root@tipi:~# echo "#################################################################"
echo "ls -R /opt/runtipi/app-data/synode-it/"
echo "#################################################################"
ls -R /opt/runtipi/app-data/synode-it/

echo "#################################################################"
echo "docker ps -a"
echo "#################################################################"
docker ps -a

echo "#################################################################"
echo "docker logs wazuh-runtipi_synode-it-wazuh-indexer-1"
echo "#################################################################"
docker logs wazuh-runtipi_synode-it-wazuh-indexer-1

echo "#################################################################"
echo "docker logs wazuh-runtipi_synode-it-wazuh-manager-1"
echo "#################################################################"
docker logs wazuh-runtipi_synode-it-wazuh-manager-1

echo "#################################################################"
echo "docker logs wazuh-runtipi_synode-it-wazuh-certs-1"
echo "#################################################################"
docker logs wazuh-runtipi_synode-it-wazuh-certs-1

echo "#################################################################"
echo "docker logs wazuh-runtipi_synode-it-wazuh-dashboard-1"
echo "#################################################################"
docker logs wazuh-runtipi_synode-it-wazuh-dashboard-1

echo "#################################################################"
echo "docker logs wazuh-runtipi_synode-it-wazuh-indexer-init-1"
echo "#################################################################"
docker logs wazuh-runtipi_synode-it-wazuh-indexer-init-1


bash /opt/runtipi/app-data/synode-it/wazuh-runtipi/data/debug/wazuh-health-check.sh
#################################################################
ls -R /opt/runtipi/app-data/synode-it/
#################################################################
/opt/runtipi/app-data/synode-it/:
wazuh-runtipi

/opt/runtipi/app-data/synode-it/wazuh-runtipi:
app.env  data

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data:
config  dashboard-config  dashboard-custom  debug  indexer-data  indexer-security  manager-api  manager-etc  manager-logs  manager-queue  scripts

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/config:
certs.yml  wazuh_ssl_certs

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/config/wazuh_ssl_certs:
admin-key.pem  dashboard-key.pem  indexer-key.pem  root-ca.key          root-ca-manager.pem  server-key.pem  wazuh.dashboard-key.pem  wazuh.indexer-key.pem  wazuh.manager-key.pem
admin.pem      dashboard.pem      indexer.pem      root-ca-manager.key  root-ca.pem          server.pem      wazuh.dashboard.pem      wazuh.indexer.pem      wazuh.manager.pem

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/dashboard-config:
opensearch_dashboards.yml

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/dashboard-custom:

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/debug:
wazuh-health-check.sh

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data:
batch_metrics_enabled.conf  logging_enabled.conf  nodes  performance_analyzer_enabled.conf  rca_enabled.conf  thread_contention_monitoring_enabled.conf

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes:
0

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0:
indices  node.lock  _state

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices:
18MchhZsSju3qq9i1Y5H5Q  bPebeko8T6CwRqKcrHuKbg  DQ_OR2__Qb68RA67hy0X-A  DYh62qctQ3arcGYuH_i56g  gHEYCq6CR8O-61IcxdbmjA  _q_HjYGKTEiE6LcoPGOGxg  w1TNGdcWRZy0quUmv00o6A

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q:
0  1  2  _state

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/0:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/0/index:
_0.cfe  _0.cfs  _0.si  _1.cfe  _1.cfs  _1.si  segments_2  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/0/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/0/translog:
translog-2.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/1:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/1/index:
_0.cfe  _0.cfs  _0.si  _1.cfe  _1.cfs  _1.si  segments_2  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/1/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/1/translog:
translog-2.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/2:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/2/index:
_0.cfe  _0.cfs  _0.si  _1.cfe  _1.cfs  _1.si  segments_2  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/2/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/2/translog:
translog-2.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/18MchhZsSju3qq9i1Y5H5Q/_state:
state-5.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/bPebeko8T6CwRqKcrHuKbg:
0  _state

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/bPebeko8T6CwRqKcrHuKbg/0:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/bPebeko8T6CwRqKcrHuKbg/0/index:
segments_2  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/bPebeko8T6CwRqKcrHuKbg/0/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/bPebeko8T6CwRqKcrHuKbg/0/translog:
translog-2.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/bPebeko8T6CwRqKcrHuKbg/_state:
state-1.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DQ_OR2__Qb68RA67hy0X-A:
0  _state

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DQ_OR2__Qb68RA67hy0X-A/0:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DQ_OR2__Qb68RA67hy0X-A/0/index:
_0.cfe  _0.cfs  _0.si  segments_2  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DQ_OR2__Qb68RA67hy0X-A/0/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DQ_OR2__Qb68RA67hy0X-A/0/translog:
translog-2.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DQ_OR2__Qb68RA67hy0X-A/_state:
state-2.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DYh62qctQ3arcGYuH_i56g:
0  _state

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DYh62qctQ3arcGYuH_i56g/0:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DYh62qctQ3arcGYuH_i56g/0/index:
segments_2  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DYh62qctQ3arcGYuH_i56g/0/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DYh62qctQ3arcGYuH_i56g/0/translog:
translog-2.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/DYh62qctQ3arcGYuH_i56g/_state:
state-1.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/gHEYCq6CR8O-61IcxdbmjA:
0  _state

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/gHEYCq6CR8O-61IcxdbmjA/0:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/gHEYCq6CR8O-61IcxdbmjA/0/index:
segments_2  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/gHEYCq6CR8O-61IcxdbmjA/0/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/gHEYCq6CR8O-61IcxdbmjA/0/translog:
translog-2.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/gHEYCq6CR8O-61IcxdbmjA/_state:
state-2.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/_q_HjYGKTEiE6LcoPGOGxg:
0  _state

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/_q_HjYGKTEiE6LcoPGOGxg/0:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/_q_HjYGKTEiE6LcoPGOGxg/0/index:
_0.cfe  _0.cfs  _0.si  segments_2  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/_q_HjYGKTEiE6LcoPGOGxg/0/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/_q_HjYGKTEiE6LcoPGOGxg/0/translog:
translog-2.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/_q_HjYGKTEiE6LcoPGOGxg/_state:
state-1.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/w1TNGdcWRZy0quUmv00o6A:
0  _state

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/w1TNGdcWRZy0quUmv00o6A/0:
index  _state  translog

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/w1TNGdcWRZy0quUmv00o6A/0/index:
_0.cfe  _0.cfs  _0.si  _1.cfe  _1.cfs  _1.si  _2.cfe  _2.cfs  _2.si  _3.cfe  _3.cfs  _3.si  _4.cfe  _4.cfs  _4.si  _5.cfe  _5.cfs  _5.si  _6.cfe  _6.cfs  _6.si  _7.cfe  _7.cfs  _7.si  segments_3  write.lock

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/w1TNGdcWRZy0quUmv00o6A/0/_state:
retention-leases-1.st  state-0.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/w1TNGdcWRZy0quUmv00o6A/0/translog:
translog-3.tlog  translog.ckp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/indices/w1TNGdcWRZy0quUmv00o6A/_state:
state-9.st

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-data/nodes/0/_state:
_10.cfe  _10.cfs  _10.si  _5.cfe  _5.cfs  _5.si  _f.cfe  _f.cfs  _f.si  _i.cfe  _i.cfs  _i.si  manifest-0.st  node-0.st  _p.cfe  _p.cfs  _p.si  _q.cfe  _q.cfs  _q.si  _s.cfe  _s.cfs  segments_13  _s.si  write.lock  _x.cfe  _x.cfs  _x.si

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-security:
action_groups.yml  config.yml  internal_users.yml  nodes_dn.yml  roles_mapping.yml  roles.yml  tenants.yml  whitelist.yml

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-api:
api.yaml  security  ssl

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-api/security:
installation_uid  private_key.pem  public_key.pem  rbac.db

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-api/ssl:
server.crt  server.key

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-etc:
ossec.conf

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs:
active-responses.log  alerts  api  api.log  archives  cluster  cluster.log  firewall  integrations.log  ossec.log  wazuh

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/alerts:
2026  alerts.json  alerts.log

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/alerts/2026:
Jan

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/alerts/2026/Jan:
ossec-alerts-02.json  ossec-alerts-02.log

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/api:

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/archives:
2026  archives.log

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/archives/2026:
Jan

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/archives/2026/Jan:
ossec-archive-02.log

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/cluster:

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/firewall:
2026  firewall.log

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/firewall/2026:
Jan

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/firewall/2026/Jan:
ossec-firewall-02.log

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-logs/wazuh:

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue:
agentless  agents-timestamp  alerts  cluster  db  diff  fim  fts  harvester  indexer  keystore  logcollector  rids  router  sockets  syscollector  tasks  vd  vd_updater

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/agentless:

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/alerts:
ar  cfgaq  cfgarq  execq

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/cluster:

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/db:
000.db  global.db  wdb

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/diff:

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/fim:
db

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/fim/db:
fim.db  fim.db-journal

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/fts:
fts-queue  hostinfo  ig-queue

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/harvester:
system_event

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/harvester/system_event:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer:
db                                                       wazuh-states-inventory-hardware-wazuh.manager    wazuh-states-inventory-networks-wazuh.manager  wazuh-states-inventory-processes-wazuh.manager  wazuh-states-inventory-system-wazuh.manager
wazuh-states-inventory-browser-extensions-wazuh.manager  wazuh-states-inventory-hotfixes-wazuh.manager    wazuh-states-inventory-packages-wazuh.manager  wazuh-states-inventory-protocols-wazuh.manager  wazuh-states-inventory-users-wazuh.manager
wazuh-states-inventory-groups-wazuh.manager              wazuh-states-inventory-interfaces-wazuh.manager  wazuh-states-inventory-ports-wazuh.manager     wazuh-states-inventory-services-wazuh.manager   wazuh-states-vulnerabilities-wazuh.manager

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db:
wazuh-states-inventory-browser-extensions-wazuh.manager  wazuh-states-inventory-hotfixes-wazuh.manager    wazuh-states-inventory-packages-wazuh.manager   wazuh-states-inventory-protocols-wazuh.manager  wazuh-states-inventory-users-wazuh.manager
wazuh-states-inventory-groups-wazuh.manager              wazuh-states-inventory-interfaces-wazuh.manager  wazuh-states-inventory-ports-wazuh.manager      wazuh-states-inventory-services-wazuh.manager   wazuh-states-vulnerabilities-wazuh.manager
wazuh-states-inventory-hardware-wazuh.manager            wazuh-states-inventory-networks-wazuh.manager    wazuh-states-inventory-processes-wazuh.manager  wazuh-states-inventory-system-wazuh.manager

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-browser-extensions-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-groups-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-hardware-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-hotfixes-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-interfaces-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-networks-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-packages-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-ports-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-processes-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-protocols-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-services-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-system-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-inventory-users-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/db/wazuh-states-vulnerabilities-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-browser-extensions-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-groups-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-hardware-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-hotfixes-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-interfaces-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-networks-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-packages-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-ports-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-processes-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-protocols-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-services-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-system-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-inventory-users-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/indexer/wazuh-states-vulnerabilities-wazuh.manager:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/keystore:
000010.sst  000017.sst  000024.log  CURRENT  IDENTITY  LOCK  LOG  LOG.old.1767364619586160  LOG.old.1767364627854510  LOG.old.1767364627927294  MANIFEST-000025  OPTIONS-000023  OPTIONS-000027

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/logcollector:
file_status.json

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/rids:
sender_counter

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/router:
deltas-syscollector  policy  rsync  subscription.sock  wdb-agent-events  wdb-inventory-events

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/sockets:
analysis  auth  com  control  download  logcollector  logtest  monitor  queue  remote  syscheck  updater-ondemand  wdb-http.sock  wmodules

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/syscollector:
db  norm_config.json

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/syscollector/db:
local.db  local.db-journal

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/tasks:
task  tasks.db  upgrade

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd:
delayed  event  feed  inventory  reports  state_track

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd/delayed:
000008.log  CURRENT  IDENTITY  LOCK  LOG  LOG.old.1767364789798006  MANIFEST-000009  OPTIONS-000007  OPTIONS-000011

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd/event:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd/feed:
000186.sst  000247.sst  000325.sst  000567.sst  000870.sst  001135.sst  001484.sst  001864.sst  003005.sst  005457.sst  005584.sst  005604.sst  005623.sst  005642.sst  005661.sst  005681.sst  005703.sst  005722.sst  005741.sst
000197.sst  000248.sst  000327.sst  000582.sst  000873.sst  001137.sst  001486.sst  001875.sst  003663.sst  005484.sst  005585.sst  005605.sst  005624.sst  005643.sst  005662.sst  005683.sst  005704.sst  005723.sst  005742.sst
000198.sst  000250.sst  000329.sst  000619.sst  000919.sst  001222.sst  001513.sst  001876.sst  003782.sst  005551.log  005587.sst  005606.sst  005625.sst  005644.sst  005663.sst  005684.sst  005705.sst  005724.sst  005743.sst
000202.sst  000251.sst  000372.sst  000621.sst  000921.sst  001225.sst  001517.sst  001886.sst  003902.sst  005563.sst  005588.sst  005607.sst  005626.sst  005645.sst  005664.sst  005685.sst  005706.sst  005725.sst  CURRENT
000211.sst  000252.sst  000374.sst  000630.sst  000928.sst  001230.sst  001557.sst  001889.sst  004220.sst  005564.sst  005589.sst  005608.sst  005627.sst  005646.sst  005665.sst  005686.sst  005707.sst  005726.sst  IDENTITY
000212.sst  000253.sst  000398.sst  000632.sst  000958.sst  001232.sst  001559.sst  001975.sst  004428.sst  005565.sst  005590.sst  005609.sst  005628.sst  005647.sst  005667.sst  005687.sst  005708.sst  005727.sst  LOCK
000218.sst  000255.sst  000435.sst  000643.sst  000960.sst  001239.sst  001623.sst  001977.sst  004550.sst  005566.sst  005591.sst  005610.sst  005629.sst  005648.sst  005668.sst  005688.sst  005709.sst  005728.sst  LOG
000220.sst  000257.sst  000443.sst  000646.sst  001014.sst  001242.sst  001626.sst  002003.sst  004799.sst  005567.sst  005592.sst  005611.sst  005630.sst  005649.sst  005669.sst  005689.sst  005710.sst  005729.sst  LOG.old.1762562988857022
000224.sst  000259.sst  000445.sst  000695.sst  001016.sst  001299.sst  001671.sst  002078.sst  004864.sst  005568.sst  005593.sst  005612.sst  005631.sst  005650.sst  005670.sst  005690.sst  005711.sst  005730.sst  LOG.old.1762563426971991
000226.sst  000261.sst  000470.sst  000708.sst  001017.sst  001319.sst  001676.sst  002079.sst  004987.sst  005569.sst  005594.sst  005613.sst  005632.sst  005651.sst  005671.sst  005691.sst  005712.sst  005731.sst  LOG.old.1767364763613696
000228.sst  000263.sst  000473.sst  000710.sst  001019.sst  001322.sst  001681.sst  002182.sst  004988.sst  005570.sst  005595.sst  005614.sst  005633.sst  005652.sst  005672.sst  005692.sst  005713.sst  005732.sst  MANIFEST-005552
000232.sst  000264.sst  000481.sst  000715.sst  001021.sst  001326.sst  001693.sst  002437.sst  004989.sst  005576.sst  005596.sst  005615.sst  005634.sst  005653.sst  005673.sst  005693.sst  005714.sst  005733.sst  OPTIONS-004877
000234.sst  000265.sst  000491.sst  000716.sst  001034.sst  001328.sst  001719.sst  002440.sst  005051.sst  005577.sst  005597.sst  005616.sst  005635.sst  005654.sst  005674.sst  005694.sst  005715.sst  005734.sst  OPTIONS-005554
000238.sst  000292.sst  000493.sst  000739.sst  001036.sst  001331.sst  001720.sst  002537.sst  005061.sst  005578.sst  005598.sst  005617.sst  005636.sst  005655.sst  005675.sst  005695.sst  005716.sst  005735.sst
000239.sst  000294.sst  000501.sst  000750.sst  001043.sst  001382.sst  001770.sst  002562.sst  005142.sst  005579.sst  005599.sst  005618.sst  005637.sst  005656.sst  005676.sst  005696.sst  005717.sst  005736.sst
000241.sst  000302.sst  000544.sst  000809.sst  001093.sst  001413.sst  001783.sst  002641.sst  005152.sst  005580.sst  005600.sst  005619.sst  005638.sst  005657.sst  005677.sst  005697.sst  005718.sst  005737.sst
000242.sst  000304.sst  000547.sst  000810.sst  001104.sst  001416.sst  001806.sst  002662.sst  005165.sst  005581.sst  005601.sst  005620.sst  005639.sst  005658.sst  005678.sst  005698.sst  005719.sst  005738.sst
000244.sst  000312.sst  000558.sst  000833.sst  001128.sst  001450.sst  001821.sst  002663.sst  005455.sst  005582.sst  005602.sst  005621.sst  005640.sst  005659.sst  005679.sst  005699.sst  005720.sst  005739.sst
000245.sst  000314.sst  000561.sst  000850.sst  001130.sst  001452.sst  001823.sst  002995.sst  005456.sst  005583.sst  005603.sst  005622.sst  005641.sst  005660.sst  005680.sst  005702.sst  005721.sst  005740.sst

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd/inventory:
000014.log  CURRENT  IDENTITY  LOCK  LOG  LOG.old.1767364787732166  MANIFEST-000015  OPTIONS-000013  OPTIONS-000017

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd/reports:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd/state_track:
000004.log  CURRENT  IDENTITY  LOCK  LOG  MANIFEST-000005  OPTIONS-000007

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd_updater:
rocksdb  tmp

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd_updater/rocksdb:
updater_vulnerability_feed_manager_metadata

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd_updater/rocksdb/updater_vulnerability_feed_manager_metadata:
000012.sst  000013.log  CURRENT  IDENTITY  LOCK  LOG  LOG.old.1767364773642184  MANIFEST-000014  OPTIONS-000011  OPTIONS-000016

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd_updater/tmp:
contents  downloads

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd_updater/tmp/contents:
2890828-api_file.json  2896828-api_file.json  2902828-api_file.json  2908828-api_file.json  2914828-api_file.json  2920828-api_file.json  2926828-api_file.json  2932828-api_file.json  2938828-api_file.json  2944828-api_file.json
2891828-api_file.json  2897828-api_file.json  2903828-api_file.json  2909828-api_file.json  2915828-api_file.json  2921828-api_file.json  2927828-api_file.json  2933828-api_file.json  2939828-api_file.json  2945828-api_file.json
2892828-api_file.json  2898828-api_file.json  2904828-api_file.json  2910828-api_file.json  2916828-api_file.json  2922828-api_file.json  2928828-api_file.json  2934828-api_file.json  2940828-api_file.json  2946828-api_file.json
2893828-api_file.json  2899828-api_file.json  2905828-api_file.json  2911828-api_file.json  2917828-api_file.json  2923828-api_file.json  2929828-api_file.json  2935828-api_file.json  2941828-api_file.json  2947828-api_file.json
2894828-api_file.json  2900828-api_file.json  2906828-api_file.json  2912828-api_file.json  2918828-api_file.json  2924828-api_file.json  2930828-api_file.json  2936828-api_file.json  2942828-api_file.json  2948828-api_file.json
2895828-api_file.json  2901828-api_file.json  2907828-api_file.json  2913828-api_file.json  2919828-api_file.json  2925828-api_file.json  2931828-api_file.json  2937828-api_file.json  2943828-api_file.json  2949828-api_file.json

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/manager-queue/vd_updater/tmp/downloads:

/opt/runtipi/app-data/synode-it/wazuh-runtipi/data/scripts:
init-certs.sh  init-dashboard.sh  init-indexer-init.sh  init-manager.sh
#################################################################
docker ps -a
#################################################################
CONTAINER ID   IMAGE                               COMMAND                  CREATED         STATUS                   PORTS                                                                                                                                                                 NAMES
08638d412b0a   wazuh/wazuh-manager:4.14.1          "bash /scripts/init-…"   7 minutes ago   Up 6 minutes (healthy)   0.0.0.0:1514-1515->1514-1515/tcp, [::]:1514-1515->1514-1515/tcp, 0.0.0.0:514->514/udp, [::]:514->514/udp, 0.0.0.0:55000->55000/tcp, [::]:55000->55000/tcp, 1516/tcp   wazuh-runtipi_synode-it-wazuh-manager-1
3e7522da10fd   wazuh/wazuh-indexer:4.14.1          "/entrypoint.sh open…"   7 minutes ago   Up 6 minutes (healthy)   9200/tcp                                                                                                                                                              wazuh-runtipi_synode-it-wazuh-indexer-1
531b9035ffd0   wazuh/wazuh-dashboard:4.14.1        "bash /scripts/init-…"   7 minutes ago   Up 6 minutes (healthy)   443/tcp, 0.0.0.0:5601->5601/tcp, [::]:5601->5601/tcp                                                                                                                  wazuh-runtipi_synode-it-wazuh-dashboard-1
c72deed62da4   wazuh/wazuh-indexer:4.14.1          "bash /scripts/init-…"   7 minutes ago   Up 6 minutes (healthy)   9200/tcp                                                                                                                                                              wazuh-runtipi_synode-it-wazuh-indexer-init-1
b2d65641008e   wazuh/wazuh-certs-generator:0.0.3   "sh /scripts/init-ce…"   7 minutes ago   Up 6 minutes (healthy)                                                                                                                                                                         wazuh-runtipi_synode-it-wazuh-certs-1
6708a581a4fd   traefik:v3.6.1                      "/entrypoint.sh --pr…"   9 days ago      Up 2 days                0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp                                                                                          runtipi-reverse-proxy
ee2a8bb95782   ghcr.io/runtipi/runtipi:v4.6.5      "docker-entrypoint.s…"   9 days ago      Up 2 days (healthy)      3000/tcp                                                                                                                                                              runtipi
6e543020cc6d   postgres:14                         "docker-entrypoint.s…"   9 days ago      Up 2 days (healthy)      5432/tcp                                                                                                                                                              runtipi-db
ec73809babe8   rabbitmq:4-alpine                   "docker-entrypoint.s…"   9 days ago      Up 2 days                4369/tcp, 5671/tcp, 15691-15692/tcp, 25672/tcp, 0.0.0.0:5672->5672/tcp, [::]:5672->5672/tcp                                                                           runtipi-queue
#################################################################
docker logs wazuh-runtipi_synode-it-wazuh-indexer-1
#################################################################
WARNING: Using incubator modules: jdk.incubator.vector
WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.19.3.jar)
WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
WARNING: System::setSecurityManager will be removed in a future release
Jan 02, 2026 2:36:42 PM sun.util.locale.provider.LocaleProviderAdapter <clinit>
WARNING: COMPAT locale provider will be removed in a future release
WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.19.3.jar)
WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
WARNING: System::setSecurityManager will be removed in a future release
[2026-01-02T14:36:42,991][INFO ][o.o.n.Node               ] [wazuh.indexer] version[2.19.3], pid[1], build[rpm/ac8f6e0114b657a116c4a41c3e12f8e0e181bbcd/2025-11-08T11:55:34.225460336Z], OS[Linux/6.8.0-90-generic/amd64], JVM[Eclipse Adoptium/OpenJDK 64-Bit Server VM/21.0.7/21.0.7+6-LTS]
[2026-01-02T14:36:42,994][INFO ][o.o.n.Node               ] [wazuh.indexer] JVM home [/usr/share/wazuh-indexer/jdk], using bundled JDK/JRE [true]
[2026-01-02T14:36:42,995][INFO ][o.o.n.Node               ] [wazuh.indexer] JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.security.manager=allow, -Djava.locale.providers=SPI,COMPAT, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/tmp/opensearch-786307466768349973, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.security.manager=allow, --add-modules=jdk.incubator.vector, -Djava.util.concurrent.ForkJoinPool.common.threadFactory=org.opensearch.secure_sm.SecuredForkJoinWorkerThreadFactory, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///usr/share/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -Xms1g, -Xmx1g, -XX:MaxDirectMemorySize=536870912, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/usr/share/wazuh-indexer/config, -Dopensearch.distribution.type=rpm, -Dopensearch.bundled_jdk=true]
[2026-01-02T14:36:43,368][INFO ][o.a.l.i.v.PanamaVectorizationProvider] [wazuh.indexer] Java vector incubator API enabled; uses preferredBitSize=128; floating-point vectors only
[2026-01-02T14:36:44,591][INFO ][o.o.s.s.t.SSLConfig      ] [wazuh.indexer] SSL dual mode is disabled
[2026-01-02T14:36:44,592][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] OpenSearch Config path is /usr/share/wazuh-indexer/config
[2026-01-02T14:36:44,985][INFO ][o.o.s.s.SslSettingsManager] [wazuh.indexer] TLS HTTP Provider                    : JDK
[2026-01-02T14:36:44,986][INFO ][o.o.s.s.SslSettingsManager] [wazuh.indexer] Enabled TLS protocols for HTTP layer : [TLSv1.3, TLSv1.2]
[2026-01-02T14:36:44,988][INFO ][o.o.s.s.SslSettingsManager] [wazuh.indexer] TLS Transport Client Provider             : JDK
[2026-01-02T14:36:44,988][INFO ][o.o.s.s.SslSettingsManager] [wazuh.indexer] TLS Transport Server Provider             : JDK
[2026-01-02T14:36:44,989][INFO ][o.o.s.s.SslSettingsManager] [wazuh.indexer] Enabled TLS protocols for Transport layer : [TLSv1.3, TLSv1.2]
[2026-01-02T14:36:45,924][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Clustername: wazuh-cluster
[2026-01-02T14:36:45,952][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Directory /usr/share/wazuh-indexer/config/certs has insecure file permissions (should be 0700)
[2026-01-02T14:36:45,953][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/dashboard-key.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,954][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/wazuh.manager.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,954][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/root-ca-manager.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,955][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/root-ca.key has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,956][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/server.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,956][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/admin.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,957][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/indexer.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,957][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/server-key.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,958][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/admin-key.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,959][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/root-ca.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,959][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/dashboard.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,960][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/wazuh.indexer-key.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,961][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/wazuh.dashboard.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,961][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,962][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/wazuh.dashboard-key.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,962][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/indexer-key.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,963][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/wazuh.manager-key.pem has insecure file permissions (should be 0600)
[2026-01-02T14:36:45,964][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/config/certs/root-ca-manager.key has insecure file permissions (should be 0600)
[2026-01-02T14:36:47,347][INFO ][o.o.p.c.c.PluginSettings ] [wazuh.indexer] Trying to create directory /dev/shm/performanceanalyzer/.
[2026-01-02T14:36:47,348][INFO ][o.o.p.c.c.PluginSettings ] [wazuh.indexer] Config: metricsLocation: /dev/shm/performanceanalyzer/, metricsDeletionInterval: 1, httpsEnabled: false, cleanup-metrics-db-files: true, batch-metrics-retention-period-minutes: 7, rpc-port: 9650, webservice-port 9600
[2026-01-02T14:36:47,851][INFO ][o.o.i.r.ReindexPlugin    ] [wazuh.indexer] ReindexPlugin reloadSPI called
[2026-01-02T14:36:47,853][INFO ][o.o.i.r.ReindexPlugin    ] [wazuh.indexer] Unable to find any implementation for RemoteReindexExtension
[2026-01-02T14:36:47,889][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: opensearch_time_series_analytics, index: .opendistro-anomaly-detector-jobs
[2026-01-02T14:36:47,925][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: reports-scheduler, index: .opendistro-reports-definitions
[2026-01-02T14:36:47,927][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: opendistro-index-management, index: .opendistro-ism-config
[2026-01-02T14:36:47,930][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: checkBatchJobTaskStatus, index: .ml_commons_task_polling_job
[2026-01-02T14:36:47,932][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: scheduler_geospatial_ip2geo_datasource, index: .scheduler-geospatial-ip2geo-datasource
[2026-01-02T14:36:47,934][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: async-query-scheduler, index: .async-query-scheduler
[2026-01-02T14:36:47,941][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [aggs-matrix-stats]
[2026-01-02T14:36:47,942][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [analysis-common]
[2026-01-02T14:36:47,943][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [cache-common]
[2026-01-02T14:36:47,943][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [geo]
[2026-01-02T14:36:47,943][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [ingest-common]
[2026-01-02T14:36:47,944][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [ingest-geoip]
[2026-01-02T14:36:47,944][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [ingest-user-agent]
[2026-01-02T14:36:47,944][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [lang-expression]
[2026-01-02T14:36:47,945][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [lang-mustache]
[2026-01-02T14:36:47,945][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [lang-painless]
[2026-01-02T14:36:47,945][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [mapper-extras]
[2026-01-02T14:36:47,946][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [opensearch-dashboards]
[2026-01-02T14:36:47,946][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [parent-join]
[2026-01-02T14:36:47,946][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [percolator]
[2026-01-02T14:36:47,946][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [rank-eval]
[2026-01-02T14:36:47,947][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [reindex]
[2026-01-02T14:36:47,947][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [repository-url]
[2026-01-02T14:36:47,947][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [search-pipeline-common]
[2026-01-02T14:36:47,948][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [systemd]
[2026-01-02T14:36:47,948][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded module [transport-netty4]
[2026-01-02T14:36:47,949][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-alerting]
[2026-01-02T14:36:47,949][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-anomaly-detection]
[2026-01-02T14:36:47,949][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-asynchronous-search]
[2026-01-02T14:36:47,950][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-cross-cluster-replication]
[2026-01-02T14:36:47,950][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-geospatial]
[2026-01-02T14:36:47,951][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-index-management]
[2026-01-02T14:36:47,951][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-job-scheduler]
[2026-01-02T14:36:47,951][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-knn]
[2026-01-02T14:36:47,952][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-ml]
[2026-01-02T14:36:47,952][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-neural-search]
[2026-01-02T14:36:47,952][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-notifications]
[2026-01-02T14:36:47,952][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-notifications-core]
[2026-01-02T14:36:47,953][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-observability]
[2026-01-02T14:36:47,953][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-performance-analyzer]
[2026-01-02T14:36:47,953][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-reports-scheduler]
[2026-01-02T14:36:47,954][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-security]
[2026-01-02T14:36:47,954][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] loaded plugin [opensearch-sql]
[2026-01-02T14:36:47,972][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Disabled https compression by default to mitigate BREACH attacks. You can enable it by setting 'http.compression: true' in opensearch.yml
[2026-01-02T14:36:48,056][WARN ][stderr                   ] [wazuh.indexer] WARNING: A restricted method in java.lang.foreign.Linker has been called
[2026-01-02T14:36:48,056][WARN ][stderr                   ] [wazuh.indexer] WARNING: java.lang.foreign.Linker::downcallHandle has been called by the unnamed module
[2026-01-02T14:36:48,057][WARN ][stderr                   ] [wazuh.indexer] WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for this module
[2026-01-02T14:36:48,151][INFO ][o.a.l.s.MemorySegmentIndexInputProvider] [wazuh.indexer] Using MemorySegmentIndexInput and native madvise support with Java 21 or later; to disable start with -Dorg.apache.lucene.store.MMapDirectory.enableMemorySegments=false
[2026-01-02T14:36:48,160][INFO ][o.o.e.NodeEnvironment    ] [wazuh.indexer] using [1] data paths, mounts [[/var/lib/wazuh-indexer (/dev/mapper/ubuntu--vg-ubuntu--lv)]], net usable_space [69.8gb], net total_space [97.8gb], types [ext4]
[2026-01-02T14:36:48,160][INFO ][o.o.e.NodeEnvironment    ] [wazuh.indexer] heap size [1gb], compressed ordinary object pointers [true]
[2026-01-02T14:36:48,200][INFO ][o.o.n.Node               ] [wazuh.indexer] node name [wazuh.indexer], node ID [jeO_mKrESxWeD0COXlnc_w], cluster name [wazuh-cluster], roles [ingest, remote_cluster_client, data, cluster_manager]
[2026-01-02T14:36:48,259][INFO ][o.o.e.ExtensionsManager  ] [wazuh.indexer] ExtensionsManager initialized
[2026-01-02T14:36:52,263][INFO ][o.o.n.p.NeuralSearch     ] [wazuh.indexer] Registering hybrid query phase searcher with feature flag [plugins.neural_search.hybrid_search_disabled]
[2026-01-02T14:36:52,761][WARN ][o.o.s.c.Salt             ] [wazuh.indexer] If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes
[2026-01-02T14:36:52,809][ERROR][o.o.s.a.s.SinkProvider   ] [wazuh.indexer] Default endpoint could not be created, auditlog will not work properly.
[2026-01-02T14:36:52,811][WARN ][o.o.s.a.r.AuditMessageRouter] [wazuh.indexer] No default storage available, audit log may not work properly. Please check configuration.
[2026-01-02T14:36:52,811][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Message routing enabled: false
[2026-01-02T14:36:52,858][INFO ][o.o.s.f.SecurityFilter   ] [wazuh.indexer] <NONE> indices are made immutable.
[2026-01-02T14:36:53,243][INFO ][o.o.t.b.CircuitBreakerService] [wazuh.indexer] Registered memory breaker.
[2026-01-02T14:36:53,715][INFO ][o.o.r.m.c.i.SdkClientFactory] [wazuh.indexer] Using local opensearch cluster as metadata store.
[2026-01-02T14:36:53,738][INFO ][o.o.m.b.MLCircuitBreakerService] [wazuh.indexer] Registered ML memory breaker.
[2026-01-02T14:36:53,740][INFO ][o.o.m.b.MLCircuitBreakerService] [wazuh.indexer] Registered ML disk breaker.
[2026-01-02T14:36:53,740][INFO ][o.o.m.b.MLCircuitBreakerService] [wazuh.indexer] Registered ML native memory breaker.
[2026-01-02T14:36:53,857][INFO ][o.r.Reflections          ] [wazuh.indexer] Reflections took 68 ms to scan 1 urls, producing 27 keys and 67 values 
[2026-01-02T14:36:53,884][INFO ][o.r.Reflections          ] [wazuh.indexer] Reflections took 3 ms to scan 1 urls, producing 3 keys and 5 values 
[2026-01-02T14:36:53,945][WARN ][o.o.s.p.SQLPlugin        ] [wazuh.indexer] Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information
[2026-01-02T14:36:54,927][INFO ][o.o.t.NettyAllocator     ] [wazuh.indexer] creating NettyAllocator with the following configs: [name=unpooled, suggested_max_allocation_size=256kb, factors={opensearch.unsafe.use_unpooled_allocator=null, g1gc_enabled=true, g1gc_region_size=1mb, heap_size=1gb}]
[2026-01-02T14:36:54,935][INFO ][o.o.s.s.t.SSLConfig      ] [wazuh.indexer] SSL dual mode is disabled
[2026-01-02T14:36:55,102][INFO ][o.o.d.DiscoveryModule    ] [wazuh.indexer] using discovery type [single-node] and seed hosts providers [settings]
[2026-01-02T14:36:55,750][WARN ][o.o.g.DanglingIndicesState] [wazuh.indexer] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
[2026-01-02T14:36:56,636][INFO ][o.o.p.h.c.PerformanceAnalyzerConfigAction] [wazuh.indexer] PerformanceAnalyzer Enabled: false
[2026-01-02T14:36:56,667][INFO ][o.o.n.Node               ] [wazuh.indexer] initialized
[2026-01-02T14:36:56,668][INFO ][o.o.n.Node               ] [wazuh.indexer] starting ...
[2026-01-02T14:36:56,779][INFO ][o.o.t.TransportService   ] [wazuh.indexer] publish_address {10.128.10.3:9300}, bound_addresses {[::]:9300}
[2026-01-02T14:36:56,782][INFO ][o.o.t.TransportService   ] [wazuh.indexer] Remote clusters initialized successfully.
[2026-01-02T14:36:57,067][INFO ][o.o.c.c.Coordinator      ] [wazuh.indexer] setting initial configuration to VotingConfiguration{jeO_mKrESxWeD0COXlnc_w}
[2026-01-02T14:36:57,257][INFO ][o.o.c.s.MasterService    ] [wazuh.indexer] Tasks batched with key: org.opensearch.cluster.coordination.JoinHelper, count:3 and sample tasks: elected-as-cluster-manager ([1] nodes joined)[{wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} elect leader, _BECOME_CLUSTER_MANAGER_TASK_, _FINISH_ELECTION_], term: 1, version: 1, delta: cluster-manager node changed {previous [], current [{wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true}]}
[2026-01-02T14:36:57,364][INFO ][o.o.c.c.CoordinationState] [wazuh.indexer] cluster UUID set to [Sjkv4gUiQEG7JRqpbXlNnw]
[2026-01-02T14:36:57,444][INFO ][o.o.c.s.ClusterApplierService] [wazuh.indexer] cluster-manager node changed {previous [], current [{wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true}]}, term: 1, version: 1, reason: Publication{term=1, version=1}
[2026-01-02T14:36:57,453][INFO ][o.o.t.i.IndexManagement  ] [wazuh.indexer] Candidate custom result indices are empty.
[2026-01-02T14:36:57,454][INFO ][o.o.t.i.IndexManagement  ] [wazuh.indexer] Candidate custom result indices are empty.
[2026-01-02T14:36:57,455][INFO ][o.o.t.c.ClusterEventListener] [wazuh.indexer] Cluster is not recovered yet.
[2026-01-02T14:36:57,482][INFO ][o.o.i.i.ManagedIndexCoordinator] [wazuh.indexer] Cache cluster manager node onClusterManager time: 1767364617482
[2026-01-02T14:36:57,493][WARN ][o.o.p.c.s.h.ConfigOverridesClusterSettingHandler] [wazuh.indexer] Config override setting update called with empty string. Ignoring.
[2026-01-02T14:36:57,503][INFO ][o.o.d.PeerFinder         ] [wazuh.indexer] setting findPeersInterval to [1s] as node commission status = [true] for local node [{wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true}]
[2026-01-02T14:36:57,506][INFO ][o.o.h.AbstractHttpServerTransport] [wazuh.indexer] publish_address {10.128.10.3:9200}, bound_addresses {[::]:9200}
[2026-01-02T14:36:57,507][INFO ][o.o.n.Node               ] [wazuh.indexer] started
[2026-01-02T14:36:57,508][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Will not attempt to create index .opendistro_security and default configs if they are absent. Use securityadmin to initialize cluster
[2026-01-02T14:36:57,509][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Background init thread started. Install default config?: false
[2026-01-02T14:36:57,509][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] 0 OpenSearch Security modules loaded so far: []
[2026-01-02T14:36:57,510][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Wait for cluster to be available ...
[2026-01-02T14:36:57,548][INFO ][o.o.t.c.HashRing         ] [wazuh.indexer] Node added: [jeO_mKrESxWeD0COXlnc_w]
[2026-01-02T14:36:57,554][INFO ][o.o.t.c.HashRing         ] [wazuh.indexer] Add data node to version hash ring: jeO_mKrESxWeD0COXlnc_w
[2026-01-02T14:36:57,557][INFO ][o.o.t.c.HashRing         ] [wazuh.indexer] All nodes with known version: {jeO_mKrESxWeD0COXlnc_w=ADNodeInfo{version=2.19.3, isEligibleDataNode=true}}
[2026-01-02T14:36:57,557][INFO ][o.o.t.c.HashRing         ] [wazuh.indexer] Rebuild hash ring for realtime with cooldown, nodeChangeEvents size 0
[2026-01-02T14:36:57,557][INFO ][o.o.t.c.HashRing         ] [wazuh.indexer] Build version hash ring successfully
[2026-01-02T14:36:57,558][INFO ][o.o.t.c.ADDataMigrator   ] [wazuh.indexer] Start migrating AD data
[2026-01-02T14:36:57,559][INFO ][o.o.t.c.ADDataMigrator   ] [wazuh.indexer] AD job index doesn't exist, no need to migrate
[2026-01-02T14:36:57,559][INFO ][o.o.t.c.ClusterEventListener] [wazuh.indexer] Init version hash ring successfully
[2026-01-02T14:36:57,577][INFO ][o.o.g.GatewayService     ] [wazuh.indexer] recovered [0] indices into cluster_state
[2026-01-02T14:36:57,602][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-observability/bPebeko8T6CwRqKcrHuKbg]
[2026-01-02T14:36:57,768][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.opensearch-observability] creating index, cause [api], templates [], shards [1]/[0]
[2026-01-02T14:36:57,905][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:36:57,906][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-observability/bPebeko8T6CwRqKcrHuKbg]
[2026-01-02T14:36:57,955][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:36:57,959][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:36:57,962][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:36:58,343][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.opensearch-observability][0]]]).
[2026-01-02T14:36:58,435][INFO ][o.o.o.i.ObservabilityIndex] [wazuh.indexer] observability:Index .opensearch-observability creation Acknowledged
[2026-01-02T14:36:58,516][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,516][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,516][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,517][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,517][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,517][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,518][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,518][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,518][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:36:58,518][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [wazuh.indexer] Failure no such index [.opendistro_security] retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST] (index=.opendistro_security)
[2026-01-02T14:37:00,242][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:00,246][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:00,248][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:00,251][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:00,565][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:02,381][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:02,743][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:02,746][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:02,750][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:02,753][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:03,042][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:03,047][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.opendistro_security] creating index, cause [api], templates [], shards [1]/[1]
[2026-01-02T14:37:03,049][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] updating number_of_replicas to [0] for indices [.opendistro_security]
[2026-01-02T14:37:03,142][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:03,336][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.opendistro_security][0]]]).
[2026-01-02T14:37:03,707][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:03,714][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/w1TNGdcWRZy0quUmv00o6A] create_mapping
[2026-01-02T14:37:03,959][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:03,969][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/w1TNGdcWRZy0quUmv00o6A] update_mapping [_doc]
[2026-01-02T14:37:04,134][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:04,143][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/w1TNGdcWRZy0quUmv00o6A] update_mapping [_doc]
[2026-01-02T14:37:04,288][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:04,301][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/w1TNGdcWRZy0quUmv00o6A] update_mapping [_doc]
[2026-01-02T14:37:04,429][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:04,443][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/w1TNGdcWRZy0quUmv00o6A] update_mapping [_doc]
[2026-01-02T14:37:04,578][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:04,590][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/w1TNGdcWRZy0quUmv00o6A] update_mapping [_doc]
[2026-01-02T14:37:04,714][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:04,722][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/w1TNGdcWRZy0quUmv00o6A] update_mapping [_doc]
[2026-01-02T14:37:04,905][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/w1TNGdcWRZy0quUmv00o6A]
[2026-01-02T14:37:04,914][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/w1TNGdcWRZy0quUmv00o6A] update_mapping [_doc]
[2026-01-02T14:37:05,040][WARN ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Unable to reload configuration, initalization thread has not yet completed.
[2026-01-02T14:37:05,243][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:05,246][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:05,248][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:05,251][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:07,516][INFO ][o.o.m.a.MLModelAutoReDeployer] [wazuh.indexer] Index not found, not performing auto reloading!
[2026-01-02T14:37:07,517][INFO ][o.o.m.c.MLCommonsClusterManagerEventListener] [wazuh.indexer] Starting ML sync up job...
[2026-01-02T14:37:07,743][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:07,746][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:07,750][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:07,753][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:10,244][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:10,246][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:10,249][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:10,251][ERROR][o.o.s.a.BackendRegistry  ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2026-01-02T14:37:11,856][INFO ][stdout                   ] [wazuh.indexer] [FINE] No subscribers registered for event class org.opensearch.security.securityconf.DynamicConfigFactory$NodesDnModelImpl
[2026-01-02T14:37:11,857][INFO ][stdout                   ] [wazuh.indexer] [FINE] No subscribers registered for event class org.greenrobot.eventbus.NoSubscriberEvent
[2026-01-02T14:37:11,858][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Hot-reloading of audit configuration is disabled. Using configuration with defaults from opensearch settings.  Populate the configuration in index using audit.yml or securityadmin to enable it.
[2026-01-02T14:37:11,859][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing on REST API is enabled.
[2026-01-02T14:37:11,859][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] [AUTHENTICATED, GRANTED_PRIVILEGES] are excluded from REST API auditing.
[2026-01-02T14:37:11,859][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing on Transport API is enabled.
[2026-01-02T14:37:11,859][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] [AUTHENTICATED, GRANTED_PRIVILEGES] are excluded from Transport API auditing.
[2026-01-02T14:37:11,859][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing of request body is enabled.
[2026-01-02T14:37:11,860][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Bulk requests resolution is disabled during request auditing.
[2026-01-02T14:37:11,860][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Index resolution is enabled during request auditing.
[2026-01-02T14:37:11,860][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Sensitive headers exclusion from auditing is enabled.
[2026-01-02T14:37:11,860][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing requests from kibanaserver users is disabled.
[2026-01-02T14:37:11,861][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing request headers <NONE> is disabled.
[2026-01-02T14:37:11,861][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing request url params <NONE> is disabled.
[2026-01-02T14:37:11,861][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing of external configuration is disabled.
[2026-01-02T14:37:11,861][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing of internal configuration is disabled.
[2026-01-02T14:37:11,862][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing only metadata information for read request is disabled.
[2026-01-02T14:37:11,862][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing will watch {} for read requests.
[2026-01-02T14:37:11,862][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing read operation requests from kibanaserver users is disabled.
[2026-01-02T14:37:11,863][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing only metadata information for write request is disabled.
[2026-01-02T14:37:11,863][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing diffs for write requests is disabled.
[2026-01-02T14:37:11,863][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing write operation requests from kibanaserver users is disabled.
[2026-01-02T14:37:11,864][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Auditing will watch <NONE> for write requests.
[2026-01-02T14:37:11,864][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] .opendistro_security is used as internal security index.
[2026-01-02T14:37:11,864][INFO ][o.o.s.a.i.AuditLogImpl   ] [wazuh.indexer] Internal index used for posting audit logs is null
[2026-01-02T14:37:11,864][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Node 'wazuh.indexer' initialized
[2026-01-02T14:37:13,308][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.kibana_1/gHEYCq6CR8O-61IcxdbmjA]
[2026-01-02T14:37:13,335][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.kibana_1] creating index, cause [api], templates [], shards [1]/[1]
[2026-01-02T14:37:13,337][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] updating number_of_replicas to [0] for indices [.kibana_1]
[2026-01-02T14:37:13,402][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.kibana_1/gHEYCq6CR8O-61IcxdbmjA]
[2026-01-02T14:37:13,565][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.kibana_1][0]]]).
[2026-01-02T14:37:14,874][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[yznG4X0lQhWWGmQDodcSbA/Q3a4CzLiQxqV2j4tGWqZuA]
[2026-01-02T14:37:14,886][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding template [wazuh-statistics] for index patterns [wazuh-statistics-*]
[2026-01-02T14:37:44,893][WARN ][r.suppressed             ] [wazuh.indexer] path: /_template/wazuh-agent, params: {name=wazuh-agent}
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index-template [wazuh-agent], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:37:47,527][ERROR][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Failed to create index .plugins-ml-config
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index [.plugins-ml-config], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:37:48,672][WARN ][r.suppressed             ] [wazuh.indexer] path: /_ingest/pipeline/filebeat-7.10.2-wazuh-alerts-pipeline, params: {id=filebeat-7.10.2-wazuh-alerts-pipeline}
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (put-pipeline-filebeat-7.10.2-wazuh-alerts-pipeline) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:37:57,485][INFO ][o.o.i.i.ManagedIndexCoordinator] [wazuh.indexer] Performing ISM template migration.
[2026-01-02T14:37:57,487][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Doing ISM template migration 1 time.
[2026-01-02T14:37:57,488][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Use 2026-01-02T13:36:57.482Z as migrating ISM template last_updated_time
[2026-01-02T14:37:57,489][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] ISM templates: {}
[2026-01-02T14:37:57,490][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Policies to update: []
[2026-01-02T14:37:57,492][INFO ][o.o.i.i.ManagedIndexCoordinator] [wazuh.indexer] Performing move cluster state metadata.
[2026-01-02T14:37:57,493][INFO ][o.o.i.i.MetadataService  ] [wazuh.indexer] ISM config index not exist, so we cancel the metadata migration job.
[2026-01-02T14:37:57,499][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Failure experienced when migrating ISM Template and update ISM policies: {}
[2026-01-02T14:37:57,527][ERROR][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Failed to create index .plugins-ml-config
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index [.plugins-ml-config], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:37:58,633][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [43694ms] which is above the warn threshold of [10s]; wrote global metadata [true] and metadata for [0] indices and skipped [3] unchanged indices
[2026-01-02T14:37:58,635][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [43.6s] publication of cluster state version [18] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
[2026-01-02T14:38:07,542][ERROR][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Failed to create index .plugins-ml-config
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index [.plugins-ml-config], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:38:11,011][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [12408ms] which is above the warn threshold of [10s]; wrote global metadata [true] and metadata for [0] indices and skipped [3] unchanged indices
[2026-01-02T14:38:11,012][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [12.4s] publication of cluster state version [19] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
[2026-01-02T14:38:11,023][INFO ][o.o.c.s.ClusterSettings  ] [wazuh.indexer] updating [plugins.index_state_management.template_migration.control] from [0] to [-1]
[2026-01-02T14:38:11,030][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[-EXGiQ34TPOjfnsNzeOW1A/K8bcwogOQyGmqVaH-mhVrg]
[2026-01-02T14:38:11,047][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[aL9eijaqQ2GJkfC2k7yrYw/yq1kwdTDSfynMAtgsc3JMQ]
[2026-01-02T14:38:11,052][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding template [wazuh-agent] for index patterns [wazuh-monitoring-*]
[2026-01-02T14:38:17,545][ERROR][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Failed to create index .plugins-ml-config
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index [.plugins-ml-config], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:38:20,602][WARN ][r.suppressed             ] [wazuh.indexer] path: /_template/wazuh, params: {name=wazuh}
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:38:23,707][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [12608ms] which is above the warn threshold of [10s]; wrote global metadata [true] and metadata for [0] indices and skipped [3] unchanged indices
[2026-01-02T14:38:23,708][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [12.6s] publication of cluster state version [20] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
[2026-01-02T14:38:23,716][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.plugins-ml-config/_q_HjYGKTEiE6LcoPGOGxg]
[2026-01-02T14:38:23,727][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.plugins-ml-config] creating index, cause [api], templates [], shards [1]/[1]
[2026-01-02T14:38:23,728][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] updating number_of_replicas to [0] for indices [.plugins-ml-config]
[2026-01-02T14:38:37,600][ERROR][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Failed to create index .plugins-ml-config
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index [.plugins-ml-config], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:38:41,028][ERROR][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Failed to update template migration setting
org.opensearch.OpenSearchException: reroute after update settings failed
	at org.opensearch.action.admin.cluster.settings.TransportClusterUpdateSettingsAction$1$1.onFailure(TransportClusterUpdateSettingsAction.java:240) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.cluster.service.MasterService$SafeClusterStateTaskListener.onFailure(MasterService.java:704) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
Caused by: org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (reroute_after_cluster_update_settings) within 30s
	... 7 more
[2026-01-02T14:38:42,058][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [18412ms] which is above the warn threshold of [10s]; wrote global metadata [false] and metadata for [1] indices and skipped [3] unchanged indices
[2026-01-02T14:38:42,230][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [18.6s] publication of cluster state version [21] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
[2026-01-02T14:38:42,234][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[.plugins-ml-config/_q_HjYGKTEiE6LcoPGOGxg]
[2026-01-02T14:38:44,895][WARN ][r.suppressed             ] [wazuh.indexer] path: /_template/wazuh-agent, params: {name=wazuh-agent}
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index-template [wazuh-agent], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:38:47,751][ERROR][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Failed to create index .plugins-ml-config
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index [.plugins-ml-config], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:38:52,648][WARN ][r.suppressed             ] [wazuh.indexer] path: /_template/wazuh, params: {name=wazuh}
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:38:53,618][ERROR][o.o.m.c.MLSyncUpCron     ] [wazuh.indexer] Failed to initialize or update ML Config index
[2026-01-02T14:38:57,492][INFO ][o.o.i.i.ManagedIndexCoordinator] [wazuh.indexer] Cancel background move metadata process.
[2026-01-02T14:38:57,493][INFO ][o.o.i.i.ManagedIndexCoordinator] [wazuh.indexer] Performing move cluster state metadata.
[2026-01-02T14:38:57,493][INFO ][o.o.i.i.MetadataService  ] [wazuh.indexer] Move metadata has finished.
[2026-01-02T14:38:57,753][ERROR][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Failed to create index .plugins-ml-config
org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index [.plugins-ml-config], cause [api]) within 30s
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
[2026-01-02T14:38:59,576][WARN ][o.o.s.a.BackendRegistry  ] [wazuh.indexer] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
[2026-01-02T14:39:04,498][INFO ][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Skip creating the Index:.plugins-ml-config that is already created by another parallel request
[2026-01-02T14:39:04,505][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[vlaaL8FtSia5a8qDi4vjaw/3wzIY1EHS4KoekVq3SpMug]
[2026-01-02T14:39:04,513][INFO ][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Skip creating the Index:.plugins-ml-config that is already created by another parallel request
[2026-01-02T14:39:04,515][INFO ][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Skip creating the Index:.plugins-ml-config that is already created by another parallel request
[2026-01-02T14:39:18,704][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [14209ms] which is above the warn threshold of [10s]; wrote global metadata [true] and metadata for [0] indices and skipped [4] unchanged indices
[2026-01-02T14:39:18,705][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [14.2s] publication of cluster state version [22] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
[2026-01-02T14:39:18,716][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-monitoring-2026.1w/DYh62qctQ3arcGYuH_i56g]
[2026-01-02T14:39:18,724][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-monitoring-2026.1w] creating index, cause [api], templates [wazuh-agent], shards [1]/[0]
[2026-01-02T14:39:33,245][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [14610ms] which is above the warn threshold of [10s]; wrote global metadata [false] and metadata for [1] indices and skipped [4] unchanged indices
[2026-01-02T14:39:33,246][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [14.6s] publication of cluster state version [23] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
[2026-01-02T14:39:33,249][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-monitoring-2026.1w/DYh62qctQ3arcGYuH_i56g]
[2026-01-02T14:39:35,505][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[TQemaB2DTUm7p-qowv4Yhg/BC4Y1JkxTeO7dfDmAktF2A]
[2026-01-02T14:39:35,568][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding template [wazuh] for index patterns [wazuh-alerts-4.x-*, wazuh-archives-4.x-*]
[2026-01-02T14:39:46,892][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [11415ms] which is above the warn threshold of [10s]; wrote global metadata [true] and metadata for [0] indices and skipped [5] unchanged indices
[2026-01-02T14:39:46,893][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [11.4s] publication of cluster state version [24] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
[2026-01-02T14:39:49,292][INFO ][o.o.c.m.MetadataUpdateSettingsService] [wazuh.indexer] updating number_of_replicas to [0] for indices [wazuh-monitoring-2026.1w]
[2026-01-02T14:39:49,307][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
[2026-01-02T14:39:49,393][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-alerts-4.x-2026.01.02] creating index, cause [auto(bulk api)], templates [wazuh], shards [3]/[0]
[2026-01-02T14:39:49,418][INFO ][o.o.m.c.MLSyncUpCron     ] [wazuh.indexer] ML configuration initialized successfully
[2026-01-02T14:39:50,623][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
[2026-01-02T14:39:55,429][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[wazuh-alerts-4.x-2026.01.02][1], [wazuh-alerts-4.x-2026.01.02][2]]]).
[2026-01-02T14:39:56,461][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
[2026-01-02T14:39:56,518][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q] update_mapping [_doc]
[2026-01-02T14:39:57,747][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
[2026-01-02T14:39:57,785][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q] update_mapping [_doc]
[2026-01-02T14:39:59,688][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
[2026-01-02T14:39:59,726][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
[2026-01-02T14:40:00,025][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
[2026-01-02T14:40:00,065][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q] update_mapping [_doc]
[2026-01-02T14:40:01,242][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A]
[2026-01-02T14:40:01,249][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-statistics-2026.1w] creating index, cause [api], templates [wazuh-statistics], shards [1]/[0]
[2026-01-02T14:40:02,396][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A]
[2026-01-02T14:40:03,121][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
[2026-01-02T14:40:04,894][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[wazuh-statistics-2026.1w][0]]]).
[2026-01-02T14:40:05,857][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A]
[2026-01-02T14:40:05,871][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A] update_mapping [_doc]
[2026-01-02T14:41:57,062][INFO ][o.o.j.s.JobSweeper       ] [wazuh.indexer] Running full sweep
[2026-01-02T14:41:57,485][INFO ][o.o.i.i.PluginVersionSweepCoordinator] [wazuh.indexer] Canceling sweep ism plugin version job
[2026-01-02T14:42:59,058][WARN ][o.o.s.a.BackendRegistry  ] [wazuh.indexer] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
#################################################################
docker logs wazuh-runtipi_synode-it-wazuh-manager-1
#################################################################
MANAGER_INIT: Starting manager initialization...
MANAGER_INIT: Configuration complete, starting Wazuh...
WATCHDOG: Waiting for Wazuh services to be fully started...
[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 0-wazuh-init: executing... 
/var/ossec/data_tmp/permanent/var/ossec/api/configuration/
Installing /var/ossec/api/configuration
/var/ossec/data_tmp/permanent/var/ossec/etc/
The path /var/ossec/etc is already mounted
/var/ossec/data_tmp/permanent/var/ossec/logs/
Installing /var/ossec/logs
/var/ossec/data_tmp/permanent/var/ossec/queue/
Installing /var/ossec/queue
/var/ossec/data_tmp/permanent/var/ossec/agentless/
Installing /var/ossec/agentless
/var/ossec/data_tmp/permanent/var/ossec/var/multigroups/
Installing /var/ossec/var/multigroups
/var/ossec/data_tmp/permanent/var/ossec/integrations/
Installing /var/ossec/integrations
/var/ossec/data_tmp/permanent/var/ossec/active-response/bin/
Installing /var/ossec/active-response/bin
/var/ossec/data_tmp/permanent/var/ossec/wodles/
The path /var/ossec/wodles is already mounted
/var/ossec/data_tmp/permanent/etc/filebeat/
The path /etc/filebeat is already mounted
Updating /var/ossec/etc/internal_options.conf
Updating /var/ossec/integrations/slack
Updating /var/ossec/integrations/slack.py
Updating /var/ossec/integrations/virustotal
Updating /var/ossec/integrations/virustotal.py
Updating /var/ossec/integrations/shuffle
Updating /var/ossec/integrations/shuffle.py
Updating /var/ossec/integrations/pagerduty
Updating /var/ossec/integrations/pagerduty.py
Updating /var/ossec/integrations/maltiverse
Updating /var/ossec/integrations/maltiverse.py
Updating /var/ossec/active-response/bin/default-firewall-drop
Updating /var/ossec/active-response/bin/disable-account
Updating /var/ossec/active-response/bin/firewalld-drop
Updating /var/ossec/active-response/bin/firewall-drop
Updating /var/ossec/active-response/bin/host-deny
Updating /var/ossec/active-response/bin/ip-customblock
Updating /var/ossec/active-response/bin/ipfw
Updating /var/ossec/active-response/bin/kaspersky.py
Updating /var/ossec/active-response/bin/kaspersky
Updating /var/ossec/active-response/bin/npf
Updating /var/ossec/active-response/bin/wazuh-slack
Updating /var/ossec/active-response/bin/pf
Updating /var/ossec/active-response/bin/restart-wazuh
Updating /var/ossec/active-response/bin/restart.sh
Updating /var/ossec/active-response/bin/route-null
Updating /var/ossec/agentless/sshlogin.exp
Updating /var/ossec/agentless/ssh_pixconfig_diff
Updating /var/ossec/agentless/ssh_asa-fwsmconfig_diff
Updating /var/ossec/agentless/ssh_integrity_check_bsd
Updating /var/ossec/agentless/main.exp
Updating /var/ossec/agentless/su.exp
Updating /var/ossec/agentless/ssh_integrity_check_linux
Updating /var/ossec/agentless/register_host.sh
Updating /var/ossec/agentless/ssh_generic_diff
Updating /var/ossec/agentless/ssh_foundry_diff
Updating /var/ossec/agentless/ssh_nopass.exp
Updating /var/ossec/agentless/ssh.exp
Updating /var/ossec/wodles/utils.py
Updating /var/ossec/wodles/aws/aws-s3
Updating /var/ossec/wodles/aws/aws-s3.py
Updating /var/ossec/wodles/aws/__init__.py
Updating /var/ossec/wodles/aws/aws_tools.py
Updating /var/ossec/wodles/aws/wazuh_integration.py
Updating /var/ossec/wodles/aws/buckets_s3/__init__.py
Updating /var/ossec/wodles/aws/buckets_s3/aws_bucket.py
Updating /var/ossec/wodles/aws/buckets_s3/cloudtrail.py
Updating /var/ossec/wodles/aws/buckets_s3/config.py
Updating /var/ossec/wodles/aws/buckets_s3/guardduty.py
Updating /var/ossec/wodles/aws/buckets_s3/load_balancers.py
Updating /var/ossec/wodles/aws/buckets_s3/server_access.py
Updating /var/ossec/wodles/aws/buckets_s3/umbrella.py
Updating /var/ossec/wodles/aws/buckets_s3/vpcflow.py
Updating /var/ossec/wodles/aws/buckets_s3/waf.py
Updating /var/ossec/wodles/aws/services/__init__.py
Updating /var/ossec/wodles/aws/services/aws_service.py
Updating /var/ossec/wodles/aws/services/cloudwatchlogs.py
Updating /var/ossec/wodles/aws/services/inspector.py
Updating /var/ossec/wodles/aws/subscribers/__init__.py
Updating /var/ossec/wodles/aws/subscribers/s3_log_handler.py
Updating /var/ossec/wodles/aws/subscribers/sqs_message_processor.py
Updating /var/ossec/wodles/aws/subscribers/sqs_queue.py
Updating /var/ossec/wodles/azure/azure-logs
Updating /var/ossec/wodles/azure/azure-logs.py
Updating /var/ossec/wodles/azure/db/orm.py
Updating /var/ossec/wodles/azure/db/utils.py
Updating /var/ossec/wodles/azure/db/__init__.py
Updating /var/ossec/wodles/azure/azure_utils.py
Updating /var/ossec/wodles/azure/azure_services/__init__.py
Updating /var/ossec/wodles/azure/azure_services/analytics.py
Updating /var/ossec/wodles/azure/azure_services/graph.py
Updating /var/ossec/wodles/azure/azure_services/storage.py
Updating /var/ossec/wodles/docker/DockerListener
Updating /var/ossec/wodles/docker/DockerListener.py
Updating /var/ossec/wodles/gcloud/gcloud
Updating /var/ossec/wodles/gcloud/gcloud.py
Updating /var/ossec/wodles/gcloud/integration.py
Updating /var/ossec/wodles/gcloud/tools.py
Updating /var/ossec/wodles/gcloud/exceptions.py
Updating /var/ossec/wodles/gcloud/buckets/bucket.py
Updating /var/ossec/wodles/gcloud/buckets/access_logs.py
Updating /var/ossec/wodles/gcloud/pubsub/subscriber.py
Updating /var/ossec/etc/lists/malicious-ioc/malicious-ip
Updating /var/ossec/etc/lists/malicious-ioc/malicious-domains
Updating /var/ossec/etc/lists/malicious-ioc/malware-hashes
Updating /etc/filebeat/wazuh-template.json
Updating /etc/filebeat/filebeat.yml
find: '/proc/224': No such file or directory
find: '/proc/409/task/409/fd/6': No such file or directory
find: '/proc/409/task/409/fdinfo/6': No such file or directory
find: '/proc/409/fd/5': No such file or directory
find: '/proc/409/fdinfo/5': No such file or directory
find: '/proc/412/task/412/fd/6': No such file or directory
find: '/proc/412/task/412/fdinfo/6': No such file or directory
find: '/proc/412/fd/5': No such file or directory
find: '/proc/412/fdinfo/5': No such file or directory
find: '/proc/451/task/451/fd/6': No such file or directory
find: '/proc/451/task/451/fdinfo/6': No such file or directory
find: '/proc/451/fd/5': No such file or directory
find: '/proc/451/fdinfo/5': No such file or directory
No Wazuh configuration files to mount...
[cont-init.d] 0-wazuh-init: exited 0.
[cont-init.d] 1-config-filebeat: executing... 
Customize Elasticsearch output IP
Configuring username.
Configuring password.
Configuring SSL verification mode.
Configuring Certificate Authorities.
Configuring SSL Certificate.
Configuring SSL Key.
[cont-init.d] 1-config-filebeat: exited 0.
[cont-init.d] 2-manager: executing... 
WATCHDOG: Still waiting for wazuh-db to start (20s elapsed)...
Configuring password.
2026/01/02 14:37:01 wazuh-modulesd:router: INFO: Loaded router module.
2026/01/02 14:37:01 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
2026/01/02 14:37:01 wazuh-modulesd:inventory-harvester: INFO: Loaded Inventory harvester module.
Starting Wazuh v4.14.1...
Started wazuh-apid...
Started wazuh-csyslogd...
Started wazuh-dbd...
2026/01/02 14:37:05 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
Started wazuh-integratord...
Started wazuh-agentlessd...
Started wazuh-authd...
WATCHDOG: wazuh-db is running, waiting additional 5s for stability...
Started wazuh-db...
Started wazuh-execd...
Started wazuh-analysisd...
Started wazuh-syscheckd...
Started wazuh-remoted...
Started wazuh-logcollector...
Started wazuh-monitord...
2026/01/02 14:37:07 wazuh-modulesd:router: INFO: Loaded router module.
2026/01/02 14:37:07 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
2026/01/02 14:37:07 wazuh-modulesd:inventory-harvester: INFO: Loaded Inventory harvester module.
Started wazuh-modulesd...
WATCHDOG: Making ossec.conf persistent...
WATCHDOG: Backing up current ossec.conf to custom storage...
WATCHDOG: Creating symlink /var/ossec/etc/ossec.conf -> custom/ossec.conf
WATCHDOG: ✓ ossec.conf is now persistent (symlink verified)
WATCHDOG: Initialization complete, entering monitoring mode
Completed.
[cont-init.d] 2-manager: exited 0.
[cont-init.d] done.
[services.d] starting services
starting Filebeat
[services.d] done.
2026/01/02 14:37:08 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-processes-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:08 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-ports-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:08 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-hotfixes-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:09 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-hardware-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:09 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-protocols-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:09 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-interfaces-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:10 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-networks-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:10 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-users-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:10 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-groups-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:10 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-browser-extensions-wazuh.manager', retrying until the connection is successful.
2026-01-02T14:37:10.546Z	INFO	instance/beat.go:645	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2026-01-02T14:37:10.579Z	INFO	instance/beat.go:653	Beat ID: 05736137-3166-4c08-b5af-386763d70982
2026-01-02T14:37:10.580Z	INFO	[seccomp]	seccomp/seccomp.go:124	Syscall filter successfully installed
2026-01-02T14:37:10.580Z	INFO	[beat]	instance/beat.go:981	Beat info	{"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "05736137-3166-4c08-b5af-386763d70982"}}}
2026-01-02T14:37:10.580Z	INFO	[beat]	instance/beat.go:990	Build info	{"system_info": {"build": {"commit": "aacf9ecd9c494aa0908f61fbca82c906b16562a8", "libbeat": "7.10.2", "time": "2025-10-17T12:05:34.000Z", "version": "7.10.2"}}}
2026-01-02T14:37:10.580Z	INFO	[beat]	instance/beat.go:993	Go runtime info	{"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":16,"version":"go1.14.12"}}}
2026-01-02T14:37:10.581Z	INFO	[beat]	instance/beat.go:997	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2025-12-31T11:52:27Z","containerized":false,"name":"wazuh.manager","ip":["127.0.0.1/8","::1/128","10.128.10.5/24"],"kernel_version":"6.8.0-90-generic","mac":["ca:44:df:0b:12:82"],"os":{"family":"redhat","platform":"amzn","name":"Amazon Linux","version":"2023","major":2023,"minor":9,"patch":20251208},"timezone":"UTC","timezone_offset_sec":0}}}
2026-01-02T14:37:10.582Z	INFO	[beat]	instance/beat.go:1026	Process info	{"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"effective":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"bounding":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"ambient":null}, "cwd": "/run/s6/services/filebeat", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 2191, "ppid": 2189, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2026-01-02T14:37:09.730Z"}}}
2026-01-02T14:37:10.582Z	INFO	instance/beat.go:299	Setup Beat: filebeat; Version: 7.10.2
2026-01-02T14:37:10.582Z	INFO	eslegclient/connection.go:99	elasticsearch url: https://wazuh.indexer:9200
2026-01-02T14:37:10.583Z	INFO	[publisher]	pipeline/module.go:113	Beat name: wazuh.manager
2026-01-02T14:37:10.584Z	INFO	beater/filebeat.go:117	Enabled modules/filesets: wazuh (alerts),  ()
2026-01-02T14:37:10.585Z	INFO	instance/beat.go:455	filebeat start running.
2026-01-02T14:37:10.600Z	INFO	memlog/store.go:119	Loading data file of '/var/lib/filebeat/registry/filebeat' succeeded. Active transaction id=0
2026-01-02T14:37:10.600Z	INFO	memlog/store.go:124	Finished loading transaction log file for '/var/lib/filebeat/registry/filebeat'. Active transaction id=0
2026-01-02T14:37:10.601Z	INFO	[registrar]	registrar/registrar.go:109	States Loaded from registrar: 0
2026-01-02T14:37:10.601Z	INFO	[crawler]	beater/crawler.go:71	Loading Inputs: 1
2026-01-02T14:37:10.601Z	INFO	log/input.go:157	Configured paths: [/var/ossec/logs/alerts/alerts.json]
2026-01-02T14:37:10.601Z	INFO	[crawler]	beater/crawler.go:141	Starting input (ID: 9132358592892857476)
2026-01-02T14:37:10.601Z	INFO	[crawler]	beater/crawler.go:108	Loading and starting Inputs completed. Enabled inputs: 1
2026-01-02T14:37:10.602Z	INFO	log/harvester.go:302	Harvester started for file: /var/ossec/logs/alerts/alerts.json
2026/01/02 14:37:10 logger-helper: INFO: InventoryHarvesterFacade module started.
2026/01/02 14:37:10 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-services-wazuh.manager', retrying until the connection is successful.
2026/01/02 14:37:14 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_amazon_linux_2023.yml'
2026/01/02 14:37:14 sca: INFO: Security Configuration Assessment scan finished. Duration: 7 seconds.
2026-01-02T14:37:18.604Z	INFO	[publisher_pipeline_output]	pipeline/output.go:143	Connecting to backoff(elasticsearch(https://wazuh.indexer:9200))
2026-01-02T14:37:18.604Z	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2026-01-02T14:37:18.604Z	INFO	[publisher]	pipeline/retry.go:223	  done
2026-01-02T14:37:18.624Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.10.2
2026-01-02T14:37:18.627Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.10.2
2026/01/02 14:37:34 wazuh-syscheckd: INFO: netstat not available. Skipping port check.
2026/01/02 14:37:40 rootcheck: INFO: Ending rootcheck scan.
2026-01-02T14:37:50.561Z	ERROR	[publisher_pipeline_output]	pipeline/output.go:154	Failed to connect to backoff(elasticsearch(https://wazuh.indexer:9200)): Connection marked as failed because the onConnect callback failed: 1 error: Error loading pipeline for fileset wazuh/alerts: couldn't load pipeline: couldn't load json. Error: 503 Service Unavailable: {"error":{"root_cause":[{"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (put-pipeline-filebeat-7.10.2-wazuh-alerts-pipeline) within 30s"}],"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (put-pipeline-filebeat-7.10.2-wazuh-alerts-pipeline) within 30s"},"status":503}. Response body: {"error":{"root_cause":[{"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (put-pipeline-filebeat-7.10.2-wazuh-alerts-pipeline) within 30s"}],"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (put-pipeline-filebeat-7.10.2-wazuh-alerts-pipeline) within 30s"},"status":503}
2026-01-02T14:37:50.561Z	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2026-01-02T14:37:50.561Z	INFO	[publisher]	pipeline/retry.go:223	  done
2026-01-02T14:37:50.561Z	INFO	[publisher_pipeline_output]	pipeline/output.go:145	Attempting to reconnect to backoff(elasticsearch(https://wazuh.indexer:9200)) with 1 reconnect attempt(s)
2026-01-02T14:37:50.577Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.10.2
2026-01-02T14:37:50.581Z	INFO	template/load.go:183	Existing template will be overwritten, as overwrite is enabled.
2026-01-02T14:37:50.585Z	INFO	template/load.go:117	Try loading template wazuh to Elasticsearch
2026-01-02T14:38:22.623Z	ERROR	[publisher_pipeline_output]	pipeline/output.go:154	Failed to connect to backoff(elasticsearch(https://wazuh.indexer:9200)): Connection marked as failed because the onConnect callback failed: error loading template: could not load template. Elasticsearch returned: couldn't load template: 503 Service Unavailable: {"error":{"root_cause":[{"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s"}],"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s"},"status":503}. Response body: {"error":{"root_cause":[{"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s"}],"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s"},"status":503}. Template is: {
  "index_patterns": [
    "wazuh-alerts-4.x-*",
    "wazuh-archives-4.x-*"
  ],
  "mappings": {
    "date_detection": false,
    "dynamic_templates": [
      {
        "string_as_keyword": {
          "mapping": {
            "type": "keyword"
          },
          "match_mapping_type": "string"
        }
      }
    ],
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "@version": {
        "type": "text"
      },
      "GeoLocation": {
        "properties": {
          "area_code": {
            "type": "long"
          },
          "city_name": {
            "type": "keyword"
          },
          "continent_code": {
            "type": "text"
          },
          "coordinates": {
            "type": "double"
          },
          "country_code2": {
            "type": "text"
          },
          "country_code3": {
            "type": "text"
          },
          "country_name": {
            "type": "keyword"
          },
          "dma_code": {
            "type": "long"
          },
          "ip": {
            "type": "keyword"
          },
          "latitude": {
            "type": "double"
          },
          "location": {
            "type": "geo_point"
          },
          "longitude": {
            "type": "double"
          },
          "postal_code": {
            "type": "keyword"
          },
          "real_region_name": {
            "type": "keyword"
          },
          "region_name": {
            "type": "keyword"
          },
          "timezone": {
            "type": "text"
          }
        }
      },
      "agent": {
        "properties": {
          "id": {
            "type": "keyword"
          },
          "ip": {
            "type": "keyword"
          },
          "name": {
            "type": "keyword"
          }
        }
      },
      "cluster": {
        "properties": {
          "name": {
            "type": "keyword"
          },
          "node": {
            "type": "keyword"
          }
        }
      },
      "command": {
        "type": "keyword"
      },
      "data": {
        "properties": {
          "YARA": {
            "properties": {
              "api_customer": {
                "type": "keyword"
              },
              "log_type": {
                "type": "keyword"
              },
              "reference": {
                "type": "keyword"
              },
              "rule_author": {
                "type": "keyword"
              },
              "rule_description": {
                "type": "keyword"
              },
              "rule_name": {
                "type": "keyword"
              },
              "scanned_file": {
                "type": "keyword"
              },
              "tags": {
                "type": "keyword"
              }
            }
          },
          "action": {
            "type": "keyword"
          },
          "audit": {
            "properties": {
              "acct": {
                "type": "keyword"
              },
              "arch": {
                "type": "keyword"
              },
              "auid": {
                "type": "keyword"
              },
              "command": {
                "type": "keyword"
              },
              "cwd": {
                "type": "keyword"
              },
              "dev": {
                "type": "keyword"
              },
              "directory": {
                "properties": {
                  "inode": {
                    "type": "keyword"
                  },
                  "mode": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "egid": {
                "type": "keyword"
              },
              "enforcing": {
                "type": "keyword"
              },
              "euid": {
                "type": "keyword"
              },
              "exe": {
                "type": "keyword"
              },
              "execve": {
                "properties": {
                  "a0": {
                    "type": "keyword"
                  },
                  "a1": {
                    "type": "keyword"
                  },
                  "a2": {
                    "type": "keyword"
                  },
                  "a3": {
                    "type": "keyword"
                  }
                }
              },
              "exit": {
                "type": "keyword"
              },
              "file": {
                "properties": {
                  "inode": {
                    "type": "keyword"
                  },
                  "mode": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "fsgid": {
                "type": "keyword"
              },
              "fsuid": {
                "type": "keyword"
              },
              "gid": {
                "type": "keyword"
              },
              "id": {
                "type": "keyword"
              },
              "key": {
                "type": "keyword"
              },
              "list": {
                "type": "keyword"
              },
              "old-auid": {
                "type": "keyword"
              },
              "old-ses": {
                "type": "keyword"
              },
              "old_enforcing": {
                "type": "keyword"
              },
              "old_prom": {
                "type": "keyword"
              },
              "op": {
                "type": "keyword"
              },
              "pid": {
                "type": "keyword"
              },
              "ppid": {
                "type": "keyword"
              },
              "prom": {
                "type": "keyword"
              },
              "res": {
                "type": "keyword"
              },
              "session": {
                "type": "keyword"
              },
              "sgid": {
                "type": "keyword"
              },
              "srcip": {
                "type": "keyword"
              },
              "subj": {
                "type": "keyword"
              },
              "success": {
                "type": "keyword"
              },
              "suid": {
                "type": "keyword"
              },
              "syscall": {
                "type": "keyword"
              },
              "tty": {
                "type": "keyword"
              },
              "type": {
                "type": "keyword"
              },
              "uid": {
                "type": "keyword"
              }
            }
          },
          "aws": {
            "properties": {
              "accountId": {
                "type": "keyword"
              },
              "bytes": {
                "type": "long"
              },
              "createdAt": {
                "type": "date"
              },
              "dstaddr": {
                "type": "ip"
              },
              "end": {
                "type": "date"
              },
              "log_info": {
                "properties": {
                  "s3bucket": {
                    "type": "keyword"
                  }
                }
              },
              "region": {
                "type": "keyword"
              },
              "resource.instanceDetails": {
                "properties": {
                  "launchTime": {
                    "type": "date"
                  },
                  "networkInterfaces": {
                    "properties": {
                      "privateIpAddress": {
                        "type": "ip"
                      },
                      "publicIp": {
                        "type": "ip"
                      }
                    }
                  }
                }
              },
              "service": {
                "properties": {
                  "action.networkConnectionAction.remoteIpDetails": {
                    "properties": {
                      "geoLocation": {
                        "type": "geo_point"
                      },
                      "ipAddressV4": {
                        "type": "ip"
                      }
                    }
                  },
                  "count": {
                    "type": "long"
                  },
                  "eventFirstSeen": {
                    "type": "date"
                  },
                  "eventLastSeen": {
                    "type": "date"
                  }
                }
              },
              "source": {
                "type": "keyword"
              },
              "source_ip_address": {
                "type": "ip"
              },
              "srcaddr": {
                "type": "ip"
              },
              "start": {
                "type": "date"
              },
              "updatedAt": {
                "type": "date"
              }
            }
          },
          "azureSignInStatus": {
            "properties": {
              "additionalDetails": {
                "type": "keyword"
              },
              "errorCode": {
                "type": "integer"
              },
              "failureReason": {
                "type": "keyword"
              }
            }
          },
          "cis": {
            "properties": {
              "benchmark": {
                "type": "keyword"
              },
              "error": {
                "type": "long"
              },
              "fail": {
                "type": "long"
              },
              "group": {
                "type": "keyword"
              },
              "notchecked": {
                "type": "long"
              },
              "pass": {
                "type": "long"
              },
              "result": {
                "type": "keyword"
              },
              "rule_title": {
                "type": "keyword"
              },
              "score": {
                "type": "long"
              },
              "timestamp": {
                "type": "keyword"
              },
              "unknown": {
                "type": "long"
              }
            }
          },
          "command": {
            "type": "keyword"
          },
          "data": {
            "type": "keyword"
          },
          "docker": {
            "properties": {
              "Action": {
                "type": "keyword"
              },
              "Actor": {
                "properties": {
                  "Attributes": {
                    "properties": {
                      "image": {
                        "type": "keyword"
                      },
                      "name": {
                        "type": "keyword"
                      }
                    }
                  }
                }
              },
              "Type": {
                "type": "keyword"
              },
              "from": {
                "type": "keyword"
              }
            }
          },
          "dstip": {
            "type": "keyword"
          },
          "dstport": {
            "type": "keyword"
          },
          "dstuser": {
            "type": "keyword"
          },
          "extra_data": {
            "type": "keyword"
          },
          "file": {
            "type": "keyword"
          },
          "gcp": {
            "properties": {
              "jsonPayload": {
                "properties": {
                  "authAnswer": {
                    "type": "keyword"
                  },
                  "queryName": {
                    "type": "keyword"
                  },
                  "responseCode": {
                    "type": "keyword"
                  },
                  "vmInstanceId": {
                    "type": "keyword"
                  },
                  "vmInstanceName": {
                    "type": "keyword"
                  }
                }
              },
              "resource": {
                "properties": {
                  "labels": {
                    "properties": {
                      "location": {
                        "type": "keyword"
                      },
                      "project_id": {
                        "type": "keyword"
                      },
                      "source_type": {
                        "type": "keyword"
                      }
                    }
                  },
                  "type": {
                    "type": "keyword"
                  }
                }
              },
              "severity": {
                "type": "keyword"
              }
            }
          },
          "github": {
            "properties": {
              "action": {
                "type": "keyword"
              },
              "actor": {
                "type": "keyword"
              },
              "actor_location": {
                "properties": {
                  "country_code": {
                    "type": "keyword"
                  }
                }
              },
              "org": {
                "type": "keyword"
              },
              "repo": {
                "type": "keyword"
              }
            }
          },
          "hardware": {
            "properties": {
              "cpu_cores": {
                "type": "long"
              },
              "cpu_mhz": {
                "type": "double"
              },
              "cpu_name": {
                "type": "keyword"
              },
              "ram_free": {
                "type": "long"
              },
              "ram_total": {
                "type": "long"
              },
              "ram_usage": {
                "type": "long"
              },
              "serial": {
                "type": "keyword"
              }
            }
          },
          "id": {
            "type": "keyword"
          },
          "integration": {
            "type": "keyword"
          },
          "ms-graph": {
            "properties": {
              "@odata.type": {
                "type": "keyword"
              },
              "activationLockBypassCode": {
                "type": "keyword"
              },
              "activity": {
                "type": "keyword"
              },
              "activityDateTime": {
                "type": "date"
              },
              "activityOperationType": {
                "type": "keyword"
              },
              "activityResult": {
                "type": "keyword"
              },
              "activityType": {
                "type": "keyword"
              },
              "actor": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "applicationDisplayName": {
                    "type": "keyword"
                  },
                  "applicationId": {
                    "type": "keyword"
                  },
                  "auditActorType": {
                    "type": "keyword"
                  },
                  "ipAddress": {
                    "type": "keyword"
                  },
                  "servicePrincipalName": {
                    "type": "keyword"
                  },
                  "type": {
                    "type": "keyword"
                  },
                  "userId": {
                    "type": "keyword"
                  },
                  "userPermissions": {
                    "type": "text"
                  },
                  "userPrincipalName": {
                    "type": "keyword"
                  }
                }
              },
              "actorDisplayName": {
                "type": "keyword"
              },
              "alertWebUrl": {
                "type": "keyword"
              },
              "androidSecurityPatchLevel": {
                "type": "keyword"
              },
              "appliedConditionalAccessPolicies": {
                "type": "keyword"
              },
              "assignedTo": {
                "type": "keyword"
              },
              "azureADDeviceId": {
                "type": "keyword"
              },
              "azureADRegistered": {
                "type": "keyword"
              },
              "category": {
                "type": "keyword"
              },
              "classification": {
                "type": "keyword"
              },
              "comments": {
                "type": "keyword"
              },
              "complianceGracePeriodExpirationDateTime": {
                "type": "date"
              },
              "complianceState": {
                "type": "keyword"
              },
              "componentName": {
                "type": "keyword"
              },
              "configurationManagerClientEnabledFeatures": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "compliancePolicy": {
                    "type": "keyword"
                  },
                  "deviceConfiguration": {
                    "type": "keyword"
                  },
                  "inventory": {
                    "type": "keyword"
                  },
                  "modernApps": {
                    "type": "keyword"
                  },
                  "resourceAccess": {
                    "type": "keyword"
                  },
                  "windowsUpdateForBusiness": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "correlationId": {
                "type": "keyword"
              },
              "createdDateTime": {
                "type": "date"
              },
              "description": {
                "type": "text"
              },
              "detectionSource": {
                "type": "keyword"
              },
              "detectorId": {
                "type": "keyword"
              },
              "determination": {
                "type": "keyword"
              },
              "deviceActionResults": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "actionName": {
                    "type": "keyword"
                  },
                  "actionState": {
                    "type": "keyword"
                  },
                  "lastUpdatedDateTime": {
                    "type": "date"
                  },
                  "startDateTime": {
                    "type": "date"
                  }
                },
                "type": "nested"
              },
              "deviceCategoryDisplayName": {
                "type": "keyword"
              },
              "deviceCount": {
                "type": "integer"
              },
              "deviceEnrollmentType": {
                "type": "keyword"
              },
              "deviceHealthAttestationState": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "attestationIdentityKey": {
                    "type": "keyword"
                  },
                  "bitLockerStatus": {
                    "type": "keyword"
                  },
                  "bootAppSecurityVersion": {
                    "type": "keyword"
                  },
                  "bootDebugging": {
                    "type": "keyword"
                  },
                  "bootManagerSecurityVersion": {
                    "type": "keyword"
                  },
                  "bootManagerVersion": {
                    "type": "keyword"
                  },
                  "bootRevisionListInfo": {
                    "type": "keyword"
                  },
                  "codeIntegrity": {
                    "type": "keyword"
                  },
                  "codeIntegrityCheckVersion": {
                    "type": "keyword"
                  },
                  "codeIntegrityPolicy": {
                    "type": "keyword"
                  },
                  "contentNamespaceUrl": {
                    "type": "keyword"
                  },
                  "contentVersion": {
                    "type": "keyword"
                  },
                  "dataExcutionPolicy": {
                    "type": "keyword"
                  },
                  "deviceHealthAttestationStatus": {
                    "type": "keyword"
                  },
                  "earlyLaunchAntiMalwareDriverProtection": {
                    "type": "keyword"
                  },
                  "healthAttestationSupportedStatus": {
                    "type": "keyword"
                  },
                  "healthStatusMismatchInfo": {
                    "type": "keyword"
                  },
                  "issuedDateTime": {
                    "type": "date"
                  },
                  "lastUpdateDateTime": {
                    "type": "date"
                  },
                  "operatingSystemKernelDebugging": {
                    "type": "keyword"
                  },
                  "operatingSystemRevListInfo": {
                    "type": "keyword"
                  },
                  "pcr0": {
                    "type": "keyword"
                  },
                  "pcrHashAlgorithm": {
                    "type": "keyword"
                  },
                  "resetCount": {
                    "type": "keyword"
                  },
                  "restartCount": {
                    "type": "keyword"
                  },
                  "safeMode": {
                    "type": "keyword"
                  },
                  "secureBoot": {
                    "type": "keyword"
                  },
                  "secureBootConfigurationPolicyFingerPrint": {
                    "type": "keyword"
                  },
                  "testSigning": {
                    "type": "keyword"
                  },
                  "tpmVersion": {
                    "type": "keyword"
                  },
                  "virtualSecureMode": {
                    "type": "keyword"
                  },
                  "windowsPE": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "deviceName": {
                "type": "keyword"
              },
              "deviceRegistrationState": {
                "type": "keyword"
              },
              "displayName": {
                "type": "keyword"
              },
              "easActivated": {
                "type": "keyword"
              },
              "easActivationDateTime": {
                "type": "date"
              },
              "easDeviceId": {
                "type": "keyword"
              },
              "emailAddress": {
                "type": "keyword"
              },
              "enrolledDateTime": {
                "type": "date"
              },
              "enrollmentProfileName": {
                "type": "keyword"
              },
              "ethernetMacAddress": {
                "type": "keyword"
              },
              "evidence": {
                "properties": {
                  "_comment": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "exchangeAccessState": {
                "type": "keyword"
              },
              "exchangeAccessStateReason": {
                "type": "keyword"
              },
              "exchangeLastSuccessfulSyncDateTime": {
                "type": "date"
              },
              "firstActivityDateTime": {
                "type": "date"
              },
              "freeStorageSpaceInBytes": {
                "type": "keyword"
              },
              "iccid": {
                "type": "keyword"
              },
              "id": {
                "type": "keyword"
              },
              "imei": {
                "type": "keyword"
              },
              "incidentId": {
                "type": "keyword"
              },
              "incidentWebUrl": {
                "type": "keyword"
              },
              "isEncrypted": {
                "type": "keyword"
              },
              "isSupervised": {
                "type": "keyword"
              },
              "jailBroken": {
                "type": "keyword"
              },
              "lastActivityDateTime": {
                "type": "date"
              },
              "lastSyncDateTime": {
                "type": "date"
              },
              "lastUpdateDateTime": {
                "type": "date"
              },
              "managedDeviceName": {
                "type": "keyword"
              },
              "managedDeviceOwnerType": {
                "type": "keyword"
              },
              "managedDevices": {
                "properties": {
                  "deviceName": {
                    "type": "keyword"
                  },
                  "id": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "managementAgent": {
                "type": "keyword"
              },
              "managementCertificateExpirationDate": {
                "type": "date"
              },
              "manufacturer": {
                "type": "keyword"
              },
              "meid": {
                "type": "keyword"
              },
              "mitreTechniques": {
                "type": "keyword"
              },
              "model": {
                "type": "keyword"
              },
              "notes": {
                "type": "keyword"
              },
              "operatingSystem": {
                "type": "keyword"
              },
              "osVersion": {
                "type": "keyword"
              },
              "partnerReportedThreatState": {
                "type": "keyword"
              },
              "phoneNumber": {
                "type": "keyword"
              },
              "physicalMemoryInBytes": {
                "type": "keyword"
              },
              "platform": {
                "type": "keyword"
              },
              "providerAlertId": {
                "type": "keyword"
              },
              "publisher": {
                "type": "keyword"
              },
              "relationship": {
                "type": "keyword"
              },
              "remediationStatus": {
                "type": "keyword"
              },
              "remoteAssistanceSessionErrorDetails": {
                "type": "keyword"
              },
              "remoteAssistanceSessionUrl": {
                "type": "keyword"
              },
              "requireUserEnrollmentApproval": {
                "type": "keyword"
              },
              "resolvedDateTime": {
                "type": "date"
              },
              "resource": {
                "type": "keyword"
              },
              "resources": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "auditResourceType": {
                    "type": "keyword"
                  },
                  "displayName": {
                    "type": "keyword"
                  },
                  "modifiedProperties": {
                    "properties": {
                      "@odata.type": {
                        "type": "keyword"
                      },
                      "displayName": {
                        "type": "keyword"
                      },
                      "newValue": {
                        "type": "keyword"
                      },
                      "oldValue": {
                        "type": "keyword"
                      }
                    },
                    "type": "nested"
                  },
                  "resourceId": {
                    "type": "keyword"
                  },
                  "type": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "roles": {
                "type": "keyword"
              },
              "serialNumber": {
                "type": "keyword"
              },
              "serviceSource": {
                "type": "keyword"
              },
              "severity": {
                "type": "keyword"
              },
              "sizeInByte": {
                "type": "keyword"
              },
              "status": {
                "type": "keyword"
              },
              "subscriberCarrier": {
                "type": "keyword"
              },
              "tenantId": {
                "type": "keyword"
              },
              "threatDisplayName": {
                "type": "keyword"
              },
              "threatFamilyName": {
                "type": "keyword"
              },
              "title": {
                "type": "keyword"
              },
              "totalStorageSpaceInBytes": {
                "type": "keyword"
              },
              "udid": {
                "type": "keyword"
              },
              "userDisplayName": {
                "type": "keyword"
              },
              "userId": {
                "type": "keyword"
              },
              "userPrincipalName": {
                "type": "keyword"
              },
              "verdict": {
                "type": "keyword"
              },
              "version": {
                "type": "keyword"
              },
              "wiFiMacAddress": {
                "type": "keyword"
              }
            }
          },
          "netinfo": {
            "properties": {
              "iface": {
                "properties": {
                  "adapter": {
                    "type": "keyword"
                  },
                  "ipv4": {
                    "properties": {
                      "address": {
                        "type": "keyword"
                      },
                      "broadcast": {
                        "type": "keyword"
                      },
                      "dhcp": {
                        "type": "keyword"
                      },
                      "gateway": {
                        "type": "keyword"
                      },
                      "metric": {
                        "type": "long"
                      },
                      "netmask": {
                        "type": "keyword"
                      }
                    }
                  },
                  "ipv6": {
                    "properties": {
                      "address": {
                        "type": "keyword"
                      },
                      "broadcast": {
                        "type": "keyword"
                      },
                      "dhcp": {
                        "type": "keyword"
                      },
                      "gateway": {
                        "type": "keyword"
                      },
                      "metric": {
                        "type": "long"
                      },
                      "netmask": {
                        "type": "keyword"
                      }
                    }
                  },
                  "mac": {
                    "type": "keyword"
                  },
                  "mtu": {
                    "type": "long"
                  },
                  "name": {
                    "type": "keyword"
                  },
                  "rx_bytes": {
                    "type": "long"
                  },
                  "rx_dropped": {
                    "type": "long"
                  },
                  "rx_errors": {
                    "type": "long"
                  },
                  "rx_packets": {
                    "type": "long"
                  },
                  "state": {
                    "type": "keyword"
                  },
                  "tx_bytes": {
                    "type": "long"
                  },
                  "tx_dropped": {
                    "type": "long"
                  },
                  "tx_errors": {
                    "type": "long"
                  },
                  "tx_packets": {
                    "type": "long"
                  },
                  "type": {
                    "type": "keyword"
                  }
                }
              }
            }
          },
          "office365": {
            "properties": {
              "Actor": {
                "properties": {
                  "ID": {
                    "type": "keyword"
                  }
                }
              },
              "ClientIP": {
                "type": "keyword"
              },
              "Operation": {
                "type": "keyword"
              },
              "ResultStatus": {
                "type": "keyword"
              },
              "Subscription": {
                "type": "keyword"
              },
              "UserId": {
                "type": "keyword"
              }
            }
          },
          "os": {
            "properties": {
              "architecture": {
                "type": "keyword"
              },
              "build": {
                "type": "keyword"
              },
              "codename": {
                "type": "keyword"
              },
              "display_version": {
                "type": "keyword"
              },
              "hostname": {
                "type": "keyword"
              },
              "major": {
                "type": "keyword"
              },
              "minor": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "patch": {
                "type": "keyword"
              },
              "platform": {
                "type": "keyword"
              },
              "release": {
                "type": "keyword"
              },
              "release_version": {
                "type": "keyword"
              },
              "sysname": {
                "type": "keyword"
              },
              "version": {
                "type": "keyword"
              }
            }
          },
          "oscap": {
            "properties": {
              "check": {
                "properties": {
                  "description": {
                    "type": "text"
                  },
                  "id": {
                    "type": "keyword"
                  },
                  "identifiers": {
                    "type": "text"
                  },
                  "oval": {
                    "properties": {
                      "id": {
                        "type": "keyword"
                      }
                    }
                  },
                  "rationale": {
                    "type": "text"
                  },
                  "references": {
                    "type": "text"
                  },
                  "result": {
                    "type": "keyword"
                  },
                  "severity": {
                    "type": "keyword"
                  },
                  "title": {
                    "type": "keyword"
                  }
                }
              },
              "scan": {
                "properties": {
                  "benchmark": {
                    "properties": {
                      "id": {
                        "type": "keyword"
                      }
                    }
                  },
                  "content": {
                    "type": "keyword"
                  },
                  "id": {
                    "type": "keyword"
                  },
                  "profile": {
                    "properties": {
                      "id": {
                        "type": "keyword"
                      },
                      "title": {
                        "type": "keyword"
                      }
                    }
                  },
                  "return_code": {
                    "type": "long"
                  },
                  "score": {
                    "type": "double"
                  }
                }
              }
            }
          },
          "osquery": {
            "properties": {
              "action": {
                "type": "keyword"
              },
              "calendarTime": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "pack": {
                "type": "keyword"
              }
            }
          },
          "parameters": {
            "properties": {
              "extra_args": {
                "type": "keyword"
              }
            }
          },
          "port": {
            "properties": {
              "inode": {
                "type": "long"
              },
              "local_ip": {
                "type": "ip"
              },
              "local_port": {
                "type": "long"
              },
              "pid": {
                "type": "long"
              },
              "process": {
                "type": "keyword"
              },
              "protocol": {
                "type": "keyword"
              },
              "remote_ip": {
                "type": "ip"
              },
              "remote_port": {
                "type": "long"
              },
              "rx_queue": {
                "type": "long"
              },
              "state": {
                "type": "keyword"
              },
              "tx_queue": {
                "type": "long"
              }
            }
          },
          "process": {
            "properties": {
              "args": {
                "type": "keyword"
              },
              "cmd": {
                "type": "keyword"
              },
              "egroup": {
                "type": "keyword"
              },
              "euser": {
                "type": "keyword"
              },
              "fgroup": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "nice": {
                "type": "long"
              },
              "nlwp": {
                "type": "long"
              },
              "pgrp": {
                "type": "long"
              },
              "pid": {
                "type": "long"
              },
              "ppid": {
                "type": "long"
              },
              "priority": {
                "type": "long"
              },
              "processor": {
                "type": "long"
              },
              "resident": {
                "type": "long"
              },
              "rgroup": {
                "type": "keyword"
              },
              "ruser": {
                "type": "keyword"
              },
              "session": {
                "type": "long"
              },
              "sgroup": {
                "type": "keyword"
              },
              "share": {
                "type": "long"
              },
              "size": {
                "type": "long"
              },
              "start_time": {
                "type": "long"
              },
              "state": {
                "type": "keyword"
              },
              "stime": {
                "type": "long"
              },
              "suser": {
                "type": "keyword"
              },
              "tgid": {
                "type": "long"
              },
              "tty": {
                "type": "long"
              },
              "utime": {
                "type": "long"
              },
              "vm_size": {
                "type": "long"
              }
            }
          },
          "program": {
            "properties": {
              "architecture": {
                "type": "keyword"
              },
              "description": {
                "type": "keyword"
              },
              "format": {
                "type": "keyword"
              },
              "install_time": {
                "type": "keyword"
              },
              "location": {
                "type": "keyword"
              },
              "multiarch": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "priority": {
                "type": "keyword"
              },
              "section": {
                "type": "keyword"
              },
              "size": {
                "type": "long"
              },
              "source": {
                "type": "keyword"
              },
              "vendor": {
                "type": "keyword"
              },
              "version": {
                "type": "keyword"
              }
            }
          },
          "protocol": {
            "type": "keyword"
          },
          "sca": {
            "properties": {
              "check": {
                "properties": {
                  "compliance": {
                    "properties": {
                      "cis": {
                        "type": "keyword"
                      },
                      "cis_csc": {
                        "type": "keyword"
                      },
                      "hipaa": {
                        "type": "keyword"
                      },
                      "nist_800_53": {
                        "type": "keyword"
                      },
                      "pci_dss": {
                        "type": "keyword"
                      }
                    }
                  },
                  "description": {
                    "type": "keyword"
                  },
                  "directory": {
                    "type": "keyword"
                  },
                  "file": {
                    "type": "keyword"
                  },
                  "id": {
                    "type": "keyword"
                  },
                  "previous_result": {
                    "type": "keyword"
                  },
                  "process": {
                    "type": "keyword"
                  },
                  "rationale": {
                    "type": "keyword"
                  },
                  "reason": {
                    "type": "keyword"
                  },
                  "references": {
                    "type": "keyword"
                  },
                  "registry": {
                    "type": "keyword"
                  },
                  "remediation": {
                    "type": "keyword"
                  },
                  "result": {
                    "type": "keyword"
                  },
                  "title": {
                    "type": "keyword"
                  }
                }
              },
              "description": {
                "type": "keyword"
              },
              "failed": {
                "type": "integer"
              },
              "file": {
                "type": "keyword"
              },
              "invalid": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "passed": {
                "type": "integer"
              },
              "policy": {
                "type": "keyword"
              },
              "policy_id": {
                "type": "keyword"
              },
              "scan_id": {
                "type": "keyword"
              },
              "score": {
                "type": "long"
              },
              "total_checks": {
                "type": "keyword"
              },
              "type": {
                "type": "keyword"
              }
            }
          },
          "scan_id": {
            "type": "keyword"
          },
          "srcip": {
            "type": "keyword"
          },
          "srcport": {
            "type": "keyword"
          },
          "srcuser": {
            "type": "keyword"
          },
          "system_name": {
            "type": "keyword"
          },
          "timestamp": {
            "type": "date"
          },
          "title": {
            "type": "keyword"
          },
          "type": {
            "type": "keyword"
          },
          "uid": {
            "type": "keyword"
          },
          "url": {
            "type": "keyword"
          },
          "virustotal": {
            "properties": {
              "description": {
                "type": "keyword"
              },
              "error": {
                "type": "keyword"
              },
              "found": {
                "type": "keyword"
              },
              "malicious": {
                "type": "keyword"
              },
              "permalink": {
                "type": "keyword"
              },
              "positives": {
                "type": "keyword"
              },
              "scan_date": {
                "type": "keyword"
              },
              "sha1": {
                "type": "keyword"
              },
              "source": {
                "properties": {
                  "alert_id": {
                    "type": "keyword"
                  },
                  "file": {
                    "type": "keyword"
                  },
                  "md5": {
                    "type": "keyword"
                  },
                  "sha1": {
                    "type": "keyword"
                  }
                }
              },
              "total": {
                "type": "keyword"
              }
            }
          },
          "vulnerability": {
            "properties": {
              "assigner": {
                "type": "keyword"
              },
              "cve": {
                "type": "keyword"
              },
              "cve_version": {
                "type": "keyword"
              },
              "cvss": {
                "properties": {
                  "cvss2": {
                    "properties": {
                      "base_score": {
                        "type": "keyword"
                      },
                      "exploitability_score": {
                        "type": "keyword"
                      },
                      "impact_score": {
                        "type": "keyword"
                      },
                      "vector": {
                        "properties": {
                          "access_complexity": {
                            "type": "keyword"
                          },
                          "attack_vector": {
                            "type": "keyword"
                          },
                          "authentication": {
                            "type": "keyword"
                          },
                          "availability": {
                            "type": "keyword"
                          },
                          "confidentiality_impact": {
                            "type": "keyword"
                          },
                          "integrity_impact": {
                            "type": "keyword"
                          },
                          "privileges_required": {
                            "type": "keyword"
                          },
                          "scope": {
                            "type": "keyword"
                          },
                          "user_interaction": {
                            "type": "keyword"
                          }
                        }
                      }
                    }
                  },
                  "cvss3": {
                    "properties": {
                      "base_score": {
                        "type": "keyword"
                      },
                      "exploitability_score": {
                        "type": "keyword"
                      },
                      "impact_score": {
                        "type": "keyword"
                      },
                      "vector": {
                        "properties": {
                          "access_complexity": {
                            "type": "keyword"
                          },
                          "attack_vector": {
                            "type": "keyword"
                          },
                          "authentication": {
                            "type": "keyword"
                          },
                          "availability": {
                            "type": "keyword"
                          },
                          "confidentiality_impact": {
                            "type": "keyword"
                          },
                          "integrity_impact": {
                            "type": "keyword"
                          },
                          "privileges_required": {
                            "type": "keyword"
                          },
                          "scope": {
                            "type": "keyword"
                          },
                          "user_interaction": {
                            "type": "keyword"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "cwe_reference": {
                "type": "keyword"
              },
              "package": {
                "properties": {
                  "architecture": {
                    "type": "keyword"
                  },
                  "condition": {
                    "type": "keyword"
                  },
                  "generated_cpe": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  },
                  "source": {
                    "type": "keyword"
                  },
                  "version": {
                    "type": "keyword"
                  }
                }
              },
              "published": {
                "type": "date"
              },
              "rationale": {
                "type": "keyword"
              },
              "reference": {
                "type": "keyword"
              },
              "scanner.reference": {
                "type": "keyword"
              },
              "severity": {
                "type": "keyword"
              },
              "status": {
                "type": "keyword"
              },
              "title": {
                "type": "keyword"
              },
              "updated": {
                "type": "date"
              }
            }
          }
        }
      },
      "decoder": {
        "properties": {
          "accumulate": {
            "type": "long"
          },
          "fts": {
            "type": "long"
          },
          "ftscomment": {
            "type": "keyword"
          },
          "name": {
            "type": "keyword"
          },
          "parent": {
            "type": "keyword"
          }
        }
      },
      "full_log": {
        "type": "text"
      },
      "host": {
        "type": "keyword"
      },
      "id": {
        "type": "keyword"
      },
      "input": {
        "properties": {
          "type": {
            "type": "keyword"
          }
        }
      },
      "location": {
        "type": "keyword"
      },
      "manager": {
        "properties": {
          "name": {
            "type": "keyword"
          }
        }
      },
      "message": {
        "type": "text"
      },
      "offset": {
        "type": "keyword"
      },
      "predecoder": {
        "properties": {
          "hostname": {
            "type": "keyword"
          },
          "program_name": {
            "type": "keyword"
          },
          "timestamp": {
            "type": "keyword"
          }
        }
      },
      "previous_log": {
        "type": "text"
      },
      "previous_output": {
        "type": "keyword"
      },
      "program_name": {
        "type": "keyword"
      },
      "rule": {
        "properties": {
          "cis": {
            "type": "keyword"
          },
          "cve": {
            "type": "keyword"
          },
          "description": {
            "type": "keyword"
          },
          "firedtimes": {
            "type": "long"
          },
          "frequency": {
            "type": "long"
          },
          "gdpr": {
            "type": "keyword"
          },
          "gpg13": {
            "type": "keyword"
          },
          "groups": {
            "type": "keyword"
          },
          "hipaa": {
            "type": "keyword"
          },
          "id": {
            "type": "keyword"
          },
          "info": {
            "type": "keyword"
          },
          "level": {
            "type": "long"
          },
          "mail": {
            "type": "boolean"
          },
          "mitre": {
            "properties": {
              "id": {
                "type": "keyword"
              },
              "tactic": {
                "type": "keyword"
              },
              "technique": {
                "type": "keyword"
              }
            }
          },
          "nist_800_53": {
            "type": "keyword"
          },
          "pci_dss": {
            "type": "keyword"
          },
          "tsc": {
            "type": "keyword"
          }
        }
      },
      "syscheck": {
        "properties": {
          "audit": {
            "properties": {
              "effective_user": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "group": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "login_user": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "process": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  },
                  "ppid": {
                    "type": "keyword"
                  }
                }
              },
              "user": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              }
            }
          },
          "diff": {
            "type": "keyword"
          },
          "event": {
            "type": "keyword"
          },
          "gid_after": {
            "type": "keyword"
          },
          "gid_before": {
            "type": "keyword"
          },
          "gname_after": {
            "type": "keyword"
          },
          "gname_before": {
            "type": "keyword"
          },
          "hard_links": {
            "type": "keyword"
          },
          "inode_after": {
            "type": "keyword"
          },
          "inode_before": {
            "type": "keyword"
          },
          "md5_after": {
            "type": "keyword"
          },
          "md5_before": {
            "type": "keyword"
          },
          "mode": {
            "type": "keyword"
          },
          "mtime_after": {
            "format": "date_optional_time",
            "type": "date"
          },
          "mtime_before": {
            "format": "date_optional_time",
            "type": "date"
          },
          "path": {
            "type": "keyword"
          },
          "perm_after": {
            "type": "keyword"
          },
          "perm_before": {
            "type": "keyword"
          },
          "sha1_after": {
            "type": "keyword"
          },
          "sha1_before": {
            "type": "keyword"
          },
          "sha256_after": {
            "type": "keyword"
          },
          "sha256_before": {
            "type": "keyword"
          },
          "size_after": {
            "type": "long"
          },
          "size_before": {
            "type": "long"
          },
          "tags": {
            "type": "keyword"
          },
          "uid_after": {
            "type": "keyword"
          },
          "uid_before": {
            "type": "keyword"
          },
          "uname_after": {
            "type": "keyword"
          },
          "uname_before": {
            "type": "keyword"
          }
        }
      },
      "timestamp": {
        "format": "date_optional_time||epoch_millis",
        "type": "date"
      },
      "title": {
        "type": "keyword"
      },
      "type": {
        "type": "text"
      }
    }
  },
  "order": 0,
  "settings": {
    "index.auto_expand_replicas": "0-1",
    "index.mapping.total_fields.limit": 10000,
    "index.number_of_replicas": "0",
    "index.number_of_shards": "3",
    "index.query.default_field": [
      "GeoLocation.city_name",
      "GeoLocation.continent_code",
      "GeoLocation.country_code2",
      "GeoLocation.country_code3",
      "GeoLocation.country_name",
      "GeoLocation.ip",
      "GeoLocation.postal_code",
      "GeoLocation.real_region_name",
      "GeoLocation.region_name",
      "GeoLocation.timezone",
      "agent.id",
      "agent.ip",
      "agent.name",
      "cluster.name",
      "cluster.node",
      "command",
      "data",
      "data.action",
      "data.audit",
      "data.audit.acct",
      "data.audit.arch",
      "data.audit.auid",
      "data.audit.command",
      "data.audit.cwd",
      "data.audit.dev",
      "data.audit.directory.inode",
      "data.audit.directory.mode",
      "data.audit.directory.name",
      "data.audit.egid",
      "data.audit.enforcing",
      "data.audit.euid",
      "data.audit.exe",
      "data.audit.execve.a0",
      "data.audit.execve.a1",
      "data.audit.execve.a2",
      "data.audit.execve.a3",
      "data.audit.exit",
      "data.audit.file.inode",
      "data.audit.file.mode",
      "data.audit.file.name",
      "data.audit.fsgid",
      "data.audit.fsuid",
      "data.audit.gid",
      "data.audit.id",
      "data.audit.key",
      "data.audit.list",
      "data.audit.old-auid",
      "data.audit.old-ses",
      "data.audit.old_enforcing",
      "data.audit.old_prom",
      "data.audit.op",
      "data.audit.pid",
      "data.audit.ppid",
      "data.audit.prom",
      "data.audit.res",
      "data.audit.session",
      "data.audit.sgid",
      "data.audit.srcip",
      "data.audit.subj",
      "data.audit.success",
      "data.audit.suid",
      "data.audit.syscall",
      "data.audit.tty",
      "data.audit.uid",
      "data.aws.accountId",
      "data.aws.account_id",
      "data.aws.action",
      "data.aws.actor",
      "data.aws.aws_account_id",
      "data.aws.description",
      "data.aws.dstport",
      "data.aws.errorCode",
      "data.aws.errorMessage",
      "data.aws.eventID",
      "data.aws.eventName",
      "data.aws.eventSource",
      "data.aws.eventType",
      "data.aws.id",
      "data.aws.name",
      "data.aws.requestParameters.accessKeyId",
      "data.aws.requestParameters.bucketName",
      "data.aws.requestParameters.gatewayId",
      "data.aws.requestParameters.groupDescription",
      "data.aws.requestParameters.groupId",
      "data.aws.requestParameters.groupName",
      "data.aws.requestParameters.host",
      "data.aws.requestParameters.hostedZoneId",
      "data.aws.requestParameters.instanceId",
      "data.aws.requestParameters.instanceProfileName",
      "data.aws.requestParameters.loadBalancerName",
      "data.aws.requestParameters.loadBalancerPorts",
      "data.aws.requestParameters.masterUserPassword",
      "data.aws.requestParameters.masterUsername",
      "data.aws.requestParameters.name",
      "data.aws.requestParameters.natGatewayId",
      "data.aws.requestParameters.networkAclId",
      "data.aws.requestParameters.path",
      "data.aws.requestParameters.policyName",
      "data.aws.requestParameters.port",
      "data.aws.requestParameters.stackId",
      "data.aws.requestParameters.stackName",
      "data.aws.requestParameters.subnetId",
      "data.aws.requestParameters.subnetIds",
      "data.aws.requestParameters.volumeId",
      "data.aws.requestParameters.vpcId",
      "data.aws.resource.accessKeyDetails.accessKeyId",
      "data.aws.resource.accessKeyDetails.principalId",
      "data.aws.resource.accessKeyDetails.userName",
      "data.aws.resource.instanceDetails.instanceId",
      "data.aws.resource.instanceDetails.instanceState",
      "data.aws.resource.instanceDetails.networkInterfaces.privateDnsName",
      "data.aws.resource.instanceDetails.networkInterfaces.publicDnsName",
      "data.aws.resource.instanceDetails.networkInterfaces.subnetId",
      "data.aws.resource.instanceDetails.networkInterfaces.vpcId",
      "data.aws.resource.instanceDetails.tags.value",
      "data.aws.responseElements.AssociateVpcCidrBlockResponse.vpcId",
      "data.aws.responseElements.description",
      "data.aws.responseElements.instanceId",
      "data.aws.responseElements.instances.instanceId",
      "data.aws.responseElements.instancesSet.items.instanceId",
      "data.aws.responseElements.listeners.port",
      "data.aws.responseElements.loadBalancerName",
      "data.aws.responseElements.loadBalancers.vpcId",
      "data.aws.responseElements.loginProfile.userName",
      "data.aws.responseElements.networkAcl.vpcId",
      "data.aws.responseElements.ownerId",
      "data.aws.responseElements.publicIp",
      "data.aws.responseElements.user.userId",
      "data.aws.responseElements.user.userName",
      "data.aws.responseElements.volumeId",
      "data.aws.service.serviceName",
      "data.aws.severity",
      "data.aws.source",
      "data.aws.sourceIPAddress",
      "data.aws.srcport",
      "data.aws.userIdentity.accessKeyId",
      "data.aws.userIdentity.accountId",
      "data.aws.userIdentity.userName",
      "data.aws.vpcEndpointId",
      "data.command",
      "data.cis.group",
      "data.cis.rule_title",
      "data.data",
      "data.docker.Actor.Attributes.container",
      "data.docker.Actor.Attributes.image",
      "data.docker.Actor.Attributes.name",
      "data.docker.Actor.ID",
      "data.docker.id",
      "data.docker.from",
      "data.docker.message",
      "data.docker.status",
      "data.dstip",
      "data.dstport",
      "data.dstuser",
      "data.extra_data",
      "data.gcp.jsonPayload.queryName",
      "data.gcp.jsonPayload.vmInstanceName",
      "data.gcp.resource.labels.location",
      "data.gcp.resource.labels.project_id",
      "data.gcp.resource.labels.source_type",
      "data.gcp.resource.type",
      "data.github.org",
      "data.github.actor",
      "data.github.action",
      "data.github.repo",
      "data.hardware.serial",
      "data.id",
      "data.integration",
      "data.netinfo.iface.adapter",
      "data.netinfo.iface.ipv4.address",
      "data.netinfo.iface.ipv6.address",
      "data.netinfo.iface.mac",
      "data.netinfo.iface.name",
      "data.office365.Actor.ID",
      "data.office365.UserId",
      "data.office365.Operation",
      "data.office365.ClientIP",
      "data.ms-graph.relationship",
      "data.ms-graph.classification",
      "data.ms-graph.detectionSource",
      "data.ms-graph.determination",
      "data.ms-graph.remediationStatus",
      "data.ms-graph.roles",
      "data.ms-graph.verdict",
      "data.ms-graph.serviceSource",
      "data.ms-graph.severity",
      "data.ms-graph.actorDisplayName",
      "data.ms-graph.alertWebUrl",
      "data.ms-graph.assignedTo",
      "data.ms-graph.category",
      "data.ms-graph.comments",
      "data.ms-graph.description",
      "data.ms-graph.detectorId",
      "data.ms-graph.evidence._comment",
      "data.ms-graph.id",
      "data.ms-graph.incidentId",
      "data.ms-graph.incidentWebUrl",
      "data.ms-graph.mitreTechniques",
      "data.ms-graph.providerAlertId",
      "data.ms-graph.resource",
      "data.ms-graph.status",
      "data.ms-graph.tenantId",
      "data.ms-graph.threatDisplayName",
      "data.ms-graph.threatFamilyName",
      "data.ms-graph.title",
      "data.ms-graph.@odata.type",
      "data.ms-graph.activationLockBypassCode",
      "data.ms-graph.activity",
      "data.ms-graph.activityOperationType",
      "data.ms-graph.activityResult",
      "data.ms-graph.activityType",
      "data.ms-graph.actor.@odata.type",
      "data.ms-graph.actor.applicationDisplayName",
      "data.ms-graph.actor.applicationId",
      "data.ms-graph.actor.auditActorType",
      "data.ms-graph.actor.ipAddress",
      "data.ms-graph.actor.servicePrincipalName",
      "data.ms-graph.actor.type",
      "data.ms-graph.actor.userId",
      "data.ms-graph.actor.userPermissions",
      "data.ms-graph.actor.userPrincipalName",
      "data.ms-graph.androidSecurityPatchLevel",
      "data.ms-graph.appliedConditionalAccessPolicies",
      "data.ms-graph.azureADDeviceId",
      "data.ms-graph.azureADRegistered",
      "data.ms-graph.complianceState",
      "data.ms-graph.componentName",
      "data.ms-graph.configurationManagerClientEnabledFeatures.@odata.type",
      "data.ms-graph.configurationManagerClientEnabledFeatures.compliancePolicy",
      "data.ms-graph.configurationManagerClientEnabledFeatures.deviceConfiguration",
      "data.ms-graph.configurationManagerClientEnabledFeatures.inventory",
      "data.ms-graph.configurationManagerClientEnabledFeatures.modernApps",
      "data.ms-graph.configurationManagerClientEnabledFeatures.resourceAccess",
      "data.ms-graph.configurationManagerClientEnabledFeatures.windowsUpdateForBusiness",
      "data.ms-graph.correlationId",
      "data.ms-graph.deviceActionResults.@odata.type",
      "data.ms-graph.deviceActionResults.actionName",
      "data.ms-graph.deviceActionResults.actionState",
      "data.ms-graph.deviceCategoryDisplayName",
      "data.ms-graph.deviceEnrollmentType",
      "data.ms-graph.deviceHealthAttestationState.@odata.type",
      "data.ms-graph.deviceHealthAttestationState.attestationIdentityKey",
      "data.ms-graph.deviceHealthAttestationState.bitLockerStatus",
      "data.ms-graph.deviceHealthAttestationState.bootAppSecurityVersion",
      "data.ms-graph.deviceHealthAttestationState.bootDebugging",
      "data.ms-graph.deviceHealthAttestationState.bootManagerSecurityVersion",
      "data.ms-graph.deviceHealthAttestationState.bootManagerVersion",
      "data.ms-graph.deviceHealthAttestationState.bootRevisionListInfo",
      "data.ms-graph.deviceHealthAttestationState.codeIntegrity",
      "data.ms-graph.deviceHealthAttestationState.codeIntegrityCheckVersion",
      "data.ms-graph.deviceHealthAttestationState.codeIntegrityPolicy",
      "data.ms-graph.deviceHealthAttestationState.contentNamespaceUrl",
      "data.ms-graph.deviceHealthAttestationState.contentVersion",
      "data.ms-graph.deviceHealthAttestationState.dataExcutionPolicy",
      "data.ms-graph.deviceHealthAttestationState.deviceHealthAttestationStatus",
      "data.ms-graph.deviceHealthAttestationState.earlyLaunchAntiMalwareDriverProtection",
      "data.ms-graph.deviceHealthAttestationState.healthAttestationSupportedStatus",
      "data.ms-graph.deviceHealthAttestationState.healthStatusMismatchInfo",
      "data.ms-graph.deviceHealthAttestationState.operatingSystemKernelDebugging",
      "data.ms-graph.deviceHealthAttestationState.operatingSystemRevListInfo",
      "data.ms-graph.deviceHealthAttestationState.pcr0",
      "data.ms-graph.deviceHealthAttestationState.pcrHashAlgorithm",
      "data.ms-graph.deviceHealthAttestationState.resetCount",
      "data.ms-graph.deviceHealthAttestationState.restartCount",
      "data.ms-graph.deviceHealthAttestationState.safeMode",
      "data.ms-graph.deviceHealthAttestationState.secureBoot",
      "data.ms-graph.deviceHealthAttestationState.secureBootConfigurationPolicyFingerPrint",
      "data.ms-graph.deviceHealthAttestationState.testSigning",
      "data.ms-graph.deviceHealthAttestationState.tpmVersion",
      "data.ms-graph.deviceHealthAttestationState.virtualSecureMode",
      "data.ms-graph.deviceHealthAttestationState.windowsPE",
      "data.ms-graph.deviceName",
      "data.ms-graph.deviceRegistrationState",
      "data.ms-graph.displayName",
      "data.ms-graph.easActivated",
      "data.ms-graph.easDeviceId",
      "data.ms-graph.emailAddress",
      "data.ms-graph.enrollmentProfileName",
      "data.ms-graph.ethernetMacAddress",
      "data.ms-graph.exchangeAccessState",
      "data.ms-graph.exchangeAccessStateReason",
      "data.ms-graph.freeStorageSpaceInBytes",
      "data.ms-graph.iccid",
      "data.ms-graph.imei",
      "data.ms-graph.isEncrypted",
      "data.ms-graph.isSupervised",
      "data.ms-graph.jailBroken",
      "data.ms-graph.managedDeviceName",
      "data.ms-graph.managedDevices.deviceName",
      "data.ms-graph.managedDevices.id",
      "data.ms-graph.managedDeviceOwnerType",
      "data.ms-graph.managementAgent",
      "data.ms-graph.manufacturer",
      "data.ms-graph.meid",
      "data.ms-graph.model",
      "data.ms-graph.notes",
      "data.ms-graph.operatingSystem",
      "data.ms-graph.osVersion",
      "data.ms-graph.partnerReportedThreatState",
      "data.ms-graph.phoneNumber",
      "data.ms-graph.physicalMemoryInBytes",
      "data.ms-graph.platform",
      "data.ms-graph.publisher",
      "data.ms-graph.remoteAssistanceSessionErrorDetails",
      "data.ms-graph.remoteAssistanceSessionUrl",
      "data.ms-graph.requireUserEnrollmentApproval",
      "data.ms-graph.resources.@odata.type",
      "data.ms-graph.resources.auditResourceType",
      "data.ms-graph.resources.displayName",
      "data.ms-graph.resources.modifiedProperties.@odata.type",
      "data.ms-graph.resources.modifiedProperties.displayName",
      "data.ms-graph.resources.modifiedProperties.oldValue",
      "data.ms-graph.resources.modifiedProperties.newValue",
      "data.ms-graph.resources.resourceId",
      "data.ms-graph.resources.type",
      "data.ms-graph.serialNumber",
      "data.ms-graph.sizeInByte",
      "data.ms-graph.subscriberCarrier",
      "data.ms-graph.totalStorageSpaceInBytes",
      "data.ms-graph.udid",
      "data.ms-graph.userDisplayName",
      "data.ms-graph.userId",
      "data.ms-graph.userPrincipalName",
      "data.ms-graph.version",
      "data.ms-graph.wiFiMacAddress",
      "data.os.architecture",
      "data.os.build",
      "data.os.codename",
      "data.os.hostname",
      "data.os.major",
      "data.os.minor",
      "data.os.patch",
      "data.os.name",
      "data.os.platform",
      "data.os.release",
      "data.os.release_version",
      "data.os.display_version",
      "data.os.sysname",
      "data.os.version",
      "data.oscap.check.description",
      "data.oscap.check.id",
      "data.oscap.check.identifiers",
      "data.oscap.check.oval.id",
      "data.oscap.check.rationale",
      "data.oscap.check.references",
      "data.oscap.check.result",
      "data.oscap.check.severity",
      "data.oscap.check.title",
      "data.oscap.scan.benchmark.id",
      "data.oscap.scan.content",
      "data.oscap.scan.id",
      "data.oscap.scan.profile.id",
      "data.oscap.scan.profile.title",
      "data.osquery.columns.address",
      "data.osquery.columns.command",
      "data.osquery.columns.description",
      "data.osquery.columns.dst_ip",
      "data.osquery.columns.gid",
      "data.osquery.columns.hostname",
      "data.osquery.columns.md5",
      "data.osquery.columns.path",
      "data.osquery.columns.sha1",
      "data.osquery.columns.sha256",
      "data.osquery.columns.src_ip",
      "data.osquery.columns.user",
      "data.osquery.columns.username",
      "data.osquery.name",
      "data.osquery.pack",
      "data.port.process",
      "data.port.protocol",
      "data.port.state",
      "data.process.args",
      "data.process.cmd",
      "data.process.egroup",
      "data.process.euser",
      "data.process.fgroup",
      "data.process.name",
      "data.process.rgroup",
      "data.process.ruser",
      "data.process.sgroup",
      "data.process.state",
      "data.process.suser",
      "data.program.architecture",
      "data.program.description",
      "data.program.format",
      "data.program.location",
      "data.program.multiarch",
      "data.program.name",
      "data.program.priority",
      "data.program.section",
      "data.program.source",
      "data.program.vendor",
      "data.program.version",
      "data.protocol",
      "data.pwd",
      "data.sca",
      "data.sca.check.compliance.cis",
      "data.sca.check.compliance.cis_csc",
      "data.sca.check.compliance.pci_dss",
      "data.sca.check.compliance.hipaa",
      "data.sca.check.compliance.nist_800_53",
      "data.sca.check.description",
      "data.sca.check.directory",
      "data.sca.check.file",
      "data.sca.check.id",
      "data.sca.check.previous_result",
      "data.sca.check.process",
      "data.sca.check.rationale",
      "data.sca.check.reason",
      "data.sca.check.references",
      "data.sca.check.registry",
      "data.sca.check.remediation",
      "data.sca.check.result",
      "data.sca.check.title",
      "data.sca.description",
      "data.sca.file",
      "data.sca.invalid",
      "data.sca.name",
      "data.sca.policy",
      "data.sca.policy_id",
      "data.sca.scan_id",
      "data.sca.total_checks",
      "data.scan_id",
      "data.script",
      "data.src_ip",
      "data.src_port",
      "data.srcip",
      "data.srcport",
      "data.srcuser",
      "data.status",
      "data.system_name",
      "data.title",
      "data.tty",
      "data.uid",
      "data.url",
      "data.virustotal.description",
      "data.virustotal.error",
      "data.virustotal.found",
      "data.virustotal.permalink",
      "data.virustotal.scan_date",
      "data.virustotal.sha1",
      "data.virustotal.source.alert_id",
      "data.virustotal.source.file",
      "data.virustotal.source.md5",
      "data.virustotal.source.sha1",
      "data.vulnerability.cve",
      "data.vulnerability.cvss.cvss2.base_score",
      "data.vulnerability.cvss.cvss2.exploitability_score",
      "data.vulnerability.cvss.cvss2.impact_score",
      "data.vulnerability.cvss.cvss2.vector.access_complexity",
      "data.vulnerability.cvss.cvss2.vector.attack_vector",
      "data.vulnerability.cvss.cvss2.vector.authentication",
      "data.vulnerability.cvss.cvss2.vector.availability",
      "data.vulnerability.cvss.cvss2.vector.confidentiality_impact",
      "data.vulnerability.cvss.cvss2.vector.integrity_impact",
      "data.vulnerability.cvss.cvss2.vector.privileges_required",
      "data.vulnerability.cvss.cvss2.vector.scope",
      "data.vulnerability.cvss.cvss2.vector.user_interaction",
      "data.vulnerability.cvss.cvss3.base_score",
      "data.vulnerability.cvss.cvss3.exploitability_score",
      "data.vulnerability.cvss.cvss3.impact_score",
      "data.vulnerability.cvss.cvss3.vector.access_complexity",
      "data.vulnerability.cvss.cvss3.vector.attack_vector",
      "data.vulnerability.cvss.cvss3.vector.authentication",
      "data.vulnerability.cvss.cvss3.vector.availability",
      "data.vulnerability.cvss.cvss3.vector.confidentiality_impact",
      "data.vulnerability.cvss.cvss3.vector.integrity_impact",
      "data.vulnerability.cvss.cvss3.vector.privileges_required",
      "data.vulnerability.cvss.cvss3.vector.scope",
      "data.vulnerability.cvss.cvss3.vector.user_interaction",
      "data.vulnerability.cwe_reference",
      "data.vulnerability.package.source",
      "data.vulnerability.package.architecture",
      "data.vulnerability.package.condition",
      "data.vulnerability.package.generated_cpe",
      "data.vulnerability.package.name",
      "data.vulnerability.package.version",
      "data.vulnerability.rationale",
      "data.vulnerability.reference",
      "data.vulnerability.severity",
      "data.vulnerability.status",
      "data.vulnerability.title",
      "data.vulnerability.assigner",
      "data.vulnerability.cve_version",
      "data.win.eventdata.auditPolicyChanges",
      "data.win.eventdata.auditPolicyChangesId",
      "data.win.eventdata.binary",
      "data.win.eventdata.category",
      "data.win.eventdata.categoryId",
      "data.win.eventdata.data",
      "data.win.eventdata.image",
      "data.win.eventdata.ipAddress",
      "data.win.eventdata.ipPort",
      "data.win.eventdata.keyName",
      "data.win.eventdata.logonGuid",
      "data.win.eventdata.logonProcessName",
      "data.win.eventdata.operation",
      "data.win.eventdata.parentImage",
      "data.win.eventdata.processId",
      "data.win.eventdata.processName",
      "data.win.eventdata.providerName",
      "data.win.eventdata.returnCode",
      "data.win.eventdata.service",
      "data.win.eventdata.status",
      "data.win.eventdata.subcategory",
      "data.win.eventdata.subcategoryGuid",
      "data.win.eventdata.subcategoryId",
      "data.win.eventdata.subjectDomainName",
      "data.win.eventdata.subjectLogonId",
      "data.win.eventdata.subjectUserName",
      "data.win.eventdata.subjectUserSid",
      "data.win.eventdata.targetDomainName",
      "data.win.eventdata.targetLinkedLogonId",
      "data.win.eventdata.targetLogonId",
      "data.win.eventdata.targetUserName",
      "data.win.eventdata.targetUserSid",
      "data.win.eventdata.workstationName",
      "data.win.system.channel",
      "data.win.system.computer",
      "data.win.system.eventID",
      "data.win.system.eventRecordID",
      "data.win.system.eventSourceName",
      "data.win.system.keywords",
      "data.win.system.level",
      "data.win.system.message",
      "data.win.system.opcode",
      "data.win.system.processID",
      "data.win.system.providerGuid",
      "data.win.system.providerName",
      "data.win.system.securityUserID",
      "data.win.system.severityValue",
      "data.win.system.userID",
      "decoder.ftscomment",
      "decoder.name",
      "decoder.parent",
      "full_log",
      "host",
      "id",
      "input",
      "location",
      "manager.name",
      "message",
      "offset",
      "predecoder.hostname",
      "predecoder.program_name",
      "previous_log",
      "previous_output",
      "program_name",
      "rule.cis",
      "rule.cve",
      "rule.description",
      "rule.gdpr",
      "rule.gpg13",
      "rule.groups",
      "rule.id",
      "rule.info",
      "rule.mitre.id",
      "rule.mitre.tactic",
      "rule.mitre.technique",
      "rule.pci_dss",
      "rule.hipaa",
      "rule.nist_800_53",
      "syscheck.audit.effective_user.id",
      "syscheck.audit.effective_user.name",
      "syscheck.audit.group.id",
      "syscheck.audit.group.name",
      "syscheck.audit.login_user.id",
      "syscheck.audit.login_user.name",
      "syscheck.audit.process.id",
      "syscheck.audit.process.name",
      "syscheck.audit.process.ppid",
      "syscheck.audit.user.id",
      "syscheck.audit.user.name",
      "syscheck.diff",
      "syscheck.event",
      "syscheck.gid_after",
      "syscheck.gid_before",
      "syscheck.gname_after",
      "syscheck.gname_before",
      "syscheck.inode_after",
      "syscheck.inode_before",
      "syscheck.md5_after",
      "syscheck.md5_before",
      "syscheck.path",
      "syscheck.mode",
      "syscheck.perm_after",
      "syscheck.perm_before",
      "syscheck.sha1_after",
      "syscheck.sha1_before",
      "syscheck.sha256_after",
      "syscheck.sha256_before",
      "syscheck.tags",
      "syscheck.uid_after",
      "syscheck.uid_before",
      "syscheck.uname_after",
      "syscheck.uname_before",
      "syscheck.arch",
      "syscheck.value_name",
      "syscheck.value_type",
      "syscheck.changed_attributes",
      "title"
    ],
    "index.refresh_interval": "5s"
  },
  "version": 1
}
2026-01-02T14:38:22.623Z	INFO	[publisher_pipeline_output]	pipeline/output.go:145	Attempting to reconnect to backoff(elasticsearch(https://wazuh.indexer:9200)) with 2 reconnect attempt(s)
2026-01-02T14:38:22.624Z	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2026-01-02T14:38:22.624Z	INFO	[publisher]	pipeline/retry.go:223	  done
2026-01-02T14:38:22.629Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.10.2
2026-01-02T14:38:22.633Z	INFO	template/load.go:183	Existing template will be overwritten, as overwrite is enabled.
2026-01-02T14:38:22.635Z	INFO	template/load.go:117	Try loading template wazuh to Elasticsearch
2026-01-02T14:38:57.326Z	ERROR	[publisher_pipeline_output]	pipeline/output.go:154	Failed to connect to backoff(elasticsearch(https://wazuh.indexer:9200)): Connection marked as failed because the onConnect callback failed: error loading template: could not load template. Elasticsearch returned: couldn't load template: 503 Service Unavailable: {"error":{"root_cause":[{"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s"}],"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s"},"status":503}. Response body: {"error":{"root_cause":[{"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s"}],"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (create-index-template [wazuh], cause [api]) within 30s"},"status":503}. Template is: {
  "index_patterns": [
    "wazuh-alerts-4.x-*",
    "wazuh-archives-4.x-*"
  ],
  "mappings": {
    "date_detection": false,
    "dynamic_templates": [
      {
        "string_as_keyword": {
          "mapping": {
            "type": "keyword"
          },
          "match_mapping_type": "string"
        }
      }
    ],
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "@version": {
        "type": "text"
      },
      "GeoLocation": {
        "properties": {
          "area_code": {
            "type": "long"
          },
          "city_name": {
            "type": "keyword"
          },
          "continent_code": {
            "type": "text"
          },
          "coordinates": {
            "type": "double"
          },
          "country_code2": {
            "type": "text"
          },
          "country_code3": {
            "type": "text"
          },
          "country_name": {
            "type": "keyword"
          },
          "dma_code": {
            "type": "long"
          },
          "ip": {
            "type": "keyword"
          },
          "latitude": {
            "type": "double"
          },
          "location": {
            "type": "geo_point"
          },
          "longitude": {
            "type": "double"
          },
          "postal_code": {
            "type": "keyword"
          },
          "real_region_name": {
            "type": "keyword"
          },
          "region_name": {
            "type": "keyword"
          },
          "timezone": {
            "type": "text"
          }
        }
      },
      "agent": {
        "properties": {
          "id": {
            "type": "keyword"
          },
          "ip": {
            "type": "keyword"
          },
          "name": {
            "type": "keyword"
          }
        }
      },
      "cluster": {
        "properties": {
          "name": {
            "type": "keyword"
          },
          "node": {
            "type": "keyword"
          }
        }
      },
      "command": {
        "type": "keyword"
      },
      "data": {
        "properties": {
          "YARA": {
            "properties": {
              "api_customer": {
                "type": "keyword"
              },
              "log_type": {
                "type": "keyword"
              },
              "reference": {
                "type": "keyword"
              },
              "rule_author": {
                "type": "keyword"
              },
              "rule_description": {
                "type": "keyword"
              },
              "rule_name": {
                "type": "keyword"
              },
              "scanned_file": {
                "type": "keyword"
              },
              "tags": {
                "type": "keyword"
              }
            }
          },
          "action": {
            "type": "keyword"
          },
          "audit": {
            "properties": {
              "acct": {
                "type": "keyword"
              },
              "arch": {
                "type": "keyword"
              },
              "auid": {
                "type": "keyword"
              },
              "command": {
                "type": "keyword"
              },
              "cwd": {
                "type": "keyword"
              },
              "dev": {
                "type": "keyword"
              },
              "directory": {
                "properties": {
                  "inode": {
                    "type": "keyword"
                  },
                  "mode": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "egid": {
                "type": "keyword"
              },
              "enforcing": {
                "type": "keyword"
              },
              "euid": {
                "type": "keyword"
              },
              "exe": {
                "type": "keyword"
              },
              "execve": {
                "properties": {
                  "a0": {
                    "type": "keyword"
                  },
                  "a1": {
                    "type": "keyword"
                  },
                  "a2": {
                    "type": "keyword"
                  },
                  "a3": {
                    "type": "keyword"
                  }
                }
              },
              "exit": {
                "type": "keyword"
              },
              "file": {
                "properties": {
                  "inode": {
                    "type": "keyword"
                  },
                  "mode": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "fsgid": {
                "type": "keyword"
              },
              "fsuid": {
                "type": "keyword"
              },
              "gid": {
                "type": "keyword"
              },
              "id": {
                "type": "keyword"
              },
              "key": {
                "type": "keyword"
              },
              "list": {
                "type": "keyword"
              },
              "old-auid": {
                "type": "keyword"
              },
              "old-ses": {
                "type": "keyword"
              },
              "old_enforcing": {
                "type": "keyword"
              },
              "old_prom": {
                "type": "keyword"
              },
              "op": {
                "type": "keyword"
              },
              "pid": {
                "type": "keyword"
              },
              "ppid": {
                "type": "keyword"
              },
              "prom": {
                "type": "keyword"
              },
              "res": {
                "type": "keyword"
              },
              "session": {
                "type": "keyword"
              },
              "sgid": {
                "type": "keyword"
              },
              "srcip": {
                "type": "keyword"
              },
              "subj": {
                "type": "keyword"
              },
              "success": {
                "type": "keyword"
              },
              "suid": {
                "type": "keyword"
              },
              "syscall": {
                "type": "keyword"
              },
              "tty": {
                "type": "keyword"
              },
              "type": {
                "type": "keyword"
              },
              "uid": {
                "type": "keyword"
              }
            }
          },
          "aws": {
            "properties": {
              "accountId": {
                "type": "keyword"
              },
              "bytes": {
                "type": "long"
              },
              "createdAt": {
                "type": "date"
              },
              "dstaddr": {
                "type": "ip"
              },
              "end": {
                "type": "date"
              },
              "log_info": {
                "properties": {
                  "s3bucket": {
                    "type": "keyword"
                  }
                }
              },
              "region": {
                "type": "keyword"
              },
              "resource.instanceDetails": {
                "properties": {
                  "launchTime": {
                    "type": "date"
                  },
                  "networkInterfaces": {
                    "properties": {
                      "privateIpAddress": {
                        "type": "ip"
                      },
                      "publicIp": {
                        "type": "ip"
                      }
                    }
                  }
                }
              },
              "service": {
                "properties": {
                  "action.networkConnectionAction.remoteIpDetails": {
                    "properties": {
                      "geoLocation": {
                        "type": "geo_point"
                      },
                      "ipAddressV4": {
                        "type": "ip"
                      }
                    }
                  },
                  "count": {
                    "type": "long"
                  },
                  "eventFirstSeen": {
                    "type": "date"
                  },
                  "eventLastSeen": {
                    "type": "date"
                  }
                }
              },
              "source": {
                "type": "keyword"
              },
              "source_ip_address": {
                "type": "ip"
              },
              "srcaddr": {
                "type": "ip"
              },
              "start": {
                "type": "date"
              },
              "updatedAt": {
                "type": "date"
              }
            }
          },
          "azureSignInStatus": {
            "properties": {
              "additionalDetails": {
                "type": "keyword"
              },
              "errorCode": {
                "type": "integer"
              },
              "failureReason": {
                "type": "keyword"
              }
            }
          },
          "cis": {
            "properties": {
              "benchmark": {
                "type": "keyword"
              },
              "error": {
                "type": "long"
              },
              "fail": {
                "type": "long"
              },
              "group": {
                "type": "keyword"
              },
              "notchecked": {
                "type": "long"
              },
              "pass": {
                "type": "long"
              },
              "result": {
                "type": "keyword"
              },
              "rule_title": {
                "type": "keyword"
              },
              "score": {
                "type": "long"
              },
              "timestamp": {
                "type": "keyword"
              },
              "unknown": {
                "type": "long"
              }
            }
          },
          "command": {
            "type": "keyword"
          },
          "data": {
            "type": "keyword"
          },
          "docker": {
            "properties": {
              "Action": {
                "type": "keyword"
              },
              "Actor": {
                "properties": {
                  "Attributes": {
                    "properties": {
                      "image": {
                        "type": "keyword"
                      },
                      "name": {
                        "type": "keyword"
                      }
                    }
                  }
                }
              },
              "Type": {
                "type": "keyword"
              },
              "from": {
                "type": "keyword"
              }
            }
          },
          "dstip": {
            "type": "keyword"
          },
          "dstport": {
            "type": "keyword"
          },
          "dstuser": {
            "type": "keyword"
          },
          "extra_data": {
            "type": "keyword"
          },
          "file": {
            "type": "keyword"
          },
          "gcp": {
            "properties": {
              "jsonPayload": {
                "properties": {
                  "authAnswer": {
                    "type": "keyword"
                  },
                  "queryName": {
                    "type": "keyword"
                  },
                  "responseCode": {
                    "type": "keyword"
                  },
                  "vmInstanceId": {
                    "type": "keyword"
                  },
                  "vmInstanceName": {
                    "type": "keyword"
                  }
                }
              },
              "resource": {
                "properties": {
                  "labels": {
                    "properties": {
                      "location": {
                        "type": "keyword"
                      },
                      "project_id": {
                        "type": "keyword"
                      },
                      "source_type": {
                        "type": "keyword"
                      }
                    }
                  },
                  "type": {
                    "type": "keyword"
                  }
                }
              },
              "severity": {
                "type": "keyword"
              }
            }
          },
          "github": {
            "properties": {
              "action": {
                "type": "keyword"
              },
              "actor": {
                "type": "keyword"
              },
              "actor_location": {
                "properties": {
                  "country_code": {
                    "type": "keyword"
                  }
                }
              },
              "org": {
                "type": "keyword"
              },
              "repo": {
                "type": "keyword"
              }
            }
          },
          "hardware": {
            "properties": {
              "cpu_cores": {
                "type": "long"
              },
              "cpu_mhz": {
                "type": "double"
              },
              "cpu_name": {
                "type": "keyword"
              },
              "ram_free": {
                "type": "long"
              },
              "ram_total": {
                "type": "long"
              },
              "ram_usage": {
                "type": "long"
              },
              "serial": {
                "type": "keyword"
              }
            }
          },
          "id": {
            "type": "keyword"
          },
          "integration": {
            "type": "keyword"
          },
          "ms-graph": {
            "properties": {
              "@odata.type": {
                "type": "keyword"
              },
              "activationLockBypassCode": {
                "type": "keyword"
              },
              "activity": {
                "type": "keyword"
              },
              "activityDateTime": {
                "type": "date"
              },
              "activityOperationType": {
                "type": "keyword"
              },
              "activityResult": {
                "type": "keyword"
              },
              "activityType": {
                "type": "keyword"
              },
              "actor": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "applicationDisplayName": {
                    "type": "keyword"
                  },
                  "applicationId": {
                    "type": "keyword"
                  },
                  "auditActorType": {
                    "type": "keyword"
                  },
                  "ipAddress": {
                    "type": "keyword"
                  },
                  "servicePrincipalName": {
                    "type": "keyword"
                  },
                  "type": {
                    "type": "keyword"
                  },
                  "userId": {
                    "type": "keyword"
                  },
                  "userPermissions": {
                    "type": "text"
                  },
                  "userPrincipalName": {
                    "type": "keyword"
                  }
                }
              },
              "actorDisplayName": {
                "type": "keyword"
              },
              "alertWebUrl": {
                "type": "keyword"
              },
              "androidSecurityPatchLevel": {
                "type": "keyword"
              },
              "appliedConditionalAccessPolicies": {
                "type": "keyword"
              },
              "assignedTo": {
                "type": "keyword"
              },
              "azureADDeviceId": {
                "type": "keyword"
              },
              "azureADRegistered": {
                "type": "keyword"
              },
              "category": {
                "type": "keyword"
              },
              "classification": {
                "type": "keyword"
              },
              "comments": {
                "type": "keyword"
              },
              "complianceGracePeriodExpirationDateTime": {
                "type": "date"
              },
              "complianceState": {
                "type": "keyword"
              },
              "componentName": {
                "type": "keyword"
              },
              "configurationManagerClientEnabledFeatures": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "compliancePolicy": {
                    "type": "keyword"
                  },
                  "deviceConfiguration": {
                    "type": "keyword"
                  },
                  "inventory": {
                    "type": "keyword"
                  },
                  "modernApps": {
                    "type": "keyword"
                  },
                  "resourceAccess": {
                    "type": "keyword"
                  },
                  "windowsUpdateForBusiness": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "correlationId": {
                "type": "keyword"
              },
              "createdDateTime": {
                "type": "date"
              },
              "description": {
                "type": "text"
              },
              "detectionSource": {
                "type": "keyword"
              },
              "detectorId": {
                "type": "keyword"
              },
              "determination": {
                "type": "keyword"
              },
              "deviceActionResults": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "actionName": {
                    "type": "keyword"
                  },
                  "actionState": {
                    "type": "keyword"
                  },
                  "lastUpdatedDateTime": {
                    "type": "date"
                  },
                  "startDateTime": {
                    "type": "date"
                  }
                },
                "type": "nested"
              },
              "deviceCategoryDisplayName": {
                "type": "keyword"
              },
              "deviceCount": {
                "type": "integer"
              },
              "deviceEnrollmentType": {
                "type": "keyword"
              },
              "deviceHealthAttestationState": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "attestationIdentityKey": {
                    "type": "keyword"
                  },
                  "bitLockerStatus": {
                    "type": "keyword"
                  },
                  "bootAppSecurityVersion": {
                    "type": "keyword"
                  },
                  "bootDebugging": {
                    "type": "keyword"
                  },
                  "bootManagerSecurityVersion": {
                    "type": "keyword"
                  },
                  "bootManagerVersion": {
                    "type": "keyword"
                  },
                  "bootRevisionListInfo": {
                    "type": "keyword"
                  },
                  "codeIntegrity": {
                    "type": "keyword"
                  },
                  "codeIntegrityCheckVersion": {
                    "type": "keyword"
                  },
                  "codeIntegrityPolicy": {
                    "type": "keyword"
                  },
                  "contentNamespaceUrl": {
                    "type": "keyword"
                  },
                  "contentVersion": {
                    "type": "keyword"
                  },
                  "dataExcutionPolicy": {
                    "type": "keyword"
                  },
                  "deviceHealthAttestationStatus": {
                    "type": "keyword"
                  },
                  "earlyLaunchAntiMalwareDriverProtection": {
                    "type": "keyword"
                  },
                  "healthAttestationSupportedStatus": {
                    "type": "keyword"
                  },
                  "healthStatusMismatchInfo": {
                    "type": "keyword"
                  },
                  "issuedDateTime": {
                    "type": "date"
                  },
                  "lastUpdateDateTime": {
                    "type": "date"
                  },
                  "operatingSystemKernelDebugging": {
                    "type": "keyword"
                  },
                  "operatingSystemRevListInfo": {
                    "type": "keyword"
                  },
                  "pcr0": {
                    "type": "keyword"
                  },
                  "pcrHashAlgorithm": {
                    "type": "keyword"
                  },
                  "resetCount": {
                    "type": "keyword"
                  },
                  "restartCount": {
                    "type": "keyword"
                  },
                  "safeMode": {
                    "type": "keyword"
                  },
                  "secureBoot": {
                    "type": "keyword"
                  },
                  "secureBootConfigurationPolicyFingerPrint": {
                    "type": "keyword"
                  },
                  "testSigning": {
                    "type": "keyword"
                  },
                  "tpmVersion": {
                    "type": "keyword"
                  },
                  "virtualSecureMode": {
                    "type": "keyword"
                  },
                  "windowsPE": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "deviceName": {
                "type": "keyword"
              },
              "deviceRegistrationState": {
                "type": "keyword"
              },
              "displayName": {
                "type": "keyword"
              },
              "easActivated": {
                "type": "keyword"
              },
              "easActivationDateTime": {
                "type": "date"
              },
              "easDeviceId": {
                "type": "keyword"
              },
              "emailAddress": {
                "type": "keyword"
              },
              "enrolledDateTime": {
                "type": "date"
              },
              "enrollmentProfileName": {
                "type": "keyword"
              },
              "ethernetMacAddress": {
                "type": "keyword"
              },
              "evidence": {
                "properties": {
                  "_comment": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "exchangeAccessState": {
                "type": "keyword"
              },
              "exchangeAccessStateReason": {
                "type": "keyword"
              },
              "exchangeLastSuccessfulSyncDateTime": {
                "type": "date"
              },
              "firstActivityDateTime": {
                "type": "date"
              },
              "freeStorageSpaceInBytes": {
                "type": "keyword"
              },
              "iccid": {
                "type": "keyword"
              },
              "id": {
                "type": "keyword"
              },
              "imei": {
                "type": "keyword"
              },
              "incidentId": {
                "type": "keyword"
              },
              "incidentWebUrl": {
                "type": "keyword"
              },
              "isEncrypted": {
                "type": "keyword"
              },
              "isSupervised": {
                "type": "keyword"
              },
              "jailBroken": {
                "type": "keyword"
              },
              "lastActivityDateTime": {
                "type": "date"
              },
              "lastSyncDateTime": {
                "type": "date"
              },
              "lastUpdateDateTime": {
                "type": "date"
              },
              "managedDeviceName": {
                "type": "keyword"
              },
              "managedDeviceOwnerType": {
                "type": "keyword"
              },
              "managedDevices": {
                "properties": {
                  "deviceName": {
                    "type": "keyword"
                  },
                  "id": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "managementAgent": {
                "type": "keyword"
              },
              "managementCertificateExpirationDate": {
                "type": "date"
              },
              "manufacturer": {
                "type": "keyword"
              },
              "meid": {
                "type": "keyword"
              },
              "mitreTechniques": {
                "type": "keyword"
              },
              "model": {
                "type": "keyword"
              },
              "notes": {
                "type": "keyword"
              },
              "operatingSystem": {
                "type": "keyword"
              },
              "osVersion": {
                "type": "keyword"
              },
              "partnerReportedThreatState": {
                "type": "keyword"
              },
              "phoneNumber": {
                "type": "keyword"
              },
              "physicalMemoryInBytes": {
                "type": "keyword"
              },
              "platform": {
                "type": "keyword"
              },
              "providerAlertId": {
                "type": "keyword"
              },
              "publisher": {
                "type": "keyword"
              },
              "relationship": {
                "type": "keyword"
              },
              "remediationStatus": {
                "type": "keyword"
              },
              "remoteAssistanceSessionErrorDetails": {
                "type": "keyword"
              },
              "remoteAssistanceSessionUrl": {
                "type": "keyword"
              },
              "requireUserEnrollmentApproval": {
                "type": "keyword"
              },
              "resolvedDateTime": {
                "type": "date"
              },
              "resource": {
                "type": "keyword"
              },
              "resources": {
                "properties": {
                  "@odata.type": {
                    "type": "keyword"
                  },
                  "auditResourceType": {
                    "type": "keyword"
                  },
                  "displayName": {
                    "type": "keyword"
                  },
                  "modifiedProperties": {
                    "properties": {
                      "@odata.type": {
                        "type": "keyword"
                      },
                      "displayName": {
                        "type": "keyword"
                      },
                      "newValue": {
                        "type": "keyword"
                      },
                      "oldValue": {
                        "type": "keyword"
                      }
                    },
                    "type": "nested"
                  },
                  "resourceId": {
                    "type": "keyword"
                  },
                  "type": {
                    "type": "keyword"
                  }
                },
                "type": "nested"
              },
              "roles": {
                "type": "keyword"
              },
              "serialNumber": {
                "type": "keyword"
              },
              "serviceSource": {
                "type": "keyword"
              },
              "severity": {
                "type": "keyword"
              },
              "sizeInByte": {
                "type": "keyword"
              },
              "status": {
                "type": "keyword"
              },
              "subscriberCarrier": {
                "type": "keyword"
              },
              "tenantId": {
                "type": "keyword"
              },
              "threatDisplayName": {
                "type": "keyword"
              },
              "threatFamilyName": {
                "type": "keyword"
              },
              "title": {
                "type": "keyword"
              },
              "totalStorageSpaceInBytes": {
                "type": "keyword"
              },
              "udid": {
                "type": "keyword"
              },
              "userDisplayName": {
                "type": "keyword"
              },
              "userId": {
                "type": "keyword"
              },
              "userPrincipalName": {
                "type": "keyword"
              },
              "verdict": {
                "type": "keyword"
              },
              "version": {
                "type": "keyword"
              },
              "wiFiMacAddress": {
                "type": "keyword"
              }
            }
          },
          "netinfo": {
            "properties": {
              "iface": {
                "properties": {
                  "adapter": {
                    "type": "keyword"
                  },
                  "ipv4": {
                    "properties": {
                      "address": {
                        "type": "keyword"
                      },
                      "broadcast": {
                        "type": "keyword"
                      },
                      "dhcp": {
                        "type": "keyword"
                      },
                      "gateway": {
                        "type": "keyword"
                      },
                      "metric": {
                        "type": "long"
                      },
                      "netmask": {
                        "type": "keyword"
                      }
                    }
                  },
                  "ipv6": {
                    "properties": {
                      "address": {
                        "type": "keyword"
                      },
                      "broadcast": {
                        "type": "keyword"
                      },
                      "dhcp": {
                        "type": "keyword"
                      },
                      "gateway": {
                        "type": "keyword"
                      },
                      "metric": {
                        "type": "long"
                      },
                      "netmask": {
                        "type": "keyword"
                      }
                    }
                  },
                  "mac": {
                    "type": "keyword"
                  },
                  "mtu": {
                    "type": "long"
                  },
                  "name": {
                    "type": "keyword"
                  },
                  "rx_bytes": {
                    "type": "long"
                  },
                  "rx_dropped": {
                    "type": "long"
                  },
                  "rx_errors": {
                    "type": "long"
                  },
                  "rx_packets": {
                    "type": "long"
                  },
                  "state": {
                    "type": "keyword"
                  },
                  "tx_bytes": {
                    "type": "long"
                  },
                  "tx_dropped": {
                    "type": "long"
                  },
                  "tx_errors": {
                    "type": "long"
                  },
                  "tx_packets": {
                    "type": "long"
                  },
                  "type": {
                    "type": "keyword"
                  }
                }
              }
            }
          },
          "office365": {
            "properties": {
              "Actor": {
                "properties": {
                  "ID": {
                    "type": "keyword"
                  }
                }
              },
              "ClientIP": {
                "type": "keyword"
              },
              "Operation": {
                "type": "keyword"
              },
              "ResultStatus": {
                "type": "keyword"
              },
              "Subscription": {
                "type": "keyword"
              },
              "UserId": {
                "type": "keyword"
              }
            }
          },
          "os": {
            "properties": {
              "architecture": {
                "type": "keyword"
              },
              "build": {
                "type": "keyword"
              },
              "codename": {
                "type": "keyword"
              },
              "display_version": {
                "type": "keyword"
              },
              "hostname": {
                "type": "keyword"
              },
              "major": {
                "type": "keyword"
              },
              "minor": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "patch": {
                "type": "keyword"
              },
              "platform": {
                "type": "keyword"
              },
              "release": {
                "type": "keyword"
              },
              "release_version": {
                "type": "keyword"
              },
              "sysname": {
                "type": "keyword"
              },
              "version": {
                "type": "keyword"
              }
            }
          },
          "oscap": {
            "properties": {
              "check": {
                "properties": {
                  "description": {
                    "type": "text"
                  },
                  "id": {
                    "type": "keyword"
                  },
                  "identifiers": {
                    "type": "text"
                  },
                  "oval": {
                    "properties": {
                      "id": {
                        "type": "keyword"
                      }
                    }
                  },
                  "rationale": {
                    "type": "text"
                  },
                  "references": {
                    "type": "text"
                  },
                  "result": {
                    "type": "keyword"
                  },
                  "severity": {
                    "type": "keyword"
                  },
                  "title": {
                    "type": "keyword"
                  }
                }
              },
              "scan": {
                "properties": {
                  "benchmark": {
                    "properties": {
                      "id": {
                        "type": "keyword"
                      }
                    }
                  },
                  "content": {
                    "type": "keyword"
                  },
                  "id": {
                    "type": "keyword"
                  },
                  "profile": {
                    "properties": {
                      "id": {
                        "type": "keyword"
                      },
                      "title": {
                        "type": "keyword"
                      }
                    }
                  },
                  "return_code": {
                    "type": "long"
                  },
                  "score": {
                    "type": "double"
                  }
                }
              }
            }
          },
          "osquery": {
            "properties": {
              "action": {
                "type": "keyword"
              },
              "calendarTime": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "pack": {
                "type": "keyword"
              }
            }
          },
          "parameters": {
            "properties": {
              "extra_args": {
                "type": "keyword"
              }
            }
          },
          "port": {
            "properties": {
              "inode": {
                "type": "long"
              },
              "local_ip": {
                "type": "ip"
              },
              "local_port": {
                "type": "long"
              },
              "pid": {
                "type": "long"
              },
              "process": {
                "type": "keyword"
              },
              "protocol": {
                "type": "keyword"
              },
              "remote_ip": {
                "type": "ip"
              },
              "remote_port": {
                "type": "long"
              },
              "rx_queue": {
                "type": "long"
              },
              "state": {
                "type": "keyword"
              },
              "tx_queue": {
                "type": "long"
              }
            }
          },
          "process": {
            "properties": {
              "args": {
                "type": "keyword"
              },
              "cmd": {
                "type": "keyword"
              },
              "egroup": {
                "type": "keyword"
              },
              "euser": {
                "type": "keyword"
              },
              "fgroup": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "nice": {
                "type": "long"
              },
              "nlwp": {
                "type": "long"
              },
              "pgrp": {
                "type": "long"
              },
              "pid": {
                "type": "long"
              },
              "ppid": {
                "type": "long"
              },
              "priority": {
                "type": "long"
              },
              "processor": {
                "type": "long"
              },
              "resident": {
                "type": "long"
              },
              "rgroup": {
                "type": "keyword"
              },
              "ruser": {
                "type": "keyword"
              },
              "session": {
                "type": "long"
              },
              "sgroup": {
                "type": "keyword"
              },
              "share": {
                "type": "long"
              },
              "size": {
                "type": "long"
              },
              "start_time": {
                "type": "long"
              },
              "state": {
                "type": "keyword"
              },
              "stime": {
                "type": "long"
              },
              "suser": {
                "type": "keyword"
              },
              "tgid": {
                "type": "long"
              },
              "tty": {
                "type": "long"
              },
              "utime": {
                "type": "long"
              },
              "vm_size": {
                "type": "long"
              }
            }
          },
          "program": {
            "properties": {
              "architecture": {
                "type": "keyword"
              },
              "description": {
                "type": "keyword"
              },
              "format": {
                "type": "keyword"
              },
              "install_time": {
                "type": "keyword"
              },
              "location": {
                "type": "keyword"
              },
              "multiarch": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "priority": {
                "type": "keyword"
              },
              "section": {
                "type": "keyword"
              },
              "size": {
                "type": "long"
              },
              "source": {
                "type": "keyword"
              },
              "vendor": {
                "type": "keyword"
              },
              "version": {
                "type": "keyword"
              }
            }
          },
          "protocol": {
            "type": "keyword"
          },
          "sca": {
            "properties": {
              "check": {
                "properties": {
                  "compliance": {
                    "properties": {
                      "cis": {
                        "type": "keyword"
                      },
                      "cis_csc": {
                        "type": "keyword"
                      },
                      "hipaa": {
                        "type": "keyword"
                      },
                      "nist_800_53": {
                        "type": "keyword"
                      },
                      "pci_dss": {
                        "type": "keyword"
                      }
                    }
                  },
                  "description": {
                    "type": "keyword"
                  },
                  "directory": {
                    "type": "keyword"
                  },
                  "file": {
                    "type": "keyword"
                  },
                  "id": {
                    "type": "keyword"
                  },
                  "previous_result": {
                    "type": "keyword"
                  },
                  "process": {
                    "type": "keyword"
                  },
                  "rationale": {
                    "type": "keyword"
                  },
                  "reason": {
                    "type": "keyword"
                  },
                  "references": {
                    "type": "keyword"
                  },
                  "registry": {
                    "type": "keyword"
                  },
                  "remediation": {
                    "type": "keyword"
                  },
                  "result": {
                    "type": "keyword"
                  },
                  "title": {
                    "type": "keyword"
                  }
                }
              },
              "description": {
                "type": "keyword"
              },
              "failed": {
                "type": "integer"
              },
              "file": {
                "type": "keyword"
              },
              "invalid": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              },
              "passed": {
                "type": "integer"
              },
              "policy": {
                "type": "keyword"
              },
              "policy_id": {
                "type": "keyword"
              },
              "scan_id": {
                "type": "keyword"
              },
              "score": {
                "type": "long"
              },
              "total_checks": {
                "type": "keyword"
              },
              "type": {
                "type": "keyword"
              }
            }
          },
          "scan_id": {
            "type": "keyword"
          },
          "srcip": {
            "type": "keyword"
          },
          "srcport": {
            "type": "keyword"
          },
          "srcuser": {
            "type": "keyword"
          },
          "system_name": {
            "type": "keyword"
          },
          "timestamp": {
            "type": "date"
          },
          "title": {
            "type": "keyword"
          },
          "type": {
            "type": "keyword"
          },
          "uid": {
            "type": "keyword"
          },
          "url": {
            "type": "keyword"
          },
          "virustotal": {
            "properties": {
              "description": {
                "type": "keyword"
              },
              "error": {
                "type": "keyword"
              },
              "found": {
                "type": "keyword"
              },
              "malicious": {
                "type": "keyword"
              },
              "permalink": {
                "type": "keyword"
              },
              "positives": {
                "type": "keyword"
              },
              "scan_date": {
                "type": "keyword"
              },
              "sha1": {
                "type": "keyword"
              },
              "source": {
                "properties": {
                  "alert_id": {
                    "type": "keyword"
                  },
                  "file": {
                    "type": "keyword"
                  },
                  "md5": {
                    "type": "keyword"
                  },
                  "sha1": {
                    "type": "keyword"
                  }
                }
              },
              "total": {
                "type": "keyword"
              }
            }
          },
          "vulnerability": {
            "properties": {
              "assigner": {
                "type": "keyword"
              },
              "cve": {
                "type": "keyword"
              },
              "cve_version": {
                "type": "keyword"
              },
              "cvss": {
                "properties": {
                  "cvss2": {
                    "properties": {
                      "base_score": {
                        "type": "keyword"
                      },
                      "exploitability_score": {
                        "type": "keyword"
                      },
                      "impact_score": {
                        "type": "keyword"
                      },
                      "vector": {
                        "properties": {
                          "access_complexity": {
                            "type": "keyword"
                          },
                          "attack_vector": {
                            "type": "keyword"
                          },
                          "authentication": {
                            "type": "keyword"
                          },
                          "availability": {
                            "type": "keyword"
                          },
                          "confidentiality_impact": {
                            "type": "keyword"
                          },
                          "integrity_impact": {
                            "type": "keyword"
                          },
                          "privileges_required": {
                            "type": "keyword"
                          },
                          "scope": {
                            "type": "keyword"
                          },
                          "user_interaction": {
                            "type": "keyword"
                          }
                        }
                      }
                    }
                  },
                  "cvss3": {
                    "properties": {
                      "base_score": {
                        "type": "keyword"
                      },
                      "exploitability_score": {
                        "type": "keyword"
                      },
                      "impact_score": {
                        "type": "keyword"
                      },
                      "vector": {
                        "properties": {
                          "access_complexity": {
                            "type": "keyword"
                          },
                          "attack_vector": {
                            "type": "keyword"
                          },
                          "authentication": {
                            "type": "keyword"
                          },
                          "availability": {
                            "type": "keyword"
                          },
                          "confidentiality_impact": {
                            "type": "keyword"
                          },
                          "integrity_impact": {
                            "type": "keyword"
                          },
                          "privileges_required": {
                            "type": "keyword"
                          },
                          "scope": {
                            "type": "keyword"
                          },
                          "user_interaction": {
                            "type": "keyword"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "cwe_reference": {
                "type": "keyword"
              },
              "package": {
                "properties": {
                  "architecture": {
                    "type": "keyword"
                  },
                  "condition": {
                    "type": "keyword"
                  },
                  "generated_cpe": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  },
                  "source": {
                    "type": "keyword"
                  },
                  "version": {
                    "type": "keyword"
                  }
                }
              },
              "published": {
                "type": "date"
              },
              "rationale": {
                "type": "keyword"
              },
              "reference": {
                "type": "keyword"
              },
              "scanner.reference": {
                "type": "keyword"
              },
              "severity": {
                "type": "keyword"
              },
              "status": {
                "type": "keyword"
              },
              "title": {
                "type": "keyword"
              },
              "updated": {
                "type": "date"
              }
            }
          }
        }
      },
      "decoder": {
        "properties": {
          "accumulate": {
            "type": "long"
          },
          "fts": {
            "type": "long"
          },
          "ftscomment": {
            "type": "keyword"
          },
          "name": {
            "type": "keyword"
          },
          "parent": {
            "type": "keyword"
          }
        }
      },
      "full_log": {
        "type": "text"
      },
      "host": {
        "type": "keyword"
      },
      "id": {
        "type": "keyword"
      },
      "input": {
        "properties": {
          "type": {
            "type": "keyword"
          }
        }
      },
      "location": {
        "type": "keyword"
      },
      "manager": {
        "properties": {
          "name": {
            "type": "keyword"
          }
        }
      },
      "message": {
        "type": "text"
      },
      "offset": {
        "type": "keyword"
      },
      "predecoder": {
        "properties": {
          "hostname": {
            "type": "keyword"
          },
          "program_name": {
            "type": "keyword"
          },
          "timestamp": {
            "type": "keyword"
          }
        }
      },
      "previous_log": {
        "type": "text"
      },
      "previous_output": {
        "type": "keyword"
      },
      "program_name": {
        "type": "keyword"
      },
      "rule": {
        "properties": {
          "cis": {
            "type": "keyword"
          },
          "cve": {
            "type": "keyword"
          },
          "description": {
            "type": "keyword"
          },
          "firedtimes": {
            "type": "long"
          },
          "frequency": {
            "type": "long"
          },
          "gdpr": {
            "type": "keyword"
          },
          "gpg13": {
            "type": "keyword"
          },
          "groups": {
            "type": "keyword"
          },
          "hipaa": {
            "type": "keyword"
          },
          "id": {
            "type": "keyword"
          },
          "info": {
            "type": "keyword"
          },
          "level": {
            "type": "long"
          },
          "mail": {
            "type": "boolean"
          },
          "mitre": {
            "properties": {
              "id": {
                "type": "keyword"
              },
              "tactic": {
                "type": "keyword"
              },
              "technique": {
                "type": "keyword"
              }
            }
          },
          "nist_800_53": {
            "type": "keyword"
          },
          "pci_dss": {
            "type": "keyword"
          },
          "tsc": {
            "type": "keyword"
          }
        }
      },
      "syscheck": {
        "properties": {
          "audit": {
            "properties": {
              "effective_user": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "group": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "login_user": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              },
              "process": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  },
                  "ppid": {
                    "type": "keyword"
                  }
                }
              },
              "user": {
                "properties": {
                  "id": {
                    "type": "keyword"
                  },
                  "name": {
                    "type": "keyword"
                  }
                }
              }
            }
          },
          "diff": {
            "type": "keyword"
          },
          "event": {
            "type": "keyword"
          },
          "gid_after": {
            "type": "keyword"
          },
          "gid_before": {
            "type": "keyword"
          },
          "gname_after": {
            "type": "keyword"
          },
          "gname_before": {
            "type": "keyword"
          },
          "hard_links": {
            "type": "keyword"
          },
          "inode_after": {
            "type": "keyword"
          },
          "inode_before": {
            "type": "keyword"
          },
          "md5_after": {
            "type": "keyword"
          },
          "md5_before": {
            "type": "keyword"
          },
          "mode": {
            "type": "keyword"
          },
          "mtime_after": {
            "format": "date_optional_time",
            "type": "date"
          },
          "mtime_before": {
            "format": "date_optional_time",
            "type": "date"
          },
          "path": {
            "type": "keyword"
          },
          "perm_after": {
            "type": "keyword"
          },
          "perm_before": {
            "type": "keyword"
          },
          "sha1_after": {
            "type": "keyword"
          },
          "sha1_before": {
            "type": "keyword"
          },
          "sha256_after": {
            "type": "keyword"
          },
          "sha256_before": {
            "type": "keyword"
          },
          "size_after": {
            "type": "long"
          },
          "size_before": {
            "type": "long"
          },
          "tags": {
            "type": "keyword"
          },
          "uid_after": {
            "type": "keyword"
          },
          "uid_before": {
            "type": "keyword"
          },
          "uname_after": {
            "type": "keyword"
          },
          "uname_before": {
            "type": "keyword"
          }
        }
      },
      "timestamp": {
        "format": "date_optional_time||epoch_millis",
        "type": "date"
      },
      "title": {
        "type": "keyword"
      },
      "type": {
        "type": "text"
      }
    }
  },
  "order": 0,
  "settings": {
    "index.auto_expand_replicas": "0-1",
    "index.mapping.total_fields.limit": 10000,
    "index.number_of_replicas": "0",
    "index.number_of_shards": "3",
    "index.query.default_field": [
      "GeoLocation.city_name",
      "GeoLocation.continent_code",
      "GeoLocation.country_code2",
      "GeoLocation.country_code3",
      "GeoLocation.country_name",
      "GeoLocation.ip",
      "GeoLocation.postal_code",
      "GeoLocation.real_region_name",
      "GeoLocation.region_name",
      "GeoLocation.timezone",
      "agent.id",
      "agent.ip",
      "agent.name",
      "cluster.name",
      "cluster.node",
      "command",
      "data",
      "data.action",
      "data.audit",
      "data.audit.acct",
      "data.audit.arch",
      "data.audit.auid",
      "data.audit.command",
      "data.audit.cwd",
      "data.audit.dev",
      "data.audit.directory.inode",
      "data.audit.directory.mode",
      "data.audit.directory.name",
      "data.audit.egid",
      "data.audit.enforcing",
      "data.audit.euid",
      "data.audit.exe",
      "data.audit.execve.a0",
      "data.audit.execve.a1",
      "data.audit.execve.a2",
      "data.audit.execve.a3",
      "data.audit.exit",
      "data.audit.file.inode",
      "data.audit.file.mode",
      "data.audit.file.name",
      "data.audit.fsgid",
      "data.audit.fsuid",
      "data.audit.gid",
      "data.audit.id",
      "data.audit.key",
      "data.audit.list",
      "data.audit.old-auid",
      "data.audit.old-ses",
      "data.audit.old_enforcing",
      "data.audit.old_prom",
      "data.audit.op",
      "data.audit.pid",
      "data.audit.ppid",
      "data.audit.prom",
      "data.audit.res",
      "data.audit.session",
      "data.audit.sgid",
      "data.audit.srcip",
      "data.audit.subj",
      "data.audit.success",
      "data.audit.suid",
      "data.audit.syscall",
      "data.audit.tty",
      "data.audit.uid",
      "data.aws.accountId",
      "data.aws.account_id",
      "data.aws.action",
      "data.aws.actor",
      "data.aws.aws_account_id",
      "data.aws.description",
      "data.aws.dstport",
      "data.aws.errorCode",
      "data.aws.errorMessage",
      "data.aws.eventID",
      "data.aws.eventName",
      "data.aws.eventSource",
      "data.aws.eventType",
      "data.aws.id",
      "data.aws.name",
      "data.aws.requestParameters.accessKeyId",
      "data.aws.requestParameters.bucketName",
      "data.aws.requestParameters.gatewayId",
      "data.aws.requestParameters.groupDescription",
      "data.aws.requestParameters.groupId",
      "data.aws.requestParameters.groupName",
      "data.aws.requestParameters.host",
      "data.aws.requestParameters.hostedZoneId",
      "data.aws.requestParameters.instanceId",
      "data.aws.requestParameters.instanceProfileName",
      "data.aws.requestParameters.loadBalancerName",
      "data.aws.requestParameters.loadBalancerPorts",
      "data.aws.requestParameters.masterUserPassword",
      "data.aws.requestParameters.masterUsername",
      "data.aws.requestParameters.name",
      "data.aws.requestParameters.natGatewayId",
      "data.aws.requestParameters.networkAclId",
      "data.aws.requestParameters.path",
      "data.aws.requestParameters.policyName",
      "data.aws.requestParameters.port",
      "data.aws.requestParameters.stackId",
      "data.aws.requestParameters.stackName",
      "data.aws.requestParameters.subnetId",
      "data.aws.requestParameters.subnetIds",
      "data.aws.requestParameters.volumeId",
      "data.aws.requestParameters.vpcId",
      "data.aws.resource.accessKeyDetails.accessKeyId",
      "data.aws.resource.accessKeyDetails.principalId",
      "data.aws.resource.accessKeyDetails.userName",
      "data.aws.resource.instanceDetails.instanceId",
      "data.aws.resource.instanceDetails.instanceState",
      "data.aws.resource.instanceDetails.networkInterfaces.privateDnsName",
      "data.aws.resource.instanceDetails.networkInterfaces.publicDnsName",
      "data.aws.resource.instanceDetails.networkInterfaces.subnetId",
      "data.aws.resource.instanceDetails.networkInterfaces.vpcId",
      "data.aws.resource.instanceDetails.tags.value",
      "data.aws.responseElements.AssociateVpcCidrBlockResponse.vpcId",
      "data.aws.responseElements.description",
      "data.aws.responseElements.instanceId",
      "data.aws.responseElements.instances.instanceId",
      "data.aws.responseElements.instancesSet.items.instanceId",
      "data.aws.responseElements.listeners.port",
      "data.aws.responseElements.loadBalancerName",
      "data.aws.responseElements.loadBalancers.vpcId",
      "data.aws.responseElements.loginProfile.userName",
      "data.aws.responseElements.networkAcl.vpcId",
      "data.aws.responseElements.ownerId",
      "data.aws.responseElements.publicIp",
      "data.aws.responseElements.user.userId",
      "data.aws.responseElements.user.userName",
      "data.aws.responseElements.volumeId",
      "data.aws.service.serviceName",
      "data.aws.severity",
      "data.aws.source",
      "data.aws.sourceIPAddress",
      "data.aws.srcport",
      "data.aws.userIdentity.accessKeyId",
      "data.aws.userIdentity.accountId",
      "data.aws.userIdentity.userName",
      "data.aws.vpcEndpointId",
      "data.command",
      "data.cis.group",
      "data.cis.rule_title",
      "data.data",
      "data.docker.Actor.Attributes.container",
      "data.docker.Actor.Attributes.image",
      "data.docker.Actor.Attributes.name",
      "data.docker.Actor.ID",
      "data.docker.id",
      "data.docker.from",
      "data.docker.message",
      "data.docker.status",
      "data.dstip",
      "data.dstport",
      "data.dstuser",
      "data.extra_data",
      "data.gcp.jsonPayload.queryName",
      "data.gcp.jsonPayload.vmInstanceName",
      "data.gcp.resource.labels.location",
      "data.gcp.resource.labels.project_id",
      "data.gcp.resource.labels.source_type",
      "data.gcp.resource.type",
      "data.github.org",
      "data.github.actor",
      "data.github.action",
      "data.github.repo",
      "data.hardware.serial",
      "data.id",
      "data.integration",
      "data.netinfo.iface.adapter",
      "data.netinfo.iface.ipv4.address",
      "data.netinfo.iface.ipv6.address",
      "data.netinfo.iface.mac",
      "data.netinfo.iface.name",
      "data.office365.Actor.ID",
      "data.office365.UserId",
      "data.office365.Operation",
      "data.office365.ClientIP",
      "data.ms-graph.relationship",
      "data.ms-graph.classification",
      "data.ms-graph.detectionSource",
      "data.ms-graph.determination",
      "data.ms-graph.remediationStatus",
      "data.ms-graph.roles",
      "data.ms-graph.verdict",
      "data.ms-graph.serviceSource",
      "data.ms-graph.severity",
      "data.ms-graph.actorDisplayName",
      "data.ms-graph.alertWebUrl",
      "data.ms-graph.assignedTo",
      "data.ms-graph.category",
      "data.ms-graph.comments",
      "data.ms-graph.description",
      "data.ms-graph.detectorId",
      "data.ms-graph.evidence._comment",
      "data.ms-graph.id",
      "data.ms-graph.incidentId",
      "data.ms-graph.incidentWebUrl",
      "data.ms-graph.mitreTechniques",
      "data.ms-graph.providerAlertId",
      "data.ms-graph.resource",
      "data.ms-graph.status",
      "data.ms-graph.tenantId",
      "data.ms-graph.threatDisplayName",
      "data.ms-graph.threatFamilyName",
      "data.ms-graph.title",
      "data.ms-graph.@odata.type",
      "data.ms-graph.activationLockBypassCode",
      "data.ms-graph.activity",
      "data.ms-graph.activityOperationType",
      "data.ms-graph.activityResult",
      "data.ms-graph.activityType",
      "data.ms-graph.actor.@odata.type",
      "data.ms-graph.actor.applicationDisplayName",
      "data.ms-graph.actor.applicationId",
      "data.ms-graph.actor.auditActorType",
      "data.ms-graph.actor.ipAddress",
      "data.ms-graph.actor.servicePrincipalName",
      "data.ms-graph.actor.type",
      "data.ms-graph.actor.userId",
      "data.ms-graph.actor.userPermissions",
      "data.ms-graph.actor.userPrincipalName",
      "data.ms-graph.androidSecurityPatchLevel",
      "data.ms-graph.appliedConditionalAccessPolicies",
      "data.ms-graph.azureADDeviceId",
      "data.ms-graph.azureADRegistered",
      "data.ms-graph.complianceState",
      "data.ms-graph.componentName",
      "data.ms-graph.configurationManagerClientEnabledFeatures.@odata.type",
      "data.ms-graph.configurationManagerClientEnabledFeatures.compliancePolicy",
      "data.ms-graph.configurationManagerClientEnabledFeatures.deviceConfiguration",
      "data.ms-graph.configurationManagerClientEnabledFeatures.inventory",
      "data.ms-graph.configurationManagerClientEnabledFeatures.modernApps",
      "data.ms-graph.configurationManagerClientEnabledFeatures.resourceAccess",
      "data.ms-graph.configurationManagerClientEnabledFeatures.windowsUpdateForBusiness",
      "data.ms-graph.correlationId",
      "data.ms-graph.deviceActionResults.@odata.type",
      "data.ms-graph.deviceActionResults.actionName",
      "data.ms-graph.deviceActionResults.actionState",
      "data.ms-graph.deviceCategoryDisplayName",
      "data.ms-graph.deviceEnrollmentType",
      "data.ms-graph.deviceHealthAttestationState.@odata.type",
      "data.ms-graph.deviceHealthAttestationState.attestationIdentityKey",
      "data.ms-graph.deviceHealthAttestationState.bitLockerStatus",
      "data.ms-graph.deviceHealthAttestationState.bootAppSecurityVersion",
      "data.ms-graph.deviceHealthAttestationState.bootDebugging",
      "data.ms-graph.deviceHealthAttestationState.bootManagerSecurityVersion",
      "data.ms-graph.deviceHealthAttestationState.bootManagerVersion",
      "data.ms-graph.deviceHealthAttestationState.bootRevisionListInfo",
      "data.ms-graph.deviceHealthAttestationState.codeIntegrity",
      "data.ms-graph.deviceHealthAttestationState.codeIntegrityCheckVersion",
      "data.ms-graph.deviceHealthAttestationState.codeIntegrityPolicy",
      "data.ms-graph.deviceHealthAttestationState.contentNamespaceUrl",
      "data.ms-graph.deviceHealthAttestationState.contentVersion",
      "data.ms-graph.deviceHealthAttestationState.dataExcutionPolicy",
      "data.ms-graph.deviceHealthAttestationState.deviceHealthAttestationStatus",
      "data.ms-graph.deviceHealthAttestationState.earlyLaunchAntiMalwareDriverProtection",
      "data.ms-graph.deviceHealthAttestationState.healthAttestationSupportedStatus",
      "data.ms-graph.deviceHealthAttestationState.healthStatusMismatchInfo",
      "data.ms-graph.deviceHealthAttestationState.operatingSystemKernelDebugging",
      "data.ms-graph.deviceHealthAttestationState.operatingSystemRevListInfo",
      "data.ms-graph.deviceHealthAttestationState.pcr0",
      "data.ms-graph.deviceHealthAttestationState.pcrHashAlgorithm",
      "data.ms-graph.deviceHealthAttestationState.resetCount",
      "data.ms-graph.deviceHealthAttestationState.restartCount",
      "data.ms-graph.deviceHealthAttestationState.safeMode",
      "data.ms-graph.deviceHealthAttestationState.secureBoot",
      "data.ms-graph.deviceHealthAttestationState.secureBootConfigurationPolicyFingerPrint",
      "data.ms-graph.deviceHealthAttestationState.testSigning",
      "data.ms-graph.deviceHealthAttestationState.tpmVersion",
      "data.ms-graph.deviceHealthAttestationState.virtualSecureMode",
      "data.ms-graph.deviceHealthAttestationState.windowsPE",
      "data.ms-graph.deviceName",
      "data.ms-graph.deviceRegistrationState",
      "data.ms-graph.displayName",
      "data.ms-graph.easActivated",
      "data.ms-graph.easDeviceId",
      "data.ms-graph.emailAddress",
      "data.ms-graph.enrollmentProfileName",
      "data.ms-graph.ethernetMacAddress",
      "data.ms-graph.exchangeAccessState",
      "data.ms-graph.exchangeAccessStateReason",
      "data.ms-graph.freeStorageSpaceInBytes",
      "data.ms-graph.iccid",
      "data.ms-graph.imei",
      "data.ms-graph.isEncrypted",
      "data.ms-graph.isSupervised",
      "data.ms-graph.jailBroken",
      "data.ms-graph.managedDeviceName",
      "data.ms-graph.managedDevices.deviceName",
      "data.ms-graph.managedDevices.id",
      "data.ms-graph.managedDeviceOwnerType",
      "data.ms-graph.managementAgent",
      "data.ms-graph.manufacturer",
      "data.ms-graph.meid",
      "data.ms-graph.model",
      "data.ms-graph.notes",
      "data.ms-graph.operatingSystem",
      "data.ms-graph.osVersion",
      "data.ms-graph.partnerReportedThreatState",
      "data.ms-graph.phoneNumber",
      "data.ms-graph.physicalMemoryInBytes",
      "data.ms-graph.platform",
      "data.ms-graph.publisher",
      "data.ms-graph.remoteAssistanceSessionErrorDetails",
      "data.ms-graph.remoteAssistanceSessionUrl",
      "data.ms-graph.requireUserEnrollmentApproval",
      "data.ms-graph.resources.@odata.type",
      "data.ms-graph.resources.auditResourceType",
      "data.ms-graph.resources.displayName",
      "data.ms-graph.resources.modifiedProperties.@odata.type",
      "data.ms-graph.resources.modifiedProperties.displayName",
      "data.ms-graph.resources.modifiedProperties.oldValue",
      "data.ms-graph.resources.modifiedProperties.newValue",
      "data.ms-graph.resources.resourceId",
      "data.ms-graph.resources.type",
      "data.ms-graph.serialNumber",
      "data.ms-graph.sizeInByte",
      "data.ms-graph.subscriberCarrier",
      "data.ms-graph.totalStorageSpaceInBytes",
      "data.ms-graph.udid",
      "data.ms-graph.userDisplayName",
      "data.ms-graph.userId",
      "data.ms-graph.userPrincipalName",
      "data.ms-graph.version",
      "data.ms-graph.wiFiMacAddress",
      "data.os.architecture",
      "data.os.build",
      "data.os.codename",
      "data.os.hostname",
      "data.os.major",
      "data.os.minor",
      "data.os.patch",
      "data.os.name",
      "data.os.platform",
      "data.os.release",
      "data.os.release_version",
      "data.os.display_version",
      "data.os.sysname",
      "data.os.version",
      "data.oscap.check.description",
      "data.oscap.check.id",
      "data.oscap.check.identifiers",
      "data.oscap.check.oval.id",
      "data.oscap.check.rationale",
      "data.oscap.check.references",
      "data.oscap.check.result",
      "data.oscap.check.severity",
      "data.oscap.check.title",
      "data.oscap.scan.benchmark.id",
      "data.oscap.scan.content",
      "data.oscap.scan.id",
      "data.oscap.scan.profile.id",
      "data.oscap.scan.profile.title",
      "data.osquery.columns.address",
      "data.osquery.columns.command",
      "data.osquery.columns.description",
      "data.osquery.columns.dst_ip",
      "data.osquery.columns.gid",
      "data.osquery.columns.hostname",
      "data.osquery.columns.md5",
      "data.osquery.columns.path",
      "data.osquery.columns.sha1",
      "data.osquery.columns.sha256",
      "data.osquery.columns.src_ip",
      "data.osquery.columns.user",
      "data.osquery.columns.username",
      "data.osquery.name",
      "data.osquery.pack",
      "data.port.process",
      "data.port.protocol",
      "data.port.state",
      "data.process.args",
      "data.process.cmd",
      "data.process.egroup",
      "data.process.euser",
      "data.process.fgroup",
      "data.process.name",
      "data.process.rgroup",
      "data.process.ruser",
      "data.process.sgroup",
      "data.process.state",
      "data.process.suser",
      "data.program.architecture",
      "data.program.description",
      "data.program.format",
      "data.program.location",
      "data.program.multiarch",
      "data.program.name",
      "data.program.priority",
      "data.program.section",
      "data.program.source",
      "data.program.vendor",
      "data.program.version",
      "data.protocol",
      "data.pwd",
      "data.sca",
      "data.sca.check.compliance.cis",
      "data.sca.check.compliance.cis_csc",
      "data.sca.check.compliance.pci_dss",
      "data.sca.check.compliance.hipaa",
      "data.sca.check.compliance.nist_800_53",
      "data.sca.check.description",
      "data.sca.check.directory",
      "data.sca.check.file",
      "data.sca.check.id",
      "data.sca.check.previous_result",
      "data.sca.check.process",
      "data.sca.check.rationale",
      "data.sca.check.reason",
      "data.sca.check.references",
      "data.sca.check.registry",
      "data.sca.check.remediation",
      "data.sca.check.result",
      "data.sca.check.title",
      "data.sca.description",
      "data.sca.file",
      "data.sca.invalid",
      "data.sca.name",
      "data.sca.policy",
      "data.sca.policy_id",
      "data.sca.scan_id",
      "data.sca.total_checks",
      "data.scan_id",
      "data.script",
      "data.src_ip",
      "data.src_port",
      "data.srcip",
      "data.srcport",
      "data.srcuser",
      "data.status",
      "data.system_name",
      "data.title",
      "data.tty",
      "data.uid",
      "data.url",
      "data.virustotal.description",
      "data.virustotal.error",
      "data.virustotal.found",
      "data.virustotal.permalink",
      "data.virustotal.scan_date",
      "data.virustotal.sha1",
      "data.virustotal.source.alert_id",
      "data.virustotal.source.file",
      "data.virustotal.source.md5",
      "data.virustotal.source.sha1",
      "data.vulnerability.cve",
      "data.vulnerability.cvss.cvss2.base_score",
      "data.vulnerability.cvss.cvss2.exploitability_score",
      "data.vulnerability.cvss.cvss2.impact_score",
      "data.vulnerability.cvss.cvss2.vector.access_complexity",
      "data.vulnerability.cvss.cvss2.vector.attack_vector",
      "data.vulnerability.cvss.cvss2.vector.authentication",
      "data.vulnerability.cvss.cvss2.vector.availability",
      "data.vulnerability.cvss.cvss2.vector.confidentiality_impact",
      "data.vulnerability.cvss.cvss2.vector.integrity_impact",
      "data.vulnerability.cvss.cvss2.vector.privileges_required",
      "data.vulnerability.cvss.cvss2.vector.scope",
      "data.vulnerability.cvss.cvss2.vector.user_interaction",
      "data.vulnerability.cvss.cvss3.base_score",
      "data.vulnerability.cvss.cvss3.exploitability_score",
      "data.vulnerability.cvss.cvss3.impact_score",
      "data.vulnerability.cvss.cvss3.vector.access_complexity",
      "data.vulnerability.cvss.cvss3.vector.attack_vector",
      "data.vulnerability.cvss.cvss3.vector.authentication",
      "data.vulnerability.cvss.cvss3.vector.availability",
      "data.vulnerability.cvss.cvss3.vector.confidentiality_impact",
      "data.vulnerability.cvss.cvss3.vector.integrity_impact",
      "data.vulnerability.cvss.cvss3.vector.privileges_required",
      "data.vulnerability.cvss.cvss3.vector.scope",
      "data.vulnerability.cvss.cvss3.vector.user_interaction",
      "data.vulnerability.cwe_reference",
      "data.vulnerability.package.source",
      "data.vulnerability.package.architecture",
      "data.vulnerability.package.condition",
      "data.vulnerability.package.generated_cpe",
      "data.vulnerability.package.name",
      "data.vulnerability.package.version",
      "data.vulnerability.rationale",
      "data.vulnerability.reference",
      "data.vulnerability.severity",
      "data.vulnerability.status",
      "data.vulnerability.title",
      "data.vulnerability.assigner",
      "data.vulnerability.cve_version",
      "data.win.eventdata.auditPolicyChanges",
      "data.win.eventdata.auditPolicyChangesId",
      "data.win.eventdata.binary",
      "data.win.eventdata.category",
      "data.win.eventdata.categoryId",
      "data.win.eventdata.data",
      "data.win.eventdata.image",
      "data.win.eventdata.ipAddress",
      "data.win.eventdata.ipPort",
      "data.win.eventdata.keyName",
      "data.win.eventdata.logonGuid",
      "data.win.eventdata.logonProcessName",
      "data.win.eventdata.operation",
      "data.win.eventdata.parentImage",
      "data.win.eventdata.processId",
      "data.win.eventdata.processName",
      "data.win.eventdata.providerName",
      "data.win.eventdata.returnCode",
      "data.win.eventdata.service",
      "data.win.eventdata.status",
      "data.win.eventdata.subcategory",
      "data.win.eventdata.subcategoryGuid",
      "data.win.eventdata.subcategoryId",
      "data.win.eventdata.subjectDomainName",
      "data.win.eventdata.subjectLogonId",
      "data.win.eventdata.subjectUserName",
      "data.win.eventdata.subjectUserSid",
      "data.win.eventdata.targetDomainName",
      "data.win.eventdata.targetLinkedLogonId",
      "data.win.eventdata.targetLogonId",
      "data.win.eventdata.targetUserName",
      "data.win.eventdata.targetUserSid",
      "data.win.eventdata.workstationName",
      "data.win.system.channel",
      "data.win.system.computer",
      "data.win.system.eventID",
      "data.win.system.eventRecordID",
      "data.win.system.eventSourceName",
      "data.win.system.keywords",
      "data.win.system.level",
      "data.win.system.message",
      "data.win.system.opcode",
      "data.win.system.processID",
      "data.win.system.providerGuid",
      "data.win.system.providerName",
      "data.win.system.securityUserID",
      "data.win.system.severityValue",
      "data.win.system.userID",
      "decoder.ftscomment",
      "decoder.name",
      "decoder.parent",
      "full_log",
      "host",
      "id",
      "input",
      "location",
      "manager.name",
      "message",
      "offset",
      "predecoder.hostname",
      "predecoder.program_name",
      "previous_log",
      "previous_output",
      "program_name",
      "rule.cis",
      "rule.cve",
      "rule.description",
      "rule.gdpr",
      "rule.gpg13",
      "rule.groups",
      "rule.id",
      "rule.info",
      "rule.mitre.id",
      "rule.mitre.tactic",
      "rule.mitre.technique",
      "rule.pci_dss",
      "rule.hipaa",
      "rule.nist_800_53",
      "syscheck.audit.effective_user.id",
      "syscheck.audit.effective_user.name",
      "syscheck.audit.group.id",
      "syscheck.audit.group.name",
      "syscheck.audit.login_user.id",
      "syscheck.audit.login_user.name",
      "syscheck.audit.process.id",
      "syscheck.audit.process.name",
      "syscheck.audit.process.ppid",
      "syscheck.audit.user.id",
      "syscheck.audit.user.name",
      "syscheck.diff",
      "syscheck.event",
      "syscheck.gid_after",
      "syscheck.gid_before",
      "syscheck.gname_after",
      "syscheck.gname_before",
      "syscheck.inode_after",
      "syscheck.inode_before",
      "syscheck.md5_after",
      "syscheck.md5_before",
      "syscheck.path",
      "syscheck.mode",
      "syscheck.perm_after",
      "syscheck.perm_before",
      "syscheck.sha1_after",
      "syscheck.sha1_before",
      "syscheck.sha256_after",
      "syscheck.sha256_before",
      "syscheck.tags",
      "syscheck.uid_after",
      "syscheck.uid_before",
      "syscheck.uname_after",
      "syscheck.uname_before",
      "syscheck.arch",
      "syscheck.value_name",
      "syscheck.value_type",
      "syscheck.changed_attributes",
      "title"
    ],
    "index.refresh_interval": "5s"
  },
  "version": 1
}
2026-01-02T14:38:57.326Z	INFO	[publisher_pipeline_output]	pipeline/output.go:145	Attempting to reconnect to backoff(elasticsearch(https://wazuh.indexer:9200)) with 3 reconnect attempt(s)
2026-01-02T14:38:57.327Z	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2026-01-02T14:38:57.327Z	INFO	[publisher]	pipeline/retry.go:223	  done
2026-01-02T14:38:57.330Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.10.2
2026-01-02T14:39:18.712Z	INFO	fileset/pipelines.go:143	Elasticsearch pipeline with ID 'filebeat-7.10.2-wazuh-alerts-pipeline' loaded
2026-01-02T14:39:18.717Z	INFO	template/load.go:183	Existing template will be overwritten, as overwrite is enabled.
2026-01-02T14:39:18.719Z	INFO	template/load.go:117	Try loading template wazuh to Elasticsearch
2026/01/02 14:39:23 wazuh-modulesd:vulnerability-scanner: INFO: Database decompression finished.
2026-01-02T14:39:46.901Z	INFO	template/load.go:109	template with name 'wazuh' loaded.
2026-01-02T14:39:46.901Z	INFO	[index-management]	idxmgmt/std.go:298	Loaded index template.
2026-01-02T14:39:46.901Z	INFO	[publisher_pipeline_output]	pipeline/output.go:151	Connection to backoff(elasticsearch(https://wazuh.indexer:9200)) established
2026/01/02 14:39:50 wazuh-modulesd:vulnerability-scanner: INFO: Vulnerability scanner module started.
2026-01-02T14:42:46.632Z	INFO	log/harvester.go:333	File is inactive: /var/ossec/logs/alerts/alerts.json. Closing because close_inactive of 5m0s reached.
#################################################################
docker logs wazuh-runtipi_synode-it-wazuh-certs-1
#################################################################
CERTS_INIT: Starting certificate initialization...
CERTS_INIT: Creating directories...
CERTS_INIT: Starting Super-Janitor Sweep...
CERTS_INIT: Generating new certificates...
Checking https://packages.wazuh.com/4.14/wazuh-certs-tool.sh ...
Downloaded wazuh-certs-tool.sh from https://packages.wazuh.com/4.14/
02/01/2026 14:36:36 INFO: Verbose logging redirected to //wazuh-certificates-tool.log
02/01/2026 14:36:37 INFO: Generating the root certificate.
02/01/2026 14:36:37 INFO: Generating Admin certificates.
02/01/2026 14:36:37 INFO: Admin certificates created.
02/01/2026 14:36:37 INFO: Generating Wazuh indexer certificates.
02/01/2026 14:36:38 INFO: Wazuh indexer certificates created.
02/01/2026 14:36:38 INFO: Generating Filebeat certificates.
02/01/2026 14:36:38 INFO: Wazuh Filebeat certificates created.
02/01/2026 14:36:38 INFO: Generating Wazuh dashboard certificates.
02/01/2026 14:36:38 INFO: Wazuh dashboard certificates created.
Moving created certificates to the destination directory
Changing certificate permissions
Setting UID indexer and dashboard
Setting UID for wazuh manager and worker
CERTS_INIT: Creating certificate symlinks...
CERTS_INIT: Setting ownership and permissions...
CERTS_INIT: Certificates ready
#################################################################
docker logs wazuh-runtipi_synode-it-wazuh-dashboard-1
#################################################################
DASHBOARD_INIT: Starting dashboard initialization...
DASHBOARD_INIT: Ensuring custom config directory exists...
DASHBOARD_INIT: Creating default dashboard config...
DASHBOARD_INIT: Default dashboard config created
DASHBOARD_INIT: Creating symlink to custom config...
DASHBOARD_INIT: Configuration complete, starting dashboard...
Created OpenSearch Dashboards keystore in /usr/share/wazuh-dashboard/config/opensearch_dashboards.keystore
{"type":"log","@timestamp":"2026-01-02T14:36:51Z","tags":["info","plugins-service"],"pid":59,"message":"Plugin \"applicationConfig\" is disabled."}
{"type":"log","@timestamp":"2026-01-02T14:36:51Z","tags":["info","plugins-service"],"pid":59,"message":"Plugin \"cspHandler\" is disabled."}
{"type":"log","@timestamp":"2026-01-02T14:36:51Z","tags":["info","plugins-service"],"pid":59,"message":"Plugin \"dataSource\" is disabled."}
{"type":"log","@timestamp":"2026-01-02T14:36:51Z","tags":["info","plugins-service"],"pid":59,"message":"Plugin \"visTypeXy\" is disabled."}
{"type":"log","@timestamp":"2026-01-02T14:36:51Z","tags":["info","plugins-service"],"pid":59,"message":"Plugin \"workspace\" is disabled."}
{"type":"log","@timestamp":"2026-01-02T14:36:51Z","tags":["warning","config","deprecation"],"pid":59,"message":"\"opensearch.requestHeadersWhitelist\" is deprecated and has been replaced by \"opensearch.requestHeadersAllowlist\""}
{"type":"log","@timestamp":"2026-01-02T14:36:51Z","tags":["info","dynamic-config-service"],"pid":59,"message":"registering middleware to inject context to AsyncLocalStorage"}
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
{"type":"log","@timestamp":"2026-01-02T14:36:51Z","tags":["info","plugins-system"],"pid":59,"message":"Setting up [51] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,savedObjects,queryEnhancements,home,dashboard,visualizations,visTypeVega,visTypeTimeline,visTypeTable,visTypeMarkdown,visBuilder,visAugmenter,tileMap,regionMap,inputControlVis,ganttChartDashboards,visualize,apmOss,management,indexPatternManagement,dataSourceManagement,reportsDashboards,indexManagementDashboards,customImportMapDashboards,anomalyDetectionDashboards,alertingDashboards,notificationsDashboards,console,advancedSettings,dataExplorer,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh,bfetch]"}
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
{"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["info","plugins","queryEnhancements"],"pid":59,"message":"queryEnhancements: Setup complete"}
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
{"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["info","dynamic-config-service"],"pid":59,"message":"initiating start()"}
{"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["info","dynamic-config-service"],"pid":59,"message":"finished start()"}
{"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["info","savedobjects-service"],"pid":59,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations..."}
{"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["error","opensearch","data"],"pid":59,"message":"[ConnectionError]: connect ECONNREFUSED 10.128.10.3:9200"}
{"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["error","savedobjects-service"],"pid":59,"message":"Unable to retrieve version information from OpenSearch nodes."}
{"type":"log","@timestamp":"2026-01-02T14:36:55Z","tags":["error","opensearch","data"],"pid":59,"message":"[ConnectionError]: connect ECONNREFUSED 10.128.10.3:9200"}
{"type":"log","@timestamp":"2026-01-02T14:36:57Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2026-01-02T14:37:00Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2026-01-02T14:37:02Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2026-01-02T14:37:05Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2026-01-02T14:37:07Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2026-01-02T14:37:10Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","savedobjects-service"],"pid":59,"message":"Starting saved objects migrations"}
{"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","savedobjects-service"],"pid":59,"message":"Creating index .kibana_1."}
{"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","savedobjects-service"],"pid":59,"message":"Pointing alias .kibana to .kibana_1."}
{"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","savedobjects-service"],"pid":59,"message":"Finished in 445ms."}
{"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["warning","cross-compatibility-service"],"pid":59,"message":"Starting cross compatibility service"}
{"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","plugins-system"],"pid":59,"message":"Starting [51] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,savedObjects,queryEnhancements,home,dashboard,visualizations,visTypeVega,visTypeTimeline,visTypeTable,visTypeMarkdown,visBuilder,visAugmenter,tileMap,regionMap,inputControlVis,ganttChartDashboards,visualize,apmOss,management,indexPatternManagement,dataSourceManagement,reportsDashboards,indexManagementDashboards,customImportMapDashboards,anomalyDetectionDashboards,alertingDashboards,notificationsDashboards,console,advancedSettings,dataExplorer,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh,bfetch]"}
{"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["info","plugins","wazuh","initialize"],"pid":59,"message":"dashboard index: .kibana"}
{"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["info","plugins","wazuh","initialize"],"pid":59,"message":"App revision: 02"}
{"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["info","plugins","wazuh","initialize"],"pid":59,"message":"Total RAM: 11958MB"}
{"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2026-01-02T14:37:15Z","tags":["listening","info"],"pid":59,"message":"Server running at https://0.0.0.0:5601"}
{"type":"log","@timestamp":"2026-01-02T14:37:15Z","tags":["info","http","server","OpenSearchDashboards"],"pid":59,"message":"http server running at https://0.0.0.0:5601"}
{"type":"response","@timestamp":"2026-01-02T14:37:20Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":11,"contentLength":9},"message":"GET /app/wazuh 302 11ms - 9.0B"}
{"type":"response","@timestamp":"2026-01-02T14:37:50Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":9,"contentLength":9},"message":"GET /app/wazuh 302 9ms - 9.0B"}
{"type":"log","@timestamp":"2026-01-02T14:38:11Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":59,"message":"Updated the wazuh-statistics template"}
{"type":"response","@timestamp":"2026-01-02T14:38:20Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":5,"contentLength":9},"message":"GET /app/wazuh 302 5ms - 9.0B"}
{"type":"response","@timestamp":"2026-01-02T14:38:50Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
{"type":"log","@timestamp":"2026-01-02T14:39:04Z","tags":["info","plugins","wazuh","monitoring"],"pid":59,"message":"Updated the wazuh-agent template"}
{"type":"response","@timestamp":"2026-01-02T14:39:20Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
{"type":"log","@timestamp":"2026-01-02T14:39:46Z","tags":["error","opensearch","data"],"pid":59,"message":"[resource_already_exists_exception]: index [wazuh-monitoring-2026.1w/DYh62qctQ3arcGYuH_i56g] already exists"}
{"type":"log","@timestamp":"2026-01-02T14:39:46Z","tags":["error","plugins","wazuh","monitoring"],"pid":59,"message":"Could not create wazuh-monitoring-2026.1w index: resource_already_exists_exception: [resource_already_exists_exception] Reason: index [wazuh-monitoring-2026.1w/DYh62qctQ3arcGYuH_i56g] already exists"}
{"type":"log","@timestamp":"2026-01-02T14:39:49Z","tags":["info","plugins","wazuh","monitoring"],"pid":59,"message":"Settings added to wazuh-monitoring-2026.1w index"}
{"type":"response","@timestamp":"2026-01-02T14:39:50Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":4,"contentLength":9},"message":"GET /app/wazuh 302 4ms - 9.0B"}
{"type":"log","@timestamp":"2026-01-02T14:40:03Z","tags":["error","opensearch","data"],"pid":59,"message":"[resource_already_exists_exception]: index [wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A] already exists"}
{"type":"log","@timestamp":"2026-01-02T14:40:05Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":59,"message":"wazuh-statistics-2026.1w index created"}
{"type":"response","@timestamp":"2026-01-02T14:40:20Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
{"type":"response","@timestamp":"2026-01-02T14:40:50Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
{"type":"response","@timestamp":"2026-01-02T14:41:21Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
{"type":"response","@timestamp":"2026-01-02T14:41:51Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
{"type":"response","@timestamp":"2026-01-02T14:42:21Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":4,"contentLength":9},"message":"GET /app/wazuh 302 4ms - 9.0B"}
{"type":"response","@timestamp":"2026-01-02T14:42:51Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":2,"contentLength":9},"message":"GET /app/wazuh 302 2ms - 9.0B"}
{"type":"response","@timestamp":"2026-01-02T14:43:21Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":2,"contentLength":9},"message":"GET /app/wazuh 302 2ms - 9.0B"}
#################################################################
docker logs wazuh-runtipi_synode-it-wazuh-indexer-init-1
#################################################################
INDEXER_INIT: Starting security initialization...
INDEXER_INIT: Copying security configs...
cp: cannot create regular file '/mnt/host-security/config.yml': Permission denied
INDEXER_INIT: Starting security initialization...
INDEXER_INIT: Copying security configs...
INDEXER_INIT: Copied config.yml
INDEXER_INIT: Copied roles.yml
INDEXER_INIT: Copied roles_mapping.yml
INDEXER_INIT: Copied internal_users.yml
INDEXER_INIT: Copied action_groups.yml
INDEXER_INIT: Copied tenants.yml
INDEXER_INIT: Copied nodes_dn.yml
INDEXER_INIT: Copied whitelist.yml
INDEXER_INIT: Security files ready
INDEXER_INIT: Waiting for indexer to be available...
INDEXER_INIT: Indexer not ready, retrying in 5 seconds...
INDEXER_INIT: Indexer not ready, retrying in 5 seconds...
INDEXER_INIT: Indexer not ready, retrying in 5 seconds...
INDEXER_INIT: Indexer not ready, retrying in 5 seconds...
OpenSearch Security not initialized.INDEXER_INIT: Indexer is ready, initializing security...
Security Admin v7
Will connect to wazuh.indexer:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.19.3
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /mnt/host-security/
Will update '/config' with /mnt/host-security/config.yml 
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /mnt/host-security/roles.yml 
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /mnt/host-security/roles_mapping.yml 
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /mnt/host-security/internal_users.yml 
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /mnt/host-security/action_groups.yml 
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /mnt/host-security/tenants.yml 
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /mnt/host-security/nodes_dn.yml 
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /mnt/host-security/whitelist.yml 
   SUCC: Configuration for 'whitelist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","actiongroups","config","internalusers"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","actiongroups","config","internalusers"]) due to: null
Done with success
INDEXER_INIT: Security initialization completed successfully
INDEXER_INIT: Initialization complete, container will remain alive
=========================================
   WAZUH HEALTH CHECK - 2026-01-02 14:43:32
=========================================

Configuration:
  Container prefix: wazuh-runtipi_synode-it
  Data directory: /opt/runtipi/app-data/synode-it/wazuh-runtipi/data
  Security directory: /opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-security

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. SERVICES HEALTH CHECK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  certs: ✓ Running & Healthy
  indexer: ✓ Running & Healthy
  manager: ✓ Running & Healthy
  dashboard: ✓ Running & Healthy
  indexer-init: ✓ Running & Healthy (init complete)

Summary: 5 OK | 0 FAILED

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1b. CONTAINER LOGS (Last 50 lines)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

═══════════════════════════════════════════════════
Container: wazuh-runtipi_synode-it-wazuh-certs-1
Status: running | Health: healthy
═══════════════════════════════════════════════════
  CERTS_INIT: Starting certificate initialization...
  CERTS_INIT: Creating directories...
  CERTS_INIT: Starting Super-Janitor Sweep...
  CERTS_INIT: Generating new certificates...
  Checking https://packages.wazuh.com/4.14/wazuh-certs-tool.sh ...
  Downloaded wazuh-certs-tool.sh from https://packages.wazuh.com/4.14/
  02/01/2026 14:36:36 INFO: Verbose logging redirected to //wazuh-certificates-tool.log
  02/01/2026 14:36:37 INFO: Generating the root certificate.
  02/01/2026 14:36:37 INFO: Generating Admin certificates.
  02/01/2026 14:36:37 INFO: Admin certificates created.
  02/01/2026 14:36:37 INFO: Generating Wazuh indexer certificates.
  02/01/2026 14:36:38 INFO: Wazuh indexer certificates created.
  02/01/2026 14:36:38 INFO: Generating Filebeat certificates.
  02/01/2026 14:36:38 INFO: Wazuh Filebeat certificates created.
  02/01/2026 14:36:38 INFO: Generating Wazuh dashboard certificates.
  02/01/2026 14:36:38 INFO: Wazuh dashboard certificates created.
  Moving created certificates to the destination directory
  Changing certificate permissions
  Setting UID indexer and dashboard
  Setting UID for wazuh manager and worker
  CERTS_INIT: Creating certificate symlinks...
  CERTS_INIT: Setting ownership and permissions...
  CERTS_INIT: Certificates ready

═══════════════════════════════════════════════════
Container: wazuh-runtipi_synode-it-wazuh-indexer-1
Status: running | Health: healthy
═══════════════════════════════════════════════════
  [2026-01-02T14:38:57,493][INFO ][o.o.i.i.MetadataService  ] [wazuh.indexer] Move metadata has finished.
  [2026-01-02T14:38:57,753][ERROR][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Failed to create index .plugins-ml-config
  org.opensearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (create-index [.plugins-ml-config], cause [api]) within 30s
  	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$0(MasterService.java:217) [opensearch-2.19.3.jar:2.19.3]
  	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) [?:?]
  	at org.opensearch.cluster.service.MasterService$Batcher.lambda$onTimeout$1(MasterService.java:216) [opensearch-2.19.3.jar:2.19.3]
  	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:955) [opensearch-2.19.3.jar:2.19.3]
  	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
  	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
  	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
  [2026-01-02T14:38:59,576][WARN ][o.o.s.a.BackendRegistry  ] [wazuh.indexer] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
  [2026-01-02T14:39:04,498][INFO ][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Skip creating the Index:.plugins-ml-config that is already created by another parallel request
  [2026-01-02T14:39:04,505][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[vlaaL8FtSia5a8qDi4vjaw/3wzIY1EHS4KoekVq3SpMug]
  [2026-01-02T14:39:04,513][INFO ][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Skip creating the Index:.plugins-ml-config that is already created by another parallel request
  [2026-01-02T14:39:04,515][INFO ][o.o.m.e.i.MLIndicesHandler] [wazuh.indexer] Skip creating the Index:.plugins-ml-config that is already created by another parallel request
  [2026-01-02T14:39:18,704][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [14209ms] which is above the warn threshold of [10s]; wrote global metadata [true] and metadata for [0] indices and skipped [4] unchanged indices
  [2026-01-02T14:39:18,705][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [14.2s] publication of cluster state version [22] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
  [2026-01-02T14:39:18,716][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-monitoring-2026.1w/DYh62qctQ3arcGYuH_i56g]
  [2026-01-02T14:39:18,724][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-monitoring-2026.1w] creating index, cause [api], templates [wazuh-agent], shards [1]/[0]
  [2026-01-02T14:39:33,245][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [14610ms] which is above the warn threshold of [10s]; wrote global metadata [false] and metadata for [1] indices and skipped [4] unchanged indices
  [2026-01-02T14:39:33,246][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [14.6s] publication of cluster state version [23] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
  [2026-01-02T14:39:33,249][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-monitoring-2026.1w/DYh62qctQ3arcGYuH_i56g]
  [2026-01-02T14:39:35,505][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[TQemaB2DTUm7p-qowv4Yhg/BC4Y1JkxTeO7dfDmAktF2A]
  [2026-01-02T14:39:35,568][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding template [wazuh] for index patterns [wazuh-alerts-4.x-*, wazuh-archives-4.x-*]
  [2026-01-02T14:39:46,892][WARN ][o.o.g.PersistedClusterStateService] [wazuh.indexer] writing cluster state took [11415ms] which is above the warn threshold of [10s]; wrote global metadata [true] and metadata for [0] indices and skipped [5] unchanged indices
  [2026-01-02T14:39:46,893][INFO ][o.o.c.c.C.CoordinatorPublication] [wazuh.indexer] after [11.4s] publication of cluster state version [24] is still waiting for {wazuh.indexer}{jeO_mKrESxWeD0COXlnc_w}{vldCRbqtQmWErKtkCVcYIA}{10.128.10.3}{10.128.10.3:9300}{dimr}{shard_indexing_pressure_enabled=true} [SENT_PUBLISH_REQUEST]
  [2026-01-02T14:39:49,292][INFO ][o.o.c.m.MetadataUpdateSettingsService] [wazuh.indexer] updating number_of_replicas to [0] for indices [wazuh-monitoring-2026.1w]
  [2026-01-02T14:39:49,307][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
  [2026-01-02T14:39:49,393][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-alerts-4.x-2026.01.02] creating index, cause [auto(bulk api)], templates [wazuh], shards [3]/[0]
  [2026-01-02T14:39:49,418][INFO ][o.o.m.c.MLSyncUpCron     ] [wazuh.indexer] ML configuration initialized successfully
  [2026-01-02T14:39:50,623][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
  [2026-01-02T14:39:55,429][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[wazuh-alerts-4.x-2026.01.02][1], [wazuh-alerts-4.x-2026.01.02][2]]]).
  [2026-01-02T14:39:56,461][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
  [2026-01-02T14:39:56,518][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q] update_mapping [_doc]
  [2026-01-02T14:39:57,747][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
  [2026-01-02T14:39:57,785][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q] update_mapping [_doc]
  [2026-01-02T14:39:59,688][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
  [2026-01-02T14:39:59,726][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
  [2026-01-02T14:40:00,025][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
  [2026-01-02T14:40:00,065][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q] update_mapping [_doc]
  [2026-01-02T14:40:01,242][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A]
  [2026-01-02T14:40:01,249][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-statistics-2026.1w] creating index, cause [api], templates [wazuh-statistics], shards [1]/[0]
  [2026-01-02T14:40:02,396][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A]
  [2026-01-02T14:40:03,121][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2026.01.02/18MchhZsSju3qq9i1Y5H5Q]
  [2026-01-02T14:40:04,894][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[wazuh-statistics-2026.1w][0]]]).
  [2026-01-02T14:40:05,857][INFO ][o.o.p.PluginsService     ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A]
  [2026-01-02T14:40:05,871][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A] update_mapping [_doc]
  [2026-01-02T14:41:57,062][INFO ][o.o.j.s.JobSweeper       ] [wazuh.indexer] Running full sweep
  [2026-01-02T14:41:57,485][INFO ][o.o.i.i.PluginVersionSweepCoordinator] [wazuh.indexer] Canceling sweep ism plugin version job
  [2026-01-02T14:42:59,058][WARN ][o.o.s.a.BackendRegistry  ] [wazuh.indexer] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'

═══════════════════════════════════════════════════
Container: wazuh-runtipi_synode-it-wazuh-indexer-init-1
Status: running | Health: healthy
═══════════════════════════════════════════════════
  INDEXER_INIT: Copying security configs...
  cp: cannot create regular file '/mnt/host-security/config.yml': Permission denied
  INDEXER_INIT: Starting security initialization...
  INDEXER_INIT: Copying security configs...
  INDEXER_INIT: Copied config.yml
  INDEXER_INIT: Copied roles.yml
  INDEXER_INIT: Copied roles_mapping.yml
  INDEXER_INIT: Copied internal_users.yml
  INDEXER_INIT: Copied action_groups.yml
  INDEXER_INIT: Copied tenants.yml
  INDEXER_INIT: Copied nodes_dn.yml
  INDEXER_INIT: Copied whitelist.yml
  INDEXER_INIT: Security files ready
  INDEXER_INIT: Waiting for indexer to be available...
  INDEXER_INIT: Indexer not ready, retrying in 5 seconds...
  INDEXER_INIT: Indexer not ready, retrying in 5 seconds...
  INDEXER_INIT: Indexer not ready, retrying in 5 seconds...
  INDEXER_INIT: Indexer not ready, retrying in 5 seconds...
  OpenSearch Security not initialized.INDEXER_INIT: Indexer is ready, initializing security...
  Security Admin v7
  Will connect to wazuh.indexer:9200 ... done
  Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
  OpenSearch Version: 2.19.3
  Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
  Clustername: wazuh-cluster
  Clusterstate: GREEN
  Number of nodes: 1
  Number of data nodes: 1
  .opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
  Populate config from /mnt/host-security/
  Will update '/config' with /mnt/host-security/config.yml 
     SUCC: Configuration for 'config' created or updated
  Will update '/roles' with /mnt/host-security/roles.yml 
     SUCC: Configuration for 'roles' created or updated
  Will update '/rolesmapping' with /mnt/host-security/roles_mapping.yml 
     SUCC: Configuration for 'rolesmapping' created or updated
  Will update '/internalusers' with /mnt/host-security/internal_users.yml 
     SUCC: Configuration for 'internalusers' created or updated
  Will update '/actiongroups' with /mnt/host-security/action_groups.yml 
     SUCC: Configuration for 'actiongroups' created or updated
  Will update '/tenants' with /mnt/host-security/tenants.yml 
     SUCC: Configuration for 'tenants' created or updated
  Will update '/nodesdn' with /mnt/host-security/nodes_dn.yml 
     SUCC: Configuration for 'nodesdn' created or updated
  Will update '/whitelist' with /mnt/host-security/whitelist.yml 
     SUCC: Configuration for 'whitelist' created or updated
  SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","actiongroups","config","internalusers"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","actiongroups","config","internalusers"]) due to: null
  Done with success
  INDEXER_INIT: Security initialization completed successfully
  INDEXER_INIT: Initialization complete, container will remain alive

═══════════════════════════════════════════════════
Container: wazuh-runtipi_synode-it-wazuh-manager-1
Status: running | Health: healthy
═══════════════════════════════════════════════════
        "syscheck.audit.process.name",
        "syscheck.audit.process.ppid",
        "syscheck.audit.user.id",
        "syscheck.audit.user.name",
        "syscheck.diff",
        "syscheck.event",
        "syscheck.gid_after",
        "syscheck.gid_before",
        "syscheck.gname_after",
        "syscheck.gname_before",
        "syscheck.inode_after",
        "syscheck.inode_before",
        "syscheck.md5_after",
        "syscheck.md5_before",
        "syscheck.path",
        "syscheck.mode",
        "syscheck.perm_after",
        "syscheck.perm_before",
        "syscheck.sha1_after",
        "syscheck.sha1_before",
        "syscheck.sha256_after",
        "syscheck.sha256_before",
        "syscheck.tags",
        "syscheck.uid_after",
        "syscheck.uid_before",
        "syscheck.uname_after",
        "syscheck.uname_before",
        "syscheck.arch",
        "syscheck.value_name",
        "syscheck.value_type",
        "syscheck.changed_attributes",
        "title"
      ],
      "index.refresh_interval": "5s"
    },
    "version": 1
  }
  2026-01-02T14:38:57.326Z	INFO	[publisher_pipeline_output]	pipeline/output.go:145	Attempting to reconnect to backoff(elasticsearch(https://wazuh.indexer:9200)) with 3 reconnect attempt(s)
  2026-01-02T14:38:57.327Z	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
  2026-01-02T14:38:57.327Z	INFO	[publisher]	pipeline/retry.go:223	  done
  2026-01-02T14:38:57.330Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.10.2
  2026-01-02T14:39:18.712Z	INFO	fileset/pipelines.go:143	Elasticsearch pipeline with ID 'filebeat-7.10.2-wazuh-alerts-pipeline' loaded
  2026-01-02T14:39:18.717Z	INFO	template/load.go:183	Existing template will be overwritten, as overwrite is enabled.
  2026-01-02T14:39:18.719Z	INFO	template/load.go:117	Try loading template wazuh to Elasticsearch
  2026/01/02 14:39:23 wazuh-modulesd:vulnerability-scanner: INFO: Database decompression finished.
  2026-01-02T14:39:46.901Z	INFO	template/load.go:109	template with name 'wazuh' loaded.
  2026-01-02T14:39:46.901Z	INFO	[index-management]	idxmgmt/std.go:298	Loaded index template.
  2026-01-02T14:39:46.901Z	INFO	[publisher_pipeline_output]	pipeline/output.go:151	Connection to backoff(elasticsearch(https://wazuh.indexer:9200)) established
  2026/01/02 14:39:50 wazuh-modulesd:vulnerability-scanner: INFO: Vulnerability scanner module started.
  2026-01-02T14:42:46.632Z	INFO	log/harvester.go:333	File is inactive: /var/ossec/logs/alerts/alerts.json. Closing because close_inactive of 5m0s reached.

═══════════════════════════════════════════════════
Container: wazuh-runtipi_synode-it-wazuh-dashboard-1
Status: running | Health: healthy
═══════════════════════════════════════════════════
  [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
  [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
  [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
  [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
  [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
  {"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["info","dynamic-config-service"],"pid":59,"message":"initiating start()"}
  {"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["info","dynamic-config-service"],"pid":59,"message":"finished start()"}
  {"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["info","savedobjects-service"],"pid":59,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations..."}
  {"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["error","opensearch","data"],"pid":59,"message":"[ConnectionError]: connect ECONNREFUSED 10.128.10.3:9200"}
  {"type":"log","@timestamp":"2026-01-02T14:36:52Z","tags":["error","savedobjects-service"],"pid":59,"message":"Unable to retrieve version information from OpenSearch nodes."}
  {"type":"log","@timestamp":"2026-01-02T14:36:55Z","tags":["error","opensearch","data"],"pid":59,"message":"[ConnectionError]: connect ECONNREFUSED 10.128.10.3:9200"}
  {"type":"log","@timestamp":"2026-01-02T14:36:57Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
  {"type":"log","@timestamp":"2026-01-02T14:37:00Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
  {"type":"log","@timestamp":"2026-01-02T14:37:02Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
  {"type":"log","@timestamp":"2026-01-02T14:37:05Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
  {"type":"log","@timestamp":"2026-01-02T14:37:07Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
  {"type":"log","@timestamp":"2026-01-02T14:37:10Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
  {"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","savedobjects-service"],"pid":59,"message":"Starting saved objects migrations"}
  {"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","savedobjects-service"],"pid":59,"message":"Creating index .kibana_1."}
  {"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","savedobjects-service"],"pid":59,"message":"Pointing alias .kibana to .kibana_1."}
  {"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","savedobjects-service"],"pid":59,"message":"Finished in 445ms."}
  {"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["warning","cross-compatibility-service"],"pid":59,"message":"Starting cross compatibility service"}
  {"type":"log","@timestamp":"2026-01-02T14:37:13Z","tags":["info","plugins-system"],"pid":59,"message":"Starting [51] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,savedObjects,queryEnhancements,home,dashboard,visualizations,visTypeVega,visTypeTimeline,visTypeTable,visTypeMarkdown,visBuilder,visAugmenter,tileMap,regionMap,inputControlVis,ganttChartDashboards,visualize,apmOss,management,indexPatternManagement,dataSourceManagement,reportsDashboards,indexManagementDashboards,customImportMapDashboards,anomalyDetectionDashboards,alertingDashboards,notificationsDashboards,console,advancedSettings,dataExplorer,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh,bfetch]"}
  {"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["info","plugins","wazuh","initialize"],"pid":59,"message":"dashboard index: .kibana"}
  {"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["info","plugins","wazuh","initialize"],"pid":59,"message":"App revision: 02"}
  {"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["info","plugins","wazuh","initialize"],"pid":59,"message":"Total RAM: 11958MB"}
  {"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
  {"type":"log","@timestamp":"2026-01-02T14:37:14Z","tags":["error","opensearch","data"],"pid":59,"message":"[ResponseError]: Response Error"}
  {"type":"log","@timestamp":"2026-01-02T14:37:15Z","tags":["listening","info"],"pid":59,"message":"Server running at https://0.0.0.0:5601"}
  {"type":"log","@timestamp":"2026-01-02T14:37:15Z","tags":["info","http","server","OpenSearchDashboards"],"pid":59,"message":"http server running at https://0.0.0.0:5601"}
  {"type":"response","@timestamp":"2026-01-02T14:37:20Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":11,"contentLength":9},"message":"GET /app/wazuh 302 11ms - 9.0B"}
  {"type":"response","@timestamp":"2026-01-02T14:37:50Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":9,"contentLength":9},"message":"GET /app/wazuh 302 9ms - 9.0B"}
  {"type":"log","@timestamp":"2026-01-02T14:38:11Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":59,"message":"Updated the wazuh-statistics template"}
  {"type":"response","@timestamp":"2026-01-02T14:38:20Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":5,"contentLength":9},"message":"GET /app/wazuh 302 5ms - 9.0B"}
  {"type":"response","@timestamp":"2026-01-02T14:38:50Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
  {"type":"log","@timestamp":"2026-01-02T14:39:04Z","tags":["info","plugins","wazuh","monitoring"],"pid":59,"message":"Updated the wazuh-agent template"}
  {"type":"response","@timestamp":"2026-01-02T14:39:20Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
  {"type":"log","@timestamp":"2026-01-02T14:39:46Z","tags":["error","opensearch","data"],"pid":59,"message":"[resource_already_exists_exception]: index [wazuh-monitoring-2026.1w/DYh62qctQ3arcGYuH_i56g] already exists"}
  {"type":"log","@timestamp":"2026-01-02T14:39:46Z","tags":["error","plugins","wazuh","monitoring"],"pid":59,"message":"Could not create wazuh-monitoring-2026.1w index: resource_already_exists_exception: [resource_already_exists_exception] Reason: index [wazuh-monitoring-2026.1w/DYh62qctQ3arcGYuH_i56g] already exists"}
  {"type":"log","@timestamp":"2026-01-02T14:39:49Z","tags":["info","plugins","wazuh","monitoring"],"pid":59,"message":"Settings added to wazuh-monitoring-2026.1w index"}
  {"type":"response","@timestamp":"2026-01-02T14:39:50Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":4,"contentLength":9},"message":"GET /app/wazuh 302 4ms - 9.0B"}
  {"type":"log","@timestamp":"2026-01-02T14:40:03Z","tags":["error","opensearch","data"],"pid":59,"message":"[resource_already_exists_exception]: index [wazuh-statistics-2026.1w/DQ_OR2__Qb68RA67hy0X-A] already exists"}
  {"type":"log","@timestamp":"2026-01-02T14:40:05Z","tags":["info","plugins","wazuh","cron-scheduler"],"pid":59,"message":"wazuh-statistics-2026.1w index created"}
  {"type":"response","@timestamp":"2026-01-02T14:40:20Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
  {"type":"response","@timestamp":"2026-01-02T14:40:50Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
  {"type":"response","@timestamp":"2026-01-02T14:41:21Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
  {"type":"response","@timestamp":"2026-01-02T14:41:51Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":3,"contentLength":9},"message":"GET /app/wazuh 302 3ms - 9.0B"}
  {"type":"response","@timestamp":"2026-01-02T14:42:21Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":4,"contentLength":9},"message":"GET /app/wazuh 302 4ms - 9.0B"}
  {"type":"response","@timestamp":"2026-01-02T14:42:51Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":2,"contentLength":9},"message":"GET /app/wazuh 302 2ms - 9.0B"}
  {"type":"response","@timestamp":"2026-01-02T14:43:21Z","tags":[],"pid":59,"method":"get","statusCode":302,"req":{"url":"/app/wazuh","method":"get","headers":{"host":"localhost:5601","user-agent":"curl/8.11.1","accept":"*/*"},"remoteAddress":"127.0.0.1","userAgent":"curl/8.11.1"},"res":{"statusCode":302,"responseTime":2,"contentLength":9},"message":"GET /app/wazuh 302 2ms - 9.0B"}

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2. DISK USAGE CHECK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  App directory: /opt/runtipi/app-data/synode-it/wazuh-runtipi
  Size: 7,4G (7 GB) - ✓ OK (expected ~5GB)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
3. SECURITY FILES CHECK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  Security directory: /opt/runtipi/app-data/synode-it/wazuh-runtipi/data/indexer-security

  config.yml: ✓ Present
  roles.yml: ✓ Present
  roles_mapping.yml: ✓ Present
  internal_users.yml: ✓ Present
  action_groups.yml: ✓ Present
  tenants.yml: ✓ Present
  nodes_dn.yml: ✓ Present
  whitelist.yml: ✓ Present

Summary: 8/8 files present

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
4. NETWORK CONNECTIVITY CHECK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  Testing dashboard → indexer connectivity...

  DNS resolution (wazuh.indexer): ✓ OK
  HTTP connectivity: ✓ OK (HTTP 401)
  Shared network: ✓ OK (wazuh-runtipi_synode-it_network)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
5. DASHBOARD CONFIGURATION CHECK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  Config file exists: ✓ YES
  Config has content: ✓ YES
  opensearch.hosts configured: ✓ opensearch.hosts: https://wazuh.indexer:9200

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
6. MANAGER CONFIGURATION CHECK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  Main config exists: ✓ YES
  Custom config exists: ✓ YES
  Main config is symlink: ✓ YES (Bug #3 fixed)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
6b. FILEBEAT CHECK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Environment Variables (Official Wazuh Method):

  FILEBEAT_SSL_VERIFICATION_MODE: ✓ full
  SSL_CERTIFICATE_AUTHORITIES: ✓ /var/ossec/etc/certs/root-ca.pem
  SSL_CERTIFICATE: ✓ /var/ossec/etc/certs/server.pem
  SSL_KEY: ✓ /var/ossec/etc/certs/server-key.pem

Generated Filebeat Configuration:

  Filebeat config exists: ✓ YES
  Config has indexer https URL: ✓ YES
  SSL verification enabled: ✗ NO (SSL not configured in filebeat.yml)
  ⚠ Check if cont-init.d/1-config-filebeat ran successfully
  Seccomp fix for pthread: ✓ YES (pthread_create fix present)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
6c. KNOWN ERRORS DETECTION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Scanning manager logs for known errors...

  pthread_create error: ✓ Not found
  x509 certificate error: ✓ Not found
  SIGABRT crash: ✓ Not found
  Filebeat ownership error: ✓ Not found

No known errors detected in manager logs

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
7. OVERALL HEALTH SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

✓ Services: All services healthy
✓ Disk: Usage normal (~5GB)
✓ Security: All 8 security files present

=========================================
✓✓✓ WAZUH IS HEALTHY - PRODUCTION READY ✓✓✓
=========================================

root@tipi:~# 
