Wazuh app doesn't open under custom spaces

[rossengeorgiev]

As you know, 6.x introduced spaces as a way to manage collections of visualization, dashboards, etc. Selecting a custom space, and trying to open the wazuh app yields a blank screen. See screenshot below.

Wazuh 3.7.2 + Kibana 6.5.4

[jesusgn90]

You are right @rossengeorgiev , we've added this to our roadmap and it will be fixed soon, thanks for your feedback. I'll copy here our progress dealing with Kibana spaces.

Best regards

[rhysxevans]

Hi

Will this fix allow the Wazuh app to "default" to a specified wazuh-alerts index ?

I am investigating the option of multitenancy via spaces , now that some of the security has been released into the basic subscription

Or do we still need to run multiple Kibana instances to get this done? (using searchguard)

Thanks

[jesusgn90]

Hi @rhysxevans ,

I think it will filter index patterns, so it will filter indices too, but it won't disable the index pattern creation menu from Kibana.

In any case, we are working on it right now, I'll update this issue with any news into this.

Thanks for your patience.

Regards

[jesusgn90]

Related: #1450

[jesusgn90]

For refreshing the known fields, we must add a condition for custom spaces.

Before:

await wzWrapper.updateIndexPatternKnownFields('index-pattern:' + item.id);

After:

 const prefix = item.namespace ? `${item.namespace}:index-pattern:` : 'index-pattern:';
 await wzWrapper.updateIndexPatternKnownFields(`${prefix}${item.id}`);

[jesusgn90]

More news, the Wazuh monitoring pattern under custom spaces is now being created if it's missing (eb1eacf).

Right now this is the status for custom spaces:

• The app doesn't crash regardless of the namespace being used.
• Monitoring pattern is created if it's missing for that space.
• Alert patterns known fields are being refreshed as expected under custom spaces.
• Monitoring pattern known fields are not being refreshed under custom spaces.
• The Wazuh app is filtering the patterns depending on the current namespace (@migruiz4).

@rhysxevans you'll have a Wazuh app working under custom spaces soon! In addition, we want to say that we still remember the "multitenancy" question you did, let me continue with the implementation and we'll update you as soon as we can.

[jesusgn90]

Hi @rhysxevans ,

Today we've fixed the two timelion visualizations under Management > Cluster for custom spaces -> ace891f

We've also fixed the top agent request for Agents preview -> 2ce377c

The task is still in progress but I think the next minor version of Wazuh may include it.

Regards

[jesusgn90]

Here d6307eb we propagate the namespace as a field for new monitoring patterns, otherwise, the app would think it doesn't exist and would try to create a new one.

[jesusgn90]

With 8300144, the reporting module can handle custom namespaces too just adding the proper parameter when searchWazuhAlertsWithPayload is called from the module.

[jesusgn90]

Current status:

• The app opens regardless of the active space.
• Monitoring pattern is created if missing regardless of the active space.
• Default alerts pattern is not created if missing for custom spaces.
• Alerts patterns known fields are being refreshed for all spaces.

At this point, the task is almost done but a lot of testing is needed.

[jesusgn90]

Branch: https://github.com/wazuh/wazuh-kibana-app/tree/fix-custom-spaces-1234

[juankaromo]

Some testing

When testing the branch in a development environment, the following error appears.

The first time you access the app with a newly created space [awesome] (now in a production environment) the following error appears. (Cannot find index patterns)

The monitoring index-pattern is not created automatically.

After creating the wazuh-alerts index pattern the app loads correctly.

[juankaromo]

Update testing

All tests have been performed with the default .kibana index.

Index patterns

• wazuh-alerts-3.x-* is not created automatically, but is expected behavior ✅
• wazuh-monitoring-3.x-* is not created automatically, and is not created until you access Overview (created when you build the visualizations). It would be necessary to correct it because in the health check it fails. ⚠
• After creating it, the app loads correctly. ✅

API management checks
All tests have been carried out successfully. ✅

Basic functions in dashboards and overviews (General and Agents) checks (included Filter checks)
All tests have been carried out successfully. ✅

Management tab checks
All tests have been carried out successfully. ✅

Agents tab checks
All tests have been carried out successfully. ✅