diff --git a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml index 88c560fa..9db5406d 100644 --- a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml @@ -30,7 +30,8 @@ wazuh_managers: api_port: 55000 api_proto: 'http' api_user: null -wazuh_profile: null +wazuh_profile_centos: 'centos, centos7, centos7.6' +wazuh_profile_ubuntu: 'ubuntu, ubuntu18, ubuntu18.04' wazuh_auto_restart: 'yes' wazuh_agent_authd: enable: false @@ -102,7 +103,7 @@ wazuh_agent_config: directories: - dirs: /etc,/usr/bin,/usr/sbin checks: 'check_all="yes"' - - dirs: /bin,/sbin + - dirs: /bin,/sbin,/boot checks: 'check_all="yes"' win_directories: - dirs: '%WINDIR%\regedit.exe' diff --git a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 index 57787b07..424410b8 100644 --- a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 +++ b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 @@ -19,8 +19,12 @@ {% endif %} {% endfor %} - {% if wazuh_profile is not none %} - {{ wazuh_profile }} + {% if wazuh_profile_centos is not none or wazuh_profile_ubuntu is not none %} + {% if ansible_distribution == 'CentOS' %} + {{ wazuh_profile_centos }} + {% elif ansible_distribution == "Ubuntu" %} + {{ wazuh_profile_ubuntu }} + {% endif %} {% endif %} {% if wazuh_notify_time is not none and wazuh_time_reconnect is not none %} {{ wazuh_notify_time }} @@ -37,16 +41,6 @@ {{ wazuh_agent_config.client_buffer.events_per_sec }} - - {{ wazuh_agent_config.log_format }} - - - - {{ wazuh_agent_config.active_response.ar_disabled|default('no') }} - {% if ansible_os_family == "Windows" %}{{ wazuh_agent_config.active_response.ca_store_win }}{% else %}{{ wazuh_agent_config.active_response.ca_store }}{% endif %} - {{ wazuh_agent_config.active_response.ca_verification }} - - {% if wazuh_agent_config.rootcheck is defined %} no @@ -75,89 +69,6 @@ {% endif %} - - {% if wazuh_agent_config.syscheck is defined %} - - no - - - {{ wazuh_agent_config.syscheck.frequency }} - {% if ansible_system == "Linux" %} - - /etc,/usr/bin,/usr/sbin - /bin,/sbin,/boot - {{ wazuh_agent_config.syscheck.scan_on_start }} - {% endif %} - - - {% if wazuh_agent_config.syscheck.directories is defined and ansible_system == "Linux" %} - {% for directory in wazuh_agent_config.syscheck.directories %} - {{ directory.dirs }} - {% endfor %} - {% endif %} - - - {% if wazuh_agent_config.syscheck.win_directories is defined and ansible_system == "Windows" %} - {% for directory in wazuh_agent_config.syscheck.win_directories %} - {{ directory.dirs }} - {% endfor %} - {% endif %} - - - {% if wazuh_agent_config.syscheck.ignore is defined and ansible_system == "Linux" %} - {% for ignore in wazuh_agent_config.syscheck.ignore %} - {{ ignore }} - {% endfor %} - {% endif %} - - - {% if wazuh_agent_config.syscheck.ignore_linux_type is defined %} - {% for ignore in wazuh_agent_config.syscheck.ignore_linux_type %} - {{ ignore }} - {% endfor %} - {% endif %} - - {% if wazuh_agent_config.syscheck.ignore is defined and ansible_system == "Windows" %} - {% for ignore in wazuh_agent_config.syscheck.ignore_win %} - {{ ignore }} - {% endfor %} - {% endif %} - - {% if ansible_system == "Linux" %} - - {% for no_diff in wazuh_agent_config.syscheck.no_diff %} - {{ no_diff }} - {% endfor %} - - {{ wazuh_agent_config.syscheck.skip_nfs }} - {% endif %} - - {% if ansible_os_family == "Windows" %} - {% for registry_key in wazuh_agent_config.syscheck.windows_registry %} - {% if registry_key.arch is defined %} - {{ registry_key.key }} - {% else %} - {{ registry_key.key }} - {% endif %} - {% endfor %} - {% endif %} - - {% if ansible_os_family == "Windows" %} - {% for registry_key in wazuh_agent_config.syscheck.windows_registry_ignore %} - {% if registry_key.type is defined %} - {{ registry_key.key }} - {% else %} - {{ registry_key.key }} - {% endif %} - {% endfor %} - {% endif %} - - {% if ansible_os_family == "Windows" %} - - {{ wazuh_agent_config.syscheck.win_audit_interval }} - {% endif %} - - {% endif %} {% if ansible_system == "Linux" %} @@ -276,6 +187,88 @@ {% endif %} + + + {% if wazuh_agent_config.syscheck is defined %} + + no + + + {{ wazuh_agent_config.syscheck.frequency }} + {% if ansible_system == "Linux" %} + {{ wazuh_agent_config.syscheck.scan_on_start }} + + {% if wazuh_agent_config.syscheck.directories is defined and ansible_system == "Linux" %} + {% for directory in wazuh_agent_config.syscheck.directories %} + {{ directory.dirs }} + {% endfor %} + {% endif %} + {% endif %} + + + {% if wazuh_agent_config.syscheck.win_directories is defined and ansible_system == "Windows" %} + {% for directory in wazuh_agent_config.syscheck.win_directories %} + {{ directory.dirs }} + {% endfor %} + {% endif %} + + + {% if wazuh_agent_config.syscheck.ignore is defined and ansible_system == "Linux" %} + {% for ignore in wazuh_agent_config.syscheck.ignore %} + {{ ignore }} + {% endfor %} + {% endif %} + + + {% if wazuh_agent_config.syscheck.ignore_linux_type is defined %} + {% for ignore in wazuh_agent_config.syscheck.ignore_linux_type %} + {{ ignore }} + {% endfor %} + {% endif %} + + {% if wazuh_agent_config.syscheck.ignore is defined and ansible_system == "Windows" %} + {% for ignore in wazuh_agent_config.syscheck.ignore_win %} + {{ ignore }} + {% endfor %} + {% endif %} + + {% if ansible_system == "Linux" %} + + {% for no_diff in wazuh_agent_config.syscheck.no_diff %} + {{ no_diff }} + {% endfor %} + + {{ wazuh_agent_config.syscheck.skip_nfs }} + {% endif %} + + {% if ansible_os_family == "Windows" %} + {% for registry_key in wazuh_agent_config.syscheck.windows_registry %} + {% if registry_key.arch is defined %} + {{ registry_key.key }} + {% else %} + {{ registry_key.key }} + {% endif %} + {% endfor %} + {% endif %} + + {% if ansible_os_family == "Windows" %} + {% for registry_key in wazuh_agent_config.syscheck.windows_registry_ignore %} + {% if registry_key.type is defined %} + {{ registry_key.key }} + {% else %} + {{ registry_key.key }} + {% endif %} + {% endfor %} + {% endif %} + + {% if ansible_os_family == "Windows" %} + + {{ wazuh_agent_config.syscheck.win_audit_interval }} + {% endif %} + + {% endif %} + + {% if ansible_system == "Linux" and wazuh_agent_config.vuls.disable == 'no' %} no @@ -365,4 +358,14 @@ {% endif %} + + {{ wazuh_agent_config.active_response.ar_disabled|default('no') }} + {% if ansible_os_family == "Windows" %}{{ wazuh_agent_config.active_response.ca_store_win }}{% else %}{{ wazuh_agent_config.active_response.ca_store }}{% endif %} + {{ wazuh_agent_config.active_response.ca_verification }} + + + + {{ wazuh_agent_config.log_format }} + +