install node

build/html/.buildinfo

@@ -1,4 +1,4 @@
 # Sphinx build info version 1
 # This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done.
-config: b7a7e0b90c868c2611afb0120e797a12
+config: cdd1a923d603bc7f759cd62795c4d279
 tags: 645f666f9bcd5a90fca523b33c5a78b7

build/html/_sources/index.rst.txt

@@ -4,21 +4,25 @@ OwlH Documentation home
 About OwlH
 ==========
 
-    v0.10.0
+    v0.17.x
 
 This picture will summarize the process we are working in.
 
 .. image:: /img/owlhprocess.png
 
-A few topics
-------------
-
 .. toctree::
-   :maxdepth: 1
+    :maxdepth: 4
+
+    main/OwlHGS
+    main/OwlHInstall
+    main/OwlHUpdate
+    main/OwlHUM
+    main/OwlHTroubleshooting
+    main/lookingfor
+    main/scenarios
+
+
 
-   main/OwlHGS
-   main/OwlHUC
-   main/OwlHUI
 
 
 CHANGELOG
@@ -28,13 +32,16 @@ As per our latest version, in OwlH solution you may find:
 
 .. _OwlH Changelog: https://github.com/OwlH-net/roadmap/blob/master/README.md
 
-**OwlH - current v0.10.x - Oct** - `OwlH Changelog`_
+**OwlH - current v0.17.x** - `OwlH Changelog`_
 
+.. toctree::
+    :maxdepth: 1
 
-.. _OwlH mailing list: https://groups.google.com/d/forum/owlh
+    main/contact
+.. _OwlH Slack workspace: https://join.slack.com/t/owlh/shared_invite/enQtNjE2NTEwODUzNTExLTJlNTdlMDRiMzM0ZTVhNWQ0YWE4YzgyYWQ4ZGYyMDQzMzM5NDA1M2I3NDlhYTFkNjdhZTk0MzFjMGU3ZWI3ZDM
 
 * email our support team - support@owlh.net
-* visit our mailing list - `OwlH mailing list`_ (owlh@googlegroups.com)
+* join OwlH slack - `OwlH Slack workspace`_
 
 documentation last updated - |today|
 

build/html/_sources/main/OwlH-elk.rst.txt

@@ -0,0 +1,134 @@
+
+Sync with ELK 7.x
+=================
+
+.. warning::
+
+    Be sure you are running ELK (elasticsearch, filebeat and kibana) with version >7.3.2
+
+.. include:: keepincontact.rst
+
+
+We will need to modify a bit the Wazuh's default filebeat configuration, we will do:
+
+  * import OwlH-Kibana objects in Kibana
+  * load OwlH template in Elasticsearch
+  * install OwlH-Filebeat module
+  * modify Wazuh's module to exclude OwlH Lines
+  * modify Filebeat main configuration to include OwlH module
+
+
+.. attention::
+  You must have access to your Wazuh's manager shell console where Filebeat is installed and to Kibana's console 
+
+.. note:: 
+  Please, check URLs and paths to ensure you use the right commands and that you adapt command lines as needed. 
+
+
+
+Download files and prepare
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+::
+    
+    # cd /tmp
+    # mkdir /tmp/owlhfilebeat
+    # wget repo.owlh.net/elastic/owlh-filebeat-7.4-files.tar.gz
+    # tar -C /tmp/owlhfilebeat -xf owlh-filebeat-7.4-files.tar.gz
+
+
+Import OwlH kibana dashboards and objects in Kibana
+---------------------------------------------------
+
+::
+
+    # curl -X POST "localhost:5601/api/saved_objects/_import" -H "kbn-xsrf: true" --form file=@/tmp/owlhfilebeat/owlh-kibana-objects-20191030.ndjson 
+
+Install OwlH template
+---------------------
+
+::
+
+    # curl -XPUT -H 'Content-Type: application/json' 'http://localhost:9200/_template/owlh' -d@/tmp/owlhfilebeat/owlh-template.json
+
+Install OwlH module
+-------------------
+
+::
+
+    # tar -C /usr/share/filebeat/module/ -xf /tmp/owlhfilebeat/owlh-filebeat-7.4-module.tar.gz
+
+Modify Wazuh Module
+-------------------
+
+::
+
+    # vi /usr/share/filebeat/module/wazuh/alerts/config/alerts.yml 
+
+
+.. attention:: 
+    be sure your file looks like this
+
+::
+
+    fields:
+      index_prefix: {{ .index_prefix }}
+    type: log
+    paths:
+    {{ range $i, $path := .paths }}
+     - {{$path}}
+    {{ end }}
+    exclude_lines: ["bro_engine"]   
+
+Modify filebeat
+^^^^^^^^^^^^^^^
+
+Modify Filebeat configuration
+-----------------------------
+
+::
+
+    # vi /etc/filebeat/filebeat.yml 
+
+.. attention:: 
+    be sure your file looks like this
+
+::
+
+    # Wazuh - Filebeat configuration file
+    filebeat.modules:
+      - module: wazuh
+        alerts:
+          enabled: true
+        archives:
+          enabled: false
+    # OwlH Module 
+      - module: owlh                    
+        events:                         
+          enabled: true
+
+    setup.template.json.enabled: true
+    setup.template.json.path: '/etc/filebeat/wazuh-template.json'
+    setup.template.json.name: 'wazuh'
+    setup.template.overwrite: true
+    setup.ilm.enabled: false
+    ## OwlH pipeline sync
+    filebeat.overwrite_pipelines: true
+
+
+Restart Filebeat
+----------------
+
+You should be done. check your kibana to see the OwlH dashboards in dashboards section, and indices in discovery section.
+
+::
+
+    Restart Filebeat
+
+    # systemctl restart filebeat 
+
+    Check Filebeat output
+
+    # journalctl -f -u filebeat
+
+    From your web browser, check kibana->dashboards

build/html/_sources/main/OwlHAPI.rst.txt

@@ -0,0 +1,10 @@
+OwlH API
+========
+
+The OwlH API is an open source **RESTful API** that allows for interaction with the ``OwlH Master`` and ``OwlH Node`` components from a web browser, command line tool like cURL or any script or program that can make web requests. The OwlH UI and APP relies on this totally. Use the API to easily perform everyday actions like adding a node, restarting the services or looking up status details.
+
+.. toctree::
+   :maxdepth: 1
+
+   OwlHAPIM
+   OwlHAPIN

build/html/_sources/main/OwlHAPIM.rst.txt

@@ -0,0 +1,7 @@
+OwlH MASTER RESTful API
+=======================
+
+
+.. note:: 
+
+    Work in progress.

build/html/_sources/main/OwlHAPIN.rst.txt

@@ -0,0 +1,6 @@
+OwlH NODE RESTful API
+=======================
+
+.. note:: 
+
+    Work in progress.

build/html/_sources/main/OwlHAllinone.rst.txt

@@ -10,6 +10,7 @@ While it is not recommended for production environment, it may work for small co
 
 .. image:: /img/allinone.png
 
+
 Installation - auto install
 ---------------------------
 
@@ -31,17 +32,46 @@ Installation
 
 :: 
 
-  # wget http://repo.owlh.net/current-centos/owlh-allinone-centos7.sh
+  # wget http://repo.owlh.net/current-centos/owlh-allinone.sh
 
 * Run installer
 
 :: 
 
-  # bash owlh-allinone-centos7.sh 1.1.1.1
+  # bash owlh-allinone.sh 
+
+
+.. note::
+
+    Note #1:
+
+    .- If you are not using an AWS deployment you will need to modify /var/www/owlh/conf/ui.conf to use your real OwlH IP. 
+
+:: 
+
+    {
+        "master":{
+            "ip":"<MASTERIP>",   <<< change with your master API IP
+            "port":"50001"
+        }
+    }
+
 
 .. note::
-    - use your owlh allinone node ip instead of 1.1.1.1
-    - if working in a cloud environment use the public ip as needed
+
+    Note #2:
+
+    .- By default, Suricata and Zeek installations are disabled right now. 
+    if you want to run them you can uncomment Suricata and Zeek lines in owlh-allinone.sh script 
+
+::
+
+    bash /tmp/owlhscripts/owlhinterface.sh
+    bash /tmp/owlhscripts/owlhui-httpd.sh
+    #bash /tmp/owlhscripts/owlhsuricata.sh <<< will install Suricata 5.0.1
+    #bash /tmp/owlhscripts/owlhzeek.sh     <<< will install Zeek 3.0.1
+    bash /tmp/owlhscripts/owlhwazuh.sh
+
 
 This will install OwlH components as well as Suricata, Zeek and Wazuh agent. Please be patient as it may take a while.
 
@@ -64,9 +94,7 @@ see our `User Interface Manual`_
     * if you can't see the right information verify that your.owlh.ip address is correctly saved:
         * Go to top menu -> config -> set your master ip with your.owlh.ip and save.
     * If ip isn't changed it can be because a permission issue with the ui.conf file. 
-        * To solve it you can run: 
-            * # wget -O - repo.owlh.net/current-centos/owlh-0.8.10.sh | bash
-        * Or modify the /var/www/owlh/conf/ui.conf file with your prefered shell editor.
+        * Modify the /var/www/owlh/conf/ui.conf file with your prefered shell editor.
 * Modify or add your first node ip with the current node ip, should be same than owlh.ip
 * Register your Wazuh agent with your wazuh manager.
     * follow Wazuh instructions to register your wazuh agent. Wazuh agent software is now installed so you only need to automatically register agent using authd command or manually, and update ossec.conf file to point to your wazuh manager (this can be done from OwlH UI)
@@ -75,6 +103,35 @@ see our `User Interface Manual`_
 
 Now we need to configure Wazuh Manager and ELK to allow OwlH data flow
 
+Installation - Update your software
+-----------------------------------
+
+OwlH Installer will help you to keep your All-in-one updated. 
+
+Edit file config.json and define action as update 
+
+::
+
+    # vi /tmp/owlhinstaller/config.json
+
+    ... (~line 18)
+    "tmpfolder":"/tmp/",
+    "action": "update",         <<<<< be sure action is update
+    "repourl":"http://repo.owlh.net/current-centos/",
+    "target": [
+        "owlhmaster",
+        "owlhnode",
+        "owlhui"
+    ],
+    ...
+
+Run again your owlhinstaller 
+
+::
+
+    # cd /tmp/owlhinstaller
+    # ./owlhinstaller
+
 More to come.
 
 .. include:: /main/contact.rst

build/html/_sources/main/OwlHAnalyzer.rst.txt

@@ -0,0 +1,35 @@
+Analyzer configuration file 
+===========================
+
+.. code-block:: JSON
+
+  
+  {
+    "enable":true,
+    "outputfile":"/var/log/owlh/alerts.json",
+    "prefilterfile":"conf/prefilters.json",
+    "postfilterfile":"conf/postfilters.json",
+    "tagsfile":"conf/tags.json",
+    "srcfiles": [
+        "/var/log/suricata/eve.json",
+        "/usr/local/zeek/logs/current/conn.log",
+        "/usr/local/zeek/logs/current/dns.log"
+    ],
+    "feedfiles": [
+        {
+            "feedfile":"/usr/local/owlh/src/owlhnode/conf/feeds/otx.feed",
+            "workers":4
+        },
+        {
+            "feedfile":"/tmp/local.feed"
+        },
+        {
+            "feedfile":"/usr/local/owlh/src/owlhnode/conf/feeds/xforce.feed",
+            "workers":4
+        },
+        {
+            "feedfile":"/usr/local/owlh/src/owlhnode/conf/feeds/falcon.feed",
+            "workers":4
+        }
+    ]
+  }

build/html/_sources/main/OwlHBASIC.rst.txt

@@ -0,0 +1,28 @@
+OwlH BASIC configuration
+=============================
+
+
+  * prepare your environment
+    * traffic capture 
+      * sizing
+      * capture configuration
+    * OS versions and support
+    * traffic store sizing
+    * hardware physical or virtual specs
+
+  * install owlh components
+    * OwlH Master
+    * OwlH Node
+    * OwlH UI
+    * OwlH Client 
+
+  * Configure
+    * from UI 
+    * API description
+
+  * Visualization
+    * OwlH dashboards integration Wazuh-ELK
+
+  * Use It
+
+.. include:: /main/contact.rst