- Overview
- Description - What the module does and why it is useful
- File Information - include configuration and scripts
- Installation & Setup - Configuration options and additional functionality
Falco-Wazuh Integration service, support with k8s v1.21.*+
Basic simple integration around falco and wazuh into k8s cluster with daemonset deployment, is adopted from https://github.com/Stuxend/falco-wazuh projects.
- Files to deploy daemonset and service account
k8/
├── deployment_cri_k8s.yaml
├── rbac-falco-wazuh_k8s_admin.yaml
└── README.md
3 files
- Wazuh server rules, import it into wazuh manager
wazuh-rules/
├── 0485-falco.xml (__*this is decoders file*__)
├── 0685-falco_rules.xml (__*this is rules file*__)
├── old
│ ├── 0485-falco.xml
│ └── 0685-falco_rules.xml
└── README.md
1 directory, 5 files
- Agent files, docker entrypoint script, and default wazuh rules
agent
├── entrypoint.sh
├── falcolog
├── falco_rules.yaml
├── falco.yaml
├── ossec.conf
└── rootchecks
├── cis_apache2224_rcl.txt
├── cis_debian_linux_rcl.txt
├── cis_mysql5-6_community_rcl.txt
├── cis_mysql5-6_enterprise_rcl.txt
├── cis_rhel5_linux_rcl.txt
├── cis_rhel6_linux_rcl.txt
├── cis_rhel7_linux_rcl.txt
├── cis_rhel_linux_rcl.txt
├── cis_sles11_linux_rcl.txt
├── cis_sles12_linux_rcl.txt
├── cis_win2012r2_domainL1_rcl.txt
├── cis_win2012r2_domainL2_rcl.txt
├── cis_win2012r2_memberL1_rcl.txt
├── cis_win2012r2_memberL2_rcl.txt
├── rootkit_files.txt
├── rootkit_trojans.txt
├── system_audit_rcl.txt
├── system_audit_ssh.txt
├── win_applications_rcl.txt
├── win_audit_rcl.txt
└── win_malware_rcl.txt
1 directory, 28 files
- Please make sure to create wazuh namespace first, and apply serviceAccount via k8/rbac-falco-wazuh_k8s_admin.yaml
- Before applying deployment file please edit this section :
- name: wazuh_token
valueFrom:
secretKeyRef:
name: wazuh-admin-token-8zzhf
key: token
- name: wazuh_cert
valueFrom:
secretKeyRef:
name: wazuh-admin-token-8zzhf
key: ca.crt
*NB: Please matching created secrets, for ex: wazuh-admin-token-xxxxx
- After editing token section, we can apply the deployment project vi k8/deployment_cri_k8s.yaml
That's all hope will be help,
Thank You
Regards,
@zeinoux