ThreatLockDown dashboard

This role deploys the ThreatLockDown dashboard. You can customize the installation with the following variables:

  • indexer_network_host: This defines the Elasticsearch node IP address (default: 127.0.0.1).

  • indexer_http_port: This defines the Elasticsearch node listening port (default: 9200).

  • dashboard_server_host: This defines the ThreatLockDown dashboard listening node address (default: 0.0.0.0).

To use the role in a playbook, a YAML file wazuh-dashboard.yml can be created with the contents below:

- hosts: dashboard
  roles:
    - wazuh-dashboard

Custom variable definitions for different environments can be set. For example:

  • For a production environment, the variables can be saved in vars-production.yml:

    indexer_network_host: '10.1.1.10'
    
  • For a development environment, the variables can be saved in vars-development.yml:

    indexer_network_host: '192.168.0.10'
    

To run the playbook for a specific environment, the command below is run:

$ ansible-playbook wazuh-dashboard.yml -e@vars-production.yml

The example above will install the ThreatLockDown dashboard and configure 10.1.1.10 as the Indexer node.

Please review the variable references section to see all variables available for this role.