URL geolocation

[German DiCasas]

Hi team,

I have  a lan with all closed port-link-ip etc. I did the permit some links to update wazuh, permit some integration and others. But, I cant visualize the map over Visualizacion -> Coordinate Map or Region Map. I mean that I can´t see the image of the map.

You do know the url to permit see the map on visualize?

I attached the map and the one with problem that I cant see the map


German

[Manuel Roldan]

Hi German,

To visualize the maps in Visualization -> Coordinate Map or Region Map in Wazuh, you must allow access to specific map services. Please ensure your firewall or network settings permit access to the following domains:

• maps.googleapis.com
• mt0.google.com
• mt1.google.com
• mt2.google.com
• mt3.google.com
• maps.gstatic.com

[German DiCasas]

Do you know the ports needed over each? 

Thanks Manuel

[German DiCasas]

I added those urls but same situation. I can see that use 80 and 443  ports correct?

Over other wazuh , with internet fre access ,  I can check those access correctly and work. But, the first wazuh I gave those urls to still doesn't work

Regards

German

[Manuel Alejandro Roldan Mella]

Hi German,

First, check if you can access the necessary URLs from the server where Wazuh is installed using the following command: curl -I https://maps.googleapis.com; also, you could temporarily configure free access to the internet to test if that is the problem. 

Manuel,

[German DiCasas]

Manuel,

I tested  curl -I https://maps.googleapis.com and the rx is:

HTTP/2 302
location: https://developers.google.com/maps/
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 03 Jun 2024 13:28:13 GMT
server: sffe
content-length: 232
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

 But no image of the map. I gave it free access for a few minutes and it worked. DO you know what access can be  needed?

Regards

[Manuel Alejandro Roldan Mella]

Hi Germán,

Please allow me some time to check for a solution. I'll get back to you shortly.

[Manuel Alejandro Roldan Mella]

Hi,

I have reviewed the issue with the maps in your dashboards and found that the map tiles are being loaded from OpenSearch. The URLs you need to allow in your firewall are as follows:

• https://tiles.maps.opensearch.org/tiles/1/1/1.png?osd_version=&opensearch_tos_agree=true
• https://maps.opensearch.org/tiles/7.2/styles/osm-desaturated.json?osd_version=&opensearch_tos_agree=true

[German DiCasas]

Hi Manuel,

Those access was granted and same situation. What else can bee? let me know.

Regards

[Manuel Alejandro Roldan Mella]

Hi German,

Check the firewall logs or the device you are using to restrict traffic. You can see which requests are being denied

[German DiCasas]

HI Manuel,

I just tried free internet again and it is not the problem or wazuh's access to the internet. I mean, with free internet not work the map too. Apparently it's something else. Let me know if you need some logs .

In a previous message I indicated that it works with the Internet but that information is incorrect. typing error. It doesn't work with free internet either. What can be?

Regards,

German

[Manuel Alejandro Roldan Mella]

Hi,

You could review  Opensearch logs: cat /var/log/opensearch/opensearch.log

Also, please give me more info about your setup:

• What version of Wazuh and OpenSearch are you using?
• Is this a new installation or an upgrade from a previous version?
• Are Wazuh Dashboard and OpenSearch installed on the same machine or separate machines?
  
• Did the problem start after a recent update or configuration change?
• Have the maps ever displayed correctly, or have they never worked since installation?
  
  
  

[German DiCasas]

Hi,

The wazuh in 4.7.5. All in one install.  It is a old install that was working without that error. Al the services are on the same machine.  The problem start, I think,  after last update from 4.7.3 to 4.7.5.   The dashboard of the map it is new.

cat /var/log/opensearch/opensearch.log
cat: /var/log/opensearch/opensearch.log: No such file or directory

 curl -X GET "http://localhost:9200"
curl: (52) Empty reply from server

Let me know if you need more info.

Regards

German

[Manuel Alejandro Roldan Mella]

First, let's check if the OpenSearch service is running. Please execute the following command: sudo systemctl status opensearch , If the service is not running, try starting it sudo systemctl start opensearch

[German DiCasas]

Manuel,

These are the outputs of these commands. Let me know

root@siem:/home/siem# sudo systemctl status opensearch
Unit opensearch.service could not be found.
root@siem:/home/siem# sudo systemctl start opensearch
Failed to start opensearch.service: Unit opensearch.service not found.

Regards

German

[Manuel Alejandro Roldan Mella]

Hi German,

please try /var/ossec/bin/wazuh-control status
If some daemons are in status not running please run /var/ossec/bin/wazuh-control restart

If nor start properly, then check /var/ossec/logs/ossec.log

I hope this helps