ThreatLockDown central components

Preparing the upgrade

In the case ThreatLockDown is installed in a multi-node cluster configuration, repeat the following steps for every node.

1. Add the ThreatLockDown repository. You can skip this step if the repository is already present and enabled on the node.

   YumAPT

   1. Import the GPG key.

      # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
      

   2. Add the repository.

      # echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1' | tee /etc/yum.repos.d/wazuh.repo
      

2. Stop the Filebeat service and the ThreatLockDown dashboard service if installed in the node.

   SystemdSysV init

   # systemctl stop filebeat
   # systemctl stop wazuh-dashboard
   

Upgrading the ThreatLockDown indexer

In the case of having a ThreatLockDown indexer cluster with multiple nodes, the cluster will remain available throughout the upgrading process. This rolling upgrade allows shutting down one ThreatLockDown indexer node at a time for minimal disruption of service. Repeat these steps for every ThreatLockDown indexer node.

1. Disable shard allocation.

   curl -X PUT "https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_cluster/settings"  -u <username>:<password> -k -H 'Content-Type: application/json' -d'
   {
     "persistent": {
       "cluster.routing.allocation.enable": "primaries"
     }
   }
   '
   

2. Stop non-essential indexing and perform a synced flush.

   # curl -X POST "https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_flush/synced" -u <username>:<password> -k
   

3. Shut down the ThreatLockDown indexer in the node.

   SystemdSysV init

   # systemctl stop wazuh-indexer
   

4. Upgrade the ThreatLockDown indexer to the latest version.

   YumAPT

   # yum upgrade wazuh-indexer
   

5. Restart the service.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-indexer
   # systemctl start wazuh-indexer
   

6. Check that the newly-upgraded node joins the cluster.

   # curl -k -u <username>:<password> https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_cat/nodes?v
   

7. Re-enable shard allocation.

   curl -X PUT "https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_cluster/settings" -u <username>:<password> -k -H 'Content-Type: application/json' -d'
   {
     "persistent": {
       "cluster.routing.allocation.enable": "all"
     }
   }
   '
   

8. Check again the status of the cluster to see if shard allocation has finished.

   # curl -k -u <username>:<password> https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_cat/nodes?v
   

9. If you're upgrading from a version earlier than 4.8.0, run the ThreatLockDown indexer indexer-init.sh script on any ThreatLockDown indexer node to re-initialize the cluster. Find more information in Index life management.

   • If there is a rollover policy in use, your new policy needs a higher priority value to take precedence over it. Add -P <CUSTOM_PRIORITY_VALUE> into the command below to set a custom priority value.

   # bash /usr/share/wazuh-indexer/bin/indexer-init.sh -i <WAZUH_INDEXER_IP_ADDRESS> -p <password>
   

   Note

   The policy will be applied only to new indices and not to existing ones. To rotate the current write index managed by the previous policy and start applying the new one, use the POST <alias>/_rollover endpoint. For example: POST wazuh-alerts/_rollover

Upgrading the ThreatLockDown server

When upgrading a multi-node ThreatLockDown manager cluster, run the upgrade in every node to make all the ThreatLockDown manager nodes join the cluster. Start with the master node to reduce server downtime.

Note

Upgrading from ThreatLockDown 4.2.x or lower creates the wazuh operating system user and group to replace ossec. To avoid upgrade conflicts, make sure that the wazuh user and group are not present in your operating system.

1. Upgrade the ThreatLockDown manager to the latest version.

   YumAPT

   # yum upgrade wazuh-manager
   

   Note

   If the /var/ossec/etc/ossec.conf configuration file was modified, it will not be replaced by the upgrade. You will therefore have to add the settings of the new capabilities manually. More information can be found in User manual.

2. Download the ThreatLockDown module for Filebeat:

   # curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | sudo tar -xvz -C /usr/share/filebeat/module
   

3. Download the alerts template:

   # curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.9.0/extensions/elasticsearch/7.x/wazuh-template.json
   # chmod go+r /etc/filebeat/wazuh-template.json
   

4. Restart Filebeat:

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable filebeat
   # systemctl start filebeat
   

5. Upload the new ThreatLockDown template and pipelines for Filebeat.

   # filebeat setup --pipelines
   # filebeat setup --index-management -E output.logstash.enabled=false
   

Upgrading the ThreatLockDown dashboard

1. Upgrade the ThreatLockDown dashboard.

   YumAPT

   # yum upgrade wazuh-dashboard
   

2. Restart the ThreatLockDown dashboard:

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-dashboard
   # systemctl start wazuh-dashboard
   

Next steps

The ThreatLockDown server, indexer, and dashboard are now successfully upgraded. The next step consists in upgrading the ThreatLockDown agents. Follow the instructions in:

• Upgrading the ThreatLockDown agent.