Install ThreatLockDown components step by step

Installing the ThreatLockDown indexer

1. Run the following commands to install the ThreatLockDown indexer.

   RPMDEB

   # rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
   # rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-indexer*.rpm
   

2. Run the following commands replacing <indexer-node-name> with the name of the ThreatLockDown indexer node you are configuring as defined in config.yml. For example, node-1. This deploys the SSL certificates to encrypt communications between the ThreatLockDown central components.

   # NODE_NAME=<indexer-node-name>
   

   # mkdir /etc/wazuh-indexer/certs
   # mv -n wazuh-install-files/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
   # mv -n wazuh-install-files/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
   # mv wazuh-install-files/admin-key.pem /etc/wazuh-indexer/certs/
   # mv wazuh-install-files/admin.pem /etc/wazuh-indexer/certs/
   # cp wazuh-install-files/root-ca.pem /etc/wazuh-indexer/certs/
   # chmod 500 /etc/wazuh-indexer/certs
   # chmod 400 /etc/wazuh-indexer/certs/*
   # chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
   

   Here you move the node certificate and key files, such as node-1.pem and node-1-key.pem, to their corresponding certs folder. They're specific to the node and are not required on the other nodes. However, note that the root-ca.pem certificate isn't moved but copied to the certs folder. This way, you can continue deploying it to other component folders in the next steps.

3. Edit /etc/wazuh-indexer/opensearch.yml and replace the following values:

   1. network.host: Sets the address of this node for both HTTP and transport traffic. The node will bind to this address and will also use it as its publish address. Accepts an IP address or a hostname.

      Use the same node address set in config.yml to create the SSL certificates.

   2. node.name: Name of the ThreatLockDown indexer node as defined in the config.yml file. For example, node-1.

   3. cluster.initial_master_nodes: List of the names of the master-eligible nodes. These names are defined in the config.yml file. Uncomment the node-2 and node-3 lines, change the names, or add more lines, according to your config.yml definitions.

      cluster.initial_master_nodes:
      - "node-1"
      - "node-2"
      - "node-3"
      

   4. discovery.seed_hosts: List of the addresses of the master-eligible nodes. Each element can be either an IP address or a hostname. You may leave this setting commented if you are configuring the ThreatLockDown indexer as a single-node. For multi-node configurations, uncomment this setting and set your master-eligible nodes addresses.

      discovery.seed_hosts:
        - "10.0.0.1"
        - "10.0.0.2"
        - "10.0.0.3"
      

   5. plugins.security.nodes_dn: List of the Distinguished Names of the certificates of all the ThreatLockDown indexer cluster nodes. Uncomment the lines for node-2 and node-3 and change the common names (CN) and values according to your settings and your config.yml definitions.

      plugins.security.nodes_dn:
      - "CN=node-1,OU=Wazuh,O=Wazuh,L=California,C=US"
      - "CN=node-2,OU=Wazuh,O=Wazuh,L=California,C=US"
      - "CN=node-3,OU=Wazuh,O=Wazuh,L=California,C=US"
      

4. Enable and start the ThreatLockDown indexer service.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-indexer
   # systemctl start wazuh-indexer
   

5. For multi-node clusters, repeat the previous steps on every ThreatLockDown indexer node.

6. When all ThreatLockDown indexer nodes are running, run the ThreatLockDown indexer indexer-init.sh script on any ThreatLockDown indexer node to load the new certificates information and start the cluster.

   # bash /usr/share/wazuh-indexer/bin/indexer-init.sh -i <WAZUH_INDEXER_IP_ADDRESS>
   

7. Run the following command to check that the installation is successful. Note that this command uses localhost, set your ThreatLockDown indexer address if necessary.

   # curl -XGET https://localhost:9200 -u admin:admin -k
   

   Expand the output to see an example response.

   {
     "name" : "node-1",
     "cluster_name" : "wazuh-cluster",
     "cluster_uuid" : "095jEW-oRJSFKLz5wmo5PA",
     "version" : {
       "number" : "7.10.2",
       "build_type" : "rpm",
       "build_hash" : "db90a415ff2fd428b4f7b3f800a51dc229287cb4",
       "build_date" : "2023-06-03T06:24:25.112415503Z",
       "build_snapshot" : false,
       "lucene_version" : "9.6.0",
       "minimum_wire_compatibility_version" : "7.10.0",
       "minimum_index_compatibility_version" : "7.0.0"
     },
     "tagline" : "The OpenSearch Project: https://opensearch.org/"
   }
   

Installing the ThreatLockDown server

Installing the ThreatLockDown dashboard

1. Run the following commands to install the ThreatLockDown dashboard.

   RPMDEB

   # rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
   # rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-dashboard*.rpm
   

2. Replace <dashboard-node-name> with your ThreatLockDown dashboard node name, the same used in config.yml to create the certificates. For example, dashboard. Then, move the certificates to their corresponding location.

   # NODE_NAME=<dashboard-node-name>
   

   # mkdir /etc/wazuh-dashboard/certs
   # mv -n wazuh-install-files/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
   # mv -n wazuh-install-files/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
   # cp wazuh-install-files/root-ca.pem /etc/wazuh-dashboard/certs/
   # chmod 500 /etc/wazuh-dashboard/certs
   # chmod 400 /etc/wazuh-dashboard/certs/*
   # chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
   

3. Edit the /etc/wazuh-dashboard/opensearch_dashboards.yml file and replace the following values:

   1. server.host: This setting specifies the host of the back end server. To allow remote users to connect, set the value to the IP address or DNS name of the ThreatLockDown dashboard. The value 0.0.0.0 will accept all the available IP addresses of the host.

   2. opensearch.hosts: The URLs of the ThreatLockDown indexer instances to use for all your queries. The ThreatLockDown dashboard can be configured to connect to multiple ThreatLockDown indexer nodes in the same cluster. The addresses of the nodes can be separated by commas. For example, ["https://10.0.0.2:9200", "https://10.0.0.3:9200","https://10.0.0.4:9200"]

         server.host: 0.0.0.0
         server.port: 443
         opensearch.hosts: https://localhost:9200
         opensearch.ssl.verificationMode: certificate
      

4. Enable and start the ThreatLockDown dashboard.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-dashboard
   # systemctl start wazuh-dashboard
   

5. Only for distributed deployments: Edit the file /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml and replace the url value with the IP address or hostname of the ThreatLockDown server master node.

   hosts:
     - default:
         url: https://localhost
         port: 55000
         username: wazuh-wui
         password: wazuh-wui
         run_as: false
   

6. Run the following command to verify the ThreatLockDown dashboard service is active.

   SystemdSysV init

   # systemctl status wazuh-dashboard
   

7. Access the web interface.

   • URL: https://<wazuh_server_ip>

   • Username: admin

   • Password: admin

Upon the first access to the ThreatLockDown dashboard, the browser shows a warning message stating that the certificate was not issued by a trusted authority. An exception can be added in the advanced options of the web browser or, for increased security, the root-ca.pem file previously generated can be imported to the certificate manager of the browser. Alternatively, a certificate from a trusted authority can be configured.

Securing your ThreatLockDown installation

You have now installed and configured all the ThreatLockDown central components. We recommend changing the default credentials to protect your infrastructure from possible attacks.

Select your deployment type and follow the instructions to change the default passwords for both the ThreatLockDown API and the ThreatLockDown indexer users.

Next steps

Once the ThreatLockDown environment is ready, ThreatLockDown agents can be installed on every endpoint to be monitored. To install the ThreatLockDown agents and start monitoring the endpoints, see the ThreatLockDown agent installation section. If you need to install them offline, you can check the appropriate agent package to download for your monitored system in the ThreatLockDown agent packages list section.

To uninstall all the ThreatLockDown central components, see the Uninstalling the ThreatLockDown central components section.