diff --git a/docker-compose/clamav/compose.yaml b/docker-compose/clamav/compose.yaml new file mode 100644 index 00000000..20d7fddd --- /dev/null +++ b/docker-compose/clamav/compose.yaml @@ -0,0 +1,20 @@ +--- +services: + clamav: + image: clamav/clamav:1.4.1 + container_name: clamav + volumes: + - ./config/clamd.conf:/etc/clamav/clamd.conf:ro + - ./config/freshclam.conf:/etc/clamav/freshclam.conf:ro + - clamav-data:/var/lib/clamav + # --> (Optional) Add a directory to scan + # - ./scandir:/scandir:rw + # <-- + # -- Change logging driver here... (required for Wazuh integration) + logging: + driver: syslog + options: + tag: "clamd" + restart: unless-stopped +volumes: + clamav-data: diff --git a/docker-compose/clamav/config/clamd.conf b/docker-compose/clamav/config/clamd.conf new file mode 100644 index 00000000..fe339da7 --- /dev/null +++ b/docker-compose/clamav/config/clamd.conf @@ -0,0 +1,81 @@ +# -- Change Log settings here... +LogSyslog yes +LogTime yes +# --> (Optional) Enable logging to file, can work together with LogSyslog +# LogFile /var/log/clamav/clamd.log +# LogRotate no +# <-- + +# -- Change process settings here... +PidFile /tmp/clamd.pid +LocalSocket /run/clamav/clamd.sock + +# -- Change TCP port settings here... +TCPSocket 3310 + +# -- Change user settings here... +User clamav + +# -- Change detection settings here... +# DetectPUA no +# HeuristicAlerts yes +# HeuristicScanPrecedence no + +# -- Change Heuristic Alerts here... +# AlertBrokenExecutables no +# AlertBrokenMedia no +# AlertEncrypted no +# AlertEncryptedArchive no +# AlertEncryptedDoc no +# AlertOLE2Macros no +# AlertPhishingSSLMismatch no +# AlertPhishingCloak no +# AlertPartitionIntersection no + +# -- Change Executable files settings here... +# ScanPE yes +# DisableCertCheck no +# ScanELF yes + +# -- Change Documents settings here... +# ScanOLE2 yes +# ScanPDF yes +# ScanSWF yes +# ScanXMLDOCS yes +# ScanHWP3 yes +# ScanOneNote yes + +# -- Change other file types settings here... +# ScanImage yes +# ScanImageFuzzyHash yes + +# -- Change Mail files settings here... +# ScanMail yes +# ScanPartialMessages no +# PhishingSignatures yes +# PhishingScanURLs yes + +# -- Change Data Loss Prevention (DLP) settings here... +# StructuredDataDetection no +# StructuredMinCreditCardCount 3 +# StructuredCCOnly no +# StructuredMinSSNCount 3 +# StructuredSSNFormatNormal yes +# StructuredSSNFormatStripped no + +# -- Change HTML settings here... +# ScanHTML yes + +# -- Change Archives settings here... +# ScanArchive yes + +# -- Change On-access Scan settings here... +# OnAccessMaxFileSize 5M +# OnAccessMaxThreads 5 +# --> (Optional) Set include paths, exclude paths, mount paths, etc... +#OnAccessIncludePath /home +#OnAccessExcludePath /home/user +#OnAccessExtraScanning no +#OnAccessMountPath / +#OnAccessMountPath /home/user +# <-- diff --git a/docker-compose/clamav/config/freshclam.conf b/docker-compose/clamav/config/freshclam.conf new file mode 100644 index 00000000..7b8ce2a5 --- /dev/null +++ b/docker-compose/clamav/config/freshclam.conf @@ -0,0 +1,21 @@ +# -- Change Log settings here... +LogSyslog no +LogTime yes +# --> (Optional) Enable logging to file, can work together with LogSyslog +# UpdateLogFile /var/log/clamav/freshclam.log +# LogRotate no +# <-- + +# -- Change process settings here... +PidFile /tmp/freshclam.pid + +# -- Change database settings here... +DatabaseOwner clamav +DatabaseMirror database.clamav.net + +# -- Change update and notification settings here... +ScriptedUpdates yes +NotifyClamd /etc/clamav/clamd.conf + +# -- Change custom sources for databases here... +#DatabaseCustomURL http://myserver.example.com/mysigs.ndb diff --git a/docker-compose/wazuh/.env.example b/docker-compose/wazuh/.env.example new file mode 100644 index 00000000..6c4025e0 --- /dev/null +++ b/docker-compose/wazuh/.env.example @@ -0,0 +1,6 @@ +INDEXER_USERNAME = "admin" +INDEXER_PASSWORD = "your-admin-password" +DASHBOARD_USERNAME = "kibanaserver" +DASHBOARD_PASSWORD = "your-kibanaserver-password" +API_USERNAME = "wazuh-wui" +API_PASSWORD = "your-wazuh-wui-password" diff --git a/docker-compose/wazuh/compose.yaml b/docker-compose/wazuh/compose.yaml new file mode 100644 index 00000000..4570c204 --- /dev/null +++ b/docker-compose/wazuh/compose.yaml @@ -0,0 +1,173 @@ +services: + wazuh.manager: + image: wazuh/wazuh-manager:4.9.2 + container_name: wazuh-prod-1-manager + hostname: wazuh.manager + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 655360 + hard: 655360 + ports: + - "1514:1514" + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - INDEXER_URL=https://wazuh.indexer:9200 + - INDEXER_USERNAME=${INDEXER_USERNAME:?error} + - INDEXER_PASSWORD=${INDEXER_PASSWORD:?error} + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=${API_USERNAME:?error} + - API_PASSWORD=${API_PASSWORD:?error} + volumes: + - wazuh_api_configuration:/var/ossec/api/configuration + - wazuh_etc:/var/ossec/etc + - wazuh_logs:/var/ossec/logs + - wazuh_queue:/var/ossec/queue + - wazuh_var_multigroups:/var/ossec/var/multigroups + - wazuh_integrations:/var/ossec/integrations + - wazuh_active_response:/var/ossec/active-response/bin + - wazuh_agentless:/var/ossec/agentless + - wazuh_wodles:/var/ossec/wodles + - filebeat_etc:/etc/filebeat + - filebeat_var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + # --> (Optional) For custom rules + # - ./config/rules/local_rules.xml:/var/ossec/etc/rules/local_rules.xml:ro + # <-- + # --> (Optional) When using traefik + # networks: + # - frontend + # <-- + # --> (Optional) When using a separate backend network + # - backend + # <-- + restart: unless-stopped + + wazuh.indexer: + image: wazuh/wazuh-indexer:4.9.2 + container_name: wazuh-prod-1-indexer + hostname: wazuh.indexer + ports: + - "9200:9200" + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem + - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml + # --> (Optional) When using traefik + # networks: + # - frontend + # <-- + # --> (Optional) When using a separate backend network + # - backend + # <-- + restart: unless-stopped + + wazuh.dashboard: + image: wazuh/wazuh-dashboard:4.9.2 + container_name: wazuh-prod-1-dashboard + hostname: wazuh.dashboard + # --> (Optional) Remove the port mapping when using traefik + ports: + - 4443:5601 + # <-- + environment: + - INDEXER_USERNAME=${INDEXER_USERNAME:?error} + - INDEXER_PASSWORD=${INDEXER_PASSWORD:?error} + - WAZUH_API_URL=https://wazuh.manager + - DASHBOARD_USERNAME=${DASHBOARD_USERNAME:?error} + - DASHBOARD_PASSWORD=${DASHBOARD_PASSWORD:?error} + - API_USERNAME=${API_USERNAME:?error} + - API_PASSWORD=${API_PASSWORD:?error} + volumes: + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config + - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom + # --> (Optional) When using traefik + # labels: + # - traefik.enable=true + # - traefik.http.routers.wazuh-prod-1-https.entrypoints=websecure + # - traefik.http.routers.wazuh-prod-1-https.rule=Host(`wazuh-prod-1.srv-prod-1.home.clcreative.de`) + # - traefik.http.routers.wazuh-prod-1-https.tls=true + # - traefik.http.routers.wazuh-prod-1-https.tls.certresolver=cloudflare + # - traefik.http.services.wazuh-prod-1-service.loadbalancer.server.port=5601 + # - traefik.http.services.wazuh-prod-1-service.loadbalancer.server.scheme=https + # networks: + # - frontend + # <-- + # --> (Optional) When using a separate backend network + # - backend + # <-- + depends_on: + - wazuh.indexer + restart: unless-stopped + + # --> (Optional) When you need to use an SMTP relay for email notifications, and authentication is required + # postfix: + # image: mwader/postfix-relay:1.1.39 + # environment: + # - POSTFIX_myhostname=postfix + # volumes: + # - ./config/postfix-relay/main.cf:/etc/postfix/main.cf:ro + # - ./config/postfix-relay/sasl_passwd:/etc/postfix/sasl_passwd:rw + # - postfix_data:/etc/postfix + # networks: + # - backend + # restart: unless-stopped + # <-- + +volumes: + wazuh_api_configuration: + wazuh_etc: + wazuh_logs: + wazuh_queue: + wazuh_var_multigroups: + wazuh_integrations: + wazuh_active_response: + wazuh_agentless: + wazuh_wodles: + filebeat_etc: + filebeat_var: + wazuh-indexer-data: + wazuh-dashboard-config: + wazuh-dashboard-custom: + # --> (Optional) When you need to use an SMTP relay for email notifications, and authentication is required + # postfix_data: + # <-- + +# --> (Optional) When using traefik +# networks: +# frontend: +# external: true +# <-- +# --> (Optional) When using a separate backend network +# backend: +# external: true +# <-- diff --git a/docker-compose/wazuh/config/postfix-relay/main.cf b/docker-compose/wazuh/config/postfix-relay/main.cf new file mode 100644 index 00000000..858bb7f6 --- /dev/null +++ b/docker-compose/wazuh/config/postfix-relay/main.cf @@ -0,0 +1,12 @@ +relayhost = [your-smtp-server-url]:587 ; Replace [your-smtp-server-url] with your SMTP server URL +smtp_sasl_auth_enable = yes +smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd +smtp_sasl_security_options = noanonymous +smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt +smtp_use_tls = yes +smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination +mydestination = localhost +myhostname = postfix +mynetworks = 0.0.0.0/0 +smtp_tls_security_level = may +smtpd_tls_security_level = none diff --git a/docker-compose/wazuh/config/postfix-relay/sasl_passwd b/docker-compose/wazuh/config/postfix-relay/sasl_passwd new file mode 100644 index 00000000..94dc285b --- /dev/null +++ b/docker-compose/wazuh/config/postfix-relay/sasl_passwd @@ -0,0 +1 @@ +[your-smtp-server-url]:587 username:password ; Replace [your-smtp-server-url] with your SMTP server URL, and username:password with your SMTP server credentials diff --git a/docker-compose/wazuh/config/rules/local_rules.xml b/docker-compose/wazuh/config/rules/local_rules.xml new file mode 100644 index 00000000..0fe67250 --- /dev/null +++ b/docker-compose/wazuh/config/rules/local_rules.xml @@ -0,0 +1,12 @@ + + + diff --git a/docker-compose/wazuh/config/wazuh_cluster/wazuh_manager.conf b/docker-compose/wazuh/config/wazuh_cluster/wazuh_manager.conf new file mode 100644 index 00000000..bd1d5562 --- /dev/null +++ b/docker-compose/wazuh/config/wazuh_cluster/wazuh_manager.conf @@ -0,0 +1,308 @@ + + + yes + yes + no + no + no + postfix + your-from-email + your-to-email + 12 + alerts.log + 10m + 0 + + + + 3 + 12 + + + + + plain + + + + secure + 1514 + tcp + 131072 + + + + + no + yes + yes + yes + yes + yes + yes + yes + + + 43200 + + etc/rootcheck/rootkit_files.txt + etc/rootcheck/rootkit_trojans.txt + + yes + + + + yes + 1800 + 1d + yes + + wodles/java + wodles/ciscat + + + + + yes + yes + /var/log/osquery/osqueryd.results.log + /etc/osquery/osquery.conf + yes + + + + + no + 1h + yes + yes + yes + yes + yes + yes + yes + + + + 10 + + + + + yes + yes + 12h + yes + + + + yes + yes + 60m + + + + yes + + https://wazuh.indexer:9200 + + + + /etc/ssl/root-ca.pem + + /etc/ssl/filebeat.pem + /etc/ssl/filebeat.key + + + + + + no + + + 43200 + + yes + + + yes + + + no + + + /etc,/usr/bin,/usr/sbin + /bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/random.seed + /etc/adjtime + /etc/httpd/logs + /etc/utmpx + /etc/wtmpx + /etc/cups/certs + /etc/dumpdates + /etc/svc/volatile + + + .log$|.swp$ + + + /etc/ssl/private.key + + yes + yes + yes + yes + + + 10 + + + 100 + + + + yes + 5m + 1h + 10 + + + + + + 127.0.0.1 + ^localhost.localdomain$ + + + + disable-account + disable-account + yes + + + + restart-wazuh + restart-wazuh + + + + firewall-drop + firewall-drop + yes + + + + host-deny + host-deny + yes + + + + route-null + route-null + yes + + + + win_route-null + route-null.exe + yes + + + + netsh + netsh.exe + yes + + + + + + + command + df -P + 360 + + + + full_command + netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d + netstat listening ports + 360 + + + + full_command + last -n 20 + 360 + + + + + ruleset/decoders + ruleset/rules + 0215-policy_rules.xml + etc/lists/audit-keys + etc/lists/amazon/aws-eventnames + etc/lists/security-eventchannel + + + etc/decoders + etc/rules + + + + yes + 1 + 64 + 15m + + + + + no + 1515 + no + yes + no + HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH + + no + etc/sslmanager.cert + etc/sslmanager.key + no + + + + wazuh + node01 + master + aa093264ef885029653eea20dfcf51ae + 1516 + 0.0.0.0 + + wazuh.manager + + no + yes + + + + + + + syslog + /var/ossec/logs/active-responses.log + + + diff --git a/docker-compose/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml b/docker-compose/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml new file mode 100644 index 00000000..ccaec070 --- /dev/null +++ b/docker-compose/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml @@ -0,0 +1,12 @@ +server.host: 0.0.0.0 +server.port: 5601 +opensearch.hosts: https://wazuh.indexer:9200 +opensearch.ssl.verificationMode: certificate +opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] +opensearch_security.multitenancy.enabled: false +opensearch_security.readonly_mode.roles: ["kibana_read_only"] +server.ssl.enabled: true +server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" +server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" +opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] +uiSettings.overrides.defaultRoute: /app/wz-home diff --git a/docker-compose/wazuh/config/wazuh_dashboard/wazuh.yml b/docker-compose/wazuh/config/wazuh_dashboard/wazuh.yml new file mode 100644 index 00000000..4cfb0fb2 --- /dev/null +++ b/docker-compose/wazuh/config/wazuh_dashboard/wazuh.yml @@ -0,0 +1,10 @@ +hosts: + - 1513629884013: + url: "https://wazuh.manager" + port: 55000 + username: wazuh-wui + password: "your-wazuh-wui-password" + run_as: false + +enrollment.dns: "your-enrollment-dns-server" +alerts.sample.prefix: "wazuh-alerts-" diff --git a/docker-compose/wazuh/config/wazuh_indexer/internal_users.yml b/docker-compose/wazuh/config/wazuh_indexer/internal_users.yml new file mode 100644 index 00000000..13bd41ac --- /dev/null +++ b/docker-compose/wazuh/config/wazuh_indexer/internal_users.yml @@ -0,0 +1,56 @@ +--- +# This is the internal user database +# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh + +_meta: + type: "internalusers" + config_version: 2 + +# Define your internal users here + +## Demo users + +admin: + hash: "$2y$12$y85PV5Ob2lqeR30Rcm/F9..8JMgLT5ALZGMtzTo7c.p1vPpR394ki" + reserved: true + backend_roles: + - "admin" + description: "Demo admin user" + +kibanaserver: + hash: "$2y$12$b9G5KNitghhTt1V5asLQd.nDOjd7O8h.30vkZVfroWT/HFq0y51TO" + reserved: true + description: "Demo kibanaserver user" + +kibanaro: + hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" + reserved: false + backend_roles: + - "kibanauser" + - "readall" + attributes: + attribute1: "value1" + attribute2: "value2" + attribute3: "value3" + description: "Demo kibanaro user" + +logstash: + hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" + reserved: false + backend_roles: + - "logstash" + description: "Demo logstash user" + +readall: + hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" + reserved: false + backend_roles: + - "readall" + description: "Demo readall user" + +snapshotrestore: + hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" + reserved: false + backend_roles: + - "snapshotrestore" + description: "Demo snapshotrestore user" diff --git a/docker-compose/wazuh/config/wazuh_indexer/wazuh.indexer.yml b/docker-compose/wazuh/config/wazuh_indexer/wazuh.indexer.yml new file mode 100644 index 00000000..afcd0ffc --- /dev/null +++ b/docker-compose/wazuh/config/wazuh_indexer/wazuh.indexer.yml @@ -0,0 +1,30 @@ +network.host: "0.0.0.0" +node.name: "wazuh.indexer" +path.data: /var/lib/wazuh-indexer +path.logs: /var/log/wazuh-indexer +discovery.type: single-node +http.port: 9200-9299 +transport.tcp.port: 9300-9399 +compatibility.override_main_response_version: true +plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.http.enabled: true +plugins.security.ssl.transport.enforce_hostname_verification: false +plugins.security.ssl.transport.resolve_hostname: false +plugins.security.authcz.admin_dn: +- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.check_snapshot_restore_write_privileges: true +plugins.security.enable_snapshot_restore_privilege: true +plugins.security.nodes_dn: +- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.restapi.roles_enabled: +- "all_access" +- "security_rest_api_access" +plugins.security.system_indices.enabled: true +plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] +plugins.security.allow_default_init_securityindex: true +cluster.routing.allocation.disk.threshold_enabled: false diff --git a/docker-compose/wazuh/generate-certs.yaml b/docker-compose/wazuh/generate-certs.yaml new file mode 100644 index 00000000..7f9ecfe3 --- /dev/null +++ b/docker-compose/wazuh/generate-certs.yaml @@ -0,0 +1,8 @@ +--- +services: + generator: + image: wazuh/wazuh-certs-generator:0.0.2 + hostname: wazuh-certs-generator + volumes: + - ./config/wazuh_indexer_ssl_certs/:/certificates/ + - ./config/certs.yml:/config/certs.yml