TSYS Group » Chief Operations Officer » Known Element Enterprises - Technology & Facility Services

Parent: #422 (BUG: tsys-siem apt-get update failing on wazuh package repo)

Background¶

Diagnosis of #422 revealed the Wazuh installation on tsys-siem (VM 707 on tsys7) is critically broken. All three packages (indexer, manager, dashboard) have missing files — binaries, configs, and data directories are all absent despite dpkg showing them as 'installed'. This is an aborted/corrupted installation requiring a full rebuild.

Scope¶

1. Add official Wazuh 4.x apt repository + GPG key to tsys-siem
2. Purge all existing wazuh-* packages (clean slate)
3. Fresh install: wazuh-manager, wazuh-indexer, wazuh-dashboard (v4.14.x)
4. Install OpenJDK (prerequisite for indexer)
5. Configure indexer: certificates, cluster/network settings
6. Configure manager: API, auth, integrations
7. Configure dashboard: connect to indexer + manager
8. Enable + start all services
9. Verify: indexer cluster health, manager agent readiness, dashboard UI accessible

Deployment decisions (awaiting user input)¶

• Single-node vs distributed deployment?
• Certificate strategy (self-signed via wazuh-certs-tool vs internal CA #342)?
• Integration with LibreNMS (#337) for alert forwarding?
• Retention policy for security events?

Related¶

• #422 (parent — apt repo diagnosis)
• #314 (OAM alerts umbrella)
• #335 (centralized syslog to Wazuh)
• #343 (monitoring coverage matrix)