Fixed merge issues

functions/extensions/kafka/README.md

@@ -0,0 +1,4 @@
+```
+curl -sSL https://raw.githubusercontent.com/bitnami/bitnami-docker-kafka/master/docker-compose.yml > docker-compose.yml
+docker-compose up -d
+```

functions/extensions/kafka/docker-compose.yml

@@ -0,0 +1,28 @@
+version: "2"
+
+services:
+  zookeeper:
+    image: docker.io/bitnami/zookeeper:3
+    ports:
+      - "2181:2181"
+    volumes:
+      - "zookeeper_data:/bitnami"
+    environment:
+      - ALLOW_ANONYMOUS_LOGIN=yes
+  kafka:
+    image: docker.io/bitnami/kafka:2
+    ports:
+      - "9092:9092"
+    volumes:
+      - "kafka_data:/bitnami"
+    environment:
+      - KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
+      - ALLOW_PLAINTEXT_LISTENER=yes
+    depends_on:
+      - zookeeper
+
+volumes:
+  zookeeper_data:
+    driver: local
+  kafka_data:
+    driver: local

functions/extensions/kafka/kafka_local.py

@@ -0,0 +1,54 @@
+import json 
+import os
+import requests
+from time import sleep
+from kafka import KafkaProducer, KafkaConsumer
+import kafka
+
+shuffle_url = os.getenv("SHUFFLE_URL")
+shuffle_apikey = os.getenv("SHUFFLE_APIKEY")
+shuffle_workflow = os.getenv("SHUFFLE_WORKFLOW")
+    
+headers = {"Authorization": "Bearer %s" % shuffle_apikey}
+topic = "workflow_%s" % shuffle_workflow
+server = "localhost:9092"
+def produce():
+    print("Starting producer")
+    producer = KafkaProducer(
+        bootstrap_servers=[server],
+        value_serializer=lambda x:
+        json.dumps(x).encode('utf-8')
+    )
+    
+    print("Adding data!")
+    for e in range(15):
+        data = {"some": e, "data": "luuuuul"}
+
+        try:
+            ret = producer.send(topic, value=data)
+            print(ret.get())
+        except kafka.errors.KafkaTimeoutError as e:
+            print("Kafka error: %s" % e)
+            continue
+
+def consume():
+    print("Starting consumer")
+    consumer = KafkaConsumer(
+        topic,
+        bootstrap_servers=[server],
+        auto_offset_reset="earliest",
+        enable_auto_commit=True,
+        value_deserializer=lambda x: json.loads(x.decode('utf-8'))
+    )
+
+    print("Getting data")
+    for message in consumer:
+        message = message.value
+        print("MSG: ", message)
+        ret = requests.post("%s/api/v1/%s/execute" % shuffle_url, headers=headers, data=message)
+        print(ret.status_code)
+        print(ret.text)
+
+if __name__ == "__main__":
+    produce()
+    #consume()

functions/extensions/kafka/requirements.txt

@@ -0,0 +1,2 @@
+kafka
+kafka-python

functions/extensions/scripts/disable_disk_check.sh

@@ -0,0 +1,11 @@
+curl -XPUT -u admin:admin https://localhost:9200/_cluster/settings -H "Content-Type:application/json" -k -d \
+'{
+	"transient": {
+		"cluster.routing.allocation.disk.threshold_enabled": false
+	}
+}'
+
+curl -XPUT -u admin:admin https://localhost:9200/_all/_settings -H "Content-Type: application/json" -k -d \
+'{
+	    "index.blocks.read_only_allow_delete": null
+}'

functions/extensions/wazuh/custom-shuffle.py

@@ -74,8 +74,7 @@ def debug(msg):
 # Skips container kills to stop self-recursion
 def filter_msg(alert):
     # These are things that recursively happen because Shuffle starts Docker containers
-    # Docker integration rules: https://github.com/wazuh/wazuh-ruleset/blob/ae36745db1d3f312db0392f5925c2f2b0ec009a9/rules/0560-docker_integration_rules.xml
-    skip = ["87924", "87900", "87901", "87902", "87903", "87904", "86001", "86002", "86003", "87932", "80710", "87929", "87928",]
+    skip = ["87924", "87900", "87901", "87902", "87903", "87904", "86001", "86002", "86003", "87932", "80710", "87929", "87928", "5710"]
     if alert["rule"]["id"] in skip:
         return False
 
@@ -96,14 +95,14 @@ def generate_msg(alert):
     level = alert['rule']['level']
 
     if (level <= 4):
-        color = "good"
+        severity = 1
     elif (level >= 5 and level <= 7):
-        color = "warning"
+        severity = 2
     else:
-        color = "danger"
+        severity = 3
 
     msg = {}
-    msg['color'] = color
+    msg['severity'] = severity 
     msg['pretext'] = "WAZUH Alert"
     msg['title'] = alert['rule']['description'] if 'description' in alert['rule'] else "N/A"
     msg['text'] = alert.get('full_log')

functions/extensions/wazuh/ossec.conf

@@ -1,5 +1,6 @@
 <integration>
   <name>custom-shuffle</name>
-  <hook_url>http://<IP>:3001/api/v1/hooks/webhook_<HOOK_ID></hook_url>
+  <level>9</level>
+  <hook_url>http://<IP>:<PORT>/api/v1/hooks/webhook_<HOOK_ID></hook_url>
   <alert_format>json</alert_format>
 </integration>