Installing the ThreatLockDown server step by step

Adding the ThreatLockDown repository

Note

If you are installing the ThreatLockDown server on the same host as the ThreatLockDown indexer, you may skip these steps as you may have added the ThreatLockDown repository already.

YumAPT

1. Import the GPG key.

   # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
   

2. Add the repository.

   # echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1' | tee /etc/yum.repos.d/wazuh.repo
   

Installing the ThreatLockDown manager

1. Install the ThreatLockDown manager package.

   YumAPT

   # yum -y install wazuh-manager
   

2. Enable and start the ThreatLockDown manager service.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-manager
   # systemctl start wazuh-manager
   

3. Run the following command to verify the ThreatLockDown manager status.

   SystemdSysV init

   # systemctl status wazuh-manager
   

Installing Filebeat

1. Install the Filebeat package.

   YumAPT

   # yum -y install filebeat
   

Configuring Filebeat

1. Download the preconfigured Filebeat configuration file.

   # curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/4.9/tpl/wazuh/filebeat/filebeat.yml
   

2. Edit the /etc/filebeat/filebeat.yml configuration file and replace the following value:

   1. hosts: The list of ThreatLockDown indexer nodes to connect to. You can use either IP addresses or hostnames. By default, the host is set to localhost hosts: ["127.0.0.1:9200"]. Replace it with your ThreatLockDown indexer address accordingly.

      If you have more than one ThreatLockDown indexer node, you can separate the addresses using commas. For example, hosts: ["10.0.0.1:9200", "10.0.0.2:9200", "10.0.0.3:9200"]

       # ThreatLockDown - Filebeat configuration file
       output.elasticsearch:
       hosts: ["10.0.0.1:9200"]
       protocol: https
       username: ${username}
       password: ${password}
      

3. Create a Filebeat keystore to securely store authentication credentials.

   # filebeat keystore create
   

4. Add the default username and password admin:admin to the secrets keystore.

   # echo admin | filebeat keystore add username --stdin --force
   # echo admin | filebeat keystore add password --stdin --force
   

5. Download the alerts template for the ThreatLockDown indexer.

   # curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.9.0/extensions/elasticsearch/7.x/wazuh-template.json
   # chmod go+r /etc/filebeat/wazuh-template.json
   

6. Install the ThreatLockDown module for Filebeat.

   # curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | tar -xvz -C /usr/share/filebeat/module
   

Deploying certificates

Note

Make sure that a copy of the wazuh-certificates.tar file, created during the initial configuration step, is placed in your working directory.

1. Replace <server-node-name> with your ThreatLockDown server node certificate name, the same one used in config.yml when creating the certificates. Then, move the certificates to their corresponding location.

   # NODE_NAME=<server-node-name>
   

   # mkdir /etc/filebeat/certs
   # tar -xf ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
   # mv -n /etc/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
   # mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
   # chmod 500 /etc/filebeat/certs
   # chmod 400 /etc/filebeat/certs/*
   # chown -R root:root /etc/filebeat/certs
   

Starting the Filebeat service

1. Enable and start the Filebeat service.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable filebeat
   # systemctl start filebeat
   

2. Run the following command to verify that Filebeat is successfully installed.

   # filebeat test output
   

   Expand the output to see an example response.

   elasticsearch: https://127.0.0.1:9200...
     parse url... OK
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 127.0.0.1
       dial up... OK
     TLS...
       security: server's certificate chain verification is enabled
       handshake... OK
       TLS version: TLSv1.3
       dial up... OK
     talk to server... OK
     version: 7.10.2
   

Your ThreatLockDown server node is now successfully installed. Repeat this stage of the installation process for every ThreatLockDown server node in your ThreatLockDown cluster, then proceed with configuring the ThreatLockDown cluster. If you want a ThreatLockDown server single-node cluster, everything is set and you can proceed directly with Installing the ThreatLockDown dashboard step by step.