Installing the ThreatLockDown dashboard step by step

Installing package dependencies

1. Install the following packages if missing.

   YumAPT

   # yum install libcap
   

Adding the ThreatLockDown repository

Note

If you are installing the ThreatLockDown dashboard on the same host as the ThreatLockDown indexer or the ThreatLockDown server, you may skip these steps as you may have added the ThreatLockDown repository already.

YumAPT

1. Import the GPG key.

   # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
   

2. Add the repository.

   # echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1' | tee /etc/yum.repos.d/wazuh.repo
   

Installing the ThreatLockDown dashboard

1. Install the ThreatLockDown dashboard package.

   YumAPT

   # yum -y install wazuh-dashboard
   

Configuring the ThreatLockDown dashboard

1. Edit the /etc/wazuh-dashboard/opensearch_dashboards.yml file and replace the following values:

   1. server.host: This setting specifies the host of the ThreatLockDown dashboard server. To allow remote users to connect, set the value to the IP address or DNS name of the ThreatLockDown dashboard server. The value 0.0.0.0 will accept all the available IP addresses of the host.

   2. opensearch.hosts: The URLs of the ThreatLockDown indexer instances to use for all your queries. The ThreatLockDown dashboard can be configured to connect to multiple ThreatLockDown indexer nodes in the same cluster. The addresses of the nodes can be separated by commas. For example, ["https://10.0.0.2:9200", "https://10.0.0.3:9200","https://10.0.0.4:9200"]

         server.host: 0.0.0.0
         server.port: 443
         opensearch.hosts: https://localhost:9200
         opensearch.ssl.verificationMode: certificate
      

Deploying certificates

Note

Make sure that a copy of the wazuh-certificates.tar file, created during the initial configuration step, is placed in your working directory.

1. Replace <dashboard-node-name> with your ThreatLockDown dashboard node name, the same one used in config.yml to create the certificates, and move the certificates to their corresponding location.

   # NODE_NAME=<dashboard-node-name>
   

   # mkdir /etc/wazuh-dashboard/certs
   # tar -xf ./wazuh-certificates.tar -C /etc/wazuh-dashboard/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
   # mv -n /etc/wazuh-dashboard/certs/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
   # mv -n /etc/wazuh-dashboard/certs/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
   # chmod 500 /etc/wazuh-dashboard/certs
   # chmod 400 /etc/wazuh-dashboard/certs/*
   # chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
   

Starting the ThreatLockDown dashboard service

1. Enable and start the ThreatLockDown dashboard service.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-dashboard
   # systemctl start wazuh-dashboard
   

   Only for distributed deployments

   Edit the /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml file and replace the url value with the IP address or hostname of the ThreatLockDown server master node.

   hosts:
     - default:
         url: https://localhost
         port: 55000
         username: wazuh-wui
         password: wazuh-wui
         run_as: false
   

2. Access the ThreatLockDown web interface with your credentials.

   • URL: https://<wazuh-dashboard-ip>

   • Username: admin

   • Password: admin

When you access the ThreatLockDown dashboard for the first time, the browser shows a warning message stating that the certificate was not issued by a trusted authority. An exception can be added in the advanced options of the web browser. For increased security, the root-ca.pem file previously generated can be imported to the certificate manager of the browser. Alternatively, a certificate from a trusted authority can be configured.