Import Manager integration to Elastic

[AlexRuiz7]

Description

Import Manager integration to Elastic.

Tasks

• Import code.
• Add a Docker environment.
• Test the integration works.
• Keep the folder layout well organized.

[f-galland]

I added a class to the event-generator script that allows it to connect to the datagram socket of the Wazuh Manager under /var/ossec/queue/sockets/queue that looks like the following:

class PublisherSocket(Publisher):
    def __init__(self, path):
        super()
        self.path = path

    def publish(self, event: str):
        event_dict = json.loads(event)
        full_log = event_dict['full_log']
        location = event_dict['location']
        message = '1:{}:{}'.format(location, full_log)
        sock = socket(AF_UNIX, SOCK_DGRAM)
        sock.connect(self.path)
        sock.send(message.encode())
        sock.close()

But the sample alerts.json file does not include a full_log field (as most real world alerts do), so we need to discuss whether we want to change our sample data or move to some other technique.

[f-galland]

In the end I discarded the above work and managed to get the events generator script to write to the manager's /var/ossec/logs/alerts/alerts.json directly.

[f-galland]