> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/ghoulsec-vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/ghoulsec-vault/security-operations/wazuh-open-source-xdr.-open-source-siem./installation/managing-multiple-wazuh-clusters-with-cross-cluster-search/cluster-configuration.md). # Cluster Configuration Clusters A & Cluster B will have the same configuration so we will cover the installation & configuration of Cluster A & we can follow the same for other clusters in the node. *** This remote Wazuh cluster collects, analyzes, and stores logs from Wazuh agents within the customer A environment. It consists of a Wazuh server that collects and analyzes log data from Wazuh agents and a Wazuh indexer that stores the Wazuh alerts. It can be configured as a single-node or multi-node Wazuh cluster. The Wazuh indexer node in cluster A trusts only the Wazuh indexer node in the CCS environment, allowing it to query its data. Alerts and log data reside in cluster A, but the CCS environment can only query the data but not store it. #### Generating certificates > **Note:** Make sure that a copy of the `root-ca.key` and `root-ca.pem` files created during the [CCS generating certificates](https://wazuh.com/blog/managing-multiple-wazuh-clusters-with-cross-cluster-search/#copy-the-root-ca) step are in your working directory. Download the `wazuh-certs-tool.sh` script and the `config.yml` configuration file. The `wazuh-certs-tool.sh` script is used to generate certificates for the cluster. ```bash curl -sO https://packages.wazuh.com/4.9/wazuh-certs-tool.sh curl -sO https://packages.wazuh.com/4.9/config.yml ``` Edit the `config.yml` file and replace the name and IP values with the corresponding node name and IP address for the Wazuh server and indexer: ```bash nodes: # Wazuh indexer nodes indexer: - name: ca-wazuh-indexer-1 ip: "192.168.146.155" # Wazuh server nodes server: - name: ca-wazuh-server-1 ip: "192.168.146.155" ``` > **Note:** Comment out or remove the Wazuh dashboard configuration since it is not in use. Run the `wazuh-certs-tool.sh` script with option `-A` and indicate the `root-ca` certificate and key created earlier to create the `admin`, and `node` certificates: ```bash bash ./wazuh-certs-tool.sh -A ./root-ca.pem ./root-ca.key ``` Compress all the certificate files and remove the uncompressed version to allow for easier transfer to other component nodes within cluster A: ```bash tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ . ``` *** #### Wazuh indexer installation ```bash apt-get install debconf adduser procps apt-get install gnupg apt-transport-https ``` Adding GPG Keys ```bash curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg ``` Adding Repository ```bash echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list ``` ```bash sudo apt update apt-get -y install wazuh-indexer ``` Edit the `/etc/wazuh-indexer/opensearch.yml` configuration file and replace the following values. * `network.host` with the IP address of the Wazuh indexer node. * `node.name` with the name of the Wazuh indexer node set in the `config.yml` file. * `cluster.initial_master_nodes` with the name of the Wazuh indexer node(s) in cluster A. * `cluster.name` with the name of the cluster. For example, `ca-cluster`. * `plugins.security.nodes_dn` with the distinguished name (DN) of the certificate for the cluster A Wazuh indexer node(s) and the CCS Wazuh indexer node. The common names (CN) will be replaced with the node names of the cluster A Wazuh indexer node and the CCS Wazuh indexer node. ```bash network.host: "192.168.146.155" <--CHANGE THIS--> node.name: "ca-wazuh-indexer-1"<--CHANGE THIS--> cluster.initial_master_nodes: - "ca-wazuh-indexer-1"<--CHANGE THIS--> #- "node-2" #- "node-3" cluster.name: "ca-cluster" <--CHANGE THIS--> #discovery.seed_hosts: # - "node-1-ip" # - "node-2-ip" # - "node-3-ip" plugins.security.nodes_dn: - "CN=ca-wazuh-indexer-1,OU=Wazuh,O=Wazuh,L=California,C=US" <--CHANGE THIS--> - "CN=ccs-wazuh-indexer-1,OU=Wazuh,O=Wazuh,L=California,C=US"<--CHANGE THIS--> #- "CN=node-3,OU=Wazuh,O=Wazuh,L=California,C=US" ``` Run the following commands, replacing `` with the value of `node.name` configured in the `/etc/wazuh-indexer/opensearch.yml` file: ```bash NODE_NAME=ca-wazuh-indexer-1 mkdir /etc/wazuh-indexer/certs tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem chmod 500 /etc/wazuh-indexer/certs chmod 400 /etc/wazuh-indexer/certs/* chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs ``` Enable and start the Wazuh indexer service: ```bash systemctl daemon-reload systemctl enable wazuh-indexer systemctl start wazuh-indexer ``` Run the Wazuh indexer `indexer-security-init.sh` script on the Wazuh indexer node to load the new certificate information and initialize the Wazuh indexer: ```bash /usr/share/wazuh-indexer/bin/indexer-security-init.sh ``` Check that the Wazuh indexer is initialized and correctly set up by running the following command: ```bash curl -k -u admin:admin https://192.168.146.155:9200 ``` The output should look like : ```bash { "name" : "ca-wazuh-indexer-1", "cluster_name" : "ca-cluster", "cluster_uuid" : "qsOmbP79SfqEM34sHH9I6g", "version" : { "number" : "7.10.2", "build_type" : "rpm", "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03", "build_date" : "2023-09-20T23:54:29.889267151Z", "build_snapshot" : false, "lucene_version" : "9.7.0", "minimum_wire_compatibility_version" : "7.10.0", "minimum_index_compatibility_version" : "7.0.0" }, "tagline" : "The OpenSearch Project: https://opensearch.org/" } ``` *** #### Wazuh server installation ```bash apt-get install gnupg apt-transport-https ## ADDING GPG KEYS curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg ## ADDING REPOSITORY echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list ## UPDATING PACKAGES apt-get update ``` Installing wazuh manager & filebeat ```bash apt-get -y install wazuh-manager apt-get -y install filebeat ``` Download the preconfigured Filebeat configuration file. ```bash curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/4.9/tpl/wazuh/filebeat/filebeat.yml ``` Edit the `/etc/filebeat/filebeat.yml` configuration file and enter the IP address of the cluster A Wazuh indexer node(s) in the hosts section: ```bash # Wazuh - Filebeat configuration file output.elasticsearch: hosts: ["192.168.10.101:9200"] ``` Create a Filebeat keystore to securely store authentication credentials and add the default username and password `admin`:`admin` to the secrets keystore: ```bash filebeat keystore create echo admin | filebeat keystore add username --stdin --force echo admin | filebeat keystore add password --stdin --force ``` Download the alerts template for the Wazuh indexer and grant appropriate read permissions: ```bash curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.9.2/extensions/elasticsearch/7.x/wazuh-template.json chmod go+r /etc/filebeat/wazuh-template.json ``` Install the Wazuh module for Filebeat: ```bash curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | tar -xvz -C /usr/share/filebeat/module ``` Replace `` with the cluster A Wazuh server node name set in `config.yml` when creating the certificates, and move the certificates to their corresponding directories: ```bash NODE_NAME= ca-wazuh-server-1 <--CHANGE THIS--> mkdir /etc/filebeat/certs tar -xf ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem mv -n /etc/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem chmod 500 /etc/filebeat/certs chmod 400 /etc/filebeat/certs/* chown -R root:root /etc/filebeat/certs ``` Save the Wazuh indexer username and password into the Wazuh manager keystore using the `wazuh-keystore` tool: ```bash /var/ossec/bin/wazuh-keystore -f indexer -k username -v admin /var/ossec/bin/wazuh-keystore -f indexer -k password -v admin ``` Edit `/var/ossec/etc/ossec.conf` file to configure the indexer connection by adding the Wazuh indexer IP address to the `` section of the `` block: ```bash yes https://192.168.146.155:9200 <--CHANGE THIS--> /etc/filebeat/certs/root-ca.pem /etc/filebeat/certs/filebeat.pem /etc/filebeat/certs/filebeat-key.pem ``` Enable and start the Wazuh manager service and Filebeat service: ```bash systemctl daemon-reload systemctl enable wazuh-manager systemctl start wazuh-manager systemctl enable filebeat systemctl start filebeat ``` Run the following command to verify that Filebeat is successfully installed: ```bash filebeat test output ## THE OUTPUT SHOULD BE elasticsearch: https://192.168.10.101:9200... parse url... OK connection... parse host... OK dns lookup... OK addresses: 192.168.10.101 dial up... OK TLS... security: server's certificate chain verification is enabled handshake... OK TLS version: TLSv1.3 dial up... OK talk to server... OK version: 7.10.2 ``` *** Here we ve successfully configured the Cluster A , Similiarly we can configure other clusters with the same method In the next section we will configure the basic index patterns eo enable clusters in the centralized wazuh dashboard