25 lines
1.2 KiB
Bash
25 lines
1.2 KiB
Bash
# REFERENCE for deploying the SIEM node (wazuh1.bitasylum.org) with the upstream
|
|
# Wazuh single-node compose. Wazuh is managed on that node, NOT by the fleet
|
|
# serving stack — so these creds live there, not in the serving repo's runtime.
|
|
# Copy to upstream/single-node/.env on the SIEM node and CHANGE every password.
|
|
|
|
# Wazuh release — pin to current stable (github.com/wazuh/wazuh-docker/releases).
|
|
WAZUH_VERSION=4.12.0
|
|
|
|
# --- credentials (ROTATE — these are public defaults) ----------------------
|
|
INDEXER_USERNAME=admin
|
|
INDEXER_PASSWORD=ChangeMe-Indexer-Adm1n!
|
|
API_USERNAME=wazuh-wui
|
|
API_PASSWORD=ChangeMe-Api-Passw0rd!
|
|
DASHBOARD_USERNAME=kibanaserver
|
|
DASHBOARD_PASSWORD=ChangeMe-Dash-Passw0rd!
|
|
|
|
# --- fleet integration (set ON the node / in the manager config) -----------
|
|
# TCP syslog ingest port the manager listens on (config/fleet-remote-syslog.xml)
|
|
# and the override publishes. The serving-host audit-collector relays here.
|
|
WAZUH_SYSLOG_PORT=514
|
|
# Source the manager accepts syslog from = the SERVING HOST's IP (goes in the
|
|
# <allowed-ips> of config/fleet-remote-syslog.xml). Confirm the real source in the
|
|
# manager logs and tighten to /32.
|
|
WAZUH_ALLOWED_IPS=SET-TO-SERVING-HOST-IP/32
|