From 1dc9a0f85bd43bbec3a670b88d4db0f6f6074365 Mon Sep 17 00:00:00 2001 From: Christopher Berger Date: Fri, 5 Jun 2026 18:22:16 +0000 Subject: [PATCH] Update README.md --- README.md | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 62 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 2521188..6931319 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,33 @@ Self-hosted Wazuh all-in-one deployment (Manager + Indexer + Dashboard) running on a Proxmox VM converted from the official Wazuh Amazon Machine Image (AMI) OVA. +## **From the Proxmox host, download the official Wazuh AMI ova file.** +### 1. Download the official AMI. (Version 4.14.5 at time of this commit. Edit as required) +`wget https://packages.wazuh.com/4.x/vm/wazuh-4.14.5.ova` + +### 2. Extract the OVA (it's just a tar archive) +`tar xvf wazuh-*.ova` + +### 3. Create a VM shell (no disk yet) — adjust VMID/resources to taste +``` +qm create 110 --name wazuh-server --memory 4096 --cores 2 \ + --net0 virtio,bridge=vmbr0 --ostype l26 --scsihw virtio-scsi-single +``` + +### 4. Import the extracted VMDK into the VM's storage +Replace "local-lvm" with your target storage + +`qm importdisk 110 wazuh-*.vmdk local-lvm --format raw` + +### 5. Attach the imported disk (importdisk leaves it as "unused0") +`qm set 110 --scsi0 local-lvm:vm-110-disk-0,discard=on,ssd=1` + +### 6. Set boot order and add a display +`qm set 110 --boot order=scsi0 --serial0 socket --vga serial0` + +### 7. Start it +`qm start 110` + --- ## Repository Contents @@ -41,7 +68,7 @@ wazuh/ | `email_notification` | `yes` | | `email_to` | `chris@wittenberger.us` | | `smtp_server` | `localhost` (Postfix relay - see email setup below) | -| `email_from` | `` | +| `email_from` | `wazuh-manager@wittenberger.us` | | `email_maxperhour` | `12` | | `email_alert_level` | **12** | | `log_alert_level` | `3` | @@ -333,17 +360,19 @@ systemctl restart postfix --- -## pfSense Syslog Integration +## pfSense Syslog Integration with Syslog-ng -pfSense does **not** run a Wazuh agent - it ships firewall logs over the network via **syslog-ng** to the Wazuh manager's syslog listener on **UDP 514**. +pfSense does **not** run a Wazuh agent - it ships firewall logs over the network via **syslog**. Syslog-ng provides a better pfSense log ingestion to the Wazuh manager's syslog listener on **UDP 514**. -### pfSense Side (syslog-ng) +### pfSense Side (remote logging options) In pfSense: **Status → System Logs → Settings → Remote Logging** +**Syslog-ng listens on port 5140, therefore we must set pfSense to forward syslog to its loopback on port 5140 in order to reach Syslog-ng** + | Setting | Value | |---------|-------| -| Remote log server | `:514` | +| Remote log server | `127.0.0.1:5140` | | Protocol | UDP | | Log contents | Firewall events (filterlog) | @@ -352,6 +381,33 @@ syslog-ng wraps the filterlog lines in a standard syslog envelope before forward <134>May 29 12:00:01 pfsense.local filterlog[1234]: 5,,,,... ``` +### Syslog-ng (must download package in pfSense) + +In pfSense: **Services > Syslog-ng > Advanced** + +| Setting | Value | +|---------|-------| +|Object Type | `Destination` | +|Object Name | `wazuh` | +|Description | `Connect to wazuh` | +|Object Parameters | | + +``` +{ + network("10.20.30.40" // Change to your wazuh-manager VM IP + transport(udp) + localip(10.1.2.3) // Change to your pfSense IP + ); +``` + +| Setting | Value | +|---------|-------| +|Object Type | `log` | +|Object Name | `wazuh_route` | +|Description | `Route default to "wazuh" destination` | +|Object Parameters | `{ source(_DEFAULT); destination(wazuh); };` | + + ### Wazuh Side The syslog remote listener in `ossec.conf` accepts these: @@ -360,7 +416,7 @@ The syslog remote listener in `ossec.conf` accepts these: syslog 514 udp - 10.0.0.0/8 + 10.0.0.0/8 // Change to match your network range WAZUH_SERVER_IP ```