Wazuh Dashboards and Kibana Plugin

[aremai]

Hi all,

Is there a way to import the official Wazuh dashboards, respectively the native wazuh kibana plugin [1] ?
Based on the documentation on readthedocs, the available Kibana version in Security Onion would be supported.

I see there's a directory called "/opt/so/conf/kibana/customdashboards"
Since everything is dockerized in Security Onion, I'm not sure if I'd be able to run "/usr/share/kibana/bin/kibana-plugin" to install the Kibana plugin.

I think not having the official Wazuh dashboards and Kibana plugin (which enables better management of the rules as well as other monitoring metrics and aspects of registered ossec-agents, etc..) creates a gap and a blindspot.

What do you think? Is there a better way to manage rules and agents?

[1] https://github.com/wazuh/wazuh-kibana-app

[weslambert]

Hi @aremai,

We don't currently support the Wazuh App for Kibana. You should be able to put custom dashboards in that directory, but simply running the kibana-plugin command inside the Docker container won't make the changes persistent. We have an issue here that was opened a while for consideration: https://github.com/Security-Onion-Solutions/securityonion/issues?q=is%3Aissue+is%3Aopen+Wazuh+app