Backup and Restore - Wazuh Dashboard Plugins

This guide focuses on backing up and restoring the assets managed by the Wazuh dashboard itself, ensuring you can recover your configuration, customizations, and saved objects in case of system failure or migration.

What to Back Up

The following assets should be included in your backup strategy:

Dashboard Configuration

Main configuration file: /etc/wazuh-dashboard/opensearch_dashboards.yml
Contains server settings, API connections, and plugin configurations
Critical for dashboard startup and connectivity

TLS Certificates

Certificate directory: /etc/wazuh-dashboard/certs/
Includes SSL/TLS certificates and keys
Required for secure communication with indexer and manager
Contains:
- dashboard.crt - Dashboard SSL certificate
- dashboard.key - Dashboard SSL private key
- root-ca.pem - Certificate Authority certificate

Saved Objects

Dashboards
Visualizations
Index patterns
Searches
Custom queries
Reports configurations

These are exported from the UI as .ndjson files.

Custom Branding Assets

Custom images directory: /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom/images/
Contains custom logos and branding elements (if used)
Only needed if custom branding is configured

Additional Files to Consider

Plugin configurations
Custom scripts
Integration configurations
Documentation of custom settings

Backup Procedures

Manual Backup

1. Export Saved Objects

Export saved objects through the dashboard UI:

Open Dashboard management > Dashboards Management > Saved objects.
Export the required objects, or use Export all objects to export everything.
Save the .ndjson file to a secure location.

2. Backup Configuration Files

Create a timestamped backup of the configuration directory:

# Create backup directory
sudo mkdir -p /root/wazuh-dashboard-backups

# Backup entire configuration directory
sudo cp -a /etc/wazuh-dashboard/ /root/wazuh-dashboard-backups/wazuh-dashboard-$(date +%Y%m%d-%H%M%S)/

# Verify backup
ls -la /root/wazuh-dashboard-backups/

3. Backup Certificates

Create a separate backup of certificates:

# Backup certificates with secure permissions
sudo mkdir -p /root/wazuh-dashboard-backups/certs-$(date +%Y%m%d-%H%M%S)
sudo cp -a /etc/wazuh-dashboard/certs/* /root/wazuh-dashboard-backups/certs-$(date +%Y%m%d-%H%M%S)/

# Verify certificate backup
sudo ls -la /root/wazuh-dashboard-backups/certs-*/

4. Backup Custom Branding

If you have custom branding configured:

# Backup custom branding assets
sudo mkdir -p /root/wazuh-dashboard-backups/custom-branding-$(date +%Y%m%d-%H%M%S)
sudo cp -a /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom/ \
  /root/wazuh-dashboard-backups/custom-branding-$(date +%Y%m%d-%H%M%S)/

5. Document Custom Settings

Create a record of your configuration:

# Extract non-commented settings
grep -v "^#" /etc/wazuh-dashboard/opensearch_dashboards.yml | grep -v "^$" \
  > /root/wazuh-dashboard-backups/custom-settings-$(date +%Y%m%d-%H%M%S).txt

# Document plugin configuration
sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin list \
  > /root/wazuh-dashboard-backups/plugins-list-$(date +%Y%m%d-%H%M%S).txt

Automated Backup Script

Create a backup script for regular automated backups:

#!/bin/bash
# Wazuh Dashboard Backup Script

BACKUP_DIR="/root/wazuh-dashboard-backups"
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
BACKUP_NAME="wazuh-dashboard-backup-${TIMESTAMP}"

# Create backup directory
mkdir -p "${BACKUP_DIR}/${BACKUP_NAME}"

# Backup configuration
cp -a /etc/wazuh-dashboard/ "${BACKUP_DIR}/${BACKUP_NAME}/config/"

# Backup custom branding (if exists)
if [ -d /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom/ ]; then
    cp -a /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom/ \
      "${BACKUP_DIR}/${BACKUP_NAME}/custom-branding/"
fi

# Document settings
grep -v "^#" /etc/wazuh-dashboard/opensearch_dashboards.yml | grep -v "^$" \
  > "${BACKUP_DIR}/${BACKUP_NAME}/custom-settings.txt"

# List installed plugins
sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin list \
  > "${BACKUP_DIR}/${BACKUP_NAME}/plugins-list.txt"

# Create archive
tar -czf "${BACKUP_DIR}/${BACKUP_NAME}.tar.gz" -C "${BACKUP_DIR}" "${BACKUP_NAME}"

# Remove uncompressed backup
rm -rf "${BACKUP_DIR}/${BACKUP_NAME}"

# Remove backups older than 30 days
find "${BACKUP_DIR}" -name "wazuh-dashboard-backup-*.tar.gz" -mtime +30 -delete

echo "Backup completed: ${BACKUP_DIR}/${BACKUP_NAME}.tar.gz"

Make the script executable and schedule it with cron:

# Make script executable
chmod +x /usr/local/bin/wazuh-dashboard-backup.sh

# Add to crontab (daily at 2 AM)
crontab -e
# Add this line:
# 0 2 * * * /usr/local/bin/wazuh-dashboard-backup.sh >> /var/log/wazuh-dashboard-backup.log 2>&1

Export Saved Objects via API

Export saved objects programmatically:

curl -X POST "https://localhost:5601/api/saved_objects/_export" \
  -H "osd-xsrf: true" \
  -H "Content-Type: application/json" \
  -u admin:admin \
  -d '{
    "type": [
      "dashboard",
      "visualization",
      "search",
      "index-pattern"
    ]
  }' \
  -o saved-objects-backup-$(date +%Y%m%d-%H%M%S).ndjson

Restore Procedures

Complete Restore

Restore the dashboard from a complete backup:

1. Install Wazuh Dashboard

Reinstall the Wazuh dashboard package on the target host: Debian/Ubuntu:

apt-get update
apt-get install wazuh-dashboard=5.0.0-1

RHEL/CentOS:

yum install wazuh-dashboard-5.0.0-1

2. Stop the Dashboard Service

systemctl stop wazuh-dashboard

3. Restore Configuration Files

Restore the configuration directory:

# Remove default configuration
sudo rm -rf /etc/wazuh-dashboard/*

# Restore from backup
sudo cp -a /root/wazuh-dashboard-backups/wazuh-dashboard-YYYYMMDD-HHMMSS/config/* /etc/wazuh-dashboard/

# Or extract from archive
tar -xzf /root/wazuh-dashboard-backups/wazuh-dashboard-backup-YYYYMMDD-HHMMSS.tar.gz -C /tmp/
sudo cp -a /tmp/wazuh-dashboard-backup-YYYYMMDD-HHMMSS/config/* /etc/wazuh-dashboard/

4. Restore Certificates

# Ensure certificates directory exists
sudo mkdir -p /etc/wazuh-dashboard/certs/

# Restore certificates
sudo cp -a /root/wazuh-dashboard-backups/certs-YYYYMMDD-HHMMSS/* /etc/wazuh-dashboard/certs/

# Set correct permissions
sudo chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs/
sudo chmod 600 /etc/wazuh-dashboard/certs/*.key
sudo chmod 644 /etc/wazuh-dashboard/certs/*.crt
sudo chmod 644 /etc/wazuh-dashboard/certs/*.pem

5. Restore Custom Branding

If you have custom branding:

# Restore custom branding assets
sudo cp -a /root/wazuh-dashboard-backups/custom-branding-YYYYMMDD-HHMMSS/* \
  /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom/

# Set correct ownership
sudo chown -R wazuh-dashboard:wazuh-dashboard \
  /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom/

6. Set File Permissions

# Set ownership
sudo chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/
sudo chown -R wazuh-dashboard:wazuh-dashboard /usr/share/wazuh-dashboard/

# Set permissions
sudo chmod 640 /etc/wazuh-dashboard/opensearch_dashboards.yml

7. Start the Dashboard Service

systemctl daemon-reload
systemctl enable wazuh-dashboard
systemctl start wazuh-dashboard

8. Verify Service Status

# Check service status
systemctl status wazuh-dashboard

# Monitor logs
sudo tail -f /var/log/wazuh-dashboard/opensearch_dashboards.log

9. Import Saved Objects

Restore saved objects through the UI:

Access the dashboard at https://<DASHBOARD_IP>/app/wz-home
Navigate to Dashboard management > Dashboard Management > Saved objects
Click Import
Select your backed-up .ndjson file
Handle conflicts appropriately
Click Import

Partial Restore

Restore Configuration Only

# Backup current configuration
sudo cp /etc/wazuh-dashboard/opensearch_dashboards.yml \
  /etc/wazuh-dashboard/opensearch_dashboards.yml.bak

# Restore from backup
sudo cp /root/wazuh-dashboard-backups/wazuh-dashboard-YYYYMMDD-HHMMSS/config/opensearch_dashboards.yml \
  /etc/wazuh-dashboard/opensearch_dashboards.yml

# Restart service
sudo systemctl restart wazuh-dashboard

Restore Certificates Only

# Stop service
sudo systemctl stop wazuh-dashboard

# Backup current certificates
sudo cp -a /etc/wazuh-dashboard/certs/ /etc/wazuh-dashboard/certs.bak/

# Restore certificates
sudo cp -a /root/wazuh-dashboard-backups/certs-YYYYMMDD-HHMMSS/* /etc/wazuh-dashboard/certs/

# Set permissions
sudo chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs/
sudo chmod 600 /etc/wazuh-dashboard/certs/*.key

# Start service
sudo systemctl start wazuh-dashboard

Import Specific Saved Objects

Import only specific types of saved objects:

# Export specific types from backup file
curl -X POST "https://localhost:5601/api/saved_objects/_import" \
  -H "osd-xsrf: true" \
  -u admin:admin \
  --form file=@saved-objects-backup.ndjson

Backup Best Practices

Backup Frequency

Configuration files: Before any changes or upgrades
Saved objects: Weekly or after significant customizations
Certificates: Before renewal or changes
Complete backups: Daily or weekly depending on change frequency

Backup Storage

Store backups in a secure location separate from the dashboard server to protect against hardware failure or data loss.

Use remote storage (NAS, cloud storage, backup server)
Encrypt sensitive backups (especially those containing certificates)
Maintain multiple backup versions
Test backup integrity regularly
Document backup and restore procedures

Backup Retention

Keep daily backups for 7 days
Keep weekly backups for 4 weeks
Keep monthly backups for 12 months
Adjust retention based on compliance requirements

Security Considerations

Secure backup storage with appropriate permissions
Encrypt backups containing sensitive data
Protect certificate private keys
Limit access to backup files
Audit backup access regularly

Disaster Recovery

Recovery Time Objective (RTO)

Expected time to restore dashboard functionality:

Configuration restore: 10-15 minutes
Complete restore: 30-60 minutes
Includes service restart and verification

Recovery Point Objective (RPO)

Acceptable data loss window:

Configuration changes: Based on backup frequency
Saved objects: Last export timestamp
Consider more frequent backups for critical environments

Disaster Recovery Testing

Regularly test your backup and restore procedures:

Schedule periodic recovery tests
Document test results
Update procedures based on findings
Train team members on restore procedures
Maintain current documentation

Troubleshooting Restore Issues

Service Fails to Start After Restore

Solutions:

Check configuration file syntax
Verify certificate paths and permissions
Review logs for specific errors
Ensure indexer connectivity
Verify file ownership and permissions

Saved Objects Import Fails

Solutions:

Verify .ndjson file integrity
Check version compatibility
Import in smaller batches
Use overwrite option for conflicts
Check for index pattern dependencies

Certificate Validation Errors

Solutions:

Verify certificate files are complete
Check certificate expiration dates
Ensure correct certificate format
Verify certificate chain is complete
Check certificate permissions

Additional Resources

Configuration reference: Review configuration options
Security hardening: Protect backup data
Upgrade procedures: Backup before upgrades
Migration guide: Backup before major migrations

​What to Back Up

​Dashboard Configuration

​TLS Certificates

​Saved Objects

​Custom Branding Assets

​Additional Files to Consider

​Backup Procedures

​Manual Backup

​1. Export Saved Objects

​2. Backup Configuration Files

​3. Backup Certificates

​4. Backup Custom Branding

​5. Document Custom Settings

​Automated Backup Script

​Export Saved Objects via API

​Restore Procedures

​Complete Restore

​1. Install Wazuh Dashboard

​2. Stop the Dashboard Service

​3. Restore Configuration Files

​4. Restore Certificates

​5. Restore Custom Branding

​6. Set File Permissions

​7. Start the Dashboard Service

​8. Verify Service Status

​9. Import Saved Objects

​Partial Restore

​Restore Configuration Only

​Restore Certificates Only

​Import Specific Saved Objects

​Backup Best Practices

​Backup Frequency

​Backup Storage

​Backup Retention

​Security Considerations

​Disaster Recovery

​Recovery Time Objective (RTO)

​Recovery Point Objective (RPO)

​Disaster Recovery Testing

​Troubleshooting Restore Issues

​Service Fails to Start After Restore

​Saved Objects Import Fails

​Certificate Validation Errors

​Additional Resources

What to Back Up

Dashboard Configuration

TLS Certificates

Saved Objects

Custom Branding Assets

Additional Files to Consider

Backup Procedures

Manual Backup

1. Export Saved Objects

2. Backup Configuration Files

3. Backup Certificates

4. Backup Custom Branding

5. Document Custom Settings

Automated Backup Script

Export Saved Objects via API

Restore Procedures

Complete Restore

1. Install Wazuh Dashboard

2. Stop the Dashboard Service

3. Restore Configuration Files

4. Restore Certificates

5. Restore Custom Branding

6. Set File Permissions

7. Start the Dashboard Service

8. Verify Service Status

9. Import Saved Objects

Partial Restore

Restore Configuration Only

Restore Certificates Only

Import Specific Saved Objects

Backup Best Practices

Backup Frequency

Backup Storage

Backup Retention

Security Considerations

Disaster Recovery

Recovery Time Objective (RTO)

Recovery Point Objective (RPO)

Disaster Recovery Testing

Troubleshooting Restore Issues

Service Fails to Start After Restore

Saved Objects Import Fails

Certificate Validation Errors

Additional Resources