diff --git a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml index 3b39063a..5d11857c 100644 --- a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml +++ b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml @@ -6,7 +6,7 @@ wazuh_template_branch: v4.8.0 filebeat_node_name: node-1 filebeat_output_indexer_hosts: - - "localhost:9200" + - "localhost" filebeat_module_package_name: wazuh-filebeat-0.4.tar.gz filebeat_module_package_path: /tmp/ diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 43c3958d..1e650233 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -144,69 +144,22 @@ wazuh_manager_sca: time: '' ## Vulnerability Detector -wazuh_manager_vulnerability_detector: - enabled: 'no' - interval: '5m' - min_full_scan_interval: '6h' - run_on_start: 'yes' - providers: - - enabled: 'no' - os: - - 'trusty' - - 'xenial' - - 'bionic' - - 'focal' - - 'jammy' - update_interval: '1h' - name: '"canonical"' - - enabled: 'no' - os: - - 'buster' - - 'bullseye' - - 'bookworm' - update_interval: '1h' - name: '"debian"' - - enabled: 'no' - os: - - '5' - - '6' - - '7' - - '8' - - '9' - update_interval: '1h' - name: '"redhat"' - - enabled: 'no' - os: - - '8' - - '9' - update_interval: '1h' - name: '"almalinux"' - - enabled: 'no' - os: - - 'amazon-linux' - - 'amazon-linux-2' - - 'amazon-linux-2023' - update_interval: '1h' - name: '"alas"' - - enabled: 'no' - os: - - '11-server' - - '11-desktop' - - '12-server' - - '12-desktop' - - '15-server' - - '15-desktop' - update_interval: '1h' - name: '"suse"' - - enabled: 'no' - update_interval: '1h' - name: '"arch"' - - enabled: 'no' - update_interval: '1h' - name: '"msu"' - - enabled: 'no' - update_interval: '1h' - name: '"nvd"' +filebeat_node_name: node-1 +filebeat_output_indexer_hosts: + - "localhost" +filebeat_output_indexer_port: 9200 +indexer_security_user: admin +indexer_security_password: changeme +filebeat_ssl_dir: /etc/pki/filebeat + +wazuh_manager_vulnerability_detection: + enabled: 'yes' + indexer_status: 'yes' + feed_update_interval: '60m' + +wazuh_manager_indexer: + enabled: 'yes' + hosts: "{{ filebeat_output_indexer_hosts }}" ## Syscheck wazuh_manager_syscheck: @@ -448,7 +401,8 @@ wazuh_manager_config_defaults: osquery: '{{ wazuh_manager_osquery }}' syscollector: '{{ wazuh_manager_syscollector }}' sca: '{{ wazuh_manager_sca }}' - vulnerability_detector: '{{ wazuh_manager_vulnerability_detector }}' + vulnerability_detection: '{{ wazuh_manager_vulnerability_detection }}' + indexer: '{{ wazuh_manager_indexer }}' log_level: '{{ wazuh_manager_log_level }}' email_level: '{{ wazuh_manager_email_level }}' localfiles: '{{ wazuh_manager_localfiles }}' diff --git a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 index c83dd4fd..d14a7bf6 100644 --- a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 +++ b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 @@ -258,37 +258,30 @@ {% endif %} - - {% if wazuh_manager_config.vulnerability_detector.enabled is defined %} - {{ wazuh_manager_config.vulnerability_detector.enabled }} - {% endif %} - {% if wazuh_manager_config.vulnerability_detector.interval is defined %} - {{ wazuh_manager_config.vulnerability_detector.interval }} - {% endif %} - {% if wazuh_manager_config.vulnerability_detector.min_full_scan_interval is defined %} - {{ wazuh_manager_config.vulnerability_detector.min_full_scan_interval }} - {% endif %} - {% if wazuh_manager_config.vulnerability_detector.run_on_start is defined %} - {{ wazuh_manager_config.vulnerability_detector.run_on_start }} - {% endif %} - {% if wazuh_manager_config.vulnerability_detector.providers is defined %} - {% for provider_ in wazuh_manager_config.vulnerability_detector.providers %} - - {% if provider_.enabled is defined %} - {{ provider_.enabled }} - {% endif %} - {% if provider_.os is defined %} - {% for os_ in provider_.os %} - {{ os_ }} - {% endfor %} - {% endif %} - {% if provider_.update_interval is defined %} - {{ provider_.update_interval }} - {% endif %} - - {% endfor %} - {% endif %} - + + {{ wazuh_manager_config.vulnerability_detection.enabled }} + {{ wazuh_manager_config.vulnerability_detection.indexer_status }} + {{ wazuh_manager_config.vulnerability_detection.feed_update_interval }} + + + + {% if wazuh_manager_config.vulnerability_detection.enabled == 'yes' or wazuh_manager_config.indexer.enabled == 'yes' %}yes{% else %}no{% endif %} + + {% for item in wazuh_manager_config.indexer.hosts %} + https://{{ item }}:{{ filebeat_output_indexer_port }} + {% endfor %} + + + {{ indexer_security_user }} + {{ indexer_security_password }} + + + {{ filebeat_ssl_dir }}/root-ca.pem + + {{ filebeat_ssl_dir }}/{{ filebeat_node_name }}.pem + {{ filebeat_ssl_dir }}/{{ filebeat_node_name }}-key.pem + +