From f6cd52514e6318f349bc1fcd3dbc3ef6726f3786 Mon Sep 17 00:00:00 2001 From: Antonio <34042064+Desvelao@users.noreply.github.com> Date: Fri, 11 Aug 2023 13:55:24 +0200 Subject: [PATCH] Merge 4.5.1-7.10 into 4.5.2-7.10 (#5779) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Merge 4.5.0-7.10 into 4.5.1-7.10 (#5724) * [Backport 4.5.0-7.10] Update test snapshots for 4.5 (#5603) Update test snapshots for 4.5 (#5601) * Add missing supported versions to the Docker environments (#5584) feat(environments): add latest versions to Docker environments - Add Kibana versions: 7.17.7, 7.17.8, 7.17.9 and 7.17.10 - Add OpenSearch: 2.6.0 - Add OpenSearch Dashboards: 2.6.0 - Add Wazuh 4.4.1, 4.4.2, 4.4.3 and 4.4.4 * Update test snapshost * Update API data to 4.5 * Update branch patterns for GH Actions --------- Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com> (cherry picked from commit 1ae5f19a9edc967187b2d946aad6e8d8f0afff14) Co-authored-by: Álex Ruiz * Fix API reference links in endpoints.json * Merge 4.4 7.10 into 4.5.0 7.10 (#5693) Merge v4.4.5-7.10.2 into 4.4-7.10 (#5667) * [Backport 4.4.5-7.10] Bump Wazuh and platform versions for v4.4.5 (#5639) (#5642) * Bump Wazuh and platform versions for v4.4.5 (#5639) * Update changelog * Update opensearch_dashboards.json * Update package.json * Update readme * Update tag script (cherry picked from commit b33c4a5dfcc4349dd0c4635f8b242f5208f17722) * Bump Wazuh and platform versions for v4.4.5 (#5639) * Update changelog * Update opensearch_dashboards.json * Update package.json * Update readme * Update tag script (cherry picked from commit b33c4a5dfcc4349dd0c4635f8b242f5208f17722) --------- * [Backport 4.4.5-7.10] Prepare tag.py for v4.4.5-rc1 (#5648) Prepare tag.py for v4.4.5-rc1 (#5645) Add -rc1 tag suffix (cherry picked from commit c10eb4eef3cec095d1c9db8e2e927bcf53e5345c) * Fix incompatible version of triple-beam subdependency (#5651) fix: add yarn.lock file and set version of triple-beam in yarn.lock * [Backport 4.4.5-7.10] Update unit-test.yml (#5656) Update unit-test.yml (#5655) (cherry picked from commit 29ec6f9522aafb12b9c3af280afc8624ce1d3cd0) * [Backport 4.4.5-7.10] Add support for Wazuh 4.4.5-rc2 (#5660) * Add support for Wazuh 4.4.5-rc2 (#5659) (cherry picked from commit 1103a0cc1d09c957024b2626f1072e4383fb524b) * Update revision of v4.4.5 in the Changelog --------- * Bump v4.4.5-7.10.2-rc2 --------- Co-authored-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com> Co-authored-by: Nicolas Agustin Guevara Pihen <42900763+Tostti@users.noreply.github.com> Co-authored-by: Álex Ruiz Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * [Backport 4.5.0-7.10] Update release utilities (#5715) Update release utilities (#5677) * feat: update release utilities to current process - Add new bump script - Port tag.py to NodeJS and allow receive parameters from stdin - Add RELEASING.md file with information about the release process related to the usage of the included scripts - Add release:bump and release:tag package scripts to run these process * remove: remove scripts/tag.py and reference in the Makefile * fix: fix help text in bump and tag scripts * remove: remove stage and commit properties from the package.json * remove: test related to stage property in the package.json * fix: check if there are changes to commit in the tag script - Code formatting - Fix variable name (cherry picked from commit e6caddc1989bd5433d901c0f0b3bf5629ba316ff) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Álex Ruiz Co-authored-by: Maximiliano Ibarra <6089438+Machi3mfl@users.noreply.github.com> Co-authored-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com> Co-authored-by: Nicolas Agustin Guevara Pihen <42900763+Tostti@users.noreply.github.com> * [Backport 4.5.1-7.10] Fix API request to get the manager labels and broken documentation link (#5730) Fix API request to get the manager labels and broken documentation link (#5687) * fix: broken documentation link * changelog: add pull request entry * fix: changed API endpoint to get the manager labels and managing the data to render * changelog: add pull request entry * changelog: fix entry * changelog: fix entry * Add response to imposter --------- Co-authored-by: yenienserrano (cherry picked from commit 6a181729b7ce6fa6f2f05f986379c9a1d4785ce4) * [Backport 4.5.1-7.10] Fix server side query in pdf report filter (#5732) * Backport 5417 * Add comments * Add changelog * Fix deep clone filters * Fix server side requirement query * Fix rootkit filter * [Backport 4.5.1-7.10] Update API data for 4.5.1 (#5759) Update API data for 4.5.1 (#5758) update: API data (cherry picked from commit db9a2c781f95ab10cd3b1bb9ba5fae1acec8ad1e) Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com> * [Backport 4.6.0-7.10] Fix outdated year in PDF report footer (#5768) Fix outdated year in PDF report footer (#5766) * Fix year in PDF footer * Modify changelog * Change tests to match the new value * Change md5 in reporting test * Change md5 in reporting test * Revert accidental change * Revert accidental change * Fix md5 in test * Change md5 in test * Change md5 in test (cherry picked from commit a997dcf1ae7006b0b1a4675777382ac63822a23a) * Merge 4.5-7.10 into 4.5.1-7.10 (#5776) * [Backport 4.5.0-7.10] Update test snapshots for 4.5 (#5603) Update test snapshots for 4.5 (#5601) * Add missing supported versions to the Docker environments (#5584) feat(environments): add latest versions to Docker environments - Add Kibana versions: 7.17.7, 7.17.8, 7.17.9 and 7.17.10 - Add OpenSearch: 2.6.0 - Add OpenSearch Dashboards: 2.6.0 - Add Wazuh 4.4.1, 4.4.2, 4.4.3 and 4.4.4 * Update test snapshost * Update API data to 4.5 * Update branch patterns for GH Actions --------- Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com> (cherry picked from commit 1ae5f19a9edc967187b2d946aad6e8d8f0afff14) Co-authored-by: Álex Ruiz * Fix API reference links in endpoints.json * Merge 4.4 7.10 into 4.5.0 7.10 (#5693) Merge v4.4.5-7.10.2 into 4.4-7.10 (#5667) * [Backport 4.4.5-7.10] Bump Wazuh and platform versions for v4.4.5 (#5639) (#5642) * Bump Wazuh and platform versions for v4.4.5 (#5639) * Update changelog * Update opensearch_dashboards.json * Update package.json * Update readme * Update tag script (cherry picked from commit b33c4a5dfcc4349dd0c4635f8b242f5208f17722) * Bump Wazuh and platform versions for v4.4.5 (#5639) * Update changelog * Update opensearch_dashboards.json * Update package.json * Update readme * Update tag script (cherry picked from commit b33c4a5dfcc4349dd0c4635f8b242f5208f17722) --------- * [Backport 4.4.5-7.10] Prepare tag.py for v4.4.5-rc1 (#5648) Prepare tag.py for v4.4.5-rc1 (#5645) Add -rc1 tag suffix (cherry picked from commit c10eb4eef3cec095d1c9db8e2e927bcf53e5345c) * Fix incompatible version of triple-beam subdependency (#5651) fix: add yarn.lock file and set version of triple-beam in yarn.lock * [Backport 4.4.5-7.10] Update unit-test.yml (#5656) Update unit-test.yml (#5655) (cherry picked from commit 29ec6f9522aafb12b9c3af280afc8624ce1d3cd0) * [Backport 4.4.5-7.10] Add support for Wazuh 4.4.5-rc2 (#5660) * Add support for Wazuh 4.4.5-rc2 (#5659) (cherry picked from commit 1103a0cc1d09c957024b2626f1072e4383fb524b) * Update revision of v4.4.5 in the Changelog --------- * Bump v4.4.5-7.10.2-rc2 --------- Co-authored-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com> Co-authored-by: Nicolas Agustin Guevara Pihen <42900763+Tostti@users.noreply.github.com> Co-authored-by: Álex Ruiz Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * [Backport 4.5.0-7.10] Update release utilities (#5715) Update release utilities (#5677) * feat: update release utilities to current process - Add new bump script - Port tag.py to NodeJS and allow receive parameters from stdin - Add RELEASING.md file with information about the release process related to the usage of the included scripts - Add release:bump and release:tag package scripts to run these process * remove: remove scripts/tag.py and reference in the Makefile * fix: fix help text in bump and tag scripts * remove: remove stage and commit properties from the package.json * remove: test related to stage property in the package.json * fix: check if there are changes to commit in the tag script - Code formatting - Fix variable name (cherry picked from commit e6caddc1989bd5433d901c0f0b3bf5629ba316ff) * Bump v4.5.0-7.10.2-alpha1 * Update CHANGELOG.md --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Álex Ruiz Co-authored-by: Maximiliano Ibarra <6089438+Machi3mfl@users.noreply.github.com> Co-authored-by: Nicolas Agustin Guevara Pihen <42900763+Tostti@users.noreply.github.com> Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com> Co-authored-by: Federico Rodriguez --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Álex Ruiz Co-authored-by: Maximiliano Ibarra <6089438+Machi3mfl@users.noreply.github.com> Co-authored-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com> Co-authored-by: Nicolas Agustin Guevara Pihen <42900763+Tostti@users.noreply.github.com> Co-authored-by: Federico Rodriguez --- CHANGELOG.md | 4 + common/api-info/endpoints.json | 8 +- common/constants.ts | 2 +- common/services/settings.test.ts | 115 ++++++++------- docker/imposter/agents/configuration.js | 15 ++ .../agents/configuration/agent_labels.json | 12 ++ .../agents/configuration/default.json | 33 +++++ .../cluster/configuration/agent_labels.json | 20 +++ docker/imposter/manager/configuration.js | 22 +++ .../manager/configuration/agent_labels.json | 20 +++ .../manager/configuration/default.json | 35 +++++ .../configuration/monitor_reports.json | 16 +++ docker/imposter/wazuh-config.yml | 6 + .../configuration/alerts/alerts-labels.js | 85 ++++------- .../management/configuration/alerts/alerts.js | 22 +-- public/react-services/reporting.js | 4 +- server/controllers/wazuh-reporting.ts | 16 ++- server/lib/reporting/base-query.ts | 45 ++---- server/lib/reporting/extended-information.ts | 2 +- server/lib/reporting/gdpr-request.ts | 27 ++-- server/lib/reporting/pci-request.ts | 30 ++-- server/lib/reporting/rootcheck-request.ts | 25 ++-- server/lib/reporting/tsc-request.ts | 44 +++--- server/routes/wazuh-reporting.test.ts | 136 +++++++++++++----- server/routes/wazuh-reporting.ts | 2 + 25 files changed, 466 insertions(+), 280 deletions(-) create mode 100644 docker/imposter/agents/configuration.js create mode 100644 docker/imposter/agents/configuration/agent_labels.json create mode 100644 docker/imposter/agents/configuration/default.json create mode 100644 docker/imposter/cluster/configuration/agent_labels.json create mode 100644 docker/imposter/manager/configuration.js create mode 100644 docker/imposter/manager/configuration/agent_labels.json create mode 100644 docker/imposter/manager/configuration/default.json create mode 100644 docker/imposter/manager/configuration/monitor_reports.json diff --git a/CHANGELOG.md b/CHANGELOG.md index c7311b063c..ee8c375a98 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,9 @@ All notable changes to the Wazuh app project will be documented in this file. - Fixed the rendering of tables that contains IPs and agent overview [#5471](https://github.com/wazuh/wazuh-kibana-app/pull/5471) - Fixed the agents active coverage stat as NaN in Details panel of Agents section [#5490](https://github.com/wazuh/wazuh-kibana-app/pull/5490) +- Fixed a broken documentation link to agent labels [#5687](https://github.com/wazuh/wazuh-kibana-app/pull/5687) +- Fixed the PDF report filters applied to tables [#5714](https://github.com/wazuh/wazuh-kibana-app/pull/5714) +- Fixed outdated year in the PDF report footer [#5766](https://github.com/wazuh/wazuh-kibana-app/pull/5766) ### Removed @@ -27,6 +30,7 @@ All notable changes to the Wazuh app project will be documented in this file. - Changed method to perform redirection on agent table buttons [#5539](https://github.com/wazuh/wazuh-kibana-app/pull/5539) - Changed windows agent service name in the deploy agent wizard [#5538](https://github.com/wazuh/wazuh-kibana-app/pull/5538) +- Changed the requests to get the agent labels for the managers [#5687](https://github.com/wazuh/wazuh-kibana-app/pull/5687) ## Wazuh v4.5.0 - Kibana 7.10.2, 7.16.x, 7.17.x - Revision 01 diff --git a/common/api-info/endpoints.json b/common/api-info/endpoints.json index e676b55387..a90e7e7ad4 100644 --- a/common/api-info/endpoints.json +++ b/common/api-info/endpoints.json @@ -279,7 +279,7 @@ }, { "name": ":configuration", - "description": "

Selected agent's configuration to read. The configuration to read depends on the selected component.\nThe following table shows all available combinations of component and configuration values:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentConfigurationTag
agentclient<client>
agentbuffer<client_buffer>
agentlabels<labels>
agentinternal<agent>, <monitord>, <remoted>
agentlessagentless<agentless>
analysisglobal<global>
analysisactive_response<active-response>
analysisalerts<alerts>
analysiscommand<command>
analysisrules<rule>
analysisdecoders<decoder>
analysisinternal<analysisd>
analysisrule_test<rule_test>
authauth<auth>
comactive-response<active-response>
comlogging<logging>
cominternal<execd>
comcluster<cluster>
csyslogcsyslog<csyslog_output>
integratorintegration<integration>
logcollectorlocalfile<localfile>
logcollectorsocket<socket>
logcollectorinternal<logcollector>
mailglobal<global><email...>
mailalerts<email_alerts>
mailinternal<maild>
monitorglobal<global>
monitorinternal<monitord>
monitorinternal<reports>
requestglobal<global>
requestremote<remote>
requestinternal<remoted>
syschecksyscheck<syscheck>
syscheckrootcheck<rootcheck>
syscheckinternal<syscheck>, <rootcheck>
wazuh-dbinternal<wazuh_db>
wazuh-dbwdb<wdb>
wmoduleswmodules<wodle>
\n", + "description": "

Selected agent's configuration to read. The configuration to read depends on the selected component.\nThe following table shows all available combinations of component and configuration values:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentConfigurationTag
agentclient<client>
agentbuffer<client_buffer>
agentlabels<labels>
agentinternal<agent>, <monitord>, <remoted>
agentlessagentless<agentless>
analysisglobal<global>
analysisactive_response<active-response>
analysisalerts<alerts>
analysiscommand<command>
analysisrules<rule>
analysisdecoders<decoder>
analysisinternal<analysisd>
analysisrule_test<rule_test>
authauth<auth>
comactive-response<active-response>
comlogging<logging>
cominternal<execd>
comcluster<cluster>
csyslogcsyslog<csyslog_output>
integratorintegration<integration>
logcollectorlocalfile<localfile>
logcollectorsocket<socket>
logcollectorinternal<logcollector>
mailglobal<global><email...>
mailalerts<email_alerts>
mailinternal<maild>
monitorglobal<global>
monitorinternal<monitord>
monitorreports<reports>
requestglobal<global>
requestremote<remote>
requestinternal<remoted>
syschecksyscheck<syscheck>
syscheckrootcheck<rootcheck>
syscheckinternal<syscheck>, <rootcheck>
wazuh-dbinternal<wazuh_db>
wazuh-dbwdb<wdb>
wmoduleswmodules<wodle>
\n", "required": true, "schema": { "type": "string", @@ -1229,7 +1229,7 @@ }, { "name": ":configuration", - "description": "

Selected agent's configuration to read. The configuration to read depends on the selected component.\nThe following table shows all available combinations of component and configuration values:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentConfigurationTag
agentclient<client>
agentbuffer<client_buffer>
agentlabels<labels>
agentinternal<agent>, <monitord>, <remoted>
agentlessagentless<agentless>
analysisglobal<global>
analysisactive_response<active-response>
analysisalerts<alerts>
analysiscommand<command>
analysisrules<rule>
analysisdecoders<decoder>
analysisinternal<analysisd>
analysisrule_test<rule_test>
authauth<auth>
comactive-response<active-response>
comlogging<logging>
cominternal<execd>
comcluster<cluster>
csyslogcsyslog<csyslog_output>
integratorintegration<integration>
logcollectorlocalfile<localfile>
logcollectorsocket<socket>
logcollectorinternal<logcollector>
mailglobal<global><email...>
mailalerts<email_alerts>
mailinternal<maild>
monitorglobal<global>
monitorinternal<monitord>
monitorinternal<reports>
requestglobal<global>
requestremote<remote>
requestinternal<remoted>
syschecksyscheck<syscheck>
syscheckrootcheck<rootcheck>
syscheckinternal<syscheck>, <rootcheck>
wazuh-dbinternal<wazuh_db>
wazuh-dbwdb<wdb>
wmoduleswmodules<wodle>
\n", + "description": "

Selected agent's configuration to read. The configuration to read depends on the selected component.\nThe following table shows all available combinations of component and configuration values:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentConfigurationTag
agentclient<client>
agentbuffer<client_buffer>
agentlabels<labels>
agentinternal<agent>, <monitord>, <remoted>
agentlessagentless<agentless>
analysisglobal<global>
analysisactive_response<active-response>
analysisalerts<alerts>
analysiscommand<command>
analysisrules<rule>
analysisdecoders<decoder>
analysisinternal<analysisd>
analysisrule_test<rule_test>
authauth<auth>
comactive-response<active-response>
comlogging<logging>
cominternal<execd>
comcluster<cluster>
csyslogcsyslog<csyslog_output>
integratorintegration<integration>
logcollectorlocalfile<localfile>
logcollectorsocket<socket>
logcollectorinternal<logcollector>
mailglobal<global><email...>
mailalerts<email_alerts>
mailinternal<maild>
monitorglobal<global>
monitorinternal<monitord>
monitorreports<reports>
requestglobal<global>
requestremote<remote>
requestinternal<remoted>
syschecksyscheck<syscheck>
syscheckrootcheck<rootcheck>
syscheckinternal<syscheck>, <rootcheck>
wazuh-dbinternal<wazuh_db>
wazuh-dbwdb<wdb>
wmoduleswmodules<wodle>
\n", "required": true, "schema": { "type": "string", @@ -4741,7 +4741,7 @@ }, { "name": ":configuration", - "description": "

Selected agent's configuration to read. The configuration to read depends on the selected component.\nThe following table shows all available combinations of component and configuration values:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentConfigurationTag
agentclient<client>
agentbuffer<client_buffer>
agentlabels<labels>
agentinternal<agent>, <monitord>, <remoted>
agentlessagentless<agentless>
analysisglobal<global>
analysisactive_response<active-response>
analysisalerts<alerts>
analysiscommand<command>
analysisrules<rule>
analysisdecoders<decoder>
analysisinternal<analysisd>
analysisrule_test<rule_test>
authauth<auth>
comactive-response<active-response>
comlogging<logging>
cominternal<execd>
comcluster<cluster>
csyslogcsyslog<csyslog_output>
integratorintegration<integration>
logcollectorlocalfile<localfile>
logcollectorsocket<socket>
logcollectorinternal<logcollector>
mailglobal<global><email...>
mailalerts<email_alerts>
mailinternal<maild>
monitorglobal<global>
monitorinternal<monitord>
monitorinternal<reports>
requestglobal<global>
requestremote<remote>
requestinternal<remoted>
syschecksyscheck<syscheck>
syscheckrootcheck<rootcheck>
syscheckinternal<syscheck>, <rootcheck>
wazuh-dbinternal<wazuh_db>
wazuh-dbwdb<wdb>
wmoduleswmodules<wodle>
\n", + "description": "

Selected agent's configuration to read. The configuration to read depends on the selected component.\nThe following table shows all available combinations of component and configuration values:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentConfigurationTag
agentclient<client>
agentbuffer<client_buffer>
agentlabels<labels>
agentinternal<agent>, <monitord>, <remoted>
agentlessagentless<agentless>
analysisglobal<global>
analysisactive_response<active-response>
analysisalerts<alerts>
analysiscommand<command>
analysisrules<rule>
analysisdecoders<decoder>
analysisinternal<analysisd>
analysisrule_test<rule_test>
authauth<auth>
comactive-response<active-response>
comlogging<logging>
cominternal<execd>
comcluster<cluster>
csyslogcsyslog<csyslog_output>
integratorintegration<integration>
logcollectorlocalfile<localfile>
logcollectorsocket<socket>
logcollectorinternal<logcollector>
mailglobal<global><email...>
mailalerts<email_alerts>
mailinternal<maild>
monitorglobal<global>
monitorinternal<monitord>
monitorreports<reports>
requestglobal<global>
requestremote<remote>
requestinternal<remoted>
syschecksyscheck<syscheck>
syscheckrootcheck<rootcheck>
syscheckinternal<syscheck>, <rootcheck>
wazuh-dbinternal<wazuh_db>
wazuh-dbwdb<wdb>
wmoduleswmodules<wodle>
\n", "required": true, "schema": { "type": "string", @@ -9701,7 +9701,7 @@ "required": true, "schema": { "type": "string", - "format": "wazuh_path" + "format": "wpk_path" } }, { diff --git a/common/constants.ts b/common/constants.ts index 8606b0459d..af0ad8411f 100644 --- a/common/constants.ts +++ b/common/constants.ts @@ -280,7 +280,7 @@ export const ASSETS_PUBLIC_URL = '/plugins/wazuh/public/assets/'; // Reports export const REPORTS_LOGO_IMAGE_ASSETS_RELATIVE_PATH = 'images/logo_reports.png'; export const REPORTS_PRIMARY_COLOR = '#256BD1'; -export const REPORTS_PAGE_FOOTER_TEXT = 'Copyright © 2022 Wazuh, Inc.'; +export const REPORTS_PAGE_FOOTER_TEXT = 'Copyright © 2023 Wazuh, Inc.'; export const REPORTS_PAGE_HEADER_TEXT = 'info@wazuh.com\nhttps://wazuh.com'; // Plugin platform diff --git a/common/services/settings.test.ts b/common/services/settings.test.ts index eeee05d52b..21efe9e414 100644 --- a/common/services/settings.test.ts +++ b/common/services/settings.test.ts @@ -1,60 +1,67 @@ import { - formatLabelValuePair, - formatSettingValueToFile, - getCustomizationSetting -} from "./settings"; + formatLabelValuePair, + formatSettingValueToFile, + getCustomizationSetting, +} from './settings'; describe('[settings] Methods', () => { + describe('formatLabelValuePair: Format the label-value pairs used to display the allowed values', () => { + it.each` + label | value | expected + ${'TestLabel'} | ${true} | ${'true (TestLabel)'} + ${'true'} | ${true} | ${'true'} + `( + `label: $label | value: $value | expected: $expected`, + ({ label, expected, value }) => { + expect(formatLabelValuePair(label, value)).toBe(expected); + }, + ); + }); - describe('formatLabelValuePair: Format the label-value pairs used to display the allowed values', () => { - it.each` - label | value | expected - ${'TestLabel'} | ${true} | ${'true (TestLabel)'} - ${'true'} | ${true} | ${'true'} - `(`label: $label | value: $value | expected: $expected`, ({ label, expected, value }) => { - expect(formatLabelValuePair(label, value)).toBe(expected); - }); - }); + describe('formatSettingValueToFile: Format setting values to save in the configuration file', () => { + it.each` + input | expected + ${'test'} | ${'"test"'} + ${'test space'} | ${'"test space"'} + ${'test\nnew line'} | ${'"test\\nnew line"'} + ${''} | ${'""'} + ${1} | ${1} + ${true} | ${true} + ${false} | ${false} + ${['test1']} | ${'["test1"]'} + ${['test1', 'test2']} | ${'["test1","test2"]'} + `(`input: $input | expected: $expected`, ({ input, expected }) => { + expect(formatSettingValueToFile(input)).toBe(expected); + }); + }); - describe('formatSettingValueToFile: Format setting values to save in the configuration file', () => { - it.each` - input | expected - ${'test'} | ${'\"test\"'} - ${'test space'} | ${'\"test space\"'} - ${'test\nnew line'} | ${'\"test\\nnew line\"'} - ${''} | ${'\"\"'} - ${1} | ${1} - ${true} | ${true} - ${false} | ${false} - ${['test1']} | ${'[\"test1\"]'} - ${['test1', 'test2']} | ${'[\"test1\",\"test2\"]'} - `(`input: $input | expected: $expected`, ({ input, expected }) => { - expect(formatSettingValueToFile(input)).toBe(expected); - }); - }); - - describe('getCustomizationSetting: Get the value for the "customization." settings depending on the "customization.enabled" setting', () => { - it.each` - customizationEnabled | settingKey | configValue | expected - ${true} | ${'customization.logo.app'} | ${'custom-image-app.png'} | ${'custom-image-app.png'} - ${true} | ${'customization.logo.app'} | ${''} | ${''} - ${false} | ${'customization.logo.app'} | ${'custom-image-app.png'} | ${''} - ${false} | ${'customization.logo.app'} | ${''} | ${''} - ${true} | ${'customization.reports.footer'} | ${'Custom footer'} | ${'Custom footer'} - ${true} | ${'customization.reports.footer'} | ${''} | ${'Copyright © 2022 Wazuh, Inc.'} - ${false} | ${'customization.reports.footer'} | ${'Custom footer'} | ${'Copyright © 2022 Wazuh, Inc.'} - ${false} | ${'customization.reports.footer'} | ${''} | ${'Copyright © 2022 Wazuh, Inc.'} - ${false} | ${'customization.reports.footer'} | ${''} | ${'Copyright © 2022 Wazuh, Inc.'} - ${true} | ${'customization.reports.header'} | ${'Custom header'} | ${'Custom header'} - ${true} | ${'customization.reports.header'} | ${''} | ${'info@wazuh.com\nhttps://wazuh.com'} - ${false} | ${'customization.reports.header'} | ${'Custom header'} | ${'info@wazuh.com\nhttps://wazuh.com'} - ${false} | ${'customization.reports.header'} | ${''} | ${'info@wazuh.com\nhttps://wazuh.com'} - `(`customizationEnabled: $customizationEnabled | settingKey: $settingKey | configValue: $configValue | expected: $expected`, ({ configValue, customizationEnabled, expected, settingKey }) => { - const configuration = { - 'customization.enabled': customizationEnabled, - [settingKey]: configValue - }; - expect(getCustomizationSetting(configuration, settingKey)).toBe(expected); - }); - }); + describe('getCustomizationSetting: Get the value for the "customization." settings depending on the "customization.enabled" setting', () => { + it.each` + customizationEnabled | settingKey | configValue | expected + ${true} | ${'customization.logo.app'} | ${'custom-image-app.png'} | ${'custom-image-app.png'} + ${true} | ${'customization.logo.app'} | ${''} | ${''} + ${false} | ${'customization.logo.app'} | ${'custom-image-app.png'} | ${''} + ${false} | ${'customization.logo.app'} | ${''} | ${''} + ${true} | ${'customization.reports.footer'} | ${'Custom footer'} | ${'Custom footer'} + ${true} | ${'customization.reports.footer'} | ${''} | ${'Copyright © 2023 Wazuh, Inc.'} + ${false} | ${'customization.reports.footer'} | ${'Custom footer'} | ${'Copyright © 2023 Wazuh, Inc.'} + ${false} | ${'customization.reports.footer'} | ${''} | ${'Copyright © 2023 Wazuh, Inc.'} + ${false} | ${'customization.reports.footer'} | ${''} | ${'Copyright © 2023 Wazuh, Inc.'} + ${true} | ${'customization.reports.header'} | ${'Custom header'} | ${'Custom header'} + ${true} | ${'customization.reports.header'} | ${''} | ${'info@wazuh.com\nhttps://wazuh.com'} + ${false} | ${'customization.reports.header'} | ${'Custom header'} | ${'info@wazuh.com\nhttps://wazuh.com'} + ${false} | ${'customization.reports.header'} | ${''} | ${'info@wazuh.com\nhttps://wazuh.com'} + `( + `customizationEnabled: $customizationEnabled | settingKey: $settingKey | configValue: $configValue | expected: $expected`, + ({ configValue, customizationEnabled, expected, settingKey }) => { + const configuration = { + 'customization.enabled': customizationEnabled, + [settingKey]: configValue, + }; + expect(getCustomizationSetting(configuration, settingKey)).toBe( + expected, + ); + }, + ); + }); }); diff --git a/docker/imposter/agents/configuration.js b/docker/imposter/agents/configuration.js new file mode 100644 index 0000000000..f1d3c93a34 --- /dev/null +++ b/docker/imposter/agents/configuration.js @@ -0,0 +1,15 @@ +var path = context.request.path; +var pathConfiguration = path.split('/'); +pathConfiguration.splice(0, 5); +console.log(pathConfiguration); +switch (pathConfiguration[0]) { + case 'labels': + respond() + .withStatusCode(200) + .withFile('agents/configuration/agent_labels.json'); + + break; + default: + respond().withStatusCode(200).withFile('agents/configuration/default.json'); + break; +} diff --git a/docker/imposter/agents/configuration/agent_labels.json b/docker/imposter/agents/configuration/agent_labels.json new file mode 100644 index 0000000000..a3bbe13481 --- /dev/null +++ b/docker/imposter/agents/configuration/agent_labels.json @@ -0,0 +1,12 @@ +{ + "data": { + "labels": [ + { + "value": "customLabel", + "key": "custom", + "hidden": "no" + } + ] + }, + "error": 0 +} diff --git a/docker/imposter/agents/configuration/default.json b/docker/imposter/agents/configuration/default.json new file mode 100644 index 0000000000..d97500d76f --- /dev/null +++ b/docker/imposter/agents/configuration/default.json @@ -0,0 +1,33 @@ +{ + "data": { + "client": { + "config-profile": "ubuntu, ubuntu20, ubuntu20.04", + "notify_time": 10, + "time-reconnect": 60, + "force_reconnect_interval": 0, + "ip_update_interval": 0, + "auto_restart": "yes", + "remote_conf": "yes", + "crypto_method": "aes", + "server": [ + { + "address": "nginx-lb/172.25.0.4", + "port": 1514, + "max_retries": 5, + "retry_interval": 10, + "protocol": "tcp" + } + ], + "enrollment": [ + { + "enabled": "yes", + "delay_after_enrollment": 20, + "port": 1515, + "ssl_cipher": "HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH", + "auto_method": "no" + } + ] + } + }, + "error": 0 +} diff --git a/docker/imposter/cluster/configuration/agent_labels.json b/docker/imposter/cluster/configuration/agent_labels.json new file mode 100644 index 0000000000..52edc2ea1d --- /dev/null +++ b/docker/imposter/cluster/configuration/agent_labels.json @@ -0,0 +1,20 @@ +{ + "data": { + "affected_items": [ + { + "labels": [ + { + "value": "customLabel", + "key": "custom", + "hidden": "no" + } + ] + } + ], + "total_affected_items": 1, + "total_failed_items": 0, + "failed_items": [] + }, + "message": "Active configuration was successfully read in specified node.", + "error": 0 +} diff --git a/docker/imposter/manager/configuration.js b/docker/imposter/manager/configuration.js new file mode 100644 index 0000000000..9b5a87219d --- /dev/null +++ b/docker/imposter/manager/configuration.js @@ -0,0 +1,22 @@ +var path = context.request.path; +var pathConfiguration = path.split('/'); +pathConfiguration.splice(0, 4); +switch (pathConfiguration[0]) { + case 'labels': + respond() + .withStatusCode(200) + .withFile('manager/configuration/agent_labels.json'); + + break; + case 'reports': + respond() + .withStatusCode(200) + .withFile('manager/configuration/monitor_reports.json'); + + break; + default: + respond() + .withStatusCode(200) + .withFile('manager/configuration/default.json'); + break; +} diff --git a/docker/imposter/manager/configuration/agent_labels.json b/docker/imposter/manager/configuration/agent_labels.json new file mode 100644 index 0000000000..52edc2ea1d --- /dev/null +++ b/docker/imposter/manager/configuration/agent_labels.json @@ -0,0 +1,20 @@ +{ + "data": { + "affected_items": [ + { + "labels": [ + { + "value": "customLabel", + "key": "custom", + "hidden": "no" + } + ] + } + ], + "total_affected_items": 1, + "total_failed_items": 0, + "failed_items": [] + }, + "message": "Active configuration was successfully read in specified node.", + "error": 0 +} diff --git a/docker/imposter/manager/configuration/default.json b/docker/imposter/manager/configuration/default.json new file mode 100644 index 0000000000..614c20c2f8 --- /dev/null +++ b/docker/imposter/manager/configuration/default.json @@ -0,0 +1,35 @@ +{ + "data": { + "affected_items": [ + { + "global": { + "email_notification": "no", + "logall": "no", + "logall_json": "no", + "integrity_checking": 8, + "rootkit_detection": 8, + "host_information": 8, + "prelude_output": "no", + "zeromq_output": "no", + "jsonout_output": "yes", + "alerts_log": "yes", + "stats": 4, + "memory_size": 8192, + "white_list": [ + "127.0.0.1", + "80.58.61.250", + "80.58.61.254", + "localhost.localdomain" + ], + "rotate_interval": 0, + "max_output_size": 0 + } + } + ], + "total_affected_items": 1, + "total_failed_items": 0, + "failed_items": [] + }, + "message": "Active configuration was successfully read in specified node", + "error": 0 +} diff --git a/docker/imposter/manager/configuration/monitor_reports.json b/docker/imposter/manager/configuration/monitor_reports.json new file mode 100644 index 0000000000..a611e47fbe --- /dev/null +++ b/docker/imposter/manager/configuration/monitor_reports.json @@ -0,0 +1,16 @@ +{ + "data": { + "affected_items": [{ + "reports": [{ + "category": "syscheck", + "title": "Daily report: File changes", + "email_to": "example@test.com" + }] + }], + "total_affected_items": 1, + "total_failed_items": 0, + "failed_items": [] + }, + "message": "Could not read active configuration in specified node", + "error": 0 +} \ No newline at end of file diff --git a/docker/imposter/wazuh-config.yml b/docker/imposter/wazuh-config.yml index 1cc5ca24b3..504af70112 100755 --- a/docker/imposter/wazuh-config.yml +++ b/docker/imposter/wazuh-config.yml @@ -50,6 +50,9 @@ resources: # Get active configuration - method: GET path: /agents/{agent_id}/config/{component}/{configuration} + response: + statusCode: 200 + scriptFile: agents/configuration.js # Remove agent from groups - method: DELETE @@ -501,6 +504,9 @@ resources: # Get active configuration - method: GET path: /manager/configuration/{component}/{configuration} + response: + statusCode: 200 + scriptFile: manager/configuration.js # ===================================================== # # MITRE diff --git a/public/controllers/management/components/management/configuration/alerts/alerts-labels.js b/public/controllers/management/components/management/configuration/alerts/alerts-labels.js index d0a9b448ae..49db124470 100644 --- a/public/controllers/management/components/management/configuration/alerts/alerts-labels.js +++ b/public/controllers/management/components/management/configuration/alerts/alerts-labels.js @@ -27,18 +27,18 @@ import { webDocumentationLink } from '../../../../../../../common/services/web_d const columns = [ { field: 'key', name: 'Label key' }, { field: 'value', name: 'Label value' }, - { field: 'hidden', name: 'Hidden' } + { field: 'hidden', name: 'Hidden' }, ]; const helpLinks = [ { text: 'Agent labels', - href: webDocumentationLink('user-manual/capabilities/labels.html') + href: webDocumentationLink('user-manual/agents/labels.html'), }, { text: 'Labels reference', - href: webDocumentationLink('user-manual/reference/ossec-conf/labels.html') - } + href: webDocumentationLink('user-manual/reference/ossec-conf/labels.html'), + }, ]; class WzConfigurationAlertsLabels extends Component { @@ -49,71 +49,34 @@ class WzConfigurationAlertsLabels extends Component { const { currentConfig, agent, wazuhNotReadyYet } = this.props; return ( - {currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ] && - isString( - currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ] - ) && ( + {currentConfig['agent-labels'] && + isString(currentConfig['agent-labels']) && ( )} - {currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ] && - !isString( - currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ] - ) && - !hasSize( - currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ].labels - ) && } + {currentConfig['agent-labels'] && + !isString(currentConfig['agent-labels']) && + !hasSize(currentConfig['agent-labels'].labels) && ( + + )} {wazuhNotReadyYet && - (!currentConfig || - !currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ]) && } - {currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ] && - !isString( - currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ] - ) && - hasSize( - currentConfig[ - agent && agent.id !== '000' ? 'agent-labels' : 'analysis-labels' - ].labels - ) ? ( + (!currentConfig || !currentConfig['agent-labels']) && ( + + )} + {currentConfig['agent-labels'] && + !isString(currentConfig['agent-labels']) && + hasSize(currentConfig['agent-labels'].labels) ? ( ) : null} @@ -123,7 +86,7 @@ class WzConfigurationAlertsLabels extends Component { } const mapStateToProps = state => ({ - wazuhNotReadyYet: state.appStateReducers.wazuhNotReadyYet + wazuhNotReadyYet: state.appStateReducers.wazuhNotReadyYet, }); export default connect(mapStateToProps)(WzConfigurationAlertsLabels); @@ -132,15 +95,15 @@ const sectionsAgent = [{ component: 'agent', configuration: 'labels' }]; export const WzConfigurationAlertsLabelsAgent = compose( connect(mapStateToProps), - withWzConfig(sectionsAgent) + withWzConfig(sectionsAgent), )(WzConfigurationAlertsLabels); WzConfigurationAlertsLabels.propTypes = { // currentConfig: PropTypes.object.isRequired, - wazuhNotReadyYet: PropTypes.oneOfType([PropTypes.bool, PropTypes.string]) + wazuhNotReadyYet: PropTypes.oneOfType([PropTypes.bool, PropTypes.string]), }; WzConfigurationAlertsLabelsAgent.propTypes = { // currentConfig: PropTypes.object.isRequired, - wazuhNotReadyYet: PropTypes.oneOfType([PropTypes.bool, PropTypes.string]) + wazuhNotReadyYet: PropTypes.oneOfType([PropTypes.bool, PropTypes.string]), }; diff --git a/public/controllers/management/components/management/configuration/alerts/alerts.js b/public/controllers/management/components/management/configuration/alerts/alerts.js index 704a38befc..c72e0b4cca 100644 --- a/public/controllers/management/components/management/configuration/alerts/alerts.js +++ b/public/controllers/management/components/management/configuration/alerts/alerts.js @@ -14,7 +14,7 @@ import React, { Component, Fragment } from 'react'; import PropTypes from 'prop-types'; import WzTabSelector, { - WzTabSelectorTab + WzTabSelectorTab, } from '../util-components/tab-selector'; import withWzConfig from '../util-hocs/wz-config'; import WzConfigurationAlertsGeneral from './alerts-general'; @@ -34,19 +34,19 @@ class WzConfigurationAlerts extends Component { return ( - + - + - + - + - + @@ -57,22 +57,22 @@ class WzConfigurationAlerts extends Component { const sections = [ { component: 'analysis', configuration: 'alerts' }, - { component: 'analysis', configuration: 'labels' }, + { component: 'agent', configuration: 'labels' }, { component: 'mail', configuration: 'alerts' }, { component: 'monitor', configuration: 'reports' }, - { component: 'csyslog', configuration: 'csyslog' } + { component: 'csyslog', configuration: 'csyslog' }, ]; const mapStateToProps = state => ({ - wazuhNotReadyYet: state.appStateReducers.wazuhNotReadyYet + wazuhNotReadyYet: state.appStateReducers.wazuhNotReadyYet, }); WzConfigurationAlerts.propTypes = { // currentConfig: PropTypes.object.isRequired, - wazuhNotReadyYet: PropTypes.oneOfType([PropTypes.bool, PropTypes.string]) + wazuhNotReadyYet: PropTypes.oneOfType([PropTypes.bool, PropTypes.string]), }; export default compose( withWzConfig(sections), - connect(mapStateToProps) + connect(mapStateToProps), )(WzConfigurationAlerts); diff --git a/public/react-services/reporting.js b/public/react-services/reporting.js index b74ed090ff..57efe1b2db 100644 --- a/public/react-services/reporting.js +++ b/public/react-services/reporting.js @@ -89,13 +89,15 @@ export class ReportingService { } const appliedFilters = await this.visHandlers.getAppliedFilters(syscollectorFilters); - + const dataplugin = await getDataPlugin(); + const serverSideQuery = dataplugin.query.getEsQuery(); const array = await this.vis2png.checkArray(visualizationIDList); const browserTimezone = moment.tz.guess(true); const data = { array, + serverSideQuery, // Used for applying the same filters on the server side requests filters: appliedFilters.filters, time: appliedFilters.time, searchBar: appliedFilters.searchBar, diff --git a/server/controllers/wazuh-reporting.ts b/server/controllers/wazuh-reporting.ts index c8d21975ce..865b45ce1e 100644 --- a/server/controllers/wazuh-reporting.ts +++ b/server/controllers/wazuh-reporting.ts @@ -291,6 +291,7 @@ export class WazuhReportingCtrl { browserTimezone, searchBar, filters, + serverSideQuery, time, tables, section, @@ -327,7 +328,7 @@ export class WazuhReportingCtrl { apiId, new Date(from).getTime(), new Date(to).getTime(), - sanitizedFilters, + serverSideQuery, agentsFilter, indexPatternTitle, agents @@ -876,7 +877,7 @@ export class WazuhReportingCtrl { ) => { try { log('reporting:createReportsAgentsInventory', `Report started`, 'info'); - const { searchBar, filters, time, indexPatternTitle, apiId } = request.body; + const { searchBar, filters, time, indexPatternTitle, apiId, serverSideQuery } = request.body; const { agentID } = request.params; const { from, to } = time || {}; // Init @@ -1062,6 +1063,15 @@ export class WazuhReportingCtrl { }; if (time) { + // Add Vulnerability Detector filter to the Server Side Query + serverSideQuery?.bool?.must?.push?.({ + match_phrase: { + "rule.groups": { + query: "vulnerability-detector" + } + } + }); + await extendedInformation( context, printer, @@ -1070,7 +1080,7 @@ export class WazuhReportingCtrl { apiId, from, to, - sanitizedFilters + ' AND rule.groups: "vulnerability-detector"', + serverSideQuery, agentsFilter, indexPatternTitle, agentID diff --git a/server/lib/reporting/base-query.ts b/server/lib/reporting/base-query.ts index 09d1f35f50..7e67e541d8 100644 --- a/server/lib/reporting/base-query.ts +++ b/server/lib/reporting/base-query.ts @@ -9,45 +9,28 @@ * * Find more information about this on the LICENSE file. */ + +import { cloneDeep } from 'lodash'; + export function Base(pattern: string, filters: any, gte: number, lte: number, allowedAgentsFilter: any = null) { + const clonedFilter = cloneDeep(filters); + clonedFilter?.bool?.must?.push?.({ + range: { + timestamp: { + gte: gte, + lte: lte, + format: 'epoch_millis' + } + } + }); const base = { - // index: pattern, - from: 0, size: 500, aggs: {}, sort: [], script_fields: {}, - query: { - bool: { - must: [ - { - query_string: { - query: filters, - analyze_wildcard: true, - default_field: '*' - } - }, - { - range: { - timestamp: { - gte: gte, - lte: lte, - format: 'epoch_millis' - } - } - } - ], - must_not: [] - } - } + query: clonedFilter }; - //Add allowed agents filter - if(allowedAgentsFilter?.query?.bool){ - base.query.bool.minimum_should_match = allowedAgentsFilter.query.bool.minimum_should_match; - base.query.bool.should = allowedAgentsFilter.query.bool.should; - } - return base; } diff --git a/server/lib/reporting/extended-information.ts b/server/lib/reporting/extended-information.ts index 3ede34dcf0..d418a1d6ea 100644 --- a/server/lib/reporting/extended-information.ts +++ b/server/lib/reporting/extended-information.ts @@ -140,7 +140,7 @@ export async function extendedInformation( try { log( 'reporting:extendedInformation', - `Section ${section} and tab ${tab}, API is ${apiId}. From ${from} to ${to}. Filters ${filters}. Index pattern ${pattern}`, + `Section ${section} and tab ${tab}, API is ${apiId}. From ${from} to ${to}. Filters ${JSON.stringify(filters)}. Index pattern ${pattern}`, 'info' ); if (section === 'agents' && !agent) { diff --git a/server/lib/reporting/gdpr-request.ts b/server/lib/reporting/gdpr-request.ts index ff377572a0..29c8c7c690 100644 --- a/server/lib/reporting/gdpr-request.ts +++ b/server/lib/reporting/gdpr-request.ts @@ -28,10 +28,6 @@ export const topGDPRRequirements = async ( allowedAgentsFilter, pattern = getSettingDefaultValue('pattern') ) => { - if (filters.includes('rule.gdpr: exists')) { - const [head, tail] = filters.split('AND rule.gdpr: exists'); - filters = head + tail; - }; try { const base = {}; @@ -50,12 +46,6 @@ export const topGDPRRequirements = async ( } }); - base.query.bool.must.push({ - exists: { - field: 'rule.gdpr' - } - }); - const response = await context.core.elasticsearch.client.asCurrentUser.search({ index: pattern, body: base @@ -77,7 +67,7 @@ export const topGDPRRequirements = async ( * @param {String} filters E.g: cluster.name: wazuh AND rule.groups: vulnerability * @returns {Array} */ -export const getRulesByRequirement= async ( +export const getRulesByRequirement = async ( context, gte, lte, @@ -86,10 +76,6 @@ export const getRulesByRequirement= async ( requirement, pattern = getSettingDefaultValue('pattern') ) => { - if (filters.includes('rule.gdpr: exists')) { - const [head, tail] = filters.split('AND rule.gdpr: exists'); - filters = head + tail; - }; try { const base = {}; @@ -119,8 +105,13 @@ export const getRulesByRequirement= async ( } }); - base.query.bool.must[0].query_string.query = - base.query.bool.must[0].query_string.query + ` AND rule.gdpr: "${requirement}"`; + base.query.bool.filter.push({ + match_phrase: { + 'rule.gdpr': { + query: requirement + } + } + }); const response = await context.core.elasticsearch.client.asCurrentUser.search({ index: pattern, @@ -138,7 +129,7 @@ export const getRulesByRequirement= async ( ) { return accum; }; - accum.push({ruleID: bucket['3'].buckets[0].key, ruleDescription: bucket.key}); + accum.push({ ruleID: bucket['3'].buckets[0].key, ruleDescription: bucket.key }); return accum; }, []); } catch (error) { diff --git a/server/lib/reporting/pci-request.ts b/server/lib/reporting/pci-request.ts index 8660265d66..cbaec5bb26 100644 --- a/server/lib/reporting/pci-request.ts +++ b/server/lib/reporting/pci-request.ts @@ -28,10 +28,7 @@ export const topPCIRequirements = async ( allowedAgentsFilter, pattern = getSettingDefaultValue('pattern') ) => { - if (filters.includes('rule.pci_dss: exists')) { - filters = filters.replace('AND rule.pci_dss: exists', ''); - }; - + try { const base = {}; @@ -48,13 +45,7 @@ export const topPCIRequirements = async ( } } }); - - base.query.bool.must.push({ - exists: { - field: 'rule.pci_dss' - } - }); - + const response = await context.core.elasticsearch.client.asCurrentUser.search({ index: pattern, body: base @@ -100,10 +91,7 @@ export const getRulesByRequirement = async ( requirement, pattern = getSettingDefaultValue('pattern') ) => { - if (filters.includes('rule.pci_dss: exists')) { - filters = filters.replace('AND rule.pci_dss: exists', ''); - }; - + try { const base = {}; @@ -132,11 +120,13 @@ export const getRulesByRequirement = async ( } }); - base.query.bool.must[0].query_string.query = - base.query.bool.must[0].query_string.query + - ' AND rule.pci_dss: "' + - requirement + - '"'; + base.query.bool.filter.push({ + match_phrase: { + 'rule.pci_dss': { + query: requirement + } + } + }); const response = await context.core.elasticsearch.client.asCurrentUser.search({ index: pattern, diff --git a/server/lib/reporting/rootcheck-request.ts b/server/lib/reporting/rootcheck-request.ts index ac48328b3a..8a46094ab9 100644 --- a/server/lib/reporting/rootcheck-request.ts +++ b/server/lib/reporting/rootcheck-request.ts @@ -46,9 +46,11 @@ export const top5RootkitsDetected = async ( } }); - base.query.bool.must[0].query_string.query = - base.query.bool.must[0].query_string.query + - ' AND "rootkit" AND "detected"'; + base.query?.bool?.must?.push({ + query_string: { + query: '"rootkit" AND "detected"' + } + }); const response = await context.core.elasticsearch.client.asCurrentUser.search({ index: pattern, @@ -97,9 +99,11 @@ export const agentsWithHiddenPids = async ( } }); - base.query.bool.must[0].query_string.query = - base.query.bool.must[0].query_string.query + - ' AND "process" AND "hidden"'; + base.query?.bool?.must?.push({ + query_string: { + query: '"process" AND "hidden"' + } + }); // "aggregations": { "1": { "value": 1 } } const response = await context.core.elasticsearch.client.asCurrentUser.search({ @@ -126,7 +130,7 @@ export const agentsWithHiddenPids = async ( * @param {String} filters E.g: cluster.name: wazuh AND rule.groups: vulnerability * @returns {Array} */ -export const agentsWithHiddenPorts = async( +export const agentsWithHiddenPorts = async ( context, gte, lte, @@ -147,8 +151,11 @@ export const agentsWithHiddenPorts = async( } }); - base.query.bool.must[0].query_string.query = - base.query.bool.must[0].query_string.query + ' AND "port" AND "hidden"'; + base.query?.bool?.must?.push({ + query_string: { + query: '"port" AND "hidden"' + } + }); // "aggregations": { "1": { "value": 1 } } const response = await context.core.elasticsearch.client.asCurrentUser.search({ diff --git a/server/lib/reporting/tsc-request.ts b/server/lib/reporting/tsc-request.ts index e326d6d054..8f08db0d10 100644 --- a/server/lib/reporting/tsc-request.ts +++ b/server/lib/reporting/tsc-request.ts @@ -12,14 +12,14 @@ import { Base } from './base-query'; import { getSettingDefaultValue } from '../../../common/services/settings'; - /** - * Returns top 5 TSC requirements - * @param {Number} context Endpoint context - * @param {Number} gte Timestamp (ms) from - * @param {Number} lte Timestamp (ms) to - * @param {String} filters E.g: cluster.name: wazuh AND rule.groups: vulnerability - * @returns {Array} - */ +/** + * Returns top 5 TSC requirements + * @param {Number} context Endpoint context + * @param {Number} gte Timestamp (ms) from + * @param {Number} lte Timestamp (ms) to + * @param {String} filters E.g: cluster.name: wazuh AND rule.groups: vulnerability + * @returns {Array} + */ export const topTSCRequirements = async ( context, gte, @@ -28,9 +28,6 @@ export const topTSCRequirements = async ( allowedAgentsFilter, pattern = getSettingDefaultValue('pattern') ) => { - if (filters.includes('rule.tsc: exists')) { - filters = filters.replace('AND rule.tsc: exists', ''); - }; try { const base = {}; @@ -49,12 +46,6 @@ export const topTSCRequirements = async ( } }); - base.query.bool.must.push({ - exists: { - field: 'rule.tsc' - } - }); - const response = await context.core.elasticsearch.client.asCurrentUser.search({ index: pattern, body: base @@ -92,7 +83,7 @@ export const topTSCRequirements = async ( * @returns {Array} */ export const getRulesByRequirement = async ( - context, + context, gte, lte, filters, @@ -100,9 +91,6 @@ export const getRulesByRequirement = async ( requirement, pattern = getSettingDefaultValue('pattern') ) => { - if (filters.includes('rule.tsc: exists')) { - filters = filters.replace('AND rule.tsc: exists', ''); - }; try { const base = {}; @@ -132,11 +120,13 @@ export const getRulesByRequirement = async ( } }); - base.query.bool.must[0].query_string.query = - base.query.bool.must[0].query_string.query + - ' AND rule.tsc: "' + - requirement + - '"'; + base.query.bool.filter.push({ + match_phrase: { + 'rule.tsc': { + query: requirement + } + } + }); const response = await context.core.elasticsearch.client.asCurrentUser.search({ index: pattern, @@ -155,7 +145,7 @@ export const getRulesByRequirement = async ( ) { return accum; }; - accum.push({ruleID: bucket['3'].buckets[0].key, ruleDescription: bucket.key}); + accum.push({ ruleID: bucket['3'].buckets[0].key, ruleDescription: bucket.key }); return accum; }, []); } catch (error) { diff --git a/server/routes/wazuh-reporting.test.ts b/server/routes/wazuh-reporting.test.ts index ae8f52de63..ab5dbe0cc5 100644 --- a/server/routes/wazuh-reporting.test.ts +++ b/server/routes/wazuh-reporting.test.ts @@ -10,20 +10,23 @@ import { WazuhReportingRoutes } from './wazuh-reporting'; import { WazuhUtilsCtrl } from '../controllers/wazuh-utils/wazuh-utils'; import md5 from 'md5'; import path from 'path'; -import { createDataDirectoryIfNotExists, createDirectoryIfNotExists } from '../lib/filesystem'; +import { + createDataDirectoryIfNotExists, + createDirectoryIfNotExists, +} from '../lib/filesystem'; import { WAZUH_DATA_CONFIG_APP_PATH, WAZUH_DATA_CONFIG_DIRECTORY_PATH, WAZUH_DATA_DOWNLOADS_REPORTS_DIRECTORY_PATH, WAZUH_DATA_LOGS_DIRECTORY_PATH, WAZUH_DATA_ABSOLUTE_PATH, - WAZUH_DATA_DOWNLOADS_DIRECTORY_PATH + WAZUH_DATA_DOWNLOADS_DIRECTORY_PATH, } from '../../common/constants'; import { execSync } from 'child_process'; import fs from 'fs'; jest.mock('../lib/reporting/extended-information', () => ({ - extendedInformation: jest.fn() + extendedInformation: jest.fn(), })); const USER_NAME = 'admin'; const loggingService = loggingSystemMock.create(); @@ -31,18 +34,19 @@ const logger = loggingService.get(); const context = { wazuh: { security: { - getCurrentUser: (request) => { + getCurrentUser: request => { // x-test-username header doesn't exist when the platform or plugin are running. // It is used to generate the output of this method so we can simulate the user // that does the request to the endpoint and is expected by the endpoint handlers // of the plugin. const username = request.headers['x-test-username']; - return { username, hashUsername: md5(username) } - } - } - } + return { username, hashUsername: md5(username) }; + }, + }, + }, }; -const enhanceWithContext = (fn: (...args: any[]) => any) => fn.bind(null, context); +const enhanceWithContext = (fn: (...args: any[]) => any) => + fn.bind(null, context); let server, innerServer; // BEFORE ALL @@ -71,12 +75,24 @@ beforeAll(async () => { } as any; server = new HttpServer(loggingService, 'tests'); const router = new Router('', logger, enhanceWithContext); - const { registerRouter, server: innerServerTest, ...rest } = await server.setup(config); + const { + registerRouter, + server: innerServerTest, + ...rest + } = await server.setup(config); innerServer = innerServerTest; // Mock decorator - jest.spyOn(WazuhUtilsCtrl.prototype as any, 'routeDecoratorProtectedAdministratorRoleValidToken') - .mockImplementation((handler) => async (...args) => handler(...args)); + jest + .spyOn( + WazuhUtilsCtrl.prototype as any, + 'routeDecoratorProtectedAdministratorRoleValidToken', + ) + .mockImplementation( + handler => + async (...args) => + handler(...args), + ); // Register routes WazuhUtilsRoutes(router); @@ -117,18 +133,29 @@ describe('[endpoint] GET /reports', () => { // Create /data/wazuh/downloads directory. createDirectoryIfNotExists(WAZUH_DATA_DOWNLOADS_DIRECTORY_PATH); - + // Create /data/wazuh/downloads/reports directory. createDirectoryIfNotExists(WAZUH_DATA_DOWNLOADS_REPORTS_DIRECTORY_PATH); // Create directories and file/s within directory. directories.forEach(({ username, files }) => { const hashUsername = md5(username); - createDirectoryIfNotExists(path.join(WAZUH_DATA_DOWNLOADS_REPORTS_DIRECTORY_PATH, hashUsername)); + createDirectoryIfNotExists( + path.join(WAZUH_DATA_DOWNLOADS_REPORTS_DIRECTORY_PATH, hashUsername), + ); if (files) { Array.from(Array(files).keys()).forEach(indexFile => { - console.log('Generating', username, indexFile) - fs.closeSync(fs.openSync(path.join(WAZUH_DATA_DOWNLOADS_REPORTS_DIRECTORY_PATH, hashUsername, `report_${indexFile}.pdf`), 'w')); + console.log('Generating', username, indexFile); + fs.closeSync( + fs.openSync( + path.join( + WAZUH_DATA_DOWNLOADS_REPORTS_DIRECTORY_PATH, + hashUsername, + `report_${indexFile}.pdf`, + ), + 'w', + ), + ); }); } }); @@ -139,13 +166,16 @@ describe('[endpoint] GET /reports', () => { execSync(`rm -rf ${WAZUH_DATA_DOWNLOADS_DIRECTORY_PATH}`); }); - it.each(directories)('get reports of $username. status response: $responseStatus', async ({ username, files }) => { - const response = await supertest(innerServer.listener) - .get(`/reports`) - .set('x-test-username', username) - .expect(200); - expect(response.body.reports).toHaveLength(files); - }); + it.each(directories)( + 'get reports of $username. status response: $responseStatus', + async ({ username, files }) => { + const response = await supertest(innerServer.listener) + .get(`/reports`) + .set('x-test-username', username) + .expect(200); + expect(response.body.reports).toHaveLength(files); + }, + ); }); describe('[endpoint] PUT /utils/configuration', () => { @@ -174,16 +204,33 @@ describe('[endpoint] PUT /utils/configuration', () => { // expectedMD5 variable is a verified md5 of a report generated with this header and footer // If any of the parameters is changed this variable should be updated with the new md5 it.each` - footer | header | responseStatusCode | expectedMD5 | tab - ${null} | ${null} | ${200} | ${'1bdc0cc05cc79fdfbb9b734a4e1cc07b'} | ${'pm'} - ${'Custom\nFooter'} | ${'info@company.com\nFake Avenue 123'}| ${200} | ${'0acbd4ee321699791b080b45c11dfe2b'} | ${'general'} - ${''} | ${''} | ${200} | ${'5f9e16540e9d8109bed75b2a8f825164'} | ${'fim'} - ${'Custom Footer'} | ${null} | ${200} | ${'5bd4c559419028fd0d282c5e8408ecff'} | ${'aws'} - ${null} | ${'Custom Header'} | ${200} | ${'f6bfca395bc3fc78105f66120f336443'} | ${'gcp'} -`(`Set custom report header and footer - Verify PDF output`, async ({footer, header, responseStatusCode, expectedMD5, tab}) => { - + footer | header | responseStatusCode | expectedMD5 | tab + ${null} | ${null} | ${200} | ${'1bdc0cc05cc79fdfbb9b734a4e1cc07b'} | ${'pm'} + ${'Custom\nFooter'} | ${'info@company.com\nFake Avenue 123'} | ${200} | ${'0acbd4ee321699791b080b45c11dfe2b'} | ${'general'} + ${''} | ${''} | ${200} | ${'5f9e16540e9d8109bed75b2a8f825164'} | ${'fim'} + ${'Custom Footer'} | ${null} | ${200} | ${'5bd4c559419028fd0d282c5e8408ecff'} | ${'aws'} + ${null} | ${'Custom Header'} | ${200} | ${'f6bfca395bc3fc78105f66120f336443'} | ${'gcp'} + `( + `Set custom report header and footer - Verify PDF output`, + async ({ footer, header, responseStatusCode, expectedMD5, tab }) => { // Mock PDF report parameters - const reportBody = { "array": [], "filters": [], "time": { "from": '2022-10-01T09:59:40.825Z', "to": '2022-10-04T09:59:40.825Z' }, "searchBar": "", "tables": [], "tab": tab, "section": "overview", "agents": false, "browserTimezone": "Europe/Madrid", "indexPatternTitle": "wazuh-alerts-*", "apiId": "default" }; + const reportBody = { + array: [], + serverSideQuery: [], + filters: [], + time: { + from: '2022-10-01T09:59:40.825Z', + to: '2022-10-04T09:59:40.825Z', + }, + searchBar: '', + tables: [], + tab: tab, + section: 'overview', + agents: false, + browserTimezone: 'Europe/Madrid', + indexPatternTitle: 'wazuh-alerts-*', + apiId: 'default', + }; // Define custom configuration const configurationBody = {}; @@ -203,10 +250,18 @@ describe('[endpoint] PUT /utils/configuration', () => { .expect(responseStatusCode); if (typeof footer == 'string') { - expect(responseConfig.body?.data?.updatedConfiguration?.['customization.reports.footer']).toMatch(configurationBody['customization.reports.footer']); + expect( + responseConfig.body?.data?.updatedConfiguration?.[ + 'customization.reports.footer' + ], + ).toMatch(configurationBody['customization.reports.footer']); } if (typeof header == 'string') { - expect(responseConfig.body?.data?.updatedConfiguration?.['customization.reports.header']).toMatch(configurationBody['customization.reports.header']); + expect( + responseConfig.body?.data?.updatedConfiguration?.[ + 'customization.reports.header' + ], + ).toMatch(configurationBody['customization.reports.header']); } } @@ -216,16 +271,19 @@ describe('[endpoint] PUT /utils/configuration', () => { .set('x-test-username', USER_NAME) .send(reportBody) .expect(200); - const fileName = responseReport.body?.message.match(/([A-Z-0-9]*\.pdf)/gi)[0]; + const fileName = + responseReport.body?.message.match(/([A-Z-0-9]*\.pdf)/gi)[0]; const userPath = md5(USER_NAME); const reportPath = `${WAZUH_DATA_DOWNLOADS_REPORTS_DIRECTORY_PATH}/${userPath}/${fileName}`; const PDFbuffer = fs.readFileSync(reportPath); const PDFcontent = PDFbuffer.toString('utf8'); - const content = PDFcontent - .replace(/\[<[a-z0-9].+> <[a-z0-9].+>\]/gi, '') - .replace(/(obj\n\(D:[0-9].+Z\)\nendobj)/gi, ''); + const content = PDFcontent.replace( + /\[<[a-z0-9].+> <[a-z0-9].+>\]/gi, + '', + ).replace(/(obj\n\(D:[0-9].+Z\)\nendobj)/gi, ''); const PDFmd5 = md5(content); expect(PDFmd5).toBe(expectedMD5); - }); + }, + ); }); diff --git a/server/routes/wazuh-reporting.ts b/server/routes/wazuh-reporting.ts index 5b4988e707..f07e509e4b 100644 --- a/server/routes/wazuh-reporting.ts +++ b/server/routes/wazuh-reporting.ts @@ -60,6 +60,7 @@ export function WazuhReportingRoutes(router: IRouter) { body: schema.object({ array: schema.any(), browserTimezone: schema.string(), + serverSideQuery: schema.maybe(schema.any()), filters: schema.maybe(schema.any()), agents: schema.maybe(schema.oneOf([agentIDValidation, schema.boolean()])), components: schema.maybe(schema.any()), @@ -124,6 +125,7 @@ export function WazuhReportingRoutes(router: IRouter) { body: schema.object({ array: schema.any(), browserTimezone: schema.string(), + serverSideQuery: schema.maybe(schema.any()), filters: schema.maybe(schema.any()), agents: schema.maybe(schema.oneOf([schema.string(), schema.boolean()])), components: schema.maybe(schema.any()),