diff --git a/website/integrations/services/wazuh/application.png b/website/integrations/services/wazuh/application.png new file mode 100644 index 000000000..9d2c8a383 Binary files /dev/null and b/website/integrations/services/wazuh/application.png differ diff --git a/website/integrations/services/wazuh/certificate.png b/website/integrations/services/wazuh/certificate.png new file mode 100644 index 000000000..f50d02309 Binary files /dev/null and b/website/integrations/services/wazuh/certificate.png differ diff --git a/website/integrations/services/wazuh/certificate1.png b/website/integrations/services/wazuh/certificate1.png new file mode 100644 index 000000000..cb0fc565d Binary files /dev/null and b/website/integrations/services/wazuh/certificate1.png differ diff --git a/website/integrations/services/wazuh/index.md b/website/integrations/services/wazuh/index.md new file mode 100644 index 000000000..5779233b5 --- /dev/null +++ b/website/integrations/services/wazuh/index.md @@ -0,0 +1,97 @@ +--- +title: wazuh. +--- + +Support level: Community + +## What is wazuh + +> wazuh is an open source Security Information and Event Management System that also has (extended) Endpoint Detection & Response (XDR) capabilities, as well as components of a Network Intrusion & Detection System (NIDS). +> +> -- https://wazuh.com + +:::note +We assume that you already have wazuh and authentik installed/setup and now want to integrate authentik as your IDP solution to have SSO within wazuh. +::: + +## Preparation + +The following placeholders will be used: + +- `wazuh.company` is the FQDN of the wazuh server instance. +- `authentik.company` is the FQDN of the authentik install. + +While wazuh allows both LDAP and SAML integration, in this post we will only walk through the SAML integration. + +### Step 1 + +The first step would be to add a certificate for wazuh. + +You can generate a new one under `System` -> `Certificates` -> `Generate` + + +Add a name, set the validity period to 365 days and click `Generate` +![](./certificate.png) + +If all goes well authentik will display a message like the one below +![](./certificate1.png) + +### Step 2 + +Now add a SAML provider - you can find the options under `Applications` -> `Providers` + +![](./provider.png) + +Select SAML Provider and click Next +![](./provider1.png) + +Add a descriptive name, select the appropriate Authentication/Authorization flow, adjust the ACS URL to contain the IP/hostname of your wazuh installation and add `/_opendistro/_security/saml/acs` to the end. + +`https:///_opendistro/_security/saml/acs` + +also make sure to give it an appropriate `EntityID` name (`issuer`), you will need that later and a valid option is e.g. `wazuh-saml` + +Select `Post` as the `Service Provider Binding` and move on to the advanced protocol settings. +![](./provider2.png) + +The last step is to select the previously created `Signing Certificate` from the dropdown list and leave the rest of the configurations as default for now. +![](./provider3.png) +![](./provider4.png) +![](./provider5.png) + +### Step 3 + +Time to create a Property Mapping - this is a custom function that takes group/user data from authentik and provides it to wazuh in a structured way. + +We will map a group membership - `wazuh-admins` - as a backend role for RBAC in wazuh using Property Mapping - `Customization` -> `Property Mappings` + +`Name: wazuh property mapping` + +`SAML Attribute Role: Roles` + +![](./property-mapping.png) +![](./property-mapping2.png) + +```python +if ak_is_group_member(request.user, name="wazuh-admins"): + yield "wazuh-admin" +``` + +Make sure to adjust the provider to include the newly created property mapping in the `Advanced protocol settings`. +![](./property-mapping3.png) + +### Step 4 + +Now create an application to use the newly created provider. `Applications` -> `Applications` - `Create` + +`Name: wazuh` + +`Slug: wazuh` + +`Provider: SAML` + +`Policy Engine: any` + +![](./application.png) + +### Step 5 diff --git a/website/integrations/services/wazuh/property-mapping.png b/website/integrations/services/wazuh/property-mapping.png new file mode 100644 index 000000000..b2bc4ada5 Binary files /dev/null and b/website/integrations/services/wazuh/property-mapping.png differ diff --git a/website/integrations/services/wazuh/property-mapping2.png b/website/integrations/services/wazuh/property-mapping2.png new file mode 100644 index 000000000..10882adcf Binary files /dev/null and b/website/integrations/services/wazuh/property-mapping2.png differ diff --git a/website/integrations/services/wazuh/property-mapping3.png b/website/integrations/services/wazuh/property-mapping3.png new file mode 100644 index 000000000..3559edf6b Binary files /dev/null and b/website/integrations/services/wazuh/property-mapping3.png differ diff --git a/website/integrations/services/wazuh/provider.png b/website/integrations/services/wazuh/provider.png new file mode 100644 index 000000000..de57d6502 Binary files /dev/null and b/website/integrations/services/wazuh/provider.png differ diff --git a/website/integrations/services/wazuh/provider1.png b/website/integrations/services/wazuh/provider1.png new file mode 100644 index 000000000..1eb610ca6 Binary files /dev/null and b/website/integrations/services/wazuh/provider1.png differ diff --git a/website/integrations/services/wazuh/provider2.png b/website/integrations/services/wazuh/provider2.png new file mode 100644 index 000000000..931dd9e8c Binary files /dev/null and b/website/integrations/services/wazuh/provider2.png differ diff --git a/website/integrations/services/wazuh/provider3.png b/website/integrations/services/wazuh/provider3.png new file mode 100644 index 000000000..3559edf6b Binary files /dev/null and b/website/integrations/services/wazuh/provider3.png differ diff --git a/website/integrations/services/wazuh/provider4.png b/website/integrations/services/wazuh/provider4.png new file mode 100644 index 000000000..91b7f2f69 Binary files /dev/null and b/website/integrations/services/wazuh/provider4.png differ diff --git a/website/integrations/services/wazuh/provider5.png b/website/integrations/services/wazuh/provider5.png new file mode 100644 index 000000000..76a9cdfea Binary files /dev/null and b/website/integrations/services/wazuh/provider5.png differ