Index life management

Using the ISM user interface

This is the recommended method. Perform the following steps using the ThreatLockDown dashboard user interface.

1. Click on the upper left menu ☰ and select Index Management under OpenSearch Plugins.

2. Choose State management policies and click rollover_policy.

3. Select your preferred edition method and update with your custom values.

Using the ISM API

You can use the ISM API directly from Dev Tools under Management section on the UI. You can also use external tools like Postman, cURL, or any other tool or library capable of performing HTTP requests.

By default, only the admin and kibanaserver users have permissions to manage the policies. However, the manage_ism permission group and role grants permissions to the ISM API.

Using the initialization script

When deploying ThreatLockDown step by step, you have the option to customize the rollover policy using the indexer-ism-init.sh script. In this scenario, the cluster initialization process involves two distinct steps instead of using the indexer-init.sh script:

1. To set up the security options, execute the indexer-security-init.sh script.

   # /usr/share/wazuh-indexer/bin/indexer-security-init.sh
   

2. Next, configure the rollover policy by running the indexer-ism-init.sh script. For example, you can specify a 30 days rollover interval with the -a option as shown below. For a complete list of available options, use --help.

   # /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -a 30d
   

   Please note that this script uses the default password for the admin user. If you have changed the password, use the -p option to specify the new password.

Using the Visual editor

1. Click on the upper left menu ☰, go to Indexer/dashboard management, and select Index Management. Choose State management policies and click Create policy. Select Visual editor and click Continue.

   
   

2. Enter a unique Policy ID in the Policy info section. For example, wazuh-alert-retention-policy. You can optionally describe the policy in the Description field.

   

3. Click Add template under ISM templates and enter an index pattern such as wazuh-alerts-* to apply this policy to future alert indices automatically.

4. Click Add state to create a state for index deletion. Enter a name such as delete_alerts.

5. Click Add action and select Delete in the Action type. Click Add action. Then click Save state.

6. Click Add state again to create an initial state. Enter a name, such as initial.

7. Choose Add before from the Order tab and select delete_alerts.

8. Click Add transition and select delete_alerts as the Destination state.

9. Select Minimum Index Age in Condition. Input the retention value, for example, 90d for 90 days, in the Minimum Index Age.

10. Click Add transition. Click Save state. Click Create.

Using the JSON editor

1. Click on the upper left menu ☰, go to Indexer/dashboard management, and choose Index Management. Choose State management policies and click Create policy. Select JSON editor and click Continue.

   

2. Enter a unique Policy ID in the Policy info section. For example, wazuh-alert-retention-policy. You can optionally enter a description within your JSON policy definition.

   

3. In the Define policy section, replace the content with your JSON policy definition. Your definition must look similar to this.

   {
       "policy": {
           "policy_id": "wazuh-alert-retention-policy",
           "description": "ThreatLockDown alerts retention policy",
           "schema_version": 17,
           "error_notification": null,
           "default_state": "retention_state",
           "states": [
               {
                   "name": "retention_state",
                   "actions": [],
                   "transitions": [
                       {
                           "state_name": "delete_alerts",
                           "conditions": {
                               "min_index_age": "90d"
                           }
                       }
                   ]
               },
               {
                   "name": "delete_alerts",
                   "actions": [
                       {
                           "retry": {
                               "count": 3,
                               "backoff": "exponential",
                               "delay": "1m"
                           },
                           "delete": {}
                       }
                   ],
                   "transitions": []
               }
           ],
           "ism_template": [
               {
                   "index_patterns": [
                       "wazuh-alerts-*"
                   ],
                   "priority": 1
               }
           ]
       }
   }
   

   Adjust the “min_index_age”: from “90d” to your preferred number of days for minimum index retention.

4. Click Create.