wazuh-docker-stack-2 - Wazuh-based security monitoring lab with Docker an

项目说明

Monitoring Stack

This repository packages a small SOC-style monitoring en built around Wazuh, Prometheus, Grafana, Alertmanager, Blackbox Exporter, and an internal service index page. It is structured for local deployment first, with the root stack handling monitoring and alert delivery while the bundled wazuh-docker-stack/ directory provides the Wazuh platform and recovery assets.

What is included

Prometheus for metrics collection and alert e

Grafana for dashboarding over the li metrics

Blackbox Exporter for ICMP a checks

Alertmanager for routing notifications

A Python-based Wazuh alert forwarder that reads Wazuh alerts and posts normalized alerts into Alertmanager

A Python-based monitoring service index page with li, service links, credential sources, and handbook PDFs

A bundled Wazuh Docker stack with single-node, multi-node, and recovery material

Repository layout

How the stack is split

Repository root: monitoring services, alert routing, and the custom Wazuh-to-Alertmanager forwarder

wazuh-docker-stack/: Wazuh deployment assets, Docker Compose stacks, and recovery automation

The root monitoring stack expects the external Docker single-node_wazuh_logs to exist, which is provided by the single-node Wazuh deployment.

Quick start

1. Copy .en to .env and adjust for your en.
2. Create required local-only secrets under secrets/.
3. Generate gateway credentials with scripts/windows/In.ps1.
4. Review targets/ping_servers.yml and update monitored hosts.
5. Start the Wazuh single-node stack from wazuh-docker-stack/single-node/.
6. Start the monitoring stack from the repository root with docker compose up -d.

Configuration files

docker-compose.yml: root monitoring services

prometheus.yml: scrape jobs and alerting targets

blackbox.yml: Blackbox Exporter probe modules

alert.rules.yml: stack health and ICMP probe alerts

alertmanager.yml: notification routing

grafana/: pro datasource and monitoring dashboards

targets/ping_servers.yml: file-based ICMP target in

targets/sensor_http_endpoints.yml: Pi-hole and mitmproxy HTTP probe in

targets/sensor_tcp_endpoints.yml: mitmproxy TCP probe in

targets/sensor_dns_endpoints.yml: Pi-hole DNS probe in

Operations

docs/runbooks/phase1-rollout.md: staged rollout and rollback notes

docs/runbooks/wazuh-single-node-rollout.md: guarded Wazuh single-node rollout path

docs/runbooks/sensor-.md: canonical Ubuntu sensor deployment path

docs/runbooks/secret-vault.md: encrypted local secret export, import, and rekey workflow

docs/runbooks/bare-metal-rebuild-drill.md: staged clean-host rebuild rehearsal from the recovery bundle and secret vault

docs/runbooks/ubuntu-lightweight-soc.md: low-resource Ubuntu SOC profile with Suricata, Cowrie, Wazuh ingestion, and Grafana

docs/reference/repository-layout.md: folder map for source-of-truth files recovery artifacts

docs/operator-handbook/README.md: installation, troubleshooting, tools usage, access in, and threat monitoring guides

docs/pdf-handbook/README.md: offline PDF export set in one folder

scripts/windows/Inion.ps1: mo secrets into gitignored secret files

scripts/windows/Inlout.ps1: rollout helper

scripts/windows/Inout.ps1: Wazuh single-node rollout helper

scripts/windows/In.ps1: create or rotate local HTTPS gateway credentials

scripts/windows/In.ps1: encrypt local secret files into one vault file

scripts/windows/In.ps1: restore local secret files from the encrypted vault

scripts/windows/In.ps1: rotate the encrypted vault passphrase

scripts/windows/Inll.ps1: stage a clean-host rebuild drill from the recovery bundle and secret vault, including staged sensor bootstrap and archi

scripts/windows/In.ps1: Windows entrypoint for the canonical sensor bootstrap

scripts/windows/Inport.ps1: local-only credential export generator

scripts/windows/Incher.ps1: local-only launcher for the public index, private credentials, and PDFs

scripts/windows/Inose.ps1: local secret-aware wrapper for Wazuh single-node compose commands

.github/workflows/ci-smoke-checks.yml: repo smoke for compose rendering, config checks, gateway , and one Blackbox probe

scripts/python/monitoring_ser.py: internal browser page for service health, links, and PDF docs

Canonical Sensor Deployment

Phase 1 standardizes the Ubuntu sensor on one declared blueprint instead of multiple inline-generated installers.

source of truth: wazuh-docker-stack/single-node/reco/blueprints/sensor-vm/

Windows entrypoint: scripts/windows/In.ps1

Linux entrypoint: scripts/linux/bootstrap_sensor_vm.sh

The older Ubuntu install scripts under scripts/linux/ and scripts/windows/ remain in the repo only as compatibility wrappers that delegate to the canonical bootstrap.

The canonical sensor path now also defaults Pi-hole and mitmproxy to pinned digests through the blueprint and Windows wrapper.

Secrets and publish safety

This repository is prepared for public Git hosting:

li are excluded from Git

example config files are tracked instead of secret-bearing runtime files

local-only files such as .env, dashboard credentials, and certificate material remain untracked

an encrypted local secret vault is a under local/secret-vault/

Before deploying, create or supply these local-only inputs yourself:

.env

secrets/bre.txt

secrets/gateway_admin_username.txt

secrets/gateway_admin_password.txt

secrets/gateway_admin_password_hash.txt

secrets/grafana_admin_username.txt

secrets/grafana_admin_password.txt

secrets/.txt

secrets/pihole_web_password.txt

wazuh-docker-stack/secrets/indexer_password.txt

wazuh-docker-stack/secrets/api_password.txt

wazuh-docker-stack/secrets/dashboard_password.txt

Wazuh dashboard runtime config

Wazuh indexer user credential material and certificates

The generated PDF handbook li docs/pdf-handbook/ and is served by the monitoring service index on .

Use scripts/windows/In.ps1 to generate or rotate the gateway credential files locally.
Use scripts/windows/In.ps1 to keep an encrypted backup of the local secret state.
Use scripts/windows/Inll.ps1 to rehearse a clean monitoring-host rebuild and staged sensor recovery before you need a real recovery.

Troubleshooting-friendly structure

Root files and folders are the source of truth for the li host.

wazuh-docker-stack/single-node/ is the source of truth for the li stack.

wazuh-docker-stack/single-node/reco/blueprints/sensor-vm/ is the only tracked clean-build blueprint.

wazuh-docker-stack/single-node/reco/backups/ is the timestamped recovery history, not a second source tree.

projects/ubuntu-lightweight-soc/ is the dedicated 4 GB Ubuntu SOC lab profile.

local/, logs/, and archives/ hold machine-local or generated operational artifacts.

Notes

The repository contains deployment scripts for both Windows and Linux operators.

The bundled Wazuh stack includes upstream-style build and recovery assets in addition to runtime Compose files.

The current public branch is intended to be safe to share, but it is still a deployment repository, not a generic product template.

项目信息

开发语言：PowerShell

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Wazuh-based security monitoring lab with Docker and defensive engineering workflows.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	wazuh-docker-stack-2 - Wazuh-based security monitoring lab with Docker an
所属分类	防护思路
发布作者	admin
发布时间	2026-10-06 00:25:08
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	372
讨论数量	0
主题状态	正常讨论中