### Example Output for Fresh Install Source: https://docs.waratek.com/elevate/deployment This is an example of the interactive output when running the deployment script for a fresh install. It shows version selection and confirmation. ```text Available Installed Waratek Products: [1] waratek-java-upgrade-22.x.x-bx [0] Exit/Stop Choose the Product Version you wish to use [0 to exit]: 1 You chose 1 [INFO] /opt/waratek-java-upgrade-22.x.x-bx is now the active product. ``` -------------------------------- ### Example Output for Rollback Source: https://docs.waratek.com/elevate/deployment This example output shows the interactive prompt when rolling back Waratek. It lists installed versions and allows selection of the desired previous version. ```text Available Installed Waratek Products: [1] waratek-java-upgrade 19.0.0 [2] waratek-java-upgrade 22.0.0 [active] [0] Exit/Stop Choose the Product Version you wish to use [0 to exit]: 1 You chose 1 [INFO] /opt/waratek-java-upgrade-19.x.x-bx is now the active product. ``` -------------------------------- ### Upgrade Script Output Example Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-portal-dedicated-to-latest Example output from the Portal Dedicated upgrade script, showing the progress of service configuration, database provisioning, and installation completion messages. ```text User 'portal' already exists Creating portal service scripts Configuring logging directory at /var/log/portal Configuring Portal database: jdbc:postgresql://localhost:5432/portal Running Flyway migration scripts WARNING: DB: there is already a transaction in progress (SQL State: 25001 - Error Code: 0) WARNING: DB: there is already a transaction in progress (SQL State: 25001 - Error Code: 0) Portal successfully installed. Please follow the Installation Guide for additional configuration options for /opt/waratek/application.properties To start the Portal run: sudo systemctl start portal ``` -------------------------------- ### Portal Startup Log Confirmation (HTTP) Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/http-connection-setup Example log message confirming the Portal service has started on an HTTP port. ```log INFO 29495 --- [main]o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 8080 (http) with context path '' ``` -------------------------------- ### Start GlassFish Domain on Linux Source: https://docs.waratek.com/java-agent/installation-guide/glass-fish Start the GlassFish domain using the asadmin start-domain command on Linux. ```bash asadmin start-domain ``` -------------------------------- ### Portal Startup Log Confirmation (HTTPS and HTTP) Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/http-connection-setup Example log message confirming the Portal service has started on both HTTPS and an additional HTTP port. ```log INFO 80782 --- [main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 8443 (https) 8080 (http) with context path '' ``` -------------------------------- ### Start PostgreSQL Service (RHEL) Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/postgre-sql-installation Starts the PostgreSQL 15 service on RHEL systems. ```bash sudo systemctl start postgresql-15.service ``` -------------------------------- ### Migration Script Output Example Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/migrating-existing-events-from-earlier-versions This is an example of the output you can expect when the `migrateEvents.sh` script is executed. It indicates the creation of various pipelines and the start of the event updating process. ```json Creating event pipeline {"acknowledged":true} Creating CEF pipeline parser {"acknowledged":true} Creating chain pipeline {"acknowledged":true} Creating trigger pipeline {"acknowledged":true} Creating ruleType pipeline {"acknowledged":true} Creating event template {"acknowledged":true} Adding ruleType mapping to existing indices {"acknowledged":true} Updating events {"task":"Qkj6UIPbQ9KUj3ZM9nXGfQ:16379"} ``` -------------------------------- ### Example: Create Certificate for Specific Domains and IPs Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/create-a-new-self-signed-certificate Example of running the script with specific domain names ('example.com', 'localhost') and IP addresses ('192.168.0.1', '12.34.56.1'). ```bash ./scripts/createSelfSignedCertificateKeystore.sh example.com,localhost 192.168.0.1,12.34.56.1 ``` -------------------------------- ### Start Portal Dedicated Service Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/starting-portal-dedicated-service Run this command to start the Portal Dedicated service after upgrade steps are completed. Ensure you have the necessary permissions. ```bash sudo systemctl start portal ``` -------------------------------- ### Enable Elasticsearch to Start on Boot Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-elasticsearch-to-8 Configure the Elasticsearch service to start automatically when the system reboots. ```bash sudo systemctl enable elasticsearch ``` -------------------------------- ### Install PostgreSQL Server (RHEL) Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/postgre-sql-installation Installs the PostgreSQL 15 server package on RHEL systems. ```bash sudo dnf install postgresql15-server -y ``` -------------------------------- ### Run Deployment Script for Fresh Install Source: https://docs.waratek.com/elevate/deployment Execute the deployment script to perform a fresh installation of Waratek. This script will prompt for version selection. ```bash /opt/waratek-java-upgrade-22.x.x-bx/script/waratek-deploy.sh ``` -------------------------------- ### Unix Path Example Source: https://docs.waratek.com/armr/rules/armr-filesystem-rule/filesystem-read-write Example of a Unix-style file path. Forward slashes are used as path separators. ```text /home/user/documents/ ``` -------------------------------- ### Start Elasticsearch Service Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/elasticsearch-installation Start the Elasticsearch service using systemd. ```bash sudo systemctl start elasticsearch ``` -------------------------------- ### Run Deployment Script for Fresh Install Source: https://docs.waratek.com/java-agent/installation-guide/java-agent-deployment Execute the waratek-deploy.sh script to perform a fresh installation of the RASP Java Agent. Follow the prompts to select the desired product version. ```bash /opt/waratek-java-agent-x.y.z-bN/script/waratek-deploy.sh Available Installed Products: [1] /opt/waratek-java-agent-x.y.z-bN [0] Exit/Stop Choose the Product Version you wish to use [0 to exit]: 1 You chose 1 [INFO] /opt/waratek-java-agent-x.y.z-bN is now the active product. ``` -------------------------------- ### Install PostgreSQL (Ubuntu) Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/postgre-sql-installation Installs PostgreSQL 15 on Ubuntu systems. Ensure to check the Minimum requirements section for supported versions. ```bash sudo apt-get -y install postgresql-15 ``` -------------------------------- ### Windows Path Examples Source: https://docs.waratek.com/armr/rules/armr-filesystem-rule/filesystem-read-write Examples of Windows file paths using both backslash and forward slash as separators. Note the escaping requirement for backslashes in ARMR files. ```text C:\Users\admin\documents\ ``` ```text C:/Users/admin/documents/ ``` -------------------------------- ### Enable Automatic Portal Start on System Boot Source: https://docs.waratek.com/portal-dedicated/installation-guide/start-stop-portal This command configures the Portal Dedicated service to start automatically whenever the system boots up. It ensures the portal is available after reboots. ```bash sudo systemctl enable portal ``` -------------------------------- ### Standardized Metadata: Affected Product Version Range Example Source: https://docs.waratek.com/armr/platform/armr-mod Example of specifying a version range for the affected product using 'from' and 'to' keys. ```ARMR affected-product-version: {range: {from: "2.5.20", to: "2.5.27"}} ``` -------------------------------- ### Waratek Installation Directory Tree Source: https://docs.waratek.com/elevate/directory-structure Provides a visual representation of the default directory structure for a Waratek installation, showing the organization of agent files, configurations, documentation, and scripts. ```bash $ tree waratek-upgrade-19.x.x-bxxx/ ├── agent │ ├── aix-ppc32 │ │ └── libwaratek.so │ ├── aix-ppc64 │ │ └── libwaratek.so │ ├── compiler11.jar │ ├── compiler8.jar │ ├── guest.jar │ ├── host.jar │ ├── linux-i586 │ │ └── libwaratek.so │ ├── linux-x64 │ │ └── libwaratek.so │ ├── module_patch.jar │ ├── solaris-sparc │ │ └── libwaratek.so │ ├── solaris-sparcv9 │ │ └── libwaratek.so │ ├── waratek.jar │ ├── windows-i586 │ │ └── waratek.dll │ └── windows-x64 │ └── waratek.dll ├── conf_1 │ ├── policy.armr │ └── waratek.properties ├── conf_2 │ ├── policy.armr │ └── waratek.properties ├── doc │ ├── Waratek Enterprise Install Guide 2019-09.pdf │ ├── Waratek Enterprise User Guide 2019-09.pdf │ └── Waratek JLP Install Guide 2019-09.pdf ├── launcher │ ├── waratek-jlp-aix-ppc32 │ ├── waratek-jlp-aix-ppc64 │ ├── waratek-jlp-linux-i586 │ ├── waratek-jlp-linux-x64 │ ├── waratek-jlp-solaris-sparc │ ├── waratek-jlp-solaris-sparcv9 │ ├── waratek-jlp-windows-i586 │ └── waratek-jlp-windows-x64 └── scripts └── waratek-deploy.sh ``` -------------------------------- ### UNC Path Example Source: https://docs.waratek.com/armr/rules/armr-filesystem-rule/filesystem-read-write Example of a Windows UNC (Universal Naming Convention) path for accessing network resources. It starts with two backslashes. ```text \\server\share\folder\file.txt ``` -------------------------------- ### Configure and Enable Portal Service Source: https://docs.waratek.com/portal-dedicated/installation-guide/basic-portal-configuration/basic-manual-configuration/portal-setup/configure-portal-prerequisites Copy the portal.service.template to the systemd system directory and enable the portal service to start on boot. ```bash $ cp daemon/portal.service.template /etc/systemd/system/portal.service $ systemctl enable portal ``` -------------------------------- ### Backup controller.keystore.p12 Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-portal-dedicated-to-latest Create a backup of the default controller.keystore.p12 file provided in the new release before overwriting it. ```bash cp controller.keystore.p12 controller.keystore.p12.bak ``` -------------------------------- ### Verify ReadonlyREST Plugin Installation Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/securing-elasticsearch After installation, run this command to list all installed Elasticsearch plugins. The output should include 'readonlyrest' if the installation was successful. ```bash sudo /usr/share/elasticsearch/bin/elasticsearch-plugin list ``` -------------------------------- ### Install ReadonlyREST Plugin for Elasticsearch Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/securing-elasticsearch Use this command to install the ReadonlyREST plugin. Ensure the path to the plugin zip file is updated to match your installation directory. ```bash sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install -b file:////opt/waratek/elasticsearch/readonlyrest-1.49.1.zip ``` -------------------------------- ### Example waratek.properties Configuration Source: https://docs.waratek.com/java-agent/installation-guide/proposed-directory-structure Illustrates key properties within the main agent configuration file, such as rule file locations, log file paths, and auto-reload settings. ```properties com.waratek.rules.local=/opt/waratek/conf_1/policy.armr com.waratek.log.file=/opt/waratek/conf_1/security.log com.waratek.rules.autoreload=true ``` -------------------------------- ### Standardized Metadata: Version Example Source: https://docs.waratek.com/armr/platform/armr-mod Example of specifying the development version of the rule as an integer. ```ARMR version: 2 ``` -------------------------------- ### Configure Agent Startup with Portal Unavailable Source: https://docs.waratek.com/java-agent/configuration-guide/agent-onboarding/portal-dedicated-on-boarding-process These examples demonstrate how to configure the `com.waratek.ControllerUnavailableAction` flag to control agent behavior when the Portal Dedicated is not responsive during startup. Choose the appropriate action based on your availability requirements. ```properties # the agent will start if the Portal Dedicated is not responsive com.waratek.ControllerUnavailableAction=ignore ``` ```properties # the agent will NOT start if the Portal Dedicated is not responsive com.waratek.ControllerUnavailableAction=fail ``` ```properties # the agent will start if the Portal Dedicated is not responsive - but will repeatedly attempt to connect in background com.waratek.ControllerUnavailableAction=retry ``` -------------------------------- ### Start Portal Service Source: https://docs.waratek.com/portal-dedicated/installation-guide/production-configuration/install-ca-certificate Restart the Portal service using systemctl. ```bash systemctl start portal ``` -------------------------------- ### Add Java Agent to WebLogic Startup Script (Windows) Source: https://docs.waratek.com/java-agent/installation-guide/oracle-weblogic Add this line to the beginning of the startWebLogic.cmd file on Windows. Ensure agent options precede existing Java options. ```batch set JAVA_OPTIONS=-javaagent:\agent\waratek.jar -Dcom.waratek.OceanicProperties=\\waratek.properties %JAVA_OPTIONS% ``` -------------------------------- ### Standardized Metadata: Creation Time Example Source: https://docs.waratek.com/armr/platform/armr-mod Example of specifying the creation time of the mod or rule. ```ARMR creation-time: "Tue 02 Nov 2021 15:46:13 GMT" ``` -------------------------------- ### Install Elasticsearch Package (CentOS/RHEL) Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-elasticsearch-to-8 Install the downloaded Elasticsearch 8.8.2 RPM package on CentOS/RHEL systems. ```bash sudo rpm -i elasticsearch-8.8.2-x86_64.rpm ``` -------------------------------- ### Add Java Agent to WebLogic Startup Script (Linux) Source: https://docs.waratek.com/java-agent/installation-guide/oracle-weblogic Add this line to the beginning of the startWebLogic.sh file on Linux. Ensure agent options precede existing Java options. ```shell JAVA_OPTIONS="-javaagent:/opt/waratek/agent/waratek.jar -Dcom.waratek.OceanicProperties=/opt/waratek//waratek.properties $JAVA_OPTIONS" ``` -------------------------------- ### Backup logging.xml Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-portal-dedicated-to-latest Create a backup of the default logging.xml file provided in the new release before overwriting it. ```bash cp logging.xml logging.xml.bak ``` -------------------------------- ### Install Elasticsearch DEB Package Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/elasticsearch-installation Install the downloaded Elasticsearch DEB package using the dpkg command. ```bash sudo dpkg -i elasticsearch-8.8.2-amd64.deb ``` -------------------------------- ### Check Installed Elasticsearch Version (Ubuntu) Source: https://docs.waratek.com/portal-dedicated/upgrading-portal-dedicated/upgrading-elasticsearch-to-8 Verify if an Elasticsearch version is currently installed on Ubuntu systems. ```bash dpkg-query -l | grep elasticsearch ``` -------------------------------- ### Enable PostgreSQL Service on Boot (RHEL) Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/postgre-sql-installation Configures the PostgreSQL 15 service to start automatically on system boot on RHEL systems. ```bash sudo systemctl enable postgresql-15.service ``` -------------------------------- ### Install Elasticsearch RPM Package Source: https://docs.waratek.com/portal-dedicated/installation-guide/dependencies-installation/elasticsearch-installation Install the downloaded Elasticsearch RPM package using the rpm command. ```bash sudo rpm --install elasticsearch-8.8.2-x86_64.rpm ``` -------------------------------- ### Verify JAVA_HOME in variable.xml Source: https://docs.waratek.com/elevate/deployments/ibm-websphere Example entry in variable.xml showing the configured JAVA_HOME path for a WebSphere node. ```xml ``` -------------------------------- ### Enable Agent Start Parameters Logging Source: https://docs.waratek.com/java-agent/configuration-guide/troubleshooting/networking Enable this parameter to log all configuration parameters for an application at startup. It can be safely enabled all the time. ```properties com.waratek.ShowStart=true ``` -------------------------------- ### Standardized Metadata: Affected Product Name Example Source: https://docs.waratek.com/armr/platform/armr-mod Example of specifying the name of the product affected by the vulnerability. ```ARMR affected-product-name: "Struts 2" ``` -------------------------------- ### Standardized Metadata: Affected OS Example Source: https://docs.waratek.com/armr/platform/armr-mod Example of specifying a single operating system affected by the vulnerability. ```ARMR affected-os: "Windows" ```