no luck.

Syed

On Monday 1 July 2024 at 10:23:27 UTC+1 Lamya Imam wrote:

[Lamya Imam]

Hi syed saifulla!

Please share the output of these commands:
# cat /var/ossec/logs/ossec.log | grep indexer-connector
# cat /var/ossec/logs/ossec.log | grep vulnerability

After that, 

Go to Dashboards Management > Index patterns > click on the index pattern (wazuh-states-vulnerabilities-*) and then click on Refresh field list [Added screenshot for reference]

Also, check from Discover > select the index pattern (wazuh-states-vulnerabilities-*) > type cluster on the search the field name > check the wazuh.cluster.name [As shown in the screenshot] 

Please share your findings here and keep me updated on how it goes.  

[syed saifulla]

Hi Lamya,

Please find the screenshots and the logs, I did try to disable and enable the indexer just to make sure, which might have been recorded in the logs.

Also when I type cluster in the discover search I don't find any results, I have attached the screenshot with and with out it. 

Thanks 

[Lamya Imam]

Hello syed saifulla,

I appreciate your effort in trying to disable and enable the indexer, just in case. It seems that the logs and screenshots were not attached to the mail. Could you please resend them?
Your proactive steps are helpful, and having the logs will allow us to understand any changes that were recorded during this process.

Thanks

[syed saifulla]

I seem to have forgotten to attach the files. I have reattached them for your reference.

[syed saifulla]

Hi Team,

Do you need anything other information form me?

Syed 

[Lamya Imam]

Hello syed saifulla!

Please allow me some time to discuss this with my team and i will get back to you as soon as possible.

[Lamya Imam]

Hi syed saifulla!

It appears you are facing an unexpected issue, which is quite unusual. To help us understand and resolve this anomaly, I recommend that you open an issue on our GitHub repository. Please provide detailed information about the problem you are experiencing. So our developer team can look into this while planning future development. You can submit your issue at the following link:
https://github.com/wazuh/wazuh/issues

Kind regards

[syed saifulla]

Sure. Thanks