Merge branch 'devel' into feature-387-kibana-app-changes

CHANGELOG.md

@@ -1,6 +1,27 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## [v3.12.0_7.6.1]
+
+### Added
+
+- Update to Wazuh v3.12.0
+- Added registration address variable to wazuh-agent playbook ([@Zenidd](https://github.com/Zenidd)) [PR#392](https://github.com/wazuh/wazuh-ansible/pull/392)
+
+### Changed
+
+- Bump NodeJS version to 10.x ([@manuasir](https://github.com/manuasir)) [PR#386](https://github.com/wazuh/wazuh-ansible/pull/386)
+- Add flag to enable/disable Windows MD5 check ([@jm404](https://github.com/jm404)) [PR#383](https://github.com/wazuh/wazuh-ansible/pull/383)
+- Rule paths are now relative to playbooks. ([@Zenidd ](https://github.com/Zenidd)) [PR#393](https://github.com/wazuh/wazuh-ansible/pull/393)
+- Add the option to create agent groups and add an agent to 1 or more group. ([@rshad](https://github.com/rshad)) [PR#361](https://github.com/wazuh/wazuh-ansible/pull/361)
+
+
+### Fixed
+
+- Removed bad formed XML comments. ([@manuasir](https://github.com/manuasir)) [PR#391](https://github.com/wazuh/wazuh-ansible/pull/391)
+- NodeJS node_options variable and Kibana plugin optimization fix. ([@Zenidd](https://github.com/Zenidd)) [PR#385](https://github.com/wazuh/wazuh-ansible/pull/385)
+- Restrictive permissions for certificate files. ([@Zenidd](https://github.com/Zenidd)) [PR#382](https://github.com/wazuh/wazuh-ansible/pull/382)
+
 ## [v3.11.4_7.6.1]
 
 ### Added
@@ -316,4 +337,3 @@ Roles:
    - ansible-filebeat: This role is prepared to install filebeat on the host that runs it.
    - ansible-wazuh-manager: With this role we will install Wazuh manager and Wazuh API on the host that runs it.
    - ansible-wazuh-agent: Using this role we will install Wazuh agent on the host that runs it and is able to register it.
-

roles/elastic-stack/ansible-elasticsearch/templates/wazuh-elastic7-template-alerts.json.j2

@@ -531,6 +531,9 @@
           "sha1_before": {
             "type": "keyword"
           },
+          "hard_links": {
+            "type": "keyword"
+          },
           "sha1_after": {
             "type": "keyword"
           },

roles/elastic-stack/ansible-kibana/defaults/main.yml

@@ -6,7 +6,7 @@ elasticsearch_network_host: "127.0.0.1"
 kibana_server_host: "0.0.0.0"
 kibana_server_port: "5601"
 elastic_stack_version: 7.6.1
-wazuh_version: 3.11.4
+wazuh_version: 3.12.0
 wazuh_app_url: https://packages.wazuh.com/wazuhapp/wazuhapp
 
 elasticrepo:
@@ -47,7 +47,7 @@ nodejs:
 
 # Build from sources
 build_from_sources: false
-wazuh_plugin_branch: 3.11-7.6
+wazuh_plugin_branch: 3.12-7.6
 
 #Nodejs NODE_OPTIONS
 node_options: --max-old-space-size=4096

roles/wazuh/ansible-wazuh-agent/defaults/main.yml

@@ -1,18 +1,18 @@
 ---
-wazuh_agent_version: 3.11.4-1
+wazuh_agent_version: 3.12.0-1
 
 
 # Custom packages installation
 
 wazuh_custom_packages_installation_agent_enabled: false
-wazuh_custom_packages_installation_agent_deb_url: "https://s3-us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/branches/3.12/deb/var/wazuh-agent_3.12.0-0.3319fimreworksqlite_amd64.deb"
+wazuh_custom_packages_installation_agent_deb_url: ""
-wazuh_custom_packages_installation_agent_rpm_url: "https://s3-us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/branches/3.12/rpm/var/wazuh-agent-3.12.0-0.3319fimreworksqlite.x86_64.rpm"
+wazuh_custom_packages_installation_agent_rpm_url: ""
 
 # Sources installation
 
 wazuh_agent_sources_installation:
   enabled: false
-  branch: "v3.11.4"
+  branch: "v3.12.0"
   user_language: "y"
   user_no_stop: "y"
   user_install_type: "agent"
@@ -63,9 +63,9 @@ wazuh_winagent_config:
   # Adding quotes to auth_path_x86 since win_shell outputs error otherwise
   auth_path_x86: C:\'Program Files (x86)'\ossec-agent\agent-auth.exe
   check_md5: True
-  md5: 87ce22038688efb44d95f9daff472056
+  md5: 91efaefae4e1977670eab0c768a22a93
-wazuh_winagent_config_url: https://packages.wazuh.com/3.x/windows/wazuh-agent-3.11.4-1.msi
+wazuh_winagent_config_url: https://packages.wazuh.com/3.x/windows/wazuh-agent-3.12.0-1.msi
-wazuh_winagent_package_name: wazuh-agent-3.11.4-1.msi
+wazuh_winagent_package_name: wazuh-agent-3.12.0-1.msi
 wazuh_agent_config:
   repo:
     apt: 'deb https://packages.wazuh.com/3.x/apt/ stable main'
@@ -87,8 +87,17 @@ wazuh_agent_config:
     scan_on_start: 'yes'
     auto_ignore: 'no'
     alert_new_files: 'yes'
-    win_audit_interval: 300
+    win_audit_interval: 60
     skip_nfs: 'yes'
+    skip_dev: 'yes'
+    skip_proc: 'yes'
+    skip_sys: 'yes'
+    process_priority: 10
+    max_eps: 100
+    sync_enabled: 'yes'
+    sync_interval: '5m'
+    sync_max_interval: '1h'
+    sync_max_eps: 10
     ignore:
       - /etc/mtab
       - /etc/hosts.deny
@@ -102,11 +111,7 @@ wazuh_agent_config:
       - /etc/cups/certs
       - /etc/dumpdates
       - /etc/svc/volatile
-      - /sys/kernel/security
-      - /sys/kernel/debug
-      - /dev/core
     ignore_linux_type:
-      - '^/proc'
       - '.log$|.swp$'
     ignore_win:
       - '.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$'
@@ -114,106 +119,39 @@ wazuh_agent_config:
       - /etc/ssl/private.key
     directories:
       - dirs: /etc,/usr/bin,/usr/sbin
-        checks: 'check_all="yes"'
+        checks: ''
       - dirs: /bin,/sbin,/boot
-        checks: 'check_all="yes"'
+        checks: ''
     win_directories:
-      - dirs: '%WINDIR%\regedit.exe'
+      - dirs: '%WINDIR%'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0" restrict="regedit.exe$|system.ini$|win.ini$"'
-      - dirs: '%WINDIR%\system.ini'
+      - dirs: '%WINDIR%\SysNative'
-        checks: 'check_all="yes"'
+        checks: >-
-      - dirs: '%WINDIR%\win.ini'
+          recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|
-        checks: 'check_all="yes"'
+          net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedt32.exe|regsvr32.exe|runas.exe|sc.exe|schtasks.exe|sethc.exe|subst.exe$"
-      - dirs: '%WINDIR%\SysNative\at.exe'
+      - dirs: '%WINDIR%\SysNative\drivers\etc%'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0"'
-      - dirs: '%WINDIR%\SysNative\attrib.exe'
+      - dirs: '%WINDIR%\SysNative\wbem'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0" restrict="WMIC.exe$"'
-      - dirs: '%WINDIR%\SysNative\cacls.exe'
+      - dirs: '%WINDIR%\SysNative\WindowsPowerShell\v1.0'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0" restrict="powershell.exe$"'
-      - dirs: '%WINDIR%\SysNative\cmd.exe'
+      - dirs: '%WINDIR%\SysNative'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0" restrict="winrm.vbs$"'
-      - dirs: '%WINDIR%\SysNative\drivers\etc'
+      - dirs: '%WINDIR%\System32'
-        checks: 'check_all="yes"'
+        checks: >-
-      - dirs: '%WINDIR%\SysNative\eventcreate.exe'
+          recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|
-        checks: 'check_all="yes"'
+          netsh.exe$|reg.exe$|regedit.exe$|regedt32.exe$|regsvr32.exe$|runas.exe$|sc.exe$|schtasks.exe$|sethc.exe$|subst.exe$"
-      - dirs: '%WINDIR%\SysNative\ftp.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\lsass.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\net.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\net1.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\netsh.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\reg.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\regedt32.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\regsvr32.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\runas.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\sc.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\schtasks.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\sethc.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\subst.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\wbem\WMIC.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\WindowsPowerShell\v1.0\powershell.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\SysNative\winrm.vbs'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\at.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\attrib.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\cacls.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\cmd.exe'
-        checks: 'check_all="yes"'
       - dirs: '%WINDIR%\System32\drivers\etc'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0"'
-      - dirs: '%WINDIR%\System32\eventcreate.exe'
+      - dirs: '%WINDIR%\System32\wbem'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0" restrict="WMIC.exe$"'
-      - dirs: '%WINDIR%\System32\ftp.exe'
+      - dirs: '%WINDIR%\System32\WindowsPowerShell\v1.0'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0" restrict="powershell.exe$"'
-      - dirs: '%WINDIR%\System32\net.exe'
+      - dirs: '%WINDIR%\System32'
-        checks: 'check_all="yes"'
+        checks: 'recursion_level="0" restrict="winrm.vbs$"'
-      - dirs: '%WINDIR%\System32\net1.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\netsh.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\reg.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\regedit.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\regedt32.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\regsvr32.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\runas.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\sc.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\schtasks.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\sethc.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\subst.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\wbem\WMIC.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe'
-        checks: 'check_all="yes"'
-      - dirs: '%WINDIR%\System32\winrm.vbs'
-        checks: 'check_all="yes"'
       - dirs: '%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup'
-        checks: 'check_all="yes" realtime="yes"'
+        checks: 'realtime="yes"'
+
     windows_registry:
       - key: 'HKEY_LOCAL_MACHINE\Software\Classes\batfile'
       - key: 'HKEY_LOCAL_MACHINE\Software\Classes\cmdfile'

roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml

@@ -41,6 +41,7 @@
   when:
     - wazuh_winagent_config.check_md5
 
+
 - name: Windows | Install Agent if not already installed
   win_package:
     path: "{{ wazuh_winagent_config.download_dir }}{{ wazuh_winagent_package_name }}"

roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2

@@ -61,7 +61,6 @@
     <skip_nfs>yes</skip_nfs>
     {% endif %}
     {% if ansible_os_family == "Windows" %}
-    <windows_audit>./shared/win_audit_rcl.txt</windows_audit>
     <windows_apps>./shared/win_applications_rcl.txt</windows_apps>
     <windows_malware>./shared/win_malware_rcl.txt</windows_malware>
     {% endif %}
@@ -248,6 +247,9 @@
     {% endfor %}
 
     <skip_nfs>{{ wazuh_agent_config.syscheck.skip_nfs }}</skip_nfs>
+    <skip_dev>{{ wazuh_agent_config.syscheck.skip_dev }}</skip_dev>
+    <skip_proc>{{ wazuh_agent_config.syscheck.skip_proc }}</skip_proc>
+    <skip_sys>{{ wazuh_agent_config.syscheck.skip_sys }}</skip_sys>
     {% endif %}
 
     {% if ansible_os_family == "Windows" %}
@@ -274,6 +276,20 @@
     <!-- Frequency for ACL checking (seconds) -->
     <windows_audit_interval>{{ wazuh_agent_config.syscheck.win_audit_interval }}</windows_audit_interval>
     {% endif %}
+
+      <!-- Nice value for Syscheck module -->
+    <process_priority>{{ wazuh_agent_config.syscheck.process_priority }}</process_priority>
+
+    <!-- Maximum output throughput -->
+    <max_eps>{{ wazuh_agent_config.syscheck.max_eps }}</max_eps>
+
+    <!-- Database synchronization settings -->
+    <synchronization>
+      <enabled>{{ wazuh_agent_config.syscheck.sync_enabled }}</enabled>
+      <interval>{{ wazuh_agent_config.syscheck.sync_interval }}</interval>
+      <max_interval>{{ wazuh_agent_config.syscheck.sync_max_interval }}</max_interval>
+      <max_eps>{{ wazuh_agent_config.syscheck.sync_max_eps }}</max_eps>
+    </synchronization>
   </syscheck>
   {% endif %}
 

roles/wazuh/ansible-wazuh-manager/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-wazuh_manager_version: 3.11.4-1
+wazuh_manager_version: 3.12.0-1
 
 wazuh_manager_fqdn: "wazuh-server"
 wazuh_manager_package_state: present
@@ -15,7 +15,7 @@ wazuh_custom_packages_installation_api_rpm_url: "https://s3-us-west-1.amazonaws.
 # Sources installation
 wazuh_manager_sources_installation:
   enabled: false
-  branch: "v3.11.4"
+  branch: "v3.12.0"
   user_language: "en"
   user_no_stop: "y"
   user_install_type: "server"
@@ -40,7 +40,7 @@ wazuh_manager_sources_installation:
 
 wazuh_api_sources_installation:
   enabled: false
-  branch: "v3.11.4"
+  branch: "v3.12.0"
   update: "y"
   remove: "y"
   directory: null
@@ -105,7 +105,7 @@ wazuh_manager_config:
   authd:
     enable: true
     port: 1515
-    use_source_ip: 'yes'
+    use_source_ip: 'no'
     force_insert: 'yes'
     force_time: 0
     purge: 'yes'
@@ -166,24 +166,29 @@ wazuh_manager_config:
       - /etc/cups/certs
       - /etc/dumpdates
       - /etc/svc/volatile
-      - /sys/kernel/security
-      - /sys/kernel/debug
-      - /dev/core
     ignore_linux_type:
-      - '^/proc'
       - '.log$|.swp$'
     no_diff:
       - /etc/ssl/private.key
     directories:
       - dirs: /etc,/usr/bin,/usr/sbin
-        checks: 'check_all="yes"'
+        checks: ''
       - dirs: /bin,/sbin,/boot
-        checks: 'check_all="yes"'
+        checks: ''
     auto_ignore_frequency:
       frequency: 'frequency="10"'
       timeframe: 'timeframe="3600"'
       value: 'no'
     skip_nfs: 'yes'
+    skip_dev: 'yes'
+    skip_proc: 'yes'
+    skip_sys: 'yes'
+    process_priority: 10
+    max_eps: 100
+    sync_enabled: 'yes'
+    sync_interval: '5m'
+    sync_max_interval: '1h'
+    sync_max_eps: 10
   rootcheck:
     frequency: 43200
   openscap:

roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2

@@ -332,6 +332,29 @@
     {% if wazuh_manager_config.syscheck.skip_nfs is defined %}
     <skip_nfs>{{ wazuh_manager_config.syscheck.skip_nfs }}</skip_nfs>
     {% endif %}
+    {% if wazuh_manager_config.syscheck.skip_dev is defined %}
+    <skip_dev>{{ wazuh_manager_config.syscheck.skip_dev }}</skip_dev>
+    {% endif %}
+    {% if wazuh_manager_config.syscheck.skip_proc is defined %}
+    <skip_proc>{{ wazuh_manager_config.syscheck.skip_proc }}</skip_proc>
+    {% endif %}
+    {% if wazuh_manager_config.syscheck.skip_sys is defined %}
+    <skip_sys>{{ wazuh_manager_config.syscheck.skip_sys }}</skip_sys>
+    {% endif %}
+
+    <!-- Nice value for Syscheck module -->
+    <process_priority>{{ wazuh_manager_config.syscheck.process_priority }}</process_priority>
+
+    <!-- Maximum output throughput -->
+    <max_eps>{{ wazuh_manager_config.syscheck.max_eps }}</max_eps>
+
+    <!-- Database synchronization settings -->
+    <synchronization>
+      <enabled>{{ wazuh_manager_config.syscheck.sync_enabled }}</enabled>
+      <interval>{{ wazuh_manager_config.syscheck.sync_interval }}</interval>
+      <max_interval>{{ wazuh_manager_config.syscheck.sync_max_interval }}</max_interval>
+      <max_eps>{{ wazuh_manager_config.syscheck.sync_max_eps }}</max_eps>
+    </synchronization>
   </syscheck>
 
   <global>