Skip to content

Commit f01675c

Browse files
committed
Update the Wazuh central components upgrade guide
1 parent 25ddc6c commit f01675c

File tree

1 file changed

+42
-8
lines changed

1 file changed

+42
-8
lines changed

source/upgrade-guide/upgrading-central-components.rst

Lines changed: 42 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -296,27 +296,57 @@ Upgrading the Wazuh manager
296296
#. Upgrade the Wazuh manager to the latest version:
297297

298298
.. tabs::
299-
299+
300300
.. group-tab:: Yum
301-
301+
302302
.. code-block:: console
303-
303+
304304
# yum upgrade wazuh-manager|WAZUH_MANAGER_RPM_PKG_INSTALL|
305-
305+
306306
.. group-tab:: APT
307-
307+
308308
.. code-block:: console
309-
309+
310310
# apt-get install wazuh-manager|WAZUH_MANAGER_DEB_PKG_INSTALL|
311-
311+
312312
.. warning::
313-
313+
314314
If the ``/var/ossec/etc/ossec.conf`` configuration file was modified, it will not be replaced by the upgrade. You will therefore have to add the settings of the new capabilities manually. More information can be found in the :doc:`/user-manual/index`.
315315

316316
#. Run the following command on the Wazuh manager node(s) to start the Wazuh manager service if you stopped it earlier:
317317

318318
.. include:: /_templates/common/start_manager.rst
319319

320+
Configuring CDB lists
321+
^^^^^^^^^^^^^^^^^^^^^
322+
323+
When upgrading from Wazuh 4.12.x or earlier, follow these steps to configure the newly added CDB lists.
324+
325+
#. Edit the ``/var/ossec/etc/ossec.conf`` file and update the ``<ruleset>`` block with the CDB lists highlighted below.
326+
327+
.. code-block:: xml
328+
:emphasize-lines: 9-11
329+
330+
<ruleset>
331+
<!-- Default ruleset -->
332+
<decoder_dir>ruleset/decoders</decoder_dir>
333+
<rule_dir>ruleset/rules</rule_dir>
334+
<rule_exclude>0215-policy_rules.xml</rule_exclude>
335+
<list>etc/lists/audit-keys</list>
336+
<list>etc/lists/amazon/aws-eventnames</list>
337+
<list>etc/lists/security-eventchannel</list>
338+
<list>etc/lists/malicious-ioc/malware-hashes</list>
339+
<list>etc/lists/malicious-ioc/malicious-ip</list>
340+
<list>etc/lists/malicious-ioc/malicious-domains</list>
341+
<!-- User-defined ruleset -->
342+
<decoder_dir>etc/decoders</decoder_dir>
343+
<rule_dir>etc/rules</rule_dir>
344+
</ruleset>
345+
346+
#. Restart the Wazuh manager to apply the configuration changes
347+
348+
.. include:: /_templates/common/start_manager.rst
349+
320350
.. _configuring_vulnerability_detection:
321351

322352
Configuring vulnerability detection
@@ -385,6 +415,10 @@ When upgrading from Wazuh version 4.7.x or earlier, follow these steps to config
385415
386416
If you have forgotten your Wazuh indexer password, refer to the :doc:`password management guide </user-manual/user-administration/password-management>` to reset it.
387417

418+
#. Restart the Wazuh manager to apply the configuration changes
419+
420+
.. include:: /_templates/common/start_manager.rst
421+
388422
.. _configuring_filebeat:
389423

390424
Configuring Filebeat

0 commit comments

Comments
 (0)