Waratek Documentation

https://docs.waratek.com
Admin
This project provides comprehensive documentation for Waratek's application security platform,...
Tokens:176,212
Snippets:2,153
Trust Score:9.3
Update:3 months ago
Show doc for...
Tokens:
Raw
### Example Output for Fresh Install

Source: https://docs.waratek.com/elevate/deployment

This is an example of the interactive output when running the deployment script for a fresh install. It shows version selection and confirmation.

```text
Available Installed Waratek Products:  

[1] waratek-java-upgrade-22.x.x-bx  

[0] Exit/Stop  

Choose the Product Version you wish to use [0 to exit]: 1  

You chose 1  

[INFO] /opt/waratek-java-upgrade-22.x.x-bx is now the active product.  
```

--------------------------------

### Example Output for Rollback

Source: https://docs.waratek.com/elevate/deployment

This example output shows the interactive prompt when rolling back Waratek. It lists installed versions and allows selection of the desired previous version.

```text
Available Installed Waratek Products:  

[1] waratek-java-upgrade 19.0.0  

[2] waratek-java-upgrade 22.0.0 [active]  

[0] Exit/Stop  

Choose the Product Version you wish to use [0 to exit]: 1  

You chose 1  

[INFO] /opt/waratek-java-upgrade-19.x.x-bx is now the active product.  
```

--------------------------------

### Upgrade Script Output Example

Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-portal-dedicated-to-latest

Example output from the Portal Dedicated upgrade script, showing the progress of service configuration, database provisioning, and installation completion messages.

```text
User 'portal' already exists  
Creating portal service scripts  
Configuring logging directory at /var/log/portal  
Configuring Portal database: jdbc:postgresql://localhost:5432/portal  
Running Flyway migration scripts  
WARNING: DB: there is already a transaction in progress (SQL State: 25001 - Error Code: 0)  
WARNING: DB: there is already a transaction in progress (SQL State: 25001 - Error Code: 0)  
Portal successfully installed.  
Please follow the Installation Guide for additional configuration options for /opt/waratek/application.properties  
To start the Portal run: sudo systemctl start portal  
```

--------------------------------

### Portal Startup Log Confirmation (HTTP)

Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/http-connection-setup

Example log message confirming the Portal service has started on an HTTP port.

```log
INFO	29495	---	[main]o.s.b.w.embedded.tomcat.TomcatWebServer	:	Tomcat started on port(s): 8080 (http) with context path ''
```

--------------------------------

### Start GlassFish Domain on Linux

Source: https://docs.waratek.com/java-agent/installation-guide/glass-fish

Start the GlassFish domain using the asadmin start-domain command on Linux.

```bash
asadmin start-domain <domain name>
```

--------------------------------

### Portal Startup Log Confirmation (HTTPS and HTTP)

Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/http-connection-setup

Example log message confirming the Portal service has started on both HTTPS and an additional HTTP port.

```log
INFO	80782	---	[main]	o.s.b.w.embedded.tomcat.TomcatWebServer	:	Tomcat started on port(s):	8443	(https)	8080	(http) with context path	''
```

--------------------------------

### Start PostgreSQL Service (RHEL)

Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/postgre-sql-installation

Starts the PostgreSQL 15 service on RHEL systems.

```bash
sudo systemctl start postgresql-15.service
```

--------------------------------

### Migration Script Output Example

Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/migrating-existing-events-from-earlier-versions

This is an example of the output you can expect when the `migrateEvents.sh` script is executed. It indicates the creation of various pipelines and the start of the event updating process.

```json
Creating event pipeline  

{"acknowledged":true}  

Creating CEF pipeline parser  

{"acknowledged":true}  

Creating chain pipeline  

{"acknowledged":true}  

Creating trigger pipeline  

{"acknowledged":true}  

Creating ruleType pipeline  

{"acknowledged":true}  

Creating event template  

{"acknowledged":true}  

Adding ruleType mapping to existing indices  

{"acknowledged":true}  

Updating events  

{"task":"Qkj6UIPbQ9KUj3ZM9nXGfQ:16379"}  
```

--------------------------------

### Example: Create Certificate for Specific Domains and IPs

Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/create-a-new-self-signed-certificate

Example of running the script with specific domain names ('example.com', 'localhost') and IP addresses ('192.168.0.1', '12.34.56.1').

```bash
./scripts/createSelfSignedCertificateKeystore.sh example.com,localhost 192.168.0.1,12.34.56.1
```

--------------------------------

### Enable Elasticsearch to Start on Boot

Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-elasticsearch-to-8

Configure the Elasticsearch service to start automatically when the system reboots.

```bash
sudo systemctl enable elasticsearch
```

--------------------------------

### Start Portal Dedicated Service

Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/starting-portal-dedicated-service

Run this command to start the Portal Dedicated service after upgrade steps are completed. Ensure you have the necessary permissions.

```bash
sudo systemctl start portal  

```

--------------------------------

### Install PostgreSQL Server (RHEL)

Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/postgre-sql-installation

Installs the PostgreSQL 15 server package on RHEL systems.

```bash
sudo dnf install postgresql15-server -y
```

--------------------------------

### Run Deployment Script for Fresh Install

Source: https://docs.waratek.com/elevate/deployment

Execute the deployment script to perform a fresh installation of Waratek. This script will prompt for version selection.

```bash
/opt/waratek-java-upgrade-22.x.x-bx/script/waratek-deploy.sh
```

--------------------------------

### Unix Path Example

Source: https://docs.waratek.com/armr/rules/armr-filesystem-rule/filesystem-read-write

Example of a Unix-style file path. Forward slashes are used as path separators.

```text
/home/user/documents/
```

--------------------------------

### Start Elasticsearch Service

Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/elasticsearch-installation

Start the Elasticsearch service using systemd.

```bash
sudo systemctl start elasticsearch
```

--------------------------------

### Run Deployment Script for Fresh Install

Source: https://docs.waratek.com/java-agent/installation-guide/java-agent-deployment

Execute the waratek-deploy.sh script to perform a fresh installation of the RASP Java Agent. Follow the prompts to select the desired product version.

```bash
/opt/waratek-java-agent-x.y.z-bN/script/waratek-deploy.sh  

Available Installed Products:  

[1] /opt/waratek-java-agent-x.y.z-bN  

[0] Exit/Stop  

Choose the Product Version you wish to use [0 to exit]: 1  

You chose 1  

[INFO] /opt/waratek-java-agent-x.y.z-bN is now the active product.  
```

--------------------------------

### Install PostgreSQL (Ubuntu)

Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/postgre-sql-installation

Installs PostgreSQL 15 on Ubuntu systems. Ensure to check the Minimum requirements section for supported versions.

```bash
sudo apt-get -y install postgresql-15
```

--------------------------------

### Windows Path Examples

Source: https://docs.waratek.com/armr/rules/armr-filesystem-rule/filesystem-read-write

Examples of Windows file paths using both backslash and forward slash as separators. Note the escaping requirement for backslashes in ARMR files.

```text
C:\Users\admin\documents\
```

```text
C:/Users/admin/documents/
```

--------------------------------

### Enable Automatic Portal Start on System Boot

Source: https://docs.waratek.com/portal-dedicated/installation-guide/start-stop-portal

This command configures the Portal Dedicated service to start automatically whenever the system boots up. It ensures the portal is available after reboots.

```bash
sudo systemctl enable portal
```

--------------------------------

### Standardized Metadata: Affected Product Version Range Example

Source: https://docs.waratek.com/armr/platform/armr-mod

Example of specifying a version range for the affected product using 'from' and 'to' keys.

```ARMR
affected-product-version: {range: {from: "2.5.20", to: "2.5.27"}}
```

--------------------------------

### Waratek Installation Directory Tree

Source: https://docs.waratek.com/elevate/directory-structure

Provides a visual representation of the default directory structure for a Waratek installation, showing the organization of agent files, configurations, documentation, and scripts.

```bash
$ tree waratek-upgrade-19.x.x-bxxx/  

├── agent  
│ ├── aix-ppc32  
│ │ └── libwaratek.so  
│ ├── aix-ppc64  
│ │ └── libwaratek.so  
│ ├── compiler11.jar  
│ ├── compiler8.jar  
│ ├── guest.jar  
│ ├── host.jar  
│ ├── linux-i586  
│ │ └── libwaratek.so  
│ ├── linux-x64  
│ │ └── libwaratek.so  
│ ├── module_patch.jar  
│ ├── solaris-sparc  
│ │ └── libwaratek.so  
│ ├── solaris-sparcv9  
│ │ └── libwaratek.so  
│ ├── waratek.jar  
│ ├── windows-i586  
│ │ └── waratek.dll  
│ └── windows-x64  
│ └── waratek.dll  

├── conf_1  
│ ├── policy.armr  
│ └── waratek.properties  

├── conf_2  
│ ├── policy.armr  
│ └── waratek.properties  

├── doc  
│ ├── Waratek Enterprise Install Guide 2019-09.pdf  
│ ├── Waratek Enterprise User Guide 2019-09.pdf  
│ └── Waratek JLP Install Guide 2019-09.pdf  

├── launcher  
│ ├── waratek-jlp-aix-ppc32  
│ ├── waratek-jlp-aix-ppc64  
│ ├── waratek-jlp-linux-i586  
│ ├── waratek-jlp-linux-x64  
│ ├── waratek-jlp-solaris-sparc  
│ ├── waratek-jlp-solaris-sparcv9  
│ ├── waratek-jlp-windows-i586  
│ └── waratek-jlp-windows-x64  

└── scripts  
└── waratek-deploy.sh  

```

--------------------------------

### UNC Path Example

Source: https://docs.waratek.com/armr/rules/armr-filesystem-rule/filesystem-read-write

Example of a Windows UNC (Universal Naming Convention) path for accessing network resources. It starts with two backslashes.

```text
\\server\share\folder\file.txt
```

--------------------------------

### Configure and Enable Portal Service

Source: https://docs.waratek.com/portal-dedicated/installation-guide/basic-portal-configuration/basic-manual-configuration/portal-setup/configure-portal-prerequisites

Copy the portal.service.template to the systemd system directory and enable the portal service to start on boot.

```bash
$ cp daemon/portal.service.template /etc/systemd/system/portal.service  

$ systemctl enable portal  
```

--------------------------------

### Backup controller.keystore.p12

Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-portal-dedicated-to-latest

Create a backup of the default controller.keystore.p12 file provided in the new release before overwriting it.

```bash
cp controller.keystore.p12 controller.keystore.p12.bak
```

--------------------------------

### Verify ReadonlyREST Plugin Installation

Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/securing-elasticsearch

After installation, run this command to list all installed Elasticsearch plugins. The output should include 'readonlyrest' if the installation was successful.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-plugin list
```

--------------------------------

### Install ReadonlyREST Plugin for Elasticsearch

Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/securing-elasticsearch

Use this command to install the ReadonlyREST plugin. Ensure the path to the plugin zip file is updated to match your installation directory.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install -b file:////opt/waratek/elasticsearch/readonlyrest-1.49.1.zip
```

--------------------------------

### Example waratek.properties Configuration

Source: https://docs.waratek.com/java-agent/installation-guide/proposed-directory-structure

Illustrates key properties within the main agent configuration file, such as rule file locations, log file paths, and auto-reload settings.

```properties
com.waratek.rules.local=/opt/waratek/conf_1/policy.armr  
com.waratek.log.file=/opt/waratek/conf_1/security.log  
com.waratek.rules.autoreload=true  

```

--------------------------------

### Standardized Metadata: Version Example

Source: https://docs.waratek.com/armr/platform/armr-mod

Example of specifying the development version of the rule as an integer.

```ARMR
version: 2
```

--------------------------------

### Configure Agent Startup with Portal Unavailable

Source: https://docs.waratek.com/java-agent/configuration-guide/agent-onboarding/portal-dedicated-on-boarding-process

These examples demonstrate how to configure the `com.waratek.ControllerUnavailableAction` flag to control agent behavior when the Portal Dedicated is not responsive during startup. Choose the appropriate action based on your availability requirements.

```properties
# the agent will start if the Portal Dedicated is not responsive
com.waratek.ControllerUnavailableAction=ignore

```

```properties
# the agent will NOT start if the Portal Dedicated is not responsive
com.waratek.ControllerUnavailableAction=fail

```

```properties
# the agent will start if the Portal Dedicated is not responsive - but will repeatedly attempt to connect in background
com.waratek.ControllerUnavailableAction=retry

```

--------------------------------

### Start Portal Service

Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/install-ca-certificate

Restart the Portal service using systemctl.

```bash
systemctl start portal
```

--------------------------------

### Add Java Agent to WebLogic Startup Script (Windows)

Source: https://docs.waratek.com/java-agent/installation-guide/oracle-weblogic

Add this line to the beginning of the startWebLogic.cmd file on Windows. Ensure agent options precede existing Java options.

```batch
set JAVA_OPTIONS=-javaagent:<absolute-path-to-agent-home-folder>\agent\waratek.jar -Dcom.waratek.OceanicProperties=<absolute-path-to-agent-home-folder>\<conf_*>\waratek.properties %JAVA_OPTIONS%
```

--------------------------------

### Standardized Metadata: Creation Time Example

Source: https://docs.waratek.com/armr/platform/armr-mod

Example of specifying the creation time of the mod or rule.

```ARMR
creation-time: "Tue 02 Nov 2021 15:46:13 GMT"
```

--------------------------------

### Install Elasticsearch Package (CentOS/RHEL)

Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-elasticsearch-to-8

Install the downloaded Elasticsearch 8.8.2 RPM package on CentOS/RHEL systems.

```bash
sudo rpm -i elasticsearch-8.8.2-x86_64.rpm
```

--------------------------------

### Add Java Agent to WebLogic Startup Script (Linux)

Source: https://docs.waratek.com/java-agent/installation-guide/oracle-weblogic

Add this line to the beginning of the startWebLogic.sh file on Linux. Ensure agent options precede existing Java options.

```shell
JAVA_OPTIONS="-javaagent:/opt/waratek/agent/waratek.jar -Dcom.waratek.OceanicProperties=/opt/waratek/<conf_*>/waratek.properties $JAVA_OPTIONS"
```

--------------------------------

### Backup logging.xml

Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-portal-dedicated-to-latest

Create a backup of the default logging.xml file provided in the new release before overwriting it.

```bash
cp logging.xml logging.xml.bak
```

--------------------------------

### Install Elasticsearch DEB Package

Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/elasticsearch-installation

Install the downloaded Elasticsearch DEB package using the dpkg command.

```bash
sudo dpkg -i elasticsearch-8.8.2-amd64.deb
```

--------------------------------

### Check Installed Elasticsearch Version (Ubuntu)

Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-elasticsearch-to-8

Verify if an Elasticsearch version is currently installed on Ubuntu systems.

```bash
dpkg-query -l | grep elasticsearch
```

--------------------------------

### Enable PostgreSQL Service on Boot (RHEL)

Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/postgre-sql-installation

Configures the PostgreSQL 15 service to start automatically on system boot on RHEL systems.

```bash
sudo systemctl enable postgresql-15.service
```

--------------------------------

### Install Elasticsearch RPM Package

Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/elasticsearch-installation

Install the downloaded Elasticsearch RPM package using the rpm command.

```bash
sudo rpm --install elasticsearch-8.8.2-x86_64.rpm
```

--------------------------------

### Verify JAVA_HOME in variable.xml

Source: https://docs.waratek.com/elevate/deployments/ibm-websphere

Example entry in variable.xml showing the configured JAVA_HOME path for a WebSphere node.

```xml
<entries xmi:id="VariableSubstitutionEntry_1528377842438" symbolicName="JAVA_HOME" value="/home/users/IBM/WebSphere/AppServer/java" description="The filesystem path to the Java Virtual Machine installation directory."/>
```

--------------------------------

### Enable Agent Start Parameters Logging

Source: https://docs.waratek.com/java-agent/configuration-guide/troubleshooting/networking

Enable this parameter to log all configuration parameters for an application at startup. It can be safely enabled all the time.

```properties
com.waratek.ShowStart=true
```

--------------------------------

### Standardized Metadata: Affected Product Name Example

Source: https://docs.waratek.com/armr/platform/armr-mod

Example of specifying the name of the product affected by the vulnerability.

```ARMR
affected-product-name: "Struts 2"
```

--------------------------------

### Standardized Metadata: Affected OS Example

Source: https://docs.waratek.com/armr/platform/armr-mod

Example of specifying a single operating system affected by the vulnerability.

```ARMR
affected-os: "Windows"
```
Tokens:
Raw