wazuh-filebeat

LOW

maintainer madara125 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt RPM and auxiliary files from Wazuh's official domain, which is plausibly the project's own infrastructure; the files are verified via checksums, and the content (configuration, module, template) is non-executable data, so the worst case of a swapped source is limited to data tampering, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt RPM and auxiliary files from Wazuh's official domain, which is plausibly the project's own infrastructure; the files are verified via checksums, and the content (configuration, module, template) is non-executable data, so the worst case of a swapped source is limited to data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 "https://packages.wazuh.com/4.x/yum/filebeat-${_prodver}.x86_64.rpm"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jesus Martin Ortega Martinez (madara125) <martin.ortega.arashi@gmail.com><jortega@condorbs.net>
    
      2# Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><david.munozm@proton.me>
    
      3pkgname=wazuh-filebeat
    
      4pkgver=7.10.2
    
      5pkgrel=5
    
      6_remRevision=2
    
      7_prodver=${pkgver}-${_remRevision}
    
      8# Version de Wazuh a la que acompaña este filebeat: fija el tag del que se toma
    
      9# wazuh-template.json. Filebeat mantiene su propio versionado (7.10.2).
    
      10_wazuhver=4.14.9
    
      11_modulever=0.5
    
      12pkgdesc="Filebeat version for Wazuh (forwards alerts to Wazuh Indexer)"
    
      13arch=('x86_64')
    
      14url="https://wazuh.com/"
    
      15license=('Apache-2.0')
    
      16groups=("wazuh-siem")
    
      17depends=(
    
      18    'glibc'
    
      19    'systemd'
    
      20    'curl'
    
      21)
    
      22optdepends=(
    
      23    'wazuh-manager: Wazuh server component'
    
      24)
    
      25
    
      26conflicts=('filebeat' 'filebeat-bin' 'filebeat-oss')
    
      27provides=('filebeat')
    
      28
    
      29# El modulo wazuh y wazuh-template.json se empaquetan como fuentes verificadas.
    
      30# Antes se descargaban con curl desde post_install: eso rompe la reproducibilidad,
    
      31# incumple las normas del AUR (toda fuente debe ir en source= con checksum), deja
    
      32# ficheros que pacman no controla y no se limpian al desinstalar, y falla en
    
      33# silencio (|| true) si no hay red durante la instalacion.
    
      34source=(
    
      35    "https://packages.wazuh.com/4.x/yum/filebeat-${_prodver}.x86_64.rpm"
    
      36    "wazuh-filebeat-module-${_modulever}.tar.gz::https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-${_modulever}.tar.gz"
    
      37    "wazuh-template-${_wazuhver}.json::https://raw.githubusercontent.com/wazuh/wazuh/v${_wazuhver}/extensions/elasticsearch/7.x/wazuh-template.json"
    
      38    "filebeat.yml"
    
      39)
    
      40
    
      41backup=(
    
      42    'etc/filebeat/filebeat.yml'
    
      43)
    
      44
    
      45sha512sums=('abe92f985b339894fadc1151744f3ed5e62483e1b1d89e38c6763858eb07ae7c4efdb8ab1780c0d9bd8769357e4852c0c54a897a2501d25f9037bb939efb21b3'
    
      46            '1a97f39d7d08f9f8136642cc5a4aa3190248ada5b986e4840955b78548fc17e1c68be283e44ea14b83776863c2b55e0633b48fa9a05c4f0ea597ae4cf8fd6e42'
    
      47            'd62ebb7c50a6530637546aafa5c8bc89028aea4299b633a74899070a5a75e3918b4dda2a38a5e02c7289cc0cffe4be40c821f7f19d03eaf3f83617c302251ae6'
    
      48            'd3849c90a02a69083c4f0441a767e7a0b4bdfc4df1deb235198e01e0f6a5e4e3f14085abe44519df7cf57bcb92d7c8f310dcac424c83036ed12cc378ed7b913c')
    
      49
    
      50install=$pkgname.install
    
      51
    
      52package() {
    
      53    cd $pkgdir
    
      54
    
      55    # Move files from RPM extraction
    
      56    mv $srcdir/etc .
    
      57    mv $srcdir/usr .
    
      58    mv $srcdir/lib ./usr
    
      59
    
      60    # Modulo wazuh de filebeat (el tar.gz se extrae a $srcdir/wazuh)
    
      61    cp -a "$srcdir/wazuh" "$pkgdir/usr/share/filebeat/module/"
    
      62    find "$pkgdir/usr/share/filebeat/module/wazuh" -type d -exec chmod 755 {} +
    
      63    find "$pkgdir/usr/share/filebeat/module/wazuh" -type f -exec chmod 644 {} +
    
      64
    
      65    # Plantilla de indices para el Wazuh Indexer
    
      66    install -Dm644 "$srcdir/wazuh-template-${_wazuhver}.json" \
    
      67        "$pkgdir/etc/filebeat/wazuh-template.json"
    
      68
    
      69    # Configuracion de Wazuh en lugar del filebeat.yml generico de Elastic, que
    
      70    # no trae el modulo wazuh, ni SSL, ni la plantilla, ni el permiso seccomp
    
      71    # de rseq (sin el, filebeat aborta con glibc reciente).
    
      72    install -Dm600 "$srcdir/filebeat.yml" "$pkgdir/etc/filebeat/filebeat.yml"
    
      73
    
      74    # Directorio de certificados: 500 es lo que documenta Wazuh y lo que deja
    
      75    # el despliegue de certs, asi coincide con el estado en disco y pacman no
    
      76    # avisa de permisos divergentes en cada reinstalacion.
    
      77    install -dm500 "$pkgdir/etc/filebeat/certs"
    
      78
    
      79    # Set systemd service file perms
    
      80    chmod 644 $pkgdir/usr/lib/systemd/system/filebeat.service
    
      81}
    
      82

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,54 +2,81 @@
 # Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><david.munozm@proton.me>
 pkgname=wazuh-filebeat
 pkgver=7.10.2
-_remRevision=1
+pkgrel=5
+_remRevision=2
 _prodver=${pkgver}-${_remRevision}
-pkgrel=1
-pkgdesc="Filebeat version for Wazuh"
+# Version de Wazuh a la que acompaña este filebeat: fija el tag del que se toma
+# wazuh-template.json. Filebeat mantiene su propio versionado (7.10.2).
+_wazuhver=4.14.9
+_modulever=0.5
+pkgdesc="Filebeat version for Wazuh (forwards alerts to Wazuh Indexer)"
 arch=('x86_64')
 url="https://wazuh.com/"
-license=('gpl2')
+license=('Apache-2.0')
 groups=("wazuh-siem")
 depends=(
     'glibc'
-    'audit'
-    'git'
-    'go'
-    'libpcap'
-    'mage'
-    'python-virtualenv'
-    'rsync'
     'systemd'
-    'python'
-);
+    'curl'
+)
 optdepends=(
-    'elasticsearch'
-);
+    'wazuh-manager: Wazuh server component'
+)
 
-conflicts=('filebeat')
+conflicts=('filebeat' 'filebeat-bin' 'filebeat-oss')
+provides=('filebeat')
 
-validpgpkeys=('9E646BB0630C8FD18ACD15541B93E6A766CD229D')
-
-source=("https://packages.wazuh.com/4.x/yum/filebeat-oss-7.10.2-x86_64.rpm")
+# El modulo wazuh y wazuh-template.json se empaquetan como fuentes verificadas.
+# Antes se descargaban con curl desde post_install: eso rompe la reproducibilidad,
+# incumple las normas del AUR (toda fuente debe ir en source= con checksum), deja
+# ficheros que pacman no controla y no se limpian al desinstalar, y falla en
+# silencio (|| true) si no hay red durante la instalacion.
+source=(
+    "https://packages.wazuh.com/4.x/yum/filebeat-${_prodver}.x86_64.rpm"
+    "wazuh-filebeat-module-${_modulever}.tar.gz::https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-${_modulever}.tar.gz"
+    "wazuh-template-${_wazuhver}.json::https://raw.githubusercontent.com/wazuh/wazuh/v${_wazuhver}/extensions/elasticsearch/7.x/wazuh-template.json"
+    "filebeat.yml"
+)
 
 backup=(
-  'etc/filebeat/filebeat.yml'
-  'etc/filebeat/certs'
-  )
+    'etc/filebeat/filebeat.yml'
+)
 
-sha256sums=('56820530dd749d61ba2750ecefc390393a8a5029dd431bf2eaf6a599a847f8f2')
+sha512sums=('abe92f985b339894fadc1151744f3ed5e62483e1b1d89e38c6763858eb07ae7c4efdb8ab1780c0d9bd8769357e4852c0c54a897a2501d25f9037bb939efb21b3'
+            '1a97f39d7d08f9f8136642cc5a4aa3190248ada5b986e4840955b78548fc17e1c68be283e44ea14b83776863c2b55e0633b48fa9a05c4f0ea597ae4cf8fd6e42'
+            'd62ebb7c50a6530637546aafa5c8bc89028aea4299b633a74899070a5a75e3918b4dda2a38a5e02c7289cc0cffe4be40c821f7f19d03eaf3f83617c302251ae6'
+            'd3849c90a02a69083c4f0441a767e7a0b4bdfc4df1deb235198e01e0f6a5e4e3f14085abe44519df7cf57bcb92d7c8f310dcac424c83036ed12cc378ed7b913c')
 
 install=$pkgname.install
 
 package() {
+    cd $pkgdir
 
-    #Setup
-    cd $pkgdir
+    # Move files from RPM extraction
     mv $srcdir/etc .
     mv $srcdir/usr .
     mv $srcdir/lib ./usr
 
-    #Set systemd service file perms
+    # Modulo wazuh de filebeat (el tar.gz se extrae a $srcdir/wazuh)
+    cp -a "$srcdir/wazuh" "$pkgdir/usr/share/filebeat/module/"
+    find "$pkgdir/usr/share/filebeat/module/wazuh" -type d -exec chmod 755 {} +
+    find "$pkgdir/usr/share/filebeat/module/wazuh" -type f -exec chmod 644 {} +
+
+    # Plantilla de indices para el Wazuh Indexer
+    install -Dm644 "$srcdir/wazuh-template-${_wazuhver}.json" \
+        "$pkgdir/etc/filebeat/wazuh-template.json"
+
+    # Configuracion de Wazuh en lugar del filebeat.yml generico de Elastic, que
+    # no trae el modulo wazuh, ni SSL, ni la plantilla, ni el permiso seccomp
+    # de rseq (sin el, filebeat aborta con glibc reciente).
+    install -Dm600 "$srcdir/filebeat.yml" "$pkgdir/etc/filebeat/filebeat.yml"
+
+    # Directorio de certificados: 500 es lo que documenta Wazuh y lo que deja
+    # el despliegue de certs, asi coincide con el estado en disco y pacman no
+    # avisa de permisos divergentes en cada reinstalacion.
+    install -dm500 "$pkgdir/etc/filebeat/certs"
+
+    # Set systemd service file perms
     chmod 644 $pkgdir/usr/lib/systemd/system/filebeat.service
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 01:13:57	Medium	1
2026-06-20 16:03:41	Clean	2
2026-06-20 00:50:07	Medium	2
2026-06-20 00:18:46	Medium	2
2026-06-19 23:51:18	Medium	2
2026-06-19 19:07:35	Low	2
2026-06-19 18:54:17	Low	2
2026-06-18 16:11:54	Medium	1