Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Release 4.5.1 - RC 1 - E2E UX tests - Wazuh indexer #18419

Closed
2 tasks done
teddytpc1 opened this issue Aug 14, 2023 · 13 comments
Closed
2 tasks done

Release 4.5.1 - RC 1 - E2E UX tests - Wazuh indexer #18419

teddytpc1 opened this issue Aug 14, 2023 · 13 comments
Assignees
@vcerenu
Labels
level/task type/test

Comments

@teddytpc1
Copy link
Member

teddytpc1 commented Aug 14, 2023 •
edited by damarisg
Loading

The following issue aims to run the specified test for the current release candidate, report the results, and open new issues for any encountered errors.

Test information
Test name Wazuh Indexer
Category Installation
Deployment option Single Indexer and agent, Multi Server: Step by step
Main release issue #18366
E2E UX tests parent issue # #18365
Release candidate # RC 1

Environment

Component OS Installation
Wazuh dashboard Amazon Linux 2 Installation assistant
Wazuh indexer Amazon Linux 2 Installation assistant
Wazuh server Amazon Linux 2 Installation assistant
Wazuh agent Amazon Linux 2 Installing Wazuh agents

Test description

Best effort to test Wazuh indexer package. Think critically and at least review/test:

  • Wazuh indexer package specs
  • Indexer package size
  • Indexer package metadata (description)
  • Indexer package digital signature
  • Installed files location, size and permissions
  • Installation footprint (check that no unnecessary files are modified/broken in the file system. For example that operating system files do keep their right owner/pemissions and that the installer did not break the system.)
  • Installed Wazuh indexer service
  • Wazuh indexer logs when installed
  • Wazuh indexer templates and indices created
  • Wazuh indexer configuration (e.g. replicas are expected to be zero by default, how many shards per index,...) Try to compare and find anomalies with the previous Wazuh indexer version using appropiate E2E UX issue. Write down and report as much information as possible to allow comparison between versions using this issue.
  • Wazuh indexer cluster node communication and configuration
  • Wazuh indexer cluster status
  • Wazuh indexer packages uninstallation procedure

Test report procedure

All test results must have one of the following statuses:
🟢 All checks passed.
🔴 There is at least one failed result.
🟡 There is at least one expected failure or skipped test and no failures.

Any failing test must be properly addressed with a new issue, detailing the error and the possible cause.

An extended report of the test results must be attached as a ZIP or TXT file. Please attach any documents, screenshots, or tables to the issue update with the results. This report can be used by the auditors to dig deeper into any possible failures and details.

Conclusions

Status Test Failure type Notes
🟢 Environment installation
🟢 Wazuh indexer package information
🟢 Installed files location, size and permissions
🟢 Installation footprint
🟢 Wazuh indexer service There are some known warnings related to System::setSecurityManager, as they were also reported on previous tests #18169 (comment)
🟢 Wazuh indexer installation logs
🟢 Wazuh indexer indices, templates, and shards
🟢 Wazuh indexer cluster status
🟢 Uninstall procedure
 :green_circle:  E2E dataflow

Auditors validation

The definition of done for this one is the validation of the conclusions and the test results from all auditors.

All checks from below must be accepted in order to close this issue.
@teddytpc1 teddytpc1 mentioned this issue Aug 14, 2023
Closed
@wazuhci wazuhci moved this to Triage in Release 4.5.1 Aug 14, 2023
@vcerenu vcerenu self-assigned this Aug 14, 2023
@wazuhci wazuhci moved this from Triage to In progress in Release 4.5.1 Aug 14, 2023
@vcerenu
Copy link
Member

vcerenu commented Aug 14, 2023 •
edited
Loading

Environment installation 🟢

Hosts information 🟢

All the hosts used for this test are taken from the same OS:

[root@ip-172-31-4-121 ~]# cat /etc/os-release 
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"
[root@ip-172-31-4-121 ~]#

The IP addresses for this scenario are:

Wazuh manager: 172.31.15.240
Wazuh indexer: 172.31.4.121
Wazuh dashboard: 172.31.0.247
Wazuh agent: 172.31.5.38

Wazuh Indexer 🟢

Generating the SSL certificates

[root@ip-172-31-4-121 ~]# curl -sO https://packages-dev.wazuh.com/4.5/wazuh-install.sh
[root@ip-172-31-4-121 ~]# curl -sO https://packages-dev.wazuh.com/4.5/config.yml
[root@ip-172-31-4-121 ~]# ls -ltr
total 160
-rw-r--r-- 1 root root 155653 Aug 14 16:31 wazuh-install.sh
-rw-r--r-- 1 root root    622 Aug 14 16:31 config.yml
[root@ip-172-31-4-121 ~]#

Content of config.yml:

[root@ip-172-31-4-121 ~]# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: 172.31.4.121
    #- name: node-2
    #  ip: <indexer-node-ip>
    #- name: node-3
    #  ip: <indexer-node-ip>

  # Wazuh server nodes
  # If there is more than one Wazuh server
  # node, each one must have a node_type
  server:
    - name: wazuh-1
      ip: 172.31.15.240
    #  node_type: master
    #- name: wazuh-2
    #  ip: <wazuh-manager-ip>
    #  node_type: worker
    #- name: wazuh-3
    #  ip: <wazuh-manager-ip>
    #  node_type: worker

  # Wazuh dashboard nodes
  dashboard:
    - name: dashboard
      ip: 172.31.0.247
[root@ip-172-31-4-121 ~]#

Created and copied the certificates to all the required nodes:

[root@ip-172-31-4-121 ~]# bash wazuh-install.sh --generate-config-files
14/08/2023 16:40:03 INFO: Starting Wazuh installation assistant. Wazuh version: 4.5.1
14/08/2023 16:40:03 INFO: Verbose logging redirected to /var/log/wazuh-install.log
14/08/2023 16:40:10 INFO: --- Configuration files ---
14/08/2023 16:40:10 INFO: Generating configuration files.
14/08/2023 16:40:11 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
[root@ip-172-31-4-121 ~]#

Wazuh indexer installation

[root@ip-172-31-4-121 ~]# bash wazuh-install.sh --wazuh-indexer node-1
14/08/2023 16:40:58 INFO: Starting Wazuh installation assistant. Wazuh version: 4.5.1
14/08/2023 16:40:58 INFO: Verbose logging redirected to /var/log/wazuh-install.log
14/08/2023 16:41:06 INFO: Wazuh development repository added.
14/08/2023 16:41:06 INFO: --- Wazuh indexer ---
14/08/2023 16:41:06 INFO: Starting Wazuh indexer installation.
14/08/2023 16:42:28 INFO: Wazuh indexer installation finished.
14/08/2023 16:42:28 INFO: Wazuh indexer post-install configuration finished.
14/08/2023 16:42:28 INFO: Starting service wazuh-indexer.
14/08/2023 16:42:48 INFO: wazuh-indexer service started.
14/08/2023 16:42:48 INFO: Initializing Wazuh indexer cluster security settings.
14/08/2023 16:42:52 INFO: Wazuh indexer cluster initialized.
14/08/2023 16:42:52 INFO: Installation finished.
[root@ip-172-31-4-121 ~]#

Cluster initialization:

[root@ip-172-31-4-121 ~]# bash wazuh-install.sh --start-cluster
14/08/2023 16:44:12 INFO: Starting Wazuh installation assistant. Wazuh version: 4.5.1
14/08/2023 16:44:12 INFO: Verbose logging redirected to /var/log/wazuh-install.log
14/08/2023 16:44:30 INFO: Wazuh indexer cluster security configuration initialized.
14/08/2023 16:44:47 INFO: Wazuh indexer cluster started.
[root@ip-172-31-4-121 ~]#
Wazuh manager 🟢

Installing the Wazuh manager

[root@ip-172-31-15-240 ~]# bash wazuh-install.sh --wazuh-server wazuh-1
14/08/2023 16:54:11 INFO: Starting Wazuh installation assistant. Wazuh version: 4.5.1
14/08/2023 16:54:11 INFO: Verbose logging redirected to /var/log/wazuh-install.log
14/08/2023 16:54:20 INFO: Wazuh development repository added.
14/08/2023 16:54:20 INFO: --- Wazuh server ---
14/08/2023 16:54:20 INFO: Starting the Wazuh manager installation.
14/08/2023 16:54:47 INFO: Wazuh manager installation finished.
14/08/2023 16:54:47 INFO: Starting service wazuh-manager.
14/08/2023 16:55:05 INFO: wazuh-manager service started.
14/08/2023 16:55:05 INFO: Starting Filebeat installation.
14/08/2023 16:55:34 INFO: Filebeat installation finished.
14/08/2023 16:55:34 INFO: Filebeat post-install configuration finished.
14/08/2023 16:55:39 INFO: Starting service filebeat.
14/08/2023 16:55:39 INFO: filebeat service started.
14/08/2023 16:55:39 INFO: Installation finished.
[root@ip-172-31-15-240 ~]# filebeat test output
elasticsearch: https://172.31.4.121:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 172.31.4.121
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2
[root@ip-172-31-15-240 ~]#
Wazuh dashboard 🟢

Installing the Wazuh dashboard

[root@ip-172-31-0-247 ~]# bash wazuh-install.sh --wazuh-dashboard dashboard
15/08/2023 10:55:31 INFO: Starting Wazuh installation assistant. Wazuh version: 4.5.1
15/08/2023 10:55:31 INFO: Verbose logging redirected to /var/log/wazuh-install.log
15/08/2023 10:55:38 INFO: Wazuh development repository added.
dashboard
15/08/2023 10:55:39 INFO: --- Wazuh dashboard ----
15/08/2023 10:55:39 INFO: Starting Wazuh dashboard installation.
15/08/2023 10:56:43 INFO: Wazuh dashboard installation finished.
15/08/2023 10:56:43 INFO: Wazuh dashboard post-install configuration finished.
15/08/2023 10:56:43 INFO: Starting service wazuh-dashboard.
15/08/2023 10:56:43 INFO: wazuh-dashboard service started.
15/08/2023 10:57:04 INFO: Initializing Wazuh dashboard web application.
15/08/2023 10:57:05 INFO: Wazuh dashboard web application initialized.
15/08/2023 10:57:05 INFO: --- Summary ---
15/08/2023 10:57:05 INFO: You can access the web interface https://172.31.0.247
    User: admin
    Password: SmqqaGMRpwcHakGi9ZHB1FLc8Qc?yTIW
15/08/2023 10:57:05 INFO: Installation finished.
[root@ip-172-31-0-247 ~]#

Dashboard UI:

image

Wazuh agent 🟢

Installing the Wazuh agent

[root@ip-172-31-5-38 ~]# rpm --import https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
[root@ip-172-31-5-38 ~]# cat > /etc/yum.repos.d/wazuh.repo << EOF
> [wazuh]
> gpgcheck=1
> gpgkey=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
> enabled=1
> name=EL-\$releasever - Wazuh
> baseurl=https://packages-dev.wazuh.com/pre-release/yum/
> protect=1
> EOF
[root@ip-172-31-5-38 ~]# WAZUH_MANAGER='172.31.15.240' WAZUH_AGENT_GROUP='default' yum install wazuh-agent-4.5.1-1.x86_64
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package wazuh-agent.x86_64 0:4.5.1-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================================================================================================================
 Package                                                 Arch                                               Version                                             Repository                                         Size
========================================================================================================================================================================================================================
Installing:
 wazuh-agent                                             x86_64                                             4.5.1-1                                             wazuh                                             8.7 M

Transaction Summary
========================================================================================================================================================================================================================
Install  1 Package

Total download size: 8.7 M
Installed size: 25 M
Is this ok [y/d/N]: y
Downloading packages:
wazuh-agent-4.5.1-1.x86_64.rpm                                                                                                                                                                   | 8.7 MB  00:00:00     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : wazuh-agent-4.5.1-1.x86_64                                                                                                                                                                           1/1 
  Verifying  : wazuh-agent-4.5.1-1.x86_64                                                                                                                                                                           1/1 

Installed:
  wazuh-agent.x86_64 0:4.5.1-1                                                                                                                                                                                          

Complete!
[root@ip-172-31-5-38 ~]# systemctl daemon-reload
[root@ip-172-31-5-38 ~]# systemctl enable wazuh-agent
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-agent.service to /usr/lib/systemd/system/wazuh-agent.service.
[root@ip-172-31-5-38 ~]# systemctl start wazuh-agent
[root@ip-172-31-5-38 ~]#

image

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023 •
edited
Loading

Wazuh indexer package information 🟢

The package specs are:

[ec2-user@ip-172-31-4-121 ~]$ rpm -qi wazuh-indexer
Name        : wazuh-indexer
Version     : 4.5.1
Release     : 1
Architecture: x86_64
Install Date: lun 14 ago 2023 16:42:15 UTC
Group       : System Environment/Daemons
Size        : 976631590
License     : GPL
Signature   : RSA/SHA256, vie 11 ago 2023 18:11:03 UTC, Key ID 96b3ee5f29111145
Source RPM  : wazuh-indexer-4.5.1-1.src.rpm
Build Date  : vie 11 ago 2023 15:45:28 UTC
Build Host  : ip-172-31-76-200.ec2.internal
Relocations : (not relocatable)
Packager    : Wazuh, Inc <[email protected]>
Vendor      : Wazuh, Inc <[email protected]>
URL         : https://www.wazuh.com/
Summary     : Wazuh indexer is a search and analytics engine for security-related data. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-indexer.html
Description :
Wazuh indexer is a near real-time full-text search and analytics engine that gathers security-related data into one platform. This Wazuh central component indexes and stores alerts generated by the Wazuh server. Wazuh indexer can be configured as a single-node or multi-node cluster, providing scalability and high availability. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-indexer.html
[ec2-user@ip-172-31-4-121 ~]$
  • Package size 🟢
  • Package description and metadata 🟢
  • Package signature 🟢

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023

Installed files location, size, and permissions 🟢

Content of /usr/share/wazuh-indexer 🟢

Details 
[root@ip-172-31-4-121 ~]# tree -pugh --du /usr/share/wazuh-indexer/
/usr/share/wazuh-indexer/
├── [drwxr-x--- wazuh-in wazuh-in  22K]  bin
│   ├── [-rwxr-x--- wazuh-in wazuh-in 5.9K]  indexer-security-init.sh
│   ├── [-rwxr-x--- wazuh-in wazuh-in 3.0K]  opensearch
│   ├── [-rwxr-x--- wazuh-in wazuh-in 1.1K]  opensearch-cli
│   ├── [-rwxr-x--- wazuh-in wazuh-in 5.2K]  opensearch-env
│   ├── [-rwxr-x--- wazuh-in wazuh-in 1.8K]  opensearch-env-from-file
│   ├── [-rwxr-x--- wazuh-in wazuh-in  218]  opensearch-keystore
│   ├── [-rwxr-x--- wazuh-in wazuh-in  151]  opensearch-node
│   ├── [drwxr-x--- wazuh-in wazuh-in 2.9K]  opensearch-performance-analyzer
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in 1.8K]  performance-analyzer-agent
│   │   └── [-rwxr-x--- wazuh-in wazuh-in 1.0K]  performance-analyzer-agent-cli
│   ├── [-rwxr-x--- wazuh-in wazuh-in  206]  opensearch-plugin
│   ├── [-rwxr-x--- wazuh-in wazuh-in  144]  opensearch-shard
│   ├── [-rwxr-x--- wazuh-in wazuh-in  207]  opensearch-upgrade
│   └── [-rwxr-x--- wazuh-in wazuh-in  583]  systemd-entrypoint
├── [drwxr-x--- wazuh-in wazuh-in 265M]  jdk
│   ├── [drwxr-x--- wazuh-in wazuh-in 468K]  bin
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jar
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jarsigner
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  java
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  javac
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  javadoc
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  javap
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jcmd
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jconsole
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jdb
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jdeprscan
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jdeps
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jfr
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jhsdb
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jimage
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jinfo
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jlink
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jmap
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jmod
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jpackage
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jps
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jrunscript
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jshell
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jstack
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jstat
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  jstatd
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  keytool
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  17K]  rmiregistry
│   │   └── [-rwxr-x--- wazuh-in wazuh-in  17K]  serialver
│   ├── [drwxr-x--- wazuh-in wazuh-in  98K]  conf
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.7K]  logging.properties
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  24K]  management
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 3.9K]  jmxremote.access
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 5.6K]  jmxremote.password.template
│   │   │   └── [-rw-r----- wazuh-in wazuh-in  14K]  management.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 6.5K]  net.properties
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 1.5K]  sdp
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 1.4K]  sdp.conf.template
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  62K]  security
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1K]  java.policy
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  56K]  java.security
│   │   │   └── [drwxr-x--- wazuh-in wazuh-in 4.2K]  policy
│   │   │       ├── [drwxr-x--- wazuh-in wazuh-in 1.4K]  limited
│   │   │       │   ├── [-rw-r----- wazuh-in wazuh-in  647]  default_local.policy
│   │   │       │   ├── [-rw-r----- wazuh-in wazuh-in  146]  default_US_export.policy
│   │   │       │   └── [-rw-r----- wazuh-in wazuh-in  566]  exempt_local.policy
│   │   │       ├── [-rw-r----- wazuh-in wazuh-in 2.3K]  README.txt
│   │   │       └── [drwxr-x--- wazuh-in wazuh-in  405]  unlimited
│   │   │           ├── [-rw-r----- wazuh-in wazuh-in  193]  default_local.policy
│   │   │           └── [-rw-r----- wazuh-in wazuh-in  146]  default_US_export.policy
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.2K]  sound.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in 204K]  include
│   │   ├── [-rw-r----- wazuh-in wazuh-in  22K]  classfile_constants.h
│   │   ├── [-rw-r----- wazuh-in wazuh-in  12K]  jawt.h
│   │   ├── [-rw-r----- wazuh-in wazuh-in 8.0K]  jdwpTransport.h
│   │   ├── [-rw-r----- wazuh-in wazuh-in  74K]  jni.h
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.7K]  jvmticmlr.h
│   │   ├── [-rw-r----- wazuh-in wazuh-in  80K]  jvmti.h
│   │   └── [drwxr-x--- wazuh-in wazuh-in 4.1K]  linux
│   │       ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  jawt_md.h
│   │       └── [-rw-r----- wazuh-in wazuh-in 2.2K]  jni_md.h
│   ├── [drwxr-x--- wazuh-in wazuh-in  76M]  jmods
│   │   ├── [-rw-r----- wazuh-in wazuh-in  21M]  java.base.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 128K]  java.compiler.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  58K]  java.datatransfer.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  13M]  java.desktop.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  46K]  java.instrument.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 125K]  java.logging.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 882K]  java.management.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  97K]  java.management.rmi.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 464K]  java.naming.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 728K]  java.net.http.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  68K]  java.prefs.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 266K]  java.rmi.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  47K]  java.scripting.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 603K]  java.security.jgss.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  87K]  java.security.sasl.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 9.6K]  java.se.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  62K]  java.smartcardio.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  82K]  java.sql.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 216K]  java.sql.rowset.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  11K]  java.transaction.xa.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 662K]  java.xml.crypto.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 5.0M]  java.xml.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  57K]  jdk.accessibility.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  37K]  jdk.attach.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.1M]  jdk.charsets.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 8.8M]  jdk.compiler.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 371K]  jdk.crypto.cryptoki.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 136K]  jdk.crypto.ec.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 162K]  jdk.dynalink.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  15K]  jdk.editpad.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.2M]  jdk.hotspot.agent.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 112K]  jdk.httpserver.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 318K]  jdk.incubator.foreign.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.0M]  jdk.incubator.vector.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  15K]  jdk.internal.ed.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 100K]  jdk.internal.jvmstat.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 412K]  jdk.internal.le.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  88K]  jdk.internal.opt.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 443K]  jdk.internal.vm.ci.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 9.4K]  jdk.internal.vm.compiler.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 9.4K]  jdk.internal.vm.compiler.management.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 261K]  jdk.jartool.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.3M]  jdk.javadoc.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 136K]  jdk.jcmd.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 467K]  jdk.jconsole.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 729K]  jdk.jdeps.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 830K]  jdk.jdi.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 147K]  jdk.jdwp.agent.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 630K]  jdk.jfr.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 408K]  jdk.jlink.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 726K]  jdk.jpackage.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 670K]  jdk.jshell.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  10K]  jdk.jsobject.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  37K]  jdk.jstatd.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 9.8M]  jdk.localedata.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  95K]  jdk.management.agent.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  61K]  jdk.management.jfr.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  76K]  jdk.management.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  68K]  jdk.naming.dns.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  30K]  jdk.naming.rmi.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  31K]  jdk.net.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in 10.0K]  jdk.nio.mapmode.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  29K]  jdk.random.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  91K]  jdk.sctp.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  72K]  jdk.security.auth.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  32K]  jdk.security.jgss.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  21K]  jdk.unsupported.desktop.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  24K]  jdk.unsupported.jmod
│   │   ├── [-rw-r----- wazuh-in wazuh-in  49K]  jdk.xml.dom.jmod
│   │   └── [-rw-r----- wazuh-in wazuh-in 110K]  jdk.zipfs.jmod
│   ├── [drwxr-x--- wazuh-in wazuh-in 162K]  legal
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  66K]  java.base
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1K]  ADDITIONAL_LICENSE_INFO
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4K]  aes.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5K]  asm.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5K]  ASSEMBLY_EXCEPTION
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 8.9K]  cldr.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5K]  c-libutl.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  11K]  icu.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  19K]  LICENSE
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  public_suffix.md
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 2.3K]  unicode.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.compiler
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.datatransfer
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  21K]  java.desktop
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  167]  colorimaging.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 1.3K]  giflib.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 3.0K]  harfbuzz.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 3.4K]  jpeg.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 1.2K]  lcms.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 5.3K]  libpng.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 5.6K]  mesa3d.md
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 1.3K]  xwd.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.instrument
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.logging
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.management
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.management.rmi
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.naming
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.net.http
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.prefs
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.rmi
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.scripting
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.security.sasl
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 1.8K]  java.smartcardio
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 1.8K]  pcsclite.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.sql
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.sql.rowset
│   │   ├── [drwxr-x--- wazuh-in wazuh-in    6]  java.transaction.xa
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  41K]  java.xml
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  11K]  bcel.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 3.7K]  dom.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4K]  jcup.md
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  13K]  xalan.md
│   │   │   └── [-rw-r----- wazuh-in wazuh-in  12K]  xerces.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  11K]  java.xml.crypto
│   │   │   └── [-rw-r----- wazuh-in wazuh-in  11K]  santuario.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 6.0K]  jdk.crypto.cryptoki
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 3.8K]  pkcs11cryptotoken.md
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 2.1K]  pkcs11wrapper.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 1.5K]  jdk.dynalink
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 1.5K]  dynalink.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 1.6K]  jdk.internal.le
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 1.5K]  jline.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 1.1K]  jdk.internal.opt
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 1.1K]  jopt-simple.md
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 4.7K]  jdk.javadoc
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 2.9K]  jquery.md
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 1.8K]  jqueryUI.md
│   │   └── [drwxr-x--- wazuh-in wazuh-in 1.3K]  jdk.localedata
│   │       └── [-rw-r----- wazuh-in wazuh-in 1.3K]  thaidict.md
│   ├── [drwxr-x--- wazuh-in wazuh-in 188M]  lib
│   │   ├── [-rw-r----- wazuh-in wazuh-in  69K]  classlist
│   │   ├── [-rw-r----- wazuh-in wazuh-in 7.9M]  ct.sym
│   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  jexec
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  70K]  jfr
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  35K]  default.jfc
│   │   │   └── [-rw-r----- wazuh-in wazuh-in  35K]  profile.jfc
│   │   ├── [-rw-r----- wazuh-in wazuh-in 108K]  jrt-fs.jar
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in  22K]  jspawnhelper
│   │   ├── [-rw-r----- wazuh-in wazuh-in   29]  jvm.cfg
│   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  libattach.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  46K]  libawt_headless.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 851K]  libawt.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 472K]  libawt_xawt.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  36K]  libdt_socket.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  libextnet.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1M]  libfontmanager.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  54K]  libinstrument.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  50K]  libj2gss.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  22K]  libj2pcsc.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  95K]  libj2pkcs11.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  libjaas.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 235K]  libjavajpeg.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 193K]  libjava.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  libjawt.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 284K]  libjdwp.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 147K]  libjimage.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  81K]  libjli.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  libjsig.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  84K]  libjsound.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 851K]  libjsvml.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 511K]  liblcms.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  libmanagement_agent.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  37K]  libmanagement_ext.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  29K]  libmanagement.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 593K]  libmlib_image.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 107K]  libnet.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 107K]  libnio.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  libprefs.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  librmi.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 181K]  libsaproc.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  36K]  libsctp.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 365K]  libsplashscreen.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  15K]  libsyslookup.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  63K]  libverify.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  41K]  libzip.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in 124M]  modules
│   │   ├── [-rw-r----- wazuh-in wazuh-in  11K]  psfontj2d.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 3.7K]  psfont.properties.ja
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 400K]  security
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 2.4K]  blocked.certs
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 161K]  cacerts
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 9.8K]  default.policy
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 227K]  public_suffix_list.dat
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  48M]  server
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  13M]  classes.jsa
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  12M]  classes_nocoops.jsa
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  libjsig.so
│   │   │   └── [-rw-r----- wazuh-in wazuh-in  23M]  libjvm.so
│   │   └── [-rw-r----- wazuh-in wazuh-in 100K]  tzdb.dat
│   ├── [drwxr-x--- wazuh-in wazuh-in 723K]  man
│   │   └── [drwxr-x--- wazuh-in wazuh-in 723K]  man1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  11K]  jar.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  55K]  jarsigner.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 184K]  java.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  83K]  javac.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  46K]  javadoc.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 7.6K]  javap.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  34K]  jcmd.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 3.6K]  jconsole.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 8.7K]  jdb.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 8.0K]  jdeprscan.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  12K]  jdeps.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 8.8K]  jfr.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 7.2K]  jhsdb.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 3.4K]  jinfo.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  12K]  jlink.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 3.4K]  jmap.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  12K]  jmod.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  14K]  jpackage.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 8.3K]  jps.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 5.2K]  jrunscript.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  43K]  jshell.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 3.0K]  jstack.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in  24K]  jstat.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 7.7K]  jstatd.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 109K]  keytool.1
│   │       ├── [-rw-r----- wazuh-in wazuh-in 3.2K]  rmiregistry.1
│   │       └── [-rw-r----- wazuh-in wazuh-in 2.8K]  serialver.1
│   ├── [-rw-r----- wazuh-in wazuh-in 2.4K]  NOTICE
│   └── [-rw-r----- wazuh-in wazuh-in 1.6K]  release
├── [drwxr-x--- wazuh-in wazuh-in  35M]  lib
│   ├── [-rw-r----- wazuh-in wazuh-in 170K]  HdrHistogram-2.1.12.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 1.1M]  hppc-0.8.1.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 448K]  jackson-core-2.14.2.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  62K]  jackson-dataformat-cbor-2.14.2.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  95K]  jackson-dataformat-smile-2.14.2.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  53K]  jackson-dataformat-yaml-2.14.2.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 7.2K]  java-version-checker-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  jna-5.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 622K]  joda-time-2.12.2.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  76K]  jopt-simple-5.0.4.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 779K]  jts-core-1.15.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 295K]  log4j-api-2.17.1.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 1.7M]  log4j-core-2.17.1.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  30K]  log4j-jul-2.17.1.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 1.8M]  lucene-analysis-common-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 599K]  lucene-backward-codecs-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 3.5M]  lucene-core-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  95K]  lucene-grouping-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 266K]  lucene-highlighter-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 151K]  lucene-join-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  52K]  lucene-memory-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  95K]  lucene-misc-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 485K]  lucene-queries-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 413K]  lucene-queryparser-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 232K]  lucene-sandbox-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 316K]  lucene-spatial3d-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 235K]  lucene-spatial-extras-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 234K]  lucene-suggest-9.5.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  13M]  opensearch-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  18K]  opensearch-cli-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  42K]  opensearch-common-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  14K]  opensearch-core-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  45K]  opensearch-geo-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  20K]  opensearch-launchers-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 6.4K]  opensearch-plugin-classloader-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  12K]  opensearch-secure-sm-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 143K]  opensearch-x-content-2.6.0.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 324K]  snakeyaml-1.33.jar
│   ├── [-rw-r----- wazuh-in wazuh-in 200K]  spatial4j-0.7.jar
│   ├── [-rw-r----- wazuh-in wazuh-in  50K]  t-digest-3.2.jar
│   └── [drwxr-x--- wazuh-in wazuh-in 6.0M]  tools
│       ├── [drwxr-x--- wazuh-in wazuh-in  16K]  keystore-cli
│       │   └── [-rw-r----- wazuh-in wazuh-in  16K]  keystore-cli-2.6.0.jar
│       ├── [drwxr-x--- wazuh-in wazuh-in 3.9M]  plugin-cli
│       │   ├── [-rw-r----- wazuh-in wazuh-in 3.6M]  bc-fips-1.0.2.3.jar
│       │   ├── [-rw-r----- wazuh-in wazuh-in 301K]  bcpg-fips-1.0.7.1.jar
│       │   └── [-rw-r----- wazuh-in wazuh-in  36K]  opensearch-plugin-cli-2.6.0.jar
│       └── [drwxr-x--- wazuh-in wazuh-in 2.1M]  upgrade-cli
│           ├── [-rw-r----- wazuh-in wazuh-in  75K]  jackson-annotations-2.14.2.jar
│           ├── [-rw-r----- wazuh-in wazuh-in 448K]  jackson-core-2.14.2.jar
│           ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.2.jar
│           └── [-rw-r----- wazuh-in wazuh-in  31K]  opensearch-upgrade-cli-2.6.0.jar
├── [-rw-r----- wazuh-in wazuh-in  11K]  LICENSE.txt
├── [drwxr-x--- wazuh-in wazuh-in  85M]  modules
│   ├── [drwxr-x--- wazuh-in wazuh-in  58K]  aggs-matrix-stats
│   │   ├── [-rw-r----- wazuh-in wazuh-in  56K]  aggs-matrix-stats-client-2.6.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in 193K]  analysis-common
│   │   ├── [-rw-r----- wazuh-in wazuh-in 191K]  analysis-common-2.6.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in  80K]  geo
│   │   ├── [-rw-r----- wazuh-in wazuh-in  78K]  geo-2.6.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in 2.0M]  ingest-common
│   │   ├── [-rw-r----- wazuh-in wazuh-in 117K]  ingest-common-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.7M]  jcodings-1.0.58.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 209K]  joni-2.1.44.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  23K]  opensearch-dissect-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  47K]  opensearch-grok-2.6.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 2.0K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in  72M]  ingest-geoip
│   │   ├── [-rw-r----- wazuh-in wazuh-in  55K]  geoip2-3.0.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 6.3M]  GeoLite2-ASN.mmdb
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60M]  GeoLite2-City.mmdb
│   │   ├── [-rw-r----- wazuh-in wazuh-in 3.8M]  GeoLite2-Country.mmdb
│   │   ├── [-rw-r----- wazuh-in wazuh-in  27K]  ingest-geoip-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  75K]  jackson-annotations-2.14.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  32K]  maxmind-db-2.1.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.7K]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in  67K]  ingest-user-agent
│   │   ├── [-rw-r----- wazuh-in wazuh-in  65K]  ingest-user-agent-2.6.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in 704K]  lang-expression
│   │   ├── [-rw-r----- wazuh-in wazuh-in 316K]  antlr4-runtime-4.11.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 120K]  asm-9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  71K]  asm-commons-9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  51K]  asm-tree-9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  65K]  lang-expression-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  76K]  lucene-expressions-9.5.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.8K]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in 174K]  lang-mustache
│   │   ├── [-rw-r----- wazuh-in wazuh-in 109K]  compiler-0.9.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  61K]  lang-mustache-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.2K]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in 1.7M]  lang-painless
│   │   ├── [-rw-r----- wazuh-in wazuh-in 316K]  antlr4-runtime-4.11.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 120K]  asm-9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  34K]  asm-analysis-9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  71K]  asm-commons-9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  51K]  asm-tree-9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  89K]  asm-util-9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.0M]  lang-painless-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  30K]  opensearch-scripting-painless-spi-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.3K]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in  84K]  mapper-extras
│   │   ├── [-rw-r----- wazuh-in wazuh-in  82K]  mapper-extras-client-2.6.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in 2.2M]  opensearch-dashboards
│   │   ├── [-rw-r----- wazuh-in wazuh-in 346K]  commons-codec-1.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60K]  commons-logging-1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 177K]  httpasyncclient-4.1.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 361K]  httpcore-nio-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 9.0K]  opensearch-dashboards-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  67K]  opensearch-rest-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  66K]  opensearch-ssl-config-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in 118K]  reindex-client-2.6.0.jar
│   ├── [drwxr-x--- wazuh-in wazuh-in  87K]  parent-join
│   │   ├── [-rw-r----- wazuh-in wazuh-in  85K]  parent-join-client-2.6.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in  74K]  percolator
│   │   ├── [-rw-r----- wazuh-in wazuh-in  72K]  percolator-client-2.6.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in  82K]  rank-eval
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in  81K]  rank-eval-client-2.6.0.jar
│   ├── [drwxr-x--- wazuh-in wazuh-in 2.2M]  reindex
│   │   ├── [-rw-r----- wazuh-in wazuh-in 346K]  commons-codec-1.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60K]  commons-logging-1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 177K]  httpasyncclient-4.1.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 361K]  httpcore-nio-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  67K]  opensearch-rest-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  66K]  opensearch-ssl-config-2.6.0.jar
│   │   ├── [drwxr-x--- wazuh-in wazuh-in 1.9K]  parent-join
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5K]  plugin-security.policy
│   │   ├── [-rw-r----- wazuh-in wazuh-in 118K]  reindex-client-2.6.0.jar
│   │   └── [drwxr-x--- wazuh-in wazuh-in 3.8K]  transport-netty4
│   │       ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │       └── [-rw-r----- wazuh-in wazuh-in 1.8K]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in  18K]  repository-url
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.1K]  plugin-security.policy
│   │   └── [-rw-r----- wazuh-in wazuh-in  15K]  repository-url-2.6.0.jar
│   ├── [drwxr-x--- wazuh-in wazuh-in  12K]  systemd
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.8K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.2K]  plugin-security.policy
│   │   └── [-rw-r----- wazuh-in wazuh-in 8.8K]  systemd-2.6.0.jar
│   └── [drwxr-x--- wazuh-in wazuh-in 3.0M]  transport-netty4
│       ├── [-rw-r----- wazuh-in wazuh-in 298K]  netty-buffer-4.1.87.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 340K]  netty-codec-4.1.87.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 636K]  netty-codec-http-4.1.87.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 641K]  netty-common-4.1.87.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 530K]  netty-handler-4.1.87.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  37K]  netty-resolver-4.1.87.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 477K]  netty-transport-4.1.87.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  43K]  netty-transport-native-unix-common-4.1.87.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│       ├── [-rw-r----- wazuh-in wazuh-in 1.8K]  plugin-security.policy
│       └── [-rw-r----- wazuh-in wazuh-in  73K]  transport-netty4-client-2.6.0.jar
├── [-rw-r----- wazuh-in wazuh-in 223K]  NOTICE.txt
├── [drwxr-x--- wazuh-in wazuh-in  33M]  performance-analyzer-rca
│   ├── [drwxr-x--- wazuh-in wazuh-in  12K]  bin
│   │   ├── [-rwxr-x--- wazuh-in wazuh-in 1.8K]  performance-analyzer-agent
│   │   └── [-rwxr-x--- wazuh-in wazuh-in 9.9K]  performance-analyzer-rca
│   ├── [drwxr-x--- wazuh-in wazuh-in  17K]  config
│   │   ├── [-rw-r----- wazuh-in wazuh-in  104]  agent-stats-metadata
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.0K]  log4j2.xml
│   │   ├── [-rw-r----- wazuh-in wazuh-in  432]  opensearch_security.policy
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.6K]  performance-analyzer.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in  106]  plugin-stats-metadata
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.3K]  rca_cluster_manager.conf
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.9K]  rca.conf
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.3K]  rca_idle_cluster_manager.conf
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.3K]  supervisord.conf
│   └── [drwxr-x--- wazuh-in wazuh-in  33M]  lib
│       ├── [-rw-r----- wazuh-in wazuh-in 3.3K]  animal-sniffer-annotations-1.21.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 3.0K]  annotations-4.1.1.4.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 941K]  bcpkix-jdk15on-1.70.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 5.6M]  bcprov-jdk15on-1.70.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 471K]  bcutil-jdk15on-1.70.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 204K]  checker-qual-3.12.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 270K]  commons-io-2.7.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 492K]  commons-lang3-3.9.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  16K]  error_prone_annotations-2.14.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  failureaccess-1.0.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 256K]  grpc-api-1.52.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  30K]  grpc-context-1.52.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 713K]  grpc-core-1.52.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 276K]  grpc-netty-1.52.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 5.0K]  grpc-protobuf-1.52.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 7.4K]  grpc-protobuf-lite-1.52.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  50K]  grpc-stub-1.52.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 243K]  gson-2.9.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 2.7M]  guava-31.1-android.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 8.6K]  j2objc-annotations-1.3.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  74K]  jackson-annotations-2.14.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 449K]  jackson-core-2.14.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  26K]  javax.annotation-api-1.3.2.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 2.0M]  jooq-3.10.8.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  19K]  jsr305-3.0.2.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 2.1K]  listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 295K]  log4j-api-2.17.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.7M]  log4j-core-2.17.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 298K]  netty-buffer-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 340K]  netty-codec-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 469K]  netty-codec-http2-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 636K]  netty-codec-http-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 118K]  netty-codec-socks-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 639K]  netty-common-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 528K]  netty-handler-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  25K]  netty-handler-proxy-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  37K]  netty-resolver-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 477K]  netty-transport-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  43K]  netty-transport-native-unix-common-4.1.86.Final.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 6.6K]  perfmark-api-0.25.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  performance-analyzer-rca-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.6M]  protobuf-java-3.21.12.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.7M]  proto-google-common-protos-2.9.0.jar
│       └── [-rw-r----- wazuh-in wazuh-in 6.9M]  sqlite-jdbc-3.32.3.2.jar
├── [drwxr-x--- wazuh-in wazuh-in 513M]  plugins
│   ├── [drwxr-x--- wazuh-in wazuh-in  13M]  opensearch-alerting
│   │   ├── [-rw-r----- wazuh-in wazuh-in  91K]  alerting-core-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  annotations-13.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 209K]  checker-qual-3.5.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 241K]  commons-beanutils-1.9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 336K]  commons-codec-1.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 575K]  commons-collections-3.2.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 192K]  commons-digester-2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60K]  commons-logging-1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 185K]  commons-validator-1.7.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 164K]  cron-utils-9.1.6.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  14K]  error_prone_annotations-2.3.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  failureaccess-1.0.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 244K]  google-java-format-1.10.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.7M]  guava-30.0-jre.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 177K]  httpasyncclient-4.1.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 361K]  httpcore-nio-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 849K]  ipaddress-5.3.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 8.6K]  j2objc-annotations-1.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 764K]  javassist-3.27.0-GA.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 219K]  javax.el-3.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  19K]  jsr305-3.0.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlin-stdlib-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 196K]  kotlin-stdlib-common-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  22K]  kotlin-stdlib-jdk7-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  kotlin-stdlib-jdk8-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 797K]  kotlinx-coroutines-core-1.1.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  94K]  kotlinx-coroutines-core-common-1.1.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1K]  listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 941K]  opensearch-alerting-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  67K]  opensearch-rest-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  72K]  percolator-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in  327]  plugin-security.policy
│   │   └── [-rw-r----- wazuh-in wazuh-in  40K]  slf4j-api-1.7.30.jar
│   ├── [drwxr-x--- wazuh-in wazuh-in  14M]  opensearch-anomaly-detection
│   │   ├── [-rw-r----- wazuh-in wazuh-in 346K]  commons-codec-1.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 278K]  commons-lang-2.6.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 574K]  commons-lang3-3.12.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60K]  commons-logging-1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1M]  commons-math3-3.6.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 138K]  commons-pool2-2.10.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  failureaccess-1.0.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 252K]  gson-2.8.9.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.8M]  guava-31.0.1-jre.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 177K]  httpasyncclient-4.1.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 361K]  httpcore-nio-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  74K]  jackson-annotations-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 832K]  javassist-3.28.0-GA.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 102K]  memory-0.12.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1006K]  opensearch-anomaly-detection-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  67K]  opensearch-rest-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 251K]  org.jacoco.agent-0.8.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  35K]  org.jacoco.ant-0.8.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1015]  plugin-security.policy
│   │   ├── [-rw-r----- wazuh-in wazuh-in  58K]  protostuff-api-1.8.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  53K]  protostuff-collectionschema-1.8.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  64K]  protostuff-core-1.8.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 436K]  protostuff-runtime-1.8.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 240K]  randomcutforest-core-3.0-rc3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  70K]  randomcutforest-parkservices-3.0-rc3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  randomcutforest-serialization-3.0-rc3.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 657K]  sketches-core-0.13.4.jar
│   ├── [drwxr-x--- wazuh-in wazuh-in 750K]  opensearch-asynchronous-search
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 164K]  opensearch-asynchronous-search-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in  326]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in 5.4M]  opensearch-cross-cluster-replication
│   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  annotations-13.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 849K]  ipaddress-5.3.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlin-stdlib-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 196K]  kotlin-stdlib-common-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  22K]  kotlin-stdlib-jdk7-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  kotlin-stdlib-jdk8-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlinx-coroutines-core-jvm-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 929K]  opensearch-cross-cluster-replication-2.6.0.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in 827K]  opensearch-geospatial
│   │   ├── [-rw-r----- wazuh-in wazuh-in 574K]  commons-lang3-3.12.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  78K]  geo-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  39K]  h3-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 9.9K]  LICENSE.txt
│   │   ├── [-rw-r----- wazuh-in wazuh-in   71]  NOTICE.txt
│   │   ├── [-rw-r----- wazuh-in wazuh-in 124K]  opensearch-geospatial-2.6.0.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in 8.6M]  opensearch-index-management
│   │   ├── [-rw-r----- wazuh-in wazuh-in  17K]  annotations-13.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 336K]  commons-codec-1.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 849K]  ipaddress-5.3.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlin-stdlib-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 196K]  kotlin-stdlib-common-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  22K]  kotlin-stdlib-jdk7-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.6M]  kotlinx-coroutines-core-jvm-1.3.9.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.5M]  opensearch-index-management-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 101K]  opensearch-index-management-spi-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in  327]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in 289K]  opensearch-job-scheduler
│   │   ├── [-rw-r----- wazuh-in wazuh-in  32K]  opensearch-job-scheduler-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 255K]  opensearch-job-scheduler-spi-2.6.0.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   ├── [drwxr-x--- wazuh-in wazuh-in  32M]  opensearch-knn
│   │   ├── [-rw-r----- wazuh-in wazuh-in 278K]  commons-lang-2.6.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  failureaccess-1.0.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.7M]  guava-30.0-jre.jar
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  29M]  lib
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 151K]  libgomp.so.1
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  57K]  libopensearchknn_common.so
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  26M]  libopensearchknn_faiss.so
│   │   │   └── [-rw-r----- wazuh-in wazuh-in 2.3M]  libopensearchknn_nmslib.so
│   │   ├── [-rw-r----- wazuh-in wazuh-in  20K]  LICENSE.txt
│   │   ├── [-rw-r----- wazuh-in wazuh-in   51]  NOTICE.txt
│   │   ├── [-rw-r----- wazuh-in wazuh-in 375K]  opensearch-knn-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in  233]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in 280M]  opensearch-ml
│   │   ├── [-rw-r----- wazuh-in wazuh-in 737K]  api-0.19.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 204K]  checker-qual-3.12.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 241K]  commons-beanutils-1.9.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 346K]  commons-codec-1.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 575K]  commons-collections-3.2.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 734K]  commons-collections4-4.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 994K]  commons-compress-1.21.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 319K]  commons-io-2.11.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 511K]  commons-lang3-3.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60K]  commons-logging-1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1M]  commons-math3-3.6.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 233K]  commons-text-1.10.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  14K]  error_prone_annotations-2.7.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  failureaccess-1.0.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 259K]  gson-2.9.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.8M]  guava-31.0.1-jre.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 177K]  httpasyncclient-4.1.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 361K]  httpcore-nio-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 8.6K]  j2objc-annotations-1.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  75K]  jackson-annotations-2.14.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 216K]  jansi-2.4.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 764K]  javassist-3.26.0-GA.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 257K]  jline-builtins-3.21.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 168K]  jline-reader-3.21.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  27K]  jline-style-3.21.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 223K]  jline-terminal-3.21.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  39K]  jline-terminal-jansi-3.21.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  19K]  jsr305-3.0.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  39K]  libsvm-3.25.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1K]  listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  24K]  log4j-slf4j-impl-2.19.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 191K]  olcut-config-protobuf-5.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 290K]  olcut-core-5.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  26K]  onnxruntime-engine-0.19.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 239M]  onnxruntime_gpu-1.13.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 225K]  opencsv-5.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 299K]  opensearch-ml-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 130K]  opensearch-ml-algorithms-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 338K]  opensearch-ml-common-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  67K]  opensearch-rest-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.0K]  plugin-security.policy
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.6M]  protobuf-java-3.21.9.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  58K]  protostuff-api-1.8.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  53K]  protostuff-collectionschema-1.8.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  64K]  protostuff-core-1.8.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 436K]  protostuff-runtime-1.8.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  82K]  pytorch-engine-0.19.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  20K]  pytorch-model-zoo-0.19.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 240K]  randomcutforest-core-3.0-rc3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  70K]  randomcutforest-parkservices-3.0-rc3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  11K]  randomcutforest-testutils-3.0-rc3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 103K]  reflections-0.9.12.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  40K]  slf4j-api-1.7.36.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  20M]  tokenizers-0.19.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  53K]  tribuo-anomaly-core-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  31K]  tribuo-anomaly-libsvm-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 139K]  tribuo-classification-core-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  92K]  tribuo-classification-sgd-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  54K]  tribuo-clustering-core-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  45K]  tribuo-clustering-kmeans-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  37K]  tribuo-common-libsvm-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  48K]  tribuo-common-sgd-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  46K]  tribuo-common-tree-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 327K]  tribuo-core-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 185K]  tribuo-data-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 125K]  tribuo-math-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  98K]  tribuo-regression-core-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  51K]  tribuo-regression-sgd-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  72K]  tribuo-util-infotheory-4.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 355K]  tribuo-util-onnx-4.2.1.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in  69K]  tribuo-util-tokenization-4.2.1.jar
│   ├── [drwxr-x--- wazuh-in wazuh-in 2.3M]  opensearch-neural-search
│   │   ├── [-rw-r----- wazuh-in wazuh-in 511K]  commons-lang3-3.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 9.9K]  LICENSE.txt
│   │   ├── [-rw-r----- wazuh-in wazuh-in   69]  NOTICE.txt
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.7M]  opensearch-ml-client-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  27K]  opensearch-neural-search-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in  307]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in 2.6M]  opensearch-notifications
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 196K]  kotlin-stdlib-common-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.6M]  kotlinx-coroutines-core-jvm-1.4.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 241K]  opensearch-notifications-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in  12M]  opensearch-notifications-core
│   │   ├── [-rw-r----- wazuh-in wazuh-in  62K]  activation-1.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1006K]  aws-java-sdk-core-1.12.48.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 774K]  aws-java-sdk-ses-1.12.48.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 422K]  aws-java-sdk-sns-1.12.48.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 147K]  aws-java-sdk-sts-1.12.48.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60K]  commons-logging-1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  75K]  jackson-annotations-2.14.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 644K]  javax.mail-1.6.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlin-stdlib-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 196K]  kotlin-stdlib-common-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  72K]  opensearch-notifications-core-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.1M]  opensearch-notifications-core-spi-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in 8.7M]  opensearch-observability
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.8M]  guava-31.0.1-jre.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  74K]  jackson-annotations-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  69K]  json-20220924.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  30K]  json-base-2.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  34K]  json-flattener-0.15.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlin-stdlib-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 196K]  kotlin-stdlib-common-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.6M]  kotlinx-coroutines-core-jvm-1.3.9.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  opensearch-observability-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in  411]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in  31M]  opensearch-performance-analyzer
│   │   ├── [-rw-r----- wazuh-in wazuh-in 3.3K]  animal-sniffer-annotations-1.21.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 3.0K]  annotations-4.1.1.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 941K]  bcpkix-jdk15on-1.70.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 5.6M]  bcprov-jdk15on-1.70.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 471K]  bcutil-jdk15on-1.70.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 218K]  checker-qual-3.29.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 270K]  commons-io-2.7.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 574K]  commons-lang3-3.12.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  16K]  error_prone_annotations-2.9.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  failureaccess-1.0.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 256K]  grpc-api-1.52.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  30K]  grpc-context-1.52.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 713K]  grpc-core-1.52.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 276K]  grpc-netty-1.52.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 5.0K]  grpc-protobuf-1.52.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 7.4K]  grpc-protobuf-lite-1.52.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  50K]  grpc-stub-1.52.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 243K]  gson-2.9.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.8M]  guava-31.1-jre.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 8.6K]  j2objc-annotations-1.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  74K]  jackson-annotations-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  43K]  jackson-module-paranamer-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  26K]  javax.annotation-api-1.3.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.0M]  jooq-3.10.8.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  19K]  jsr305-3.0.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1K]  listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 298K]  netty-buffer-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 340K]  netty-codec-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 469K]  netty-codec-http2-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 636K]  netty-codec-http-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 118K]  netty-codec-socks-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 641K]  netty-common-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 530K]  netty-handler-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  25K]  netty-handler-proxy-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  37K]  netty-resolver-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 477K]  netty-transport-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  43K]  netty-transport-native-unix-common-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 156K]  opensearch-performance-analyzer-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 6.6K]  perfmark-api-0.25.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  performanceanalyzer-rca-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.3K]  plugin-security.policy
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.6M]  protobuf-java-3.21.12.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.7M]  proto-google-common-protos-2.9.0.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 6.9M]  sqlite-jdbc-3.32.3.2.jar
│   ├── [drwxr-x--- wazuh-in wazuh-in 9.4M]  opensearch-reports-scheduler
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 252K]  gson-2.8.9.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.8M]  guava-31.0.1-jre.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  74K]  jackson-annotations-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  63K]  json-20180813.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  30K]  json-base-2.2.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  34K]  json-flattener-0.15.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 428K]  jsoup-1.15.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlin-stdlib-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 196K]  kotlin-stdlib-common-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 130K]  kotlin-test-1.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.6M]  kotlinx-coroutines-core-jvm-1.3.9.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 285K]  opensearch-reports-scheduler-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in  411]  plugin-security.policy
│   ├── [drwxr-x--- wazuh-in wazuh-in  45M]  opensearch-security
│   │   ├── [-rw-r----- wazuh-in wazuh-in  29K]  accessors-smart-2.4.7.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  56K]  aggs-matrix-stats-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 119K]  asm-9.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 941K]  bcpkix-jdk15on-1.70.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 5.7M]  bcprov-jdk15on-1.67.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 209K]  checker-qual-3.5.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  52K]  commons-cli-1.3.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 340K]  commons-codec-1.14.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 575K]  commons-collections-3.2.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 256K]  commons-lang-2.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 424K]  commons-lang3-3.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60K]  commons-logging-1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 233K]  commons-text-1.10.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 109K]  compiler-0.9.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 159K]  cryptacular-1.2.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  cxf-core-3.5.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  22K]  cxf-rt-rs-json-basic-3.5.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 229K]  cxf-rt-rs-security-jose-3.5.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  41K]  cxf-rt-security-3.5.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  14K]  error_prone_annotations-2.3.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  59K]  eventbus-3.2.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  failureaccess-1.0.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.7M]  guava-30.0-jre.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 177K]  httpasyncclient-4.1.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 160K]  httpclient-cache-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 361K]  httpcore-nio-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  29K]  istack-commons-runtime-3.0.12.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 8.6K]  j2objc-annotations-1.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  75K]  jackson-annotations-2.14.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  67K]  jakarta.activation-1.2.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  24K]  jakarta.annotation-api-1.3.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 113K]  jakarta.xml.bind-api-2.3.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  12K]  java-saml-2.5.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 111K]  java-saml-core-2.5.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 266K]  java-support-7.5.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1013K]  jaxb-runtime-2.3.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  73K]  jjwt-api-0.10.8.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  69K]  jjwt-impl-0.10.8.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.6K]  jjwt-jackson-0.10.8.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  25K]  json-flattener-0.5.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 218K]  json-path-2.4.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 116K]  json-smart-2.4.7.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  19K]  jsr305-3.0.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 4.7M]  kafka-clients-3.0.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  61K]  lang-mustache-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 784K]  ldaptive-1.2.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.1K]  listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 635K]  lz4-java-1.7.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  82K]  mapper-extras-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 110K]  metrics-core-3.1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  33K]  minimal-json-0.9.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 298K]  netty-buffer-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 340K]  netty-codec-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 636K]  netty-codec-http-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 641K]  netty-common-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 530K]  netty-handler-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  37K]  netty-resolver-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 477K]  netty-transport-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  43K]  netty-transport-native-unix-common-4.1.87.Final.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 178K]  opensaml-core-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  55K]  opensaml-messaging-api-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  30K]  opensaml-profile-api-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 398K]  opensaml-saml-api-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.1M]  opensaml-saml-impl-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  65K]  opensaml-security-api-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 109K]  opensaml-security-impl-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 166K]  opensaml-soap-api-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 394K]  opensaml-soap-impl-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  23K]  opensaml-storage-api-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 205K]  opensaml-xmlsec-api-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 290K]  opensaml-xmlsec-impl-3.4.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  67K]  opensearch-rest-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 302K]  opensearch-rest-high-level-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.1M]  opensearch-security-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  85K]  parent-join-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   ├── [-rw-r----- wazuh-in wazuh-in 3.2K]  plugin-security.policy
│   │   ├── [-rw-r----- wazuh-in wazuh-in  81K]  rank-eval-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  40K]  slf4j-api-1.7.30.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9M]  snappy-java-1.1.8.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 191K]  stax2-api-4.2.1.jar
│   │   ├── [drwxr-x--- wazuh-in wazuh-in  78K]  tools
│   │   │   ├── [-rwxr----- wazuh-in wazuh-in 1.4K]  audit_config_migrater.sh
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in  622]  config.yml
│   │   │   ├── [-rwxr----- wazuh-in wazuh-in 1.3K]  hash.sh
│   │   │   ├── [-rwxr----- wazuh-in wazuh-in 1.4K]  securityadmin.sh
│   │   │   ├── [-rw-r----- wazuh-in wazuh-in 3.9K]  SECURITY_ADMIN_TESTS.md
│   │   │   ├── [-rwxr----- wazuh-in wazuh-in  31K]  wazuh-certs-tool.sh
│   │   │   └── [-rwxr----- wazuh-in wazuh-in  39K]  wazuh-passwords-tool.sh
│   │   ├── [-rw-r----- wazuh-in wazuh-in  73K]  transport-netty4-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  70K]  txw2-2.3.4.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  woodstox-core-6.4.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 169K]  xmlschema-core-2.2.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.1M]  xmlsec-2.2.3.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  30K]  zjsonpatch-0.4.4.jar
│   │   └── [-rw-r----- wazuh-in wazuh-in 6.4M]  zstd-jni-1.5.0-2.jar
│   ├── [drwxr-x--- wazuh-in wazuh-in 7.2M]  opensearch-security-analytics
│   │   ├── [-rw-r----- wazuh-in wazuh-in 315K]  antlr4-runtime-4.10.1.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 346K]  commons-codec-1.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 574K]  commons-lang3-3.12.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  60K]  commons-logging-1.2.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 583K]  common-utils-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 164K]  cron-utils-9.1.6.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 177K]  httpasyncclient-4.1.5.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 361K]  httpcore-nio-4.4.15.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlin-stdlib-1.6.10.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in  67K]  opensearch-rest-client-2.6.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 2.2M]  opensearch-security-analytics-2.6.0.0.jar
│   │   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  plugin-descriptor.properties
│   │   └── [-rw-r----- wazuh-in wazuh-in  327]  plugin-security.policy
│   └── [drwxr-x--- wazuh-in wazuh-in  40M]  opensearch-sql
│       ├── [-rw-r----- wazuh-in wazuh-in  17K]  annotations-13.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.3M]  antlr4-4.7.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 329K]  antlr4-runtime-4.7.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 164K]  antlr-runtime-3.5.2.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 204K]  checker-qual-3.12.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  40K]  common-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 336K]  commons-codec-1.13.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 511K]  commons-lang3-3.10.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 2.1M]  commons-math3-3.6.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 603K]  core-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.9M]  druid-1.0.15.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  14K]  error_prone_annotations-2.7.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  failureaccess-1.0.1.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  78K]  geo-2.6.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 252K]  gson-2.8.9.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 2.8M]  guava-31.0.1-jre.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 177K]  httpasyncclient-4.1.5.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 762K]  httpclient-4.5.13.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 321K]  httpcore-4.4.15.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 361K]  httpcore-nio-4.4.15.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  11M]  icu4j-58.2.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 8.6K]  j2objc-annotations-1.3.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  75K]  jackson-annotations-2.14.2.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.5M]  jackson-databind-2.14.2.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  83K]  javax.json-1.0.4.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  63K]  json-20180813.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  19K]  jsr305-3.0.2.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 2.8M]  kotlin-reflect-1.4.30.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  kotlin-stdlib-1.6.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 196K]  kotlin-stdlib-common-1.6.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  22K]  kotlin-stdlib-jdk7-1.4.30.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 949K]  legacy-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  11K]  LICENSE.txt
│       ├── [-rw-r----- wazuh-in wazuh-in 2.1K]  listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  721]  NOTICE.txt
│       ├── [-rw-r----- wazuh-in wazuh-in 774K]  okhttp-4.9.3.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  14K]  okhttp-aws-signer-1.0.2.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 237K]  okio-jvm-2.8.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 220K]  opensearch-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.7M]  opensearch-ml-client-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  67K]  opensearch-rest-client-2.6.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  36K]  opensearch-sql-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  66K]  opensearch-ssl-config-2.6.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  26K]  org.abego.treelayout.core-1.0.3.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  85K]  parent-join-client-2.6.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.8K]  plugin-descriptor.properties
│       ├── [-rw-r----- wazuh-in wazuh-in  651]  plugin-security.policy
│       ├── [-rw-r----- wazuh-in wazuh-in 307K]  ppl-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  24K]  presto-matching-0.240.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  69K]  prometheus-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  36K]  protocol-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 118K]  reindex-client-2.6.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  52K]  resilience4j-core-1.5.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  45K]  resilience4j-retry-1.5.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  40K]  slf4j-api-1.7.36.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 374K]  spring-aop-5.3.22.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 683K]  spring-beans-5.3.22.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.2M]  spring-context-5.3.22.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 1.4M]  spring-core-5.3.22.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 283K]  spring-expression-5.3.22.jar
│       ├── [-rw-r----- wazuh-in wazuh-in  24K]  spring-jcl-5.3.22.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 329K]  sql-2.6.0.0.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 234K]  ST4-4.0.8.jar
│       ├── [-rw-r----- wazuh-in wazuh-in 877K]  vavr-0.10.2.jar
│       └── [-rw-r----- wazuh-in wazuh-in 3.0K]  vavr-match-0.10.2.jar
└── [-r--r----- wazuh-in wazuh-in    6]  VERSION

 931M used in 98 directories, 933 files
[root@ip-172-31-4-121 ~]#

Content of /etc/wazuh-indexer 🟢

Details 
[root@ip-172-31-4-121 ~]# tree -pugh --du /etc/wazuh-indexer/
/etc/wazuh-indexer/
├── [dr-x------ wazuh-in wazuh-in 6.9K]  certs
│   ├── [-r-------- wazuh-in wazuh-in 1.7K]  admin-key.pem
│   ├── [-r-------- wazuh-in wazuh-in 1.1K]  admin.pem
│   ├── [-r-------- wazuh-in wazuh-in 1.7K]  node-1-key.pem
│   ├── [-r-------- wazuh-in wazuh-in 1.2K]  node-1.pem
│   └── [-r-------- wazuh-in wazuh-in 1.2K]  root-ca.pem
├── [-rw-rw---- wazuh-in wazuh-in 2.7K]  jvm.options
├── [drwxr-x--- wazuh-in wazuh-in    6]  jvm.options.d
├── [-rw-rw---- wazuh-in wazuh-in  14K]  log4j2.properties
├── [-rw-rw---- wazuh-in wazuh-in  196]  opensearch.keystore
├── [drwxr-x--- wazuh-in wazuh-in  438]  opensearch-notifications
│   └── [-rw-r----- wazuh-in wazuh-in  407]  notifications.yml
├── [drwxr-x--- wazuh-in wazuh-in  565]  opensearch-notifications-core
│   └── [-rw-r----- wazuh-in wazuh-in  529]  notifications-core.yml
├── [drwxr-x--- wazuh-in wazuh-in 1.3K]  opensearch-observability
│   └── [-rw-rw---- wazuh-in wazuh-in 1.3K]  observability.yml
├── [drwxr-x--- wazuh-in wazuh-in  17K]  opensearch-performance-analyzer
│   ├── [-rw-r----- wazuh-in wazuh-in  104]  agent-stats-metadata
│   ├── [-rw-r----- wazuh-in wazuh-in 2.0K]  log4j2.xml
│   ├── [-rw-r----- wazuh-in wazuh-in  432]  opensearch_security.policy
│   ├── [-rw-r----- wazuh-in wazuh-in 1.6K]  performance-analyzer.properties
│   ├── [-rw-r----- wazuh-in wazuh-in  106]  plugin-stats-metadata
│   ├── [-rw-r----- wazuh-in wazuh-in 4.3K]  rca_cluster_manager.conf
│   ├── [-rw-r----- wazuh-in wazuh-in 2.9K]  rca.conf
│   ├── [-rw-r----- wazuh-in wazuh-in 4.3K]  rca_idle_cluster_manager.conf
│   └── [-rw-r----- wazuh-in wazuh-in 1.3K]  supervisord.conf
├── [drwxr-x--- wazuh-in wazuh-in  332]  opensearch-reports-scheduler
│   └── [-rw-rw---- wazuh-in wazuh-in  297]  reports-scheduler.yml
├── [drwxr-x--- wazuh-in wazuh-in  36K]  opensearch-security
│   ├── [-rw-r----- wazuh-in wazuh-in   50]  action_groups.yml
│   ├── [-rw-r----- wazuh-in wazuh-in 1.9K]  allowlist.yml
│   ├── [-rw-r----- wazuh-in wazuh-in 2.5K]  audit.yml
│   ├── [-rw-r----- wazuh-in wazuh-in 9.7K]  config.yml
│   ├── [-rw-r----- wazuh-in wazuh-in 1.3K]  internal_users.yml
│   ├── [-rw-r----- wazuh-in wazuh-in  154]  nodes_dn.yml
│   ├── [-rw-r----- wazuh-in wazuh-in  12K]  opensearch.yml.example
│   ├── [-rw-r----- wazuh-in wazuh-in 1.5K]  roles_mapping.yml
│   ├── [-rw-r----- wazuh-in wazuh-in 4.5K]  roles.yml
│   ├── [-rw-r----- wazuh-in wazuh-in  170]  tenants.yml
│   └── [-rw-r----- wazuh-in wazuh-in 1.9K]  whitelist.yml
└── [-rw-rw---- wazuh-in wazuh-in 2.2K]  opensearch.yml

  86K used in 8 directories, 33 files
[root@ip-172-31-4-121 ~]#

Content of /var/log/wazuh-indexer 🟢

Details 
[root@ip-172-31-4-121 ~]# tree -pugh --du /var/log/wazuh-indexer/
/var/log/wazuh-indexer/
├── [-rw-r--r-- wazuh-in wazuh-in 197K]  gc.log
├── [-rw-r--r-- wazuh-in wazuh-in 2.0K]  gc.log.00
├── [-rw-r--r-- wazuh-in wazuh-in 8.7K]  wazuh-indexer-cluster-2023-08-14-1.json.gz
├── [-rw-r--r-- wazuh-in wazuh-in 7.7K]  wazuh-indexer-cluster-2023-08-14-1.log.gz
├── [-rw-r----- wazuh-in wazuh-in 7.3K]  wazuh-indexer-cluster_deprecation.json
├── [-rw-r----- wazuh-in wazuh-in 3.6K]  wazuh-indexer-cluster_deprecation.log
├── [-rw-r----- wazuh-in wazuh-in    0]  wazuh-indexer-cluster_index_indexing_slowlog.json
├── [-rw-r----- wazuh-in wazuh-in    0]  wazuh-indexer-cluster_index_indexing_slowlog.log
├── [-rw-r----- wazuh-in wazuh-in    0]  wazuh-indexer-cluster_index_search_slowlog.json
├── [-rw-r----- wazuh-in wazuh-in    0]  wazuh-indexer-cluster_index_search_slowlog.log
├── [-rw-r--r-- wazuh-in wazuh-in  29K]  wazuh-indexer-cluster.log
├── [-rw-r--r-- wazuh-in wazuh-in  84K]  wazuh-indexer-cluster_server.json
├── [-rw-r----- wazuh-in wazuh-in    0]  wazuh-indexer-cluster_task_detailslog.json
└── [-rw-r----- wazuh-in wazuh-in    0]  wazuh-indexer-cluster_task_detailslog.log

 343K used in 0 directories, 14 files
[root@ip-172-31-4-121 ~]#

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023

Installation footprint 🟢

[root@ip-172-31-4-121 ~]# find /etc -user wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@ip-172-31-4-121 ~]# find /usr -user wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@ip-172-31-4-121 ~]# find /var -user wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@ip-172-31-4-121 ~]# find /bin -user wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@ip-172-31-4-121 ~]# find /etc -group wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@ip-172-31-4-121 ~]# find /usr -group wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@ip-172-31-4-121 ~]# find /var -group wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@ip-172-31-4-121 ~]# find /bin -group wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@ip-172-31-4-121 ~]#

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023

Wazuh indexer service 🟢

Content of service file 
[root@ip-172-31-4-121 ~]# systemctl cat wazuh-indexer.service
# /usr/lib/systemd/system/wazuh-indexer.service
[Unit]
Description=Wazuh-indexer
Documentation=https://documentation.wazuh.com
Wants=network-online.target
After=network-online.target

[Service]
Type=notify
RuntimeDirectory=wazuh-indexer
PrivateTmp=yes
Environment=OPENSEARCH_HOME=/usr/share/wazuh-indexer
Environment=OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
Environment=PID_DIR=/run/wazuh-indexer
Environment=OPENSEARCH_SD_NOTIFY=true
EnvironmentFile=-/etc/sysconfig/wazuh-indexer

WorkingDirectory=/usr/share/wazuh-indexer

User=wazuh-indexer
Group=wazuh-indexer

ExecStart=/usr/share/wazuh-indexer/bin/systemd-entrypoint -p ${PID_DIR}/wazuh-indexer.pid --quiet

# StandardOutput is configured to redirect to journalctl since
# some error messages may be logged in standard output before
# wazuh-indexer logging system is initialized. Elasticsearch
# stores its logs in /var/log/wazuh-indexer and does not use
# journalctl by default. If you also want to enable journalctl
# logging, you can simply remove the "quiet" option from ExecStart.
StandardOutput=journal
StandardError=inherit

# Specifies the maximum file descriptor number that can be opened by this process
LimitNOFILE=65535

# Specifies the maximum number of processes
LimitNPROC=4096

# Specifies the maximum size of virtual memory
LimitAS=infinity

# Specifies the maximum file size
LimitFSIZE=infinity

# Disable timeout logic and wait until process is stopped
TimeoutStopSec=0

# SIGTERM signal is used to stop the Java process
KillSignal=SIGTERM

# Send the signal only to the JVM rather than its control group
KillMode=process

# Java process is never killed
SendSIGKILL=no

# When a JVM receives a SIGTERM signal it exits with code 143
SuccessExitStatus=143

# Allow a slow startup before the systemd notifier module kicks in to extend the timeout
TimeoutStartSec=180

[Install]
WantedBy=multi-user.target
[root@ip-172-31-4-121 ~]#
Wazuh indexer service status 
[root@ip-172-31-4-121 ~]# systemctl is-enabled wazuh-indexer
enabled
[root@ip-172-31-4-121 ~]# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
   Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2023-08-14 16:42:48 UTC; 21h ago
     Docs: https://documentation.wazuh.com
 Main PID: 6969 (java)
   CGroup: /system.slice/wazuh-indexer.service
           └─6969 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -...

Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at org.opensearch.jobscheduler.sweeper.JobSweeper.lambda$initBackgroundSweep$10(JobSweeper.java:294)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at org.opensearch.threadpool.Scheduler$ReschedulingRunnable.doRun(Scheduler.java:239)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:806)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: at java.base/java.lang.Thread.run(Thread.java:833)
[root@ip-172-31-4-121 ~]#

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023 •
edited
Loading

Wazuh indexer installation logs 🟢

[root@ip-172-31-4-121 ~]#  journalctl | grep -i wazuh-indexer
Aug 14 16:41:18 ip-172-31-4-121.us-west-1.compute.internal groupadd[6742]: group added to /etc/group: name=wazuh-indexer, GID=993
Aug 14 16:41:18 ip-172-31-4-121.us-west-1.compute.internal groupadd[6742]: group added to /etc/gshadow: name=wazuh-indexer
Aug 14 16:41:18 ip-172-31-4-121.us-west-1.compute.internal groupadd[6742]: new group: name=wazuh-indexer, GID=993
Aug 14 16:41:18 ip-172-31-4-121.us-west-1.compute.internal useradd[6747]: new user: name=wazuh-indexer, UID=995, GID=993, home=/usr/share/wazuh-indexer, shell=/sbin/nologin
Aug 14 16:42:15 ip-172-31-4-121.us-west-1.compute.internal yum[6731]: Installed: wazuh-indexer-4.5.1-1.x86_64
Aug 14 16:42:28 ip-172-31-4-121.us-west-1.compute.internal systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Aug 14 16:42:28 ip-172-31-4-121.us-west-1.compute.internal systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Aug 14 16:42:28 ip-172-31-4-121.us-west-1.compute.internal systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Aug 14 16:42:28 ip-172-31-4-121.us-west-1.compute.internal systemd[1]: Starting Wazuh-indexer...
Aug 14 16:42:30 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
Aug 14 16:42:32 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
Aug 14 16:42:48 ip-172-31-4-121.us-west-1.compute.internal systemd[1]: Started Wazuh-indexer.
Aug 14 16:44:20 ip-172-31-4-121.us-west-1.compute.internal sudo[7558]:     root : TTY=pts/0 ; PWD=/root ; USER=wazuh-indexer ; ENV=JAVA_HOME=/usr/share/wazuh-indexer/jdk/ OPENSEARCH_CONF_DIR=/etc/wazuh-indexer ; COMMAND=/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /etc/wazuh-indexer/opensearch-security -icl -p 9200 -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -h 172.31.4.121
Aug 14 16:44:20 ip-172-31-4-121.us-west-1.compute.internal sudo[7558]: pam_unix(sudo:session): session opened for user wazuh-indexer by ec2-user(uid=0)
Aug 14 16:44:30 ip-172-31-4-121.us-west-1.compute.internal sudo[7558]: pam_unix(sudo:session): session closed for user wazuh-indexer
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: 2023-08-15 00:02:48,462 opensearch[node-1][scheduler][T#1] ERROR Could not define attribute view on path "/var/log/wazuh-indexer/wazuh-indexer-cluster_server.json" got access denied ("java.lang.RuntimePermission" "accessUserInformation") java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessUserInformation")
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: 2023-08-15 00:02:48,471 opensearch[node-1][scheduler][T#1] ERROR Could not define attribute view on path "/var/log/wazuh-indexer/wazuh-indexer-cluster.log" got access denied ("java.lang.RuntimePermission" "accessUserInformation") java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessUserInformation")
Aug 15 13:44:47 ip-172-31-4-121.us-west-1.compute.internal systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Aug 15 13:45:08 ip-172-31-4-121.us-west-1.compute.internal systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
[root@ip-172-31-4-121 ~]#

Known warnings related to System::setSecurityManager, also appeared in the previous test
Known error related to access denied ("java.lang.RuntimePermission" "accessUserInformation") has an issue created for its analysis wazuh/wazuh-packages#2139

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023

Wazuh indexer indices, templates, and shards 🟢

Indices

[root@ip-172-31-4-121 ~]# curl -u admin:SmqqaGMRpwcHakGi9ZHB1FLc8Qc?yTIW -k https://172.31.4.121:9200/_cat/indices?v=true
health status index                       uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   wazuh-monitoring-2023.33w   LsGNbt1dSxOfmIPEj--gQw   1   0         10            0    173.6kb        173.6kb
green  open   .opensearch-observability   h3qnxmO4R9WFPzuKz8eW8g   1   0          0            0       208b           208b
green  open   wazuh-statistics-2023.33w   fCtWKUxRSHWtDZetu3eJsA   1   0         70            0    244.9kb        244.9kb
green  open   wazuh-alerts-4.x-2023.08.15 r8XwMVdhSc2YLm8SPFyXZg   3   0        217            0    650.7kb        650.7kb
green  open   .opendistro_security        ohB7ZtI0Q_OHqBKxdF5Agg   1   0         10            1       44kb           44kb
green  open   .kibana_1                   fiHMLWu-QXGL4Qzg8t_6SA   1   0          4            0     15.1kb         15.1kb
green  open   wazuh-alerts-4.x-2023.08.14 fNflzF34QNKxllZXdze2KA   3   0        191            0    504.2kb        504.2kb
[root@ip-172-31-4-121 ~]#

Templates

[root@ip-172-31-4-121 ~]# curl -u admin:SmqqaGMRpwcHakGi9ZHB1FLc8Qc?yTIW -k https://172.31.4.121:9200/_cat/templates?pretty
wazuh-agent         [wazuh-monitoring-*]                       0   
wazuh               [wazuh-alerts-4.x-*, wazuh-archives-4.x-*] 0 1 
wazuh-statistics    [wazuh-statistics-*]                       0   
sso_trace_template  [sso_traces-*-*]                           1 1 []
sso_metric_template [sso_metrics-*-*]                          1 1 []
[root@ip-172-31-4-121 ~]#

Shards

[root@ip-172-31-4-121 ~]# curl -u admin:SmqqaGMRpwcHakGi9ZHB1FLc8Qc?yTIW -k https://172.31.4.121:9200/_cat/shards?v=true
index                       shard prirep state   docs   store ip           node
.kibana_1                   0     p      STARTED    4  15.1kb 172.31.4.121 node-1
.opendistro_security        0     p      STARTED   10    44kb 172.31.4.121 node-1
wazuh-statistics-2023.33w   0     p      STARTED   70 244.9kb 172.31.4.121 node-1
wazuh-monitoring-2023.33w   0     p      STARTED   10 173.6kb 172.31.4.121 node-1
wazuh-alerts-4.x-2023.08.14 1     p      STARTED   65 171.4kb 172.31.4.121 node-1
wazuh-alerts-4.x-2023.08.14 2     p      STARTED   61 189.6kb 172.31.4.121 node-1
wazuh-alerts-4.x-2023.08.14 0     p      STARTED   65 143.1kb 172.31.4.121 node-1
wazuh-alerts-4.x-2023.08.15 1     p      STARTED   62 172.3kb 172.31.4.121 node-1
wazuh-alerts-4.x-2023.08.15 2     p      STARTED   82 262.8kb 172.31.4.121 node-1
wazuh-alerts-4.x-2023.08.15 0     p      STARTED   73 215.5kb 172.31.4.121 node-1
.opensearch-observability   0     p      STARTED    0    208b 172.31.4.121 node-1
[root@ip-172-31-4-121 ~]#

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023

Wazuh indexer cluster status 🟢

Cluster status

[root@ip-172-31-4-121 ~]# curl -u admin:SmqqaGMRpwcHakGi9ZHB1FLc8Qc?yTIW -k https://172.31.4.121:9200/_cluster/state/nodes?pretty
{
  "cluster_name" : "wazuh-indexer-cluster",
  "cluster_uuid" : "dpTMlXi-TS-8-pCCNtTc5A",
  "nodes" : {
    "i7jjnStkTuK9TrR7rYcHuQ" : {
      "name" : "node-1",
      "ephemeral_id" : "7MKzFLs3Sd2RxKYq7AgZ7Q",
      "transport_address" : "172.31.4.121:9300",
      "attributes" : {
        "shard_indexing_pressure_enabled" : "true"
      }
    }
  }
}
[root@ip-172-31-4-121 ~]#

Cluster health

[root@ip-172-31-4-121 ~]# curl -u admin:SmqqaGMRpwcHakGi9ZHB1FLc8Qc?yTIW -k https://172.31.4.121:9200/_cluster/health?pretty
{
  "cluster_name" : "wazuh-indexer-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 11,
  "active_shards" : 11,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}
[root@ip-172-31-4-121 ~]#

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023

E2E dataflow 🟢

With every component deployed, it has been verified that the UI works as expected, being able to see alerts from the agent directly in the UI.
image

image

image

@vcerenu
Copy link
Member

vcerenu commented Aug 15, 2023

Uninstall procedure 🟢

Followed the next guide:
https://documentation.wazuh.com/current/user-manual/uninstall/central-components.html#uninstall-the-wazuh-indexer

[root@ip-172-31-4-121 ~]# yum remove wazuh-indexer
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package wazuh-indexer.x86_64 0:4.5.1-1 will be erased
--> Finished Dependency Resolution
amzn2-core/2/x86_64                                                                                                                                                                              | 3.7 kB  00:00:00     

Dependencies Resolved

========================================================================================================================================================================================================================
 Package                                                  Arch                                              Version                                             Repository                                         Size
========================================================================================================================================================================================================================
Removing:
 wazuh-indexer                                            x86_64                                            4.5.1-1                                             @wazuh                                            931 M

Transaction Summary
========================================================================================================================================================================================================================
Remove  1 Package

Installed size: 931 M
Is this ok [y/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Stopping wazuh-indexer service... OK
  Erasing    : wazuh-indexer-4.5.1-1.x86_64                                                                                                                                                                         1/1 
warning: /etc/wazuh-indexer/opensearch.yml saved as /etc/wazuh-indexer/opensearch.yml.rpmsave
warning: /etc/wazuh-indexer/jvm.options saved as /etc/wazuh-indexer/jvm.options.rpmsave
  Verifying  : wazuh-indexer-4.5.1-1.x86_64                                                                                                                                                                         1/1 

Removed:
  wazuh-indexer.x86_64 0:4.5.1-1                                                                                                                                                                                        

Complete!
[root@ip-172-31-4-121 ~]#

uninstall check:

[root@ip-172-31-4-121 ~]# systemctl status wazuh-indexer
Unit wazuh-indexer.service could not be found.
[root@ip-172-31-4-121 ~]# systemctl cat wazuh-indexer.service
No files found for wazuh-indexer.service.
[root@ip-172-31-4-121 ~]# yum list installed | grep wazuh-indexer
[root@ip-172-31-4-121 ~]#

@wazuhci wazuhci moved this from In progress to Pending review in Release 4.5.1 Aug 15, 2023
@AlexRuiz7
Copy link
Member

AlexRuiz7 commented Aug 16, 2023 •
edited
Loading

Wazuh indexer installation logs

Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: 2023-08-15 00:02:48,462 opensearch[node-1][scheduler][T#1] ERROR Could not define attribute view on path "/var/log/wazuh-indexer/wazuh-indexer-cluster_server.json" got access denied ("java.lang.RuntimePermission" "accessUserInformation") java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessUserInformation")
Aug 15 00:02:48 ip-172-31-4-121.us-west-1.compute.internal systemd-entrypoint[6969]: 2023-08-15 00:02:48,471 opensearch[node-1][scheduler][T#1] ERROR Could not define attribute view on path "/var/log/wazuh-indexer/wazuh-indexer-cluster.log" got access denied ("java.lang.RuntimePermission" "accessUserInformation") java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessUserInformation")

What about these errors?

@vcerenu
Copy link
Member

vcerenu commented Aug 16, 2023

my bad, I had found this error in a older test: #16187 (comment) and had not been reported

@damarisg
Copy link
Member

LGTM!

@wazuhci wazuhci moved this from Pending review to Done in Release 4.5.1 Aug 16, 2023
@hector222arroyo hector222arroyo mentioned this issue Aug 21, 2023
Closed
2 tasks
@mateocervilla mateocervilla mentioned this issue Oct 18, 2023
Closed
2 tasks
@thecotilking thecotilking mentioned this issue Feb 27, 2024
Closed
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vcerenu vcerenu

Labels
level/task type/test
Projects
No open projects
Release 4.5.1
Status: Done
Milestone
No milestone
Development

No branches or pull requests
4 participants
@damarisg @AlexRuiz7 @teddytpc1 @vcerenu