Skip to content

QUICKSTART.md

Latest commit

 

History

History
158 lines (103 loc) · 2.13 KB

QUICKSTART.md

File metadata and controls

158 lines (103 loc) · 2.13 KB
Raw

QUICKSTART.md

Quickstart Guide

This guide installs and runs Cloudfence WVAgents on a clean FreeBSD host.

Requirements

Host system:

• FreeBSD 13.x or 14.x
• root privileges
• internet access for packages

Step 1 — Install WVAgents

Run installer:

./install.sh install <package.tar.gz>

The installer will:

• install dependencies
• configure rsyslog
• disable base syslogd
• extract WVAgents into /usr/local/cloudfence

Step 2 — Configure Runtime Settings

Copy configuration template:

cp /usr/local/cloudfence/etc/cloudfence.conf.example \
   /usr/local/cloudfence/etc/cloudfence.conf

Secure permissions:

chmod 600 /usr/local/cloudfence/etc/cloudfence.conf

Edit configuration and set:

MANAGER_ADDRESS
MANAGER_KEY
CUSTOMER

Step 3 — Verify Logging Service

Ensure rsyslog is running:

service rsyslogd status

Verify UDP syslog input:

cat /usr/local/etc/rsyslog.d/00-cloudfence-input.conf

Expected configuration:

module(load="imudp")
input(type="imudp" port="514")

Step 4 — Create First Virtual Agent

Run:

/usr/local/cloudfence/bin/wva-setup.sh add <DeviceIP> <AgentName>

Example:

/usr/local/cloudfence/bin/wva-setup.sh add 192.168.10.1 firewall01

The tool will:

• create jail
• install wazuh-agent
• configure syslog-ng
• create rsyslog routing rule
• enroll the agent

Step 5 — Verify Agent

List agents:

/usr/local/cloudfence/bin/wva-setup.sh list

Verify jail:

bastille list

Check ingestion pipeline:

bastille cmd <JAIL_NAME> "service wazuh_agent status"

Step 6 — Assign Wazuh Group

After agent appears in Wazuh manager:

  1. Open Wazuh dashboard
  2. Locate the new agent
  3. Assign correct device group

Example groups:

network-firewall
network-router
server-linux
server-windows

This ensures correct rule and decoder behavior.

Next Steps

Once basic ingestion is working, you can:

• onboard additional devices
• automate onboarding workflows
• tune rules per device type
• integrate with MDR operations