github wazuh/wazuh-documentation v5.0.0-rc2
Wazuh v5.0.0 RC 2
on GitHub

pre-release3 hours ago

Added

  • Added documentation for the reporting plugin in the Wazuh dashboard package generation guide. (#8682)
  • Added references for FIM (Syscheck) and inventory (Syscollector) state persistence settings. (#8801)
  • Added documentation for SCA state persistence settings. (#8841)
  • Added ARM64 support for Linux and macOS WPK packages. (#8851)
  • Added integrity_interval to the syscheck synchronization configuration and updated the response_timeout default value. (#9099)
  • Added integrity_interval to the SCA and the syscollector synchronization configuration. (#9164)
  • Added Upgrading to Wazuh 5.x sub-section to the Upgrade guide. (#9435)
  • Added the Data analysis documentation to the User manual. (#9743) (#10348) (#10359)
  • Added the Migration guide documentation. (#9772) (#9792) (#9817) (#9873) (#10028) (#10067) (#10264) (#10322) (#10353) (#10360) (#10396) (#10451) (#10460) (#10524) (#10599)
  • Added the Security configuration assessment use case to the Proof of concept guide. (#9777)
  • Added the Network IDS integration use case to the Proof of concept guide. (#9831) (#10228)
  • Added the Detecting a Cross-Site Scripting (XSS) attack use case to the Proof of concept guide. (#9916)
  • Added the Wazuh CTI documentation as a new top-level section. (#9989) (#9990) (#10250) (#10500)
  • Added the Incident response dashboard section, the Email notification channel, and the AI Assistant configuration documentation to the Wazuh dashboard section. (#10033)
  • Added the Installation Assistant, Certs tool, Wazuh passwords tool, wazuh-manager-certs and wazuh-manager-resolve-credentials documentation to the Reference section. (#10047) (#10416) (#10499) (#10540)
  • Added a note to the Regulatory compliance index page stating that the rule and control mappings are indicative and require an independent qualified assessor for formal certification. (#10191) (#10321)

Changed

  • Replaced indexer_cluster_initial_master_nodes with indexer_initial_cluster_manager_nodes in Puppet deployment documentation. (#8666)
  • Updated the File Integrity Monitoring documentation to remove deprecated settings (max_interval, queue_size, thread_pool, database, and registry_enabled), add the missing check_device setting, and fix the max_eps definition in the synchronization settings table. (#8735)
  • Updated the FIM documentation to change the default FIM who-data mode provider to eBPF. (#8805)
  • Updated references in steps and links to 5.x. (#8853) (#9658) (#9660)
  • Updated the Installation from sources documentation to Wazuh 5.0, covering the build dependencies, the Wazuh manager installation steps with the Wazuh indexer and the Wazuh dashboard, token enrollment for the Wazuh agent, and the Linux, Windows and macOS installation and uninstall steps. Made the section visible in Deployment options. (#9397) (#10576) (#10586) (#10599)
  • Updated the Installation guide. (#9545) (#9682) (#9692) (#9736) (#9771) (#9962) (#9968) (#9969) (#9994) (#10002) (#10019) (#10187) (#10212) (#10221) (#10239) (#10251) (#10252) (#10255) (#10352) (#10361) (#10394) (#10451) (#10529) (#10539) (#10548) (#10559) (#10562) (#10599)
  • Updated the Installation alternatives documentation. (#9576) (#9587) (#9589) (#9591) (#9595) (#9597) (#9606) (#9607) (#9674) (#10270) (#10275) (#10324) (#10326) (#10332) (#10349) (#10447) (#10451) (#10505) (#10560) (#10563) (#10599)
  • Updated the Wazuh agent documentation in User manual. (#9665) (#9669) (#9701) (#9702) (#9812) (#9993) (#10035) (#10065) (#10212) (#10214) (#10263) (#10266) (#10451) (#10464) (#10529) (#10538) (#10565) (#10598)
  • Updated the Wazuh dashboard documentation in User manual. (#9688) (#10033) (#10036) (#10213) (#10249) (#10351) (#10386) (#10388) (#10390) (#10402) (#10416) (#10451) (#10460) (#10498) (#10500) (#10590)
  • Updated the Quickstart documentation. (#9680) (#9769) (#10234) (#10248) (#10258) (#10344) (#10347) (#10379) (#10393) (#10506) (#10547) (#10599)
  • Updated the Wazuh server documentation to the new Wazuh manager documentation in the User manual. (#9728) (#9737) (#10064) (#10237) (#10343) (#10451) (#10460) (#10497) (#10498)
  • Updated the User administration documentation. (#9745) (#9758) (#9765) (#9766) (#9775) (#10040) (#10236) (#10259) (#10265) (#10337) (#10389) (#10390) (#10451) (#10460) (#10499)
  • Updated the Monitoring GitHub documentation. (#9836) (#9840) (#9949) (#10390)
  • Updated the Monitoring Office 365 documentation. (#9935)
  • Updated the Proof of concept guide use cases for File integrity monitoring, Vulnerability detection, Monitoring Docker events, Detecting an SQL injection attack, Network IDS integration, Monitoring AWS infrastructure, Detecting hidden processes, and Blocking a known malicious actor. (#9777) (#9831) (#9916) (#10336) (#10420) (#10520)
  • Updated the Container security documentation. (#9816) (#9819) (#9823) (#10206) (#10380)
  • Updated the System inventory documentation. (#9820) (#9832) (#10215) (#10216) (#10228) (#10391) (#10451) (#10500) (#10520) (#10580)
  • Updated the Security configuration assessment capability documentation. (#9834) (#9849) (#10178) (#10367) (#10377) (#10451) (#10498) (#10520)
  • Updated the Vulnerability detection capability documentation and added a Use cases section. (#9835) (#9841) (#10018) (#10228) (#10408) (#10451) (#10520) (#10560) (#10563) (#10564)
  • Updated the Command monitoring capability documentation. (#9883) (#9915) (#10357) (#10499)
  • Updated the File integrity monitoring capability documentation to Wazuh 5.0. (#9961) (#10165) (#10391) (#10392) (#10499)
  • Updated the Using Wazuh for GDPR compliance documentation in Regulatory compliance to Wazuh 5.0. (#9944) (#10191) (#10321)
  • Updated the Monitoring Linux system calls capability documentation to Wazuh 5.0. (#10010) (#10391)
  • Updated the Wazuh indexer API reference, removing the non-tracked version number from its page header, grouping its sections by plugin, and fixing a duplicate tag name that could merge two unrelated sections. (#10015) (#10016) (#10017) (#10025) (#10041) (#10042) (#10043) (#10044) (#10048) (#10449) (#10450) (#10518)
  • Updated the Using Wazuh for TSC compliance documentation in Regulatory compliance to Wazuh 5.0. (#10027) (#10045) (#10191) (#10321)
  • Updated the Log data collection capability documentation to Wazuh 5.0, covering Wazuh agent configuration, collecting logs from files and operating systems, log data analysis, and new use cases. (#10034) (#10037) (#10499) (#10568)
  • Updated the Reference documentation to Wazuh 5.0, splitting the local configuration reference into separate wazuh-manager.conf and ossec.conf sections, renaming manager daemons and tools with the wazuh-manager- prefix, updating the internal configuration, daemons, and tools references, and removing documentation for configuration sections and CLI tools no longer supported in Wazuh 5.0, and adding the Wazuh Common Schema (WCS) section, with the How WCS works, How Wazuh uses WCS fields, and Key WCS fields pages and the WCS field reference with the findings and state indices. (#10047) (#10070) (#10071) (#10072) (#10177) (#10215) (#10266) (#10271) (#10323) (#10345) (#10365) (#10366) (#10400) (#10401) (#10409) (#10421) (#10451) (#10460) (#10499) (#10500) (#10520) (#10540) (#10589) (#10599)
  • Updated the Active response capability documentation to Wazuh 5.0, covering configuration from the Wazuh dashboard, the consolidated block-ip script, developing custom scripts, migrating custom scripts from Wazuh 4.x, and new use cases for blocking web attacks and removing malicious files. (#10062) (#10228)
  • Replaced the admin user with the dedicated wazuh-manager user in the Wazuh indexer connector credential examples, and standardized the indexer connector certificate name to indexer-connector.pem/indexer-connector-key.pem across the Installation guide, Deployment options, and User manual documentation, also correcting the certificate ownership and permissions in the Installation guide's certificate deployment step so the Wazuh manager can read them after dropping privileges. (#10063)
  • Updated the Using Wazuh for PCI DSS compliance documentation in Regulatory compliance to Wazuh 5.0. (#10066) (#10191) (#10321) (#10357) (#10451)
  • Updated the Getting started documentation to Wazuh 5.0, covering the dashboard screenshot gallery, the Architecture section's overview, component communication and required ports, and the Use cases section. (#10069) (#10073) (#10231) (#10239) (#10244) (#10246) (#10364) (#10451) (#10460) (#10498) (#10499) (#10526) (#10527)
  • Updated the Using Wazuh for HIPAA compliance documentation in Regulatory compliance to Wazuh 5.0. (#10083) (#10191) (#10321)
  • Updated the Monitoring Google Cloud documentation in Cloud security to Wazuh 5.0, covering the Wazuh agent-only prerequisites, enabling the integration from the Wazuh dashboard, a consolidated log sink export flow, and configuring the Wazuh modules for Pub/Sub and Storage buckets. (#10092) (#10520)
  • Updated the Wazuh indexer documentation in User manual to Wazuh 5.0, covering data streams and stateful indices, the Wazuh Common Schema, Sigma rules, index templates, the Setup, Content Manager, Reporting, Security Analytics, Notifications, and Alerting modules, indexer tuning, migrating indices, backup and restore, and role-based access control. (#10093) (#10271) (#10350) (#10362) (#10451) (#10460) (#10498) (#10599)
  • Updated the Monitoring Microsoft Azure documentation in Cloud security to Wazuh 5.0, covering the Wazuh agent-only prerequisites, enabling the integration from the Wazuh dashboard, configuring credentials for Azure Log Analytics, Azure Storage, and the standalone Wazuh module for Microsoft Graph, the Microsoft Intune integration, and use cases. (#10139) (#10390) (#10520)
  • Updated the Wazuh indexer cluster documentation in User manual to Wazuh 5.0, covering cluster architecture and node types, required ports, cluster configuration, certificate deployment, cluster tuning, security initialization, adding and removing nodes, cluster management, and troubleshooting. (#10183) (#10185) (#10228) (#10350) (#10416) (#10451) (#10460) (#10498)
  • Updated the Deployment on Docker documentation to Wazuh 5.0, covering the Nginx agent connection role, readiness checks and restart steps, Docker Compose plugin requirements, local image build options, container access and persistence, 5.0.x upgrade scope, uninstall steps, and a corrected internal link in Wazuh Docker utilities. (#10212) (#10325) (#10333) (#10356) (#10528)
  • Updated the Deployment with Ansible documentation to Wazuh 5.0, covering generated deployment passwords, enrollment token-based agent deployment, certificate handling, and the Roles and Variables references. (#10319) (#10341)
  • Updated the Deployment on Kubernetes documentation to Wazuh 5.0, covering the resource requirements, network policies, Amazon EKS and local cluster deployment steps, enrollment token-based agent deployment, and the clean up steps. Removed the steps to change the password of Wazuh users. (#9941) (#10320) (#10324) (#10346) (#10358) (#10525)
  • Updated the Using Wazuh for NIST 800-53 compliance documentation in Regulatory compliance to Wazuh 5.0. (#10381)
  • Updated the Wazuh indexer API documentation for Wazuh 5.0, including the use of data streams and the Wazuh Common Schema fields in the examples, and the JSON Web Token authentication steps. (#10419) (#10442) (#10460)
  • Updated the Monitoring Amazon Web Services (AWS) documentation in Cloud security to Wazuh 5.0, covering the Wazuh agent-only prerequisites, enabling the AWS integrations from the Wazuh dashboard, the updated policies and service configuration, findings-based use cases, the new Amazon ECR image scanning use case, the Custom Logs Buckets and AWS Security Hub CSPM sections, and troubleshooting. (#10420) (#10446) (#10459)
  • Updated the Wazuh server API documentation to the new Wazuh manager API documentation in the User manual, including its use cases. (#10530)

Removed

  • Removed all agent-auth references as this tool was replaced by wazuh-agent-auth. (#8718)
  • Removed compatibility.override_main_response_version setting from Wazuh Indexer configuration as it is no longer supported in OpenSearch 3.0. (#8609)
  • Removed several Rootcheck configuration options and added a corresponding note to the central components upgrade guide. (#8759)
  • Removed references to the server version of the manage_agents tool. (#8792)
  • Removed cron.prefix, cron.statistics.*, and wazuh.monitoring.* configuration settings from the Wazuh dashboard. (#8790)
  • Removed references to deprecated client communication and FIM configuration options. (#8809)
  • Removed documentation and references to deprecated Wazuh Manager daemons: wazuh-agentlessd, wazuh-csyslogd, wazuh-dbd, wazuh-integratord, wazuh-maild, and wazuh-reportd. (#8778)
  • Removed documentation and references to deprecated CLI tools: clear_stats, update_ruleset, and wazuh-regex. (#8778)
  • Removed documentation to deprecated fluent-forward tool. (#8778)
  • Removed support for legacy operating systems, including Red Hat 5, CentOS 5, Oracle Linux 5, SUSE Linux Enterprise Server 11, AIX, HP-UX, Solaris, Windows XP, Windows Vista, and Windows Server 2003. (#8894)
  • Removed deprecated configuration variables in the Deployment with Puppet documentation. (#9378)
  • Removed Osquery references as this capability is now deprecated. (#8958)
Check out latest releases or
releases around wazuh/wazuh-documentation v5.0.0-rc2

Don't miss a new wazuh-documentation release

NewReleases is sending notifications on new releases.

Get notifications