Skip to content

Commit 6eda636

Browse files
ayodekoayodeko
committed
Update Wazuh indexer component documentation
1 parent 17d93a1 commit 6eda636

File tree

1 file changed

+7
-94
lines changed

1 file changed

+7
-94
lines changed

‎source/getting-started/components/wazuh-indexer.rst‎

Lines changed: 7 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -8,109 +8,22 @@ Wazuh indexer
88

99
The Wazuh indexer is a highly scalable, full-text search and analytics engine. This Wazuh central component indexes and stores alerts generated by the Wazuh server and provides near real-time data search and analytics capabilities. The Wazuh indexer can be configured as a single-node or multi-node cluster, providing scalability and high availability.
1010

11-
The Wazuh indexer stores data as JSON documents. Each document correlates a set of keys, field names or properties, with their corresponding values which can be strings, numbers, booleans, dates, arrays of values, geolocations, or other types of data.
11+
The Wazuh indexer stores data as JSON documents. Each document correlates a set of keys, field names, or properties with their corresponding values, which can be strings, numbers, Boolean values, dates, arrays of values, geolocations, or other types of data.
1212

13-
An index is a collection of documents that are related to each other. The documents stored in the Wazuh indexer are distributed across different containers known as shards. By distributing the documents across multiple shards, and distributing those shards across multiple nodes, the Wazuh indexer can ensure redundancy. This protects your system against hardware failures and increases query capacity as nodes are added to a cluster.
13+
An index is a collection of related documents. The documents stored in the Wazuh indexer are distributed across different containers known as shards. By distributing the documents across multiple shards and distributing those shards across various nodes, the Wazuh indexer can ensure redundancy. This protects your system against hardware failures and increases query capacity as nodes are added to a cluster.
1414

15-
Wazuh uses four different indices to store different event types:
16-
17-
.. |--| unicode:: U+02011 .. non-breaking dash
18-
:trim:
19-
20-
+---------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
21-
| Index | Description |
22-
+=================================+==========================================================================================================================================================================================================================================+
23-
| **wazuh** |--| **alerts** | Stores alerts generated by the :doc:`/getting-started/components/wazuh-server`. These are created each time an event trips a rule with a high enough priority (this threshold is configurable). |
24-
+---------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
25-
| **wazuh** |--| **archives** | Stores all events (archive data) received by the :doc:`/getting-started/components/wazuh-server`, whether or not they trip a rule. |
26-
+---------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
27-
| **wazuh** |--| **monitoring** | Stores data related to the :doc:`/getting-started/components/wazuh-agent` status over time. It is used by the web interface to represent when individual agents are or have been ``Active``, ``Disconnected``, or ``Never connected``. |
28-
+---------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
29-
| **wazuh** |--| **statistics** | Stores data related to the :doc:`/getting-started/components/wazuh-server` performance. It is used by the web interface to represent the performance statistics. |
30-
+---------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
15+
We show an image of the Wazuh indexer cluster below:
3116

3217
.. thumbnail:: /images/getting-started/wazuh-indexer.png
3318
:title: Wazuh indexer
3419
:alt: Wazuh indexer
3520
:align: center
3621
:width: 80%
3722

38-
Example query
39-
-------------
40-
41-
You can interact with the Wazuh indexer cluster using the Wazuh indexer REST API, which offers a lot of flexibility. You can perform searches, add or delete documents, modify indices, and more.
42-
43-
Here is an example of a query to Wazuh indexer that returns the last lateral movement alert using SSH technique:
44-
45-
.. code-block:: console
46-
:emphasize-lines: 6,7
47-
48-
GET /wazuh-alerts-4.x-*/_search
49-
{
50-
"query": {
51-
"bool": {
52-
"must": [
53-
{"term": { "rule.mitre.tactic": "Lateral Movement" } },
54-
{"term": { "rule.mitre.technique": "SSH" } }
55-
]
56-
}
57-
},
58-
"sort": [
59-
{ "timestamp": { "order": "desc" } }
60-
],
61-
"size": 1
62-
}
63-
64-
Below is an extract of the query result, which is a part of the indexed alert document:
23+
Wazuh uses several types of indices to store different event types. For details, see the :doc:`Wazuh indexer indices </user-manual/wazuh-indexer/wazuh-indexer-indices>` section of the documentation.
6524

66-
.. code-block:: json
67-
:class: output
68-
:emphasize-lines: 13,21,27
69-
70-
{
71-
"timestamp" : "2022-04-24T17:24:56.110+0000",
72-
"agent" : {
73-
"ip" : "10.0.1.52",
74-
"name" : "Amazon",
75-
"id" : "001"
76-
},
77-
"data" : {
78-
"srcip" : "68.183.216.91",
79-
"srcport" : "53820"
80-
},
81-
"rule" : {
82-
"description" : "sshd: insecure connection attempt (scan).",
83-
"id" : "5706",
84-
"level" : 6,
85-
"pci_dss" : ["11.4"],
86-
"mitre" : {
87-
"technique" : [
88-
"SSH"
89-
],
90-
"id" : ["T1021.004"],
91-
"tactic" : [
92-
"Lateral Movement"
93-
]
94-
}
95-
},
96-
"full_log" : "Apr 24 17:24:55 ip-10-0-1-52 sshd[32179]: Did not receive identification string from 68.183.216.91 port 53820",
97-
"location" : "/var/log/secure",
98-
"predecoder" : {
99-
"hostname" : "ip-10-0-1-52",
100-
"program_name" : "sshd",
101-
"timestamp" : "Apr 24 17:24:55"
102-
},
103-
"decoder" : {
104-
"parent" : "sshd",
105-
"name" : "sshd"
106-
},
107-
"GeoLocation" : {
108-
"city_name" : "Frankfurt am Main",
109-
"country_name" : "Germany",
110-
"region_name" : "Hesse"
111-
}
112-
}
25+
The Wazuh indexer is well-suited for time-sensitive use cases like security analytics and infrastructure monitoring, as it is a near real-time search platform. The latency from the time a document is indexed until it becomes searchable is very short, typically one second.
11326

114-
The Wazuh indexer is well suited for time-sensitive use cases like security analytics and infrastructure monitoring as it is a near real-time search platform. The latency from the time a document is indexed until it becomes searchable is very short, typically one second.
27+
In addition to its speed, scalability, and resiliency, the Wazuh indexer has several built-in features that make storing and searching data even more efficient, such as data roll-ups, alerting, anomaly detection, and index lifecycle management.
11528

116-
In addition to its speed, scalability, and resiliency, the Wazuh indexer has several built-in features that make storing and searching data even more efficient, such as data rollups, alerting, anomaly detection, and index lifecycle management.
29+
Visit the :doc:`installation guide </installation-guide/wazuh-indexer/index>` and :doc:`user manual </user-manual/wazuh-indexer/index>` for more information about the Wazuh indexer.

0 commit comments

Comments
 (0)