> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Hardening Guide

> Comprehensive security hardening recommendations for Wazuh Dashboard deployments to protect against unauthorized access and ensure secure operations

This guide provides comprehensive security hardening recommendations for Wazuh Dashboard deployments. Following these practices reduces attack surface, protects sensitive data, and ensures secure operations.

## Overview

Security hardening for Wazuh Dashboard encompasses:

* **Access control** - Authentication, authorization, and privilege management
* **Transport security** - Encryption and certificate management
* **Operational security** - Configuration management and monitoring
* **Network security** - Firewall rules and network segmentation
* **Data protection** - Sensitive data handling and backup security

Reference: `docs/ref/security.md`

## Access control

Implement robust access control mechanisms to restrict dashboard access to authorized personnel.

### Change default credentials

Replace default administrative credentials immediately after installation:

1. Access the Wazuh Dashboard using default credentials:
   * **URL**: `https://<WAZUH_DASHBOARD_IP_ADDRESS>`
   * **Username**: `admin`
   * **Password**: `admin`

2. Navigate to **Security** or use the Security plugin API to update credentials

3. Create a strong administrative password:
   * Minimum 12 characters
   * Combination of uppercase, lowercase, numbers, and special characters
   * No dictionary words or common patterns
   * Unique to the Wazuh Dashboard (not reused across systems)

4. Update the indexer user credentials:

   ```bash theme={null}
   /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \
     -cd /etc/wazuh-indexer/opensearch-security/ \
     -icl -nhnv \
     -cacert /etc/wazuh-indexer/certs/root-ca.pem \
     -cert /etc/wazuh-indexer/certs/admin.pem \
     -key /etc/wazuh-indexer/certs/admin-key.pem
   ```

### Implement Single Sign-On (SAML)

Configure SAML authentication for centralized identity management:

#### SAML configuration

1. Configure the security plugin in the Wazuh Indexer (`config.yml`):

```yaml theme={null}
config:
  dynamic:
    http:
      anonymous_auth_enabled: false
    authc:
      saml_auth:
        order: 1
        description: "SAML authentication provider"
        http_enabled: true
        transport_enabled: false
        http_authenticator:
          type: saml
          challenge: true
          config:
            idp:
              metadata_url: https://idp.example.com/metadata
              entity_id: https://idp.example.com
            sp:
              entity_id: wazuh-dashboard
              signature_private_key_filepath: "certs/saml-key.pem"
            kibana_url: https://wazuh-dashboard.example.com
            roles_key: Role
            exchange_key: <secure-random-key>
        authentication_backend:
          type: noop
```

Reference: `docker/wazuh-4.7/config/wazuh_indexer/config-saml.yml`

2. Update the Wazuh Dashboard configuration (`opensearch_dashboards.yml`):

```yaml theme={null}
opensearch_security.auth.type: "saml"
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout"]
```

#### Role mapping

Configure role-based access control through SAML assertions:

1. Map SAML roles to Wazuh Dashboard roles

2. Define granular permissions for each role:
   * **Administrator**: Full access to all features and configuration
   * **Analyst**: Read-only access to security events and dashboards
   * **Operator**: Limited access to specific modules or agent groups

3. Validate role mappings after authentication

### Restrict administrative access

Limit access to administrative functions:

1. **Dashboard Management** access should be restricted to administrators only
2. Implement principle of least privilege for user accounts
3. Create service accounts for API integrations with minimal required permissions
4. Regularly audit user permissions and remove unnecessary access
5. Implement multi-factor authentication where supported by the identity provider

### Session management

Configure secure session parameters:

```yaml theme={null}
# opensearch_dashboards.yml
opensearch_security.session.ttl: 3600000  # 1 hour in milliseconds
opensearch_security.session.keepalive: false
```

* Configure appropriate session timeouts based on security requirements
* Disable session keepalive for sensitive environments
* Implement automatic logout after inactivity periods

## Transport security

Secure all network communications with encryption and proper certificate management.

### TLS/SSL configuration

Configure TLS encryption for all communications:

#### Dashboard to Indexer

```yaml theme={null}
# opensearch_dashboards.yml
opensearch.hosts: https://localhost:9200
opensearch.ssl.verificationMode: certificate
opensearch.ssl.certificateAuthorities:
  - /etc/wazuh-dashboard/certs/root-ca.pem
opensearch.ssl.certificate: /etc/wazuh-dashboard/certs/dashboard.pem
opensearch.ssl.key: /etc/wazuh-dashboard/certs/dashboard-key.pem
```

Reference: `docs/ref/getting-started/installation.md:144`

#### Dashboard HTTPS

```yaml theme={null}
# opensearch_dashboards.yml
server.ssl.enabled: true
server.ssl.certificate: /etc/wazuh-dashboard/certs/dashboard.pem
server.ssl.key: /etc/wazuh-dashboard/certs/dashboard-key.pem
```

#### Wazuh API connection

```yaml theme={null}
# opensearch_dashboards.yml
wazuh_core.hosts:
  default:
    url: https://localhost
    port: 55000
    username: wazuh-wui
    password: <secure-password>
    run_as: false
```

Ensure the Wazuh API uses HTTPS with valid certificates.

Reference: `docs/ref/getting-started/installation.md:146`

### Certificate management

Implement secure certificate lifecycle management:

#### Certificate generation

1. Use strong key sizes (minimum 2048-bit RSA or 256-bit ECC)
2. Generate certificates with appropriate Subject Alternative Names (SANs)
3. Use internal Certificate Authority or trusted commercial CA
4. Document certificate inventory and expiration dates

#### Certificate deployment

1. Create certificate directory with restricted permissions:

   ```bash theme={null}
   mkdir /etc/wazuh-dashboard/certs
   chmod 500 /etc/wazuh-dashboard/certs
   ```

2. Deploy certificates with secure ownership and permissions:

   ```bash theme={null}
   tar -xf wazuh-certificates.tar -C /etc/wazuh-dashboard/certs/
   chmod 400 /etc/wazuh-dashboard/certs/*
   chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
   ```

Reference: `docs/ref/getting-started/installation.md:166`

#### Certificate rotation

1. Monitor certificate expiration dates
2. Plan certificate renewal 30-60 days before expiration
3. Test renewed certificates in non-production environments
4. Implement rolling updates to minimize service disruption
5. Update all configuration references to new certificates

#### Certificate validation

Configure appropriate certificate verification:

```yaml theme={null}
# opensearch_dashboards.yml
opensearch.ssl.verificationMode: certificate  # or 'full' for hostname validation
```

Options:

* `certificate`: Validate certificate chain and expiration
* `full`: Validate certificate and hostname match
* `none`: Disable validation (not recommended for production)

### TLS protocol configuration

Enforce modern TLS protocols and cipher suites:

```yaml theme={null}
# opensearch_dashboards.yml
server.ssl.supportedProtocols: ['TLSv1.2', 'TLSv1.3']
server.ssl.cipherSuites:
  - TLS_AES_256_GCM_SHA384
  - TLS_CHACHA20_POLY1305_SHA256
  - TLS_AES_128_GCM_SHA256
  - ECDHE-RSA-AES256-GCM-SHA384
  - ECDHE-RSA-AES128-GCM-SHA256
```

* Disable TLS 1.0 and 1.1
* Prefer TLS 1.3 where supported
* Disable weak cipher suites
* Configure Forward Secrecy

## Network security

Implement network-level controls to restrict access to the dashboard.

### Firewall configuration

Restrict network access to required ports:

```bash theme={null}
# Allow HTTPS traffic to dashboard
firewall-cmd --permanent --add-port=443/tcp

# Allow dashboard to indexer communication
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<indexer-ip>" port port="9200" protocol="tcp" accept'

# Reload firewall
firewall-cmd --reload
```

### IP whitelisting

Restrict access to trusted IP ranges:

```yaml theme={null}
# opensearch_dashboards.yml
server.host: "0.0.0.0"  # Bind to all interfaces
```

Implement IP filtering at the network level (firewall, load balancer, or reverse proxy):

```
# Example nginx configuration
allow 10.0.0.0/8;
allow 192.168.1.0/24;
deny all;
```

### Private networking

Deploy Wazuh Dashboard in private networks:

1. Place dashboard in private subnet without direct internet access
2. Use VPN or bastion hosts for administrative access
3. Route internet-bound traffic through NAT gateway for updates
4. Implement network segmentation between dashboard, indexer, and agents

### Reverse proxy deployment

Deploy a reverse proxy for additional security:

```nginx theme={null}
server {
    listen 443 ssl http2;
    server_name wazuh-dashboard.example.com;

    ssl_certificate /etc/nginx/certs/dashboard.crt;
    ssl_certificate_key /etc/nginx/certs/dashboard.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Rate limiting
    limit_req zone=dashboard burst=10 nodelay;

    location / {
        proxy_pass https://localhost:5601;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
```

## Operational security

Maintain secure operational practices for ongoing security.

### Keep software updated

Implement regular update procedures:

1. Subscribe to Wazuh security advisories
2. Test updates in non-production environments
3. Schedule maintenance windows for updates
4. Follow upgrade procedures documented in the release notes
5. Backup configuration before applying updates

Reference: `docs/ref/upgrade.md:46`

### Configuration management

Secure configuration files:

1. Restrict file permissions:

   ```bash theme={null}
   chmod 640 /etc/wazuh-dashboard/opensearch_dashboards.yml
   chown root:wazuh-dashboard /etc/wazuh-dashboard/opensearch_dashboards.yml
   ```

2. Version control configuration files (excluding sensitive credentials)

3. Implement configuration validation before deployment

4. Document all configuration changes

5. Maintain separate configurations for different environments

### Secrets management

Protect sensitive credentials:

1. Never commit credentials to version control
2. Use environment variables or secret management systems for credentials
3. Rotate credentials regularly (quarterly or after personnel changes)
4. Implement audit logging for credential access
5. Encrypt credentials at rest

### Audit logging

Enable comprehensive audit logging:

1. Configure OpenSearch audit logging:

   ```yaml theme={null}
   # opensearch.yml
   plugins.security.audit.type: internal_opensearch
   plugins.security.audit.config.disabled_rest_categories: NONE
   plugins.security.audit.config.disabled_transport_categories: NONE
   ```

2. Monitor dashboard access logs:

   ```bash theme={null}
   tail -f /var/log/wazuh-dashboard/opensearch_dashboards.log
   ```

3. Centralize logs to SIEM or log management platform

4. Configure alerts for suspicious activities:
   * Failed authentication attempts
   * Privilege escalation attempts
   * Configuration changes
   * Unusual access patterns

### Backup security

Secure backup procedures:

1. Backup critical components:
   * Configuration files: `/etc/wazuh-dashboard/opensearch_dashboards.yml`
   * TLS certificates: `/etc/wazuh-dashboard/certs/`
   * Saved objects and dashboards

Reference: `docs/ref/backup-restore.md:8`

2. Encrypt backups at rest and in transit
3. Store backups in secure, access-controlled locations
4. Test backup restoration procedures regularly
5. Implement backup retention policies
6. Document backup and recovery procedures

### Security monitoring

Implement continuous security monitoring:

1. Monitor authentication failures and unauthorized access attempts
2. Track configuration changes and administrative actions
3. Alert on certificate expiration approaching
4. Monitor system resource utilization for anomalies
5. Review security logs regularly

## Data protection

Protect sensitive data within the dashboard environment.

### Saved object review

Regularly review saved objects for sensitive data:

1. Navigate to **Stack Management > Saved Objects**
2. Review visualizations, dashboards, and searches
3. Identify objects containing sensitive queries or filters
4. Remove or restrict access to sensitive objects
5. Implement naming conventions to identify sensitive content

### Notification channel security

Secure external integration credentials:

1. Review notification channels for embedded credentials
2. Use webhook URLs without embedded secrets where possible
3. Rotate integration API keys regularly
4. Restrict who can create or modify notification channels
5. Audit notification channel usage

### Index-level security

Implement field-level and document-level security:

1. Configure field masking for sensitive data (PII, credentials)
2. Implement document-level security to restrict data access by user role
3. Use read-only aliases for analyst access
4. Audit index access patterns

### Data retention

Implement appropriate data retention policies:

1. Define retention periods based on compliance requirements
2. Configure Index State Management (ISM) policies
3. Securely delete expired data
4. Archive long-term data to secure, encrypted storage
5. Document retention policy rationale

## Compliance considerations

Align security hardening with regulatory requirements:

### PCI DSS

* Implement strong access control (Requirement 7, 8)
* Encrypt data in transit (Requirement 4)
* Maintain audit logs (Requirement 10)
* Regular security testing (Requirement 11)

### HIPAA

* Access control and authentication (164.312(a))
* Encryption and integrity controls (164.312(e))
* Audit controls (164.312(b))
* Transmission security (164.312(e)(1))

### GDPR

* Access control and authorization (Article 32)
* Encryption of personal data (Article 32)
* Ability to ensure confidentiality (Article 32)
* Regular testing of security measures (Article 32)

## Security checklist

Use this checklist to validate security hardening:

* [ ] Default administrative credentials changed
* [ ] SAML SSO configured with role-based access control
* [ ] TLS 1.2+ configured for all communications
* [ ] Valid certificates deployed with proper permissions
* [ ] Certificate expiration monitoring implemented
* [ ] Firewall rules restrict access to required ports only
* [ ] Dashboard deployed in private network segment
* [ ] Configuration files have restricted permissions
* [ ] Secrets stored securely (not in configuration files)
* [ ] Software update process documented and scheduled
* [ ] Audit logging enabled and monitored
* [ ] Backup procedures documented and tested
* [ ] Saved objects reviewed for sensitive data
* [ ] Notification channels secured
* [ ] Data retention policies implemented
* [ ] Security monitoring alerts configured

## Troubleshooting

### Certificate errors

* Verify certificate paths in `opensearch_dashboards.yml` are correct
* Check certificate file permissions (should be 400)
* Validate certificate chain includes root CA
* Confirm certificate has not expired
* Verify hostname matches certificate CN or SAN

### SAML authentication issues

* Verify IdP metadata URL is accessible
* Check exchange key configuration matches between components
* Validate role mapping configuration
* Review security plugin logs for SAML errors
* Confirm callback URLs are whitelisted

### Connection failures

* Verify TLS configuration matches between dashboard and indexer
* Check firewall rules allow required ports
* Validate certificate verification mode settings
* Test connectivity using curl or openssl commands
* Review network security group or ACL configurations

## Related resources

* Installation guide for initial certificate deployment procedures
* Upgrade guide for maintaining security during updates
* Backup and restore guide for securing configuration backups
* Migration guide for security considerations during platform migrations


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.