diff --git a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml
index 05b0fe8b..2e5bf4f0 100644
--- a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml
+++ b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml
@@ -87,8 +87,17 @@ wazuh_agent_config:
scan_on_start: 'yes'
auto_ignore: 'no'
alert_new_files: 'yes'
- win_audit_interval: 300
+ win_audit_interval: 60
skip_nfs: 'yes'
+ skip_dev: 'yes'
+ skip_proc: 'yes'
+ skip_sys: 'yes'
+ process_priority: 10
+ max_eps: 100
+ sync_enabled: 'yes'
+ sync_interval: '5m'
+ sync_max_interval: '1h'
+ sync_max_eps: 10
ignore:
- /etc/mtab
- /etc/hosts.deny
@@ -114,106 +123,39 @@ wazuh_agent_config:
- /etc/ssl/private.key
directories:
- dirs: /etc,/usr/bin,/usr/sbin
- checks: 'check_all="yes"'
+ checks: ''
- dirs: /bin,/sbin,/boot
- checks: 'check_all="yes"'
+ checks: ''
win_directories:
- - dirs: '%WINDIR%\regedit.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\system.ini'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\win.ini'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\at.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\attrib.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\cacls.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\cmd.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\drivers\etc'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\eventcreate.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\ftp.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\lsass.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\net.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\net1.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\netsh.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\reg.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\regedt32.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\regsvr32.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\runas.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\sc.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\schtasks.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\sethc.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\subst.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\wbem\WMIC.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\WindowsPowerShell\v1.0\powershell.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\SysNative\winrm.vbs'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\at.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\attrib.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\cacls.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\cmd.exe'
- checks: 'check_all="yes"'
+ - dirs: '%WINDIR%'
+ checks: 'recursion_level="0" restrict="regedit.exe$|system.ini$|win.ini$"'
+ - dirs: '%WINDIR%\SysNative'
+ checks: >-
+ recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|
+ net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedt32.exe|regsvr32.exe|runas.exe|sc.exe|schtasks.exe|sethc.exe|subst.exe$"
+ - dirs: '%WINDIR%\SysNative\drivers\etc%'
+ checks: 'recursion_level="0"'
+ - dirs: '%WINDIR%\SysNative\wbem'
+ checks: 'recursion_level="0" restrict="WMIC.exe$"'
+ - dirs: '%WINDIR%\SysNative\WindowsPowerShell\v1.0'
+ checks: 'recursion_level="0" restrict="powershell.exe$"'
+ - dirs: '%WINDIR%\SysNative'
+ checks: 'recursion_level="0" restrict="winrm.vbs$"'
+ - dirs: '%WINDIR%\System32'
+ checks: >-
+ recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|
+ netsh.exe$|reg.exe$|regedit.exe$|regedt32.exe$|regsvr32.exe$|runas.exe$|sc.exe$|schtasks.exe$|sethc.exe$|subst.exe$"
- dirs: '%WINDIR%\System32\drivers\etc'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\eventcreate.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\ftp.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\net.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\net1.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\netsh.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\reg.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\regedit.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\regedt32.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\regsvr32.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\runas.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\sc.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\schtasks.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\sethc.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\subst.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\wbem\WMIC.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe'
- checks: 'check_all="yes"'
- - dirs: '%WINDIR%\System32\winrm.vbs'
- checks: 'check_all="yes"'
+ checks: 'recursion_level="0"'
+ - dirs: '%WINDIR%\System32\wbem'
+ checks: 'recursion_level="0" restrict="WMIC.exe$"'
+ - dirs: '%WINDIR%\System32\WindowsPowerShell\v1.0'
+ checks: 'recursion_level="0" restrict="powershell.exe$"'
+ - dirs: '%WINDIR%\System32'
+ checks: 'recursion_level="0" restrict="winrm.vbs$"'
- dirs: '%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup'
- checks: 'check_all="yes" realtime="yes"'
+ checks: 'realtime="yes"'
+
windows_registry:
- key: 'HKEY_LOCAL_MACHINE\Software\Classes\batfile'
- key: 'HKEY_LOCAL_MACHINE\Software\Classes\cmdfile'
diff --git a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2
index 0c640cdc..28b6828a 100644
--- a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2
+++ b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2
@@ -61,7 +61,6 @@
yes
{% endif %}
{% if ansible_os_family == "Windows" %}
- ./shared/win_audit_rcl.txt
./shared/win_applications_rcl.txt
./shared/win_malware_rcl.txt
{% endif %}
@@ -186,13 +185,13 @@
{% if wazuh_agent_config.sca.skip_nfs | length > 0 %}
yes
{% endif %}
- {% if wazuh_agent_config.sca.day | length > 0 %}
+ {% if wazuh_agent_config.sca.day | length > 0 %}
yes
{% endif %}
- {% if wazuh_agent_config.sca.wday | length > 0 %}
+ {% if wazuh_agent_config.sca.wday | length > 0 %}
yes
{% endif %}
- {% if wazuh_agent_config.sca.time | length > 0 %}
+ {% if wazuh_agent_config.sca.time | length > 0 %}
{% endif %}
@@ -246,8 +245,11 @@
{% for no_diff in wazuh_agent_config.syscheck.no_diff %}
{{ no_diff }}
{% endfor %}
-
+
{{ wazuh_agent_config.syscheck.skip_nfs }}
+ {{ wazuh_agent_config.syscheck.skip_dev }}
+ {{ wazuh_agent_config.syscheck.skip_proc }}
+ {{ wazuh_agent_config.syscheck.skip_sys }}
{% endif %}
{% if ansible_os_family == "Windows" %}
@@ -274,6 +276,20 @@
{{ wazuh_agent_config.syscheck.win_audit_interval }}
{% endif %}
+
+
+ {{ wazuh_agent_config.syscheck.process_priority }}
+
+
+ {{ wazuh_agent_config.syscheck.max_eps }}
+
+
+
+ {{ wazuh_agent_config.syscheck.sync_enabled }}
+ {{ wazuh_agent_config.syscheck.interval }}
+ {{ wazuh_agent_config.syscheck.max_interval }}
+ {{ wazuh_agent_config.syscheck.max_eps }}
+
{% endif %}
@@ -292,7 +308,7 @@
{% if ansible_system == "Linux" %}
{% for localfile in wazuh_agent_config.localfiles.linux %}
-
+
{{ localfile.format }}
{% if localfile.format == 'command' or localfile.format == 'full_command' %}