{"id":13590001,"url":"https://github.com/pyToshka/docker-wazuh-agent","last_synced_at":"2025-04-08T12:32:21.981Z","repository":{"id":44691124,"uuid":"338063884","full_name":"pyToshka/docker-wazuh-agent","owner":"pyToshka","description":"Monitoring a Kubernetes cluster involves deploying and utilizing the Wazuh agent within the Kubernetes environment.","archived":false,"fork":false,"pushed_at":"2025-03-31T22:10:00.000Z","size":77,"stargazers_count":59,"open_issues_count":2,"forks_count":34,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-02T08:09:47.074Z","etag":null,"topics":["aks","cis","daemonset","devops","eks","gke","kubernetes","monitoring","scanner","security-tools","wazuh","wazuh-agent","wazuh-server"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pyToshka.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-02-11T15:11:32.000Z","updated_at":"2025-03-25T22:52:15.000Z","dependencies_parsed_at":"2024-04-22T22:24:36.580Z","dependency_job_id":"05de428c-da5a-47fb-b721-9d1f96367d14","html_url":"https://github.com/pyToshka/docker-wazuh-agent","commit_stats":null,"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyToshka%2Fdocker-wazuh-agent","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyToshka%2Fdocker-wazuh-agent/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyToshka%2Fdocker-wazuh-agent/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyToshka%2Fdocker-wazuh-agent/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pyToshka","download_url":"https://codeload.github.com/pyToshka/docker-wazuh-agent/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247842844,"owners_count":21005355,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aks","cis","daemonset","devops","eks","gke","kubernetes","monitoring","scanner","security-tools","wazuh","wazuh-agent","wazuh-server"],"created_at":"2024-08-01T16:00:37.498Z","updated_at":"2025-04-08T12:32:21.533Z","avatar_url":"https://github.com/pyToshka.png","language":"Python","funding_links":["https://www.buymeacoffee.com/pyToshka"],"categories":["security-tools"],"sub_categories":[],"readme":"# docker-wazuh-agent\n\n\u003ca href=\"https://www.buymeacoffee.com/pyToshka\" target=\"_blank\"\u003e\u003cimg src=\"https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png\" alt=\"Buy Me A Coffee\" style=\"height: 60px !important;width: 217px !important;\" \u003e\u003c/a\u003e\n\nWazuh is a free, open source and enterprise-ready security monitoring\nsolution for threat detection, integrity monitoring, incident response and compliance.\n\n## Disclaimer\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n## Description\n\n**Wazuh Agent Docker Image with Auto-Registration on Wazuh Server**\n\nThe Wazuh Agent, encapsulated within a Docker image, comes equipped with an automatic registration feature for seamless integration with the Wazuh server. This versatile implementation is designed to function not only as a standalone Docker container but also as a Kubernetes DaemonSet.\n\n*Key Features:*\n1. **Containerization:** The Wazuh Agent is encapsulated within a Docker image, promoting portability and ease of deployment across various environments.\n\n2. **Auto-Registration:** The agent is configured to automatically register with the Wazuh server, streamlining the onboarding process and eliminating manual intervention.\n\n3. **Standalone Deployment:** The Docker container can be deployed as a standalone entity, offering flexibility for environments that do not utilize orchestration tools.\n\n4. **Kubernetes Compatibility:** Integrated as a Kubernetes DaemonSet, the Wazuh Agent seamlessly scales across nodes within a Kubernetes cluster, ensuring comprehensive security coverage.\n\n\n*Note:*\nAlways refer to the [official documentation](https://documentation.wazuh.com/current/getting-started/index.html) for detailed configuration options and additional customization possibilities.\n\nThis implementation offers a seamless and adaptable solution for incorporating Wazuh security monitoring into both standalone and orchestrated environments.\n\n## Wazuh agent version\n\n### Braking changes\n\n*Wazuh agent v4.3.10* will reach its end of life (EOL) and the cessation of support on February 1, 2024.\n\n\n\u003e\u003e Commencing on February 1, 2024, the main branch will incorporate the latest code.\n\u003e\u003e\n\u003e\u003e Exercise caution, as potential bugs may exist in this branch. It is crucial to migrate all your deployments to Docker image tags listed below for reference.\n\n\n| GitHub branch/tag | Wazuh Agent version | EOL | Docker image tag |\n|-------------------|---------------------|-----|------------------|\n| main              | v4.7.2-1            | LTS | latest           |\n| v4.7.2-1          | v4.7.2-1            | LTS | 4.7.1            |\n| v4.7.1-1          | v4.7.1-1            | LTS | 4.7.1            |\n| v4.6.0-1          | v4.6.0-1            | LTS | 4.6.0            |\n| v4.5.4-1          | v4.5.4-1            | LTS | 4.5.4            |\n| v4.4.5-1          | v4.4.5-1            | LTS | 4.4.5            |\n\n## DockerHub images\n\n| Repository Name                                               | Description                                                 | Pull command                                     |\n|---------------------------------------------------------------|-------------------------------------------------------------|--------------------------------------------------|\n| https://hub.docker.com/r/opennix/wazuh-agent            | Wazuh agent based on Minideb                                | docker pull opennix/wazuh-agent                  |\n| https://hub.docker.com/r/opennix/wazuh-agent-amazonlinux | Wazuh agent based on Amazon Linux version 2023.3.20231218.0 | docker pull opennix/wazuh-agent-amazonlinux |\n| https://hub.docker.com/r/opennix/wazuh-agent-ubuntu     | Wazuh agent based on Ubuntu 24.04                           | docker pull opennix/wazuh-agent-ubuntu      |\n|                                                               |                                                             |                                                  |\n\n\n## Structure\n\n`register_agent.py` - Auto register docker based agent\n\n`cleanup_agents.py` - Cleanup disconnected or never connected agents older than N days\n\n`deregister_agent.py` -  De-registration of agent\n\n## Environments\n\n| Name                       | Type     | Description                                                                                                                                       | Default   | Required |\n|----------------------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------|-----------|----------|\n| `JOIN_MANAGER_PROTOCOL`    | `string` | Http or https protocol for Wazuh restapi connection                                                                                               | `https`   | `Yes`    |\n| `JOIN_MANAGER_MASTER_HOST` | `string` | Ip address or Domain name of Wazuh server using for restapi calls                                                                                 | `None`    | `Yes`    |\n| `JOIN_MANAGER_WORKER_HOST` | `string` | Ip address or Domain name of Wazuh worker for agent connection, if using ALL in One installation the same value as for `JOIN_MANAGER_MASTER_HOST` | `None`    | `Yes`    |\n| `JOIN_MANAGER_USER`        | `string` | Username for Wazuh API autorization                                                                                                               | `None`    | `Yes`    |\n| `JOIN_MANAGER_PASSWORD`    | `string` | Password for Wazuh API autorization                                                                                                               | `None`    | `Yes`    |\n| `JOIN_MANAGER_API_PORT`    | `string` | Port where the Wazuh API listened                                                                                                                 | `55000`   | `Yes`    |\n| `JOIN_MANAGER_PORT`        | `string` | Wazuh server port for communication between agent and server                                                                                      | `1514`    | `Yes`    |\n| `NODE_NAME`                | `string` | Node name if not present image will use `HOSTNAME` system variable                                                                                | `None`    | `No`     |\n| `VIRUS_TOTAL_KEY`          | `string` | Api key for VirusTotal integration                                                                                                                | `None`    | `No`     |\n| `WAZUH_GROUPS`             | `string` | Group(s) name comma separated for auto adding agent,                                                                                              | `default` | `No`     |\n| `WAZUH_WAIT_TIME`          | `string` | Sleep for N second                                                                                                                                | `10`      | `No`     |\n\n## Run as docker image\n\nThe Simplest way of running the container\n\n```shell\ndocker run --rm opennix/wazuh-agent:latest\n```\n## Run docker-compose\n\nGenerate certificates\n```shell\ndocker compose -f tests/single-node/generate-indexer-certs.yml run --rm generator\n```\n\nRun\n\n```shell\ndocker compose up -d\n```\n\nWill run Wazuh cluster in single node mode and 3 agents\n\n## Use Makefile\n```shell\nmake\nhelp                           Help for usage\nbuild-minideb                  Build Wazuh Agent minideb based\nbuild-amazon-linux             Build Wazuh Agent amazon linux based\nbuild-ubuntu                   Build Wazuh Agent ubuntu linux based\ndocker-run                     Run Wazuh Agent docker image  minideb based\ndocker-push-minideb            Push Wazuh Agent docker image  minideb based\ndocker-push-amazon-linux       Push Wazuh Agent docker image amazon linux based\ndocker-push-ubuntu             Push Wazuh Agent docker image ubuntu linux based\nrun-local                      Run docker compose stack with all agents on board\n\n```\n## Advanced usage\n\n```bash\ndocker run -d --name wazuh -v /:/rootfs:ro --net host --hostname ${HOSTNAME} \\\n-e JOIN_MANAGER_MASTER_HOST=172.17.0.1 -e JOIN_MANAGER_WORKER_HOST=172.17.0.1 \\\n-e JOIN_PASSWORD=test123 -e JOIN_MANAGER_USER=user \\\n-v /etc/os-release:/etc/os-release -v /var/run/docker.sock:/var/run/docker.sock \\\n opennix/wazuh-agent\n\n```\n\n## Run as Kubernetes DaemonSet\n\nSetup environments in `wazuh-daemon-sets.yaml` like above.\n\nExample:\n\n```yaml\nenv:\n    - name: JOIN_MANAGER_MASTER_HOST\n      value: \"wazuh.wazuh.svc.cluster.local\"\n    - name: JOIN_MANAGER_WORKER_HOST\n      value: \"wazuh-workers.wazuh.svc.cluster.local\"\n    - name: JOIN_MANAGER_PROTOCOL\n      value: \"https\"\n    - name: NODE_NAME\n      valueFrom:\n        fieldRef:\n          fieldPath: spec.nodeName\n    - name: JOIN_MANAGER_USER\n      valueFrom:\n       secretKeyRef:\n         name: wazuh-api-cred\n         key: username\n    - name: JOIN_MANAGER_PASSWORD\n      valueFrom:\n        secretKeyRef:\n          name: wazuh-api-cred\n          key: password\n    - name: JOIN_MANAGER_API_PORT\n      value: \"55000\"\n    - name: JOIN_MANAGER_PORT\n      value: \"1514\"\n\n```\n\nAnd apply template ```kubectl -f wazuh-daemon-sets.yaml```\nDaemonSet will deploy to wazuh namespace.\n\n## Build local docker image\n\nBuilding default image agent based on [Minideb](https://github.com/bitnami/minideb) with default Agent version `4.3.10-1`\n\n```bash\ndocker build . -t wazuh-agent:latest\n```\n\nBuilding agent image based on [Amazon Linux](https://hub.docker.com/_/amazonlinux) with default Agent version `4.3.10-1`\n```bash\ndocker build -f images/Dockerfile.amazonlinux . -t wazuh-agent:latest\n```\n\nBuilding agent image based on [Ubuntu 24.04](https://wiki.ubuntu.com/NobleNumbat) with default Agent version `4.3.10-1`\n```bash\ndocker build -f images/Dockerfile.ubuntu . -t wazuh-agent:latest\n```\n\nBuild agent image with custom agent version\n\n```shell\n docker build -f path-to-docker-file . -t  wazuh-agent:\u003ctag\u003e --build-arg AGENT_VERSION=\u003cwazuh-agent-version\u003e\n```\n\nFor example build minideb with Wazuh agent version `4.4.5-1`\n\n```shell\n docker build . -t  wazuh-agent:latest --build-arg AGENT_VERSION=4.4.5-1\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FpyToshka%2Fdocker-wazuh-agent","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FpyToshka%2Fdocker-wazuh-agent","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FpyToshka%2Fdocker-wazuh-agent/lists"}