Why I'm Writing this Post

In some previous posts, I've gone over a few topics that necessitate this post, including:

• Introduced the process of installing and configuring Wazuh
• Covering the OwlH integration with Wazuh (Archived Page)
• Covering the logall_json log archiving option in Wazuh

For anyone who may have followed any of my previous write-ups, I want to have a brief overview that will ensure your upgrades go as smoothly as possible.

Official Upgrade Documentation

My previous write-ups covering installation and integration are written using the Wazuh central components; that is — Wazuh Indexer, Wazuh Manager, and Wazuh Dashboard.

Wazuh central components - Upgrade guide · Wazuh documentation

User manual, installation and configuration guides. Learn how to get the most out of the Wazuh platform.

WazuhWazuh

Upgrading with Customizations

I am going to refer you to the official documentation for all of the commands and procedures for upgrading the Wazuh server infrastructure. I will merely be adding context for certain parts in the sections below.

In general, the processes is detailed in four core steps:

1. Preparing to upgrade
2. Upgrading Wazuh Indexer
3. Upgrading Wazuh Manager Server
4. Upgrading Wazuh Dashboard

Preparing to Upgrade

Log into the Wazuh Manager server and run the following command:

systemctl stop wazuh-manager

systemctl stop filebeat

Then, log into the Wazuh Dashboard server and run this command:

systemctl stop wazuh-dashboard

Wazuh Indexer

Some tips if you followed my Wazuh SIEM setup guide for Proxmox:

• If you're running a cluster of Wazuh Indexers, perform the Wazuh Indexer steps on each node one at a time.
  • Do not try to complete them simultaneously
  • We do this to maintain uptime of the cluster
• For the curl commands, username:password is the credential you use to log into Wazuh Dashboard.
  • I recommend only providing the username in the command
  • Do NOT put the password on the command line

sudo apt-mark hold wazuh-indexer

Wazuh Manager

If you followed my SIEM setup guide, log into your Wazuh Manager server and run the commands shown in the documetnation.

Wazuh Manager Configuration

As noted in the upgrade guide, if /var/ossec/etc/ossec.conf has been modified, the original will not be overwritten. You will have to reconcile any differences between /var/ossec/etc/ossec.conf and /var/ossec/etc/ossec.conf.new.

In my environment — as documented in this guide — I am using the logall_json option and rotate_interval options in ossec.conf, therefore necessitating this step.

sudo apt-mark hold wazuh-manager

Filebeat Configuration

Installing a new version of Wazuh Manager requires the latest wazuh module for Filebeat. This will not overwrite /etc/filebeat/filebeat.conf, but it will overwrite the files in /usr/share/filebeat/modules/wazuh.

Wazuh Dashboards

sudo apt-mark hold wazuh-dashboard

When logging back into the Wazuh Dashboard server — https://wazuh-dashboard-ip — the wazuh-alerts-* index pattern will be set as the default index pattern.

In my environment:

• I am using the logall_json option
• Filebeat is reading from archive.json in Wazuh
• Filebeat is writing to wazuh-archives-*

I'd like to set wazuh-archives-* as the default index pattern after upgrade.

Wazuh Agents

Windows

Windows agents are installed via a MSI package and will not be automatically upgraded. Install the target MSI package and restart the service. If you need to install on a batch of hosts, consider using something like Ansible or a PowerShell script over WinRM.

Linux

Linux agents — when installed using your distributions package manager (eg. apt, yum) — need to be held back from unintended upgrades. For example, running apt update && apt upgrade -y would upgrade the Wazuh Agent on a Debian-based system if the package was not held.

For Debian-based distributions, you can use the apt-mark command to hold pacakges from being upgraded without specific overrides.

sudo apt-mark hold wazuh-agent

When ready to upgrade the package:

• Run the command below
• If prompted to overwrite any configuration files, typically answer, N

# Install the latest version of the wazuh-agent package
sudo apt install wazuh-agent
# Put the package back on hold
sudo apt-mark hold wazuh-agent