Merge pull request #106 from wazuh/Issue_95-default_configuration
Adapt configuration to current release
This commit is contained in:
AlfonsoRBJ
GitHub
commit
7644661f1c
@ -4,7 +4,7 @@ elasticsearch_node_name: node-1
|
||||
elasticsearch_http_port: 9200
|
||||
elasticsearch_network_host: 127.0.0.1
|
||||
elasticsearch_jvm_xms: null
|
||||
elastic_stack_version: 6.5.3
|
||||
elastic_stack_version: 6.5.4
|
||||
elasticsearch_shards: 5
|
||||
elasticsearch_replicas: 1
|
||||
elasticsearch_install_java: yes
|
||||
|
||||
@ -3,5 +3,6 @@ elasticsearch_http_port: "9200"
|
||||
elasticsearch_network_host: "127.0.0.1"
|
||||
kibana_server_host: "0.0.0.0"
|
||||
kibana_server_port: "5601"
|
||||
elastic_stack_version: 6.5.3
|
||||
wazuh_version: 3.7.1
|
||||
elastic_stack_version: 6.5.4
|
||||
wazuh_version: 3.7.2
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ elasticsearch_network_host: ["Localhost"]
|
||||
elasticsearch_http_port: "9200"
|
||||
elasticsearch_shards: 5
|
||||
elasticsearch_replicas: 1
|
||||
elastic_stack_version: 6.5.3
|
||||
elastic_stack_version: 6.5.4
|
||||
|
||||
logstash_ssl: false
|
||||
logstash_ssl_dir: /etc/pki/logstash
|
||||
|
||||
@ -15,8 +15,9 @@ wazuh_agent_authd:
|
||||
ssl_agent_cert: null
|
||||
ssl_agent_key: null
|
||||
ssl_auto_negotiate: 'no'
|
||||
wazuh_notify_time: null
|
||||
wazuh_time_reconnect: null
|
||||
wazuh_notify_time: '10'
|
||||
wazuh_time_reconnect: '60'
|
||||
wazuh_crypto_method: 'aes'
|
||||
wazuh_winagent_config:
|
||||
install_dir: 'C:\wazuh-agent\'
|
||||
version: '3.7.0'
|
||||
@ -24,16 +25,26 @@ wazuh_winagent_config:
|
||||
repo: https://packages.wazuh.com/3.x/windows/
|
||||
md5: 43936e7bc7eb51bd186f47dac4a6f477
|
||||
wazuh_agent_config:
|
||||
active_response_disabled: 'no'
|
||||
active_response:
|
||||
ar_disabled: 'no'
|
||||
ca_store: '/var/ossec/etc/wpk_root.pem'
|
||||
ca_verification: 'yes'
|
||||
log_format: 'plain'
|
||||
client_buffer:
|
||||
disable: 'no'
|
||||
queue_size: '5000'
|
||||
events_per_sec: '500'
|
||||
syscheck:
|
||||
frequency: 43200
|
||||
scan_on_start: 'yes'
|
||||
auto_ignore: 'no'
|
||||
alert_new_files: 'yes'
|
||||
remove_old_diff: 'yes'
|
||||
restart_audit: 'yes'
|
||||
skip_nfs: 'yes'
|
||||
ignore:
|
||||
- /etc/mtab
|
||||
- /etc/mnttab
|
||||
#- /etc/mnttab
|
||||
- /etc/hosts.deny
|
||||
- /etc/mail/statistics
|
||||
- /etc/random-seed
|
||||
@ -45,6 +56,8 @@ wazuh_agent_config:
|
||||
- /etc/cups/certs
|
||||
- /etc/dumpdates
|
||||
- /etc/svc/volatile
|
||||
- /sys/kernel/security
|
||||
- /sys/kernel/debug
|
||||
no_diff:
|
||||
- /etc/ssl/private.key
|
||||
directories:
|
||||
@ -59,10 +72,26 @@ wazuh_agent_config:
|
||||
rootcheck:
|
||||
frequency: 43200
|
||||
openscap:
|
||||
disable: 'yes'
|
||||
disable: 'no'
|
||||
timeout: 1800
|
||||
interval: '1d'
|
||||
scan_on_start: 'yes'
|
||||
osquery:
|
||||
disable: 'yes'
|
||||
run_daemon: 'yes'
|
||||
log_path: '/var/log/osquery/osqueryd.results.log'
|
||||
config_path: '/etc/osquery/osquery.conf'
|
||||
ad_labels: 'yes'
|
||||
syscollector:
|
||||
disable: 'no'
|
||||
interval: '1h'
|
||||
scan_on_start: 'yes'
|
||||
hardware: 'yes'
|
||||
os: 'yes'
|
||||
network: 'yes'
|
||||
packages: 'yes'
|
||||
ports_no: 'yes'
|
||||
processes: 'yes'
|
||||
cis_cat:
|
||||
disable: 'yes'
|
||||
install_java: 'yes'
|
||||
@ -86,17 +115,33 @@ wazuh_agent_config:
|
||||
- 'nvd-year 2016'
|
||||
- 'autoupdate'
|
||||
localfiles:
|
||||
debian:
|
||||
- format: 'syslog'
|
||||
location: '/var/log/auth.log'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/syslog'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/dpkg.log'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/kern.log'
|
||||
centos:
|
||||
- format: 'syslog'
|
||||
location: '/var/log/messages'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/secure'
|
||||
- format: 'syslog'
|
||||
location: 'var/log/auth.log'
|
||||
location: '/var/log/maillog'
|
||||
- format: 'audit'
|
||||
location: '/var/log/audit/audit.log'
|
||||
common:
|
||||
- format: 'syslog'
|
||||
location: '/var/ossec/logs/active-responses.log'
|
||||
- format: 'command'
|
||||
command: 'df -P'
|
||||
frequency: '360'
|
||||
- format: 'full_command'
|
||||
command: 'netstat -tln | grep -v 127.0.0.1 | sort'
|
||||
command: netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
|
||||
alias: 'netstat listening ports'
|
||||
frequency: '360'
|
||||
- format: 'full_command'
|
||||
command: 'last -n 20'
|
||||
|
||||
@ -29,14 +29,22 @@
|
||||
<time-reconnect>{{ wazuh_time_reconnect }}</time-reconnect>
|
||||
{% endif %}
|
||||
<auto_restart>{{ wazuh_auto_restart }}</auto_restart>
|
||||
<crypto_method>{{ wazuh_crypto_method }}</crypto_method>
|
||||
</client>
|
||||
|
||||
<client_buffer>
|
||||
<!-- Agent buffer options -->
|
||||
<disabled>{{ wazuh_agent_config.client_buffer.disable }}</disabled>
|
||||
<queue_size>{{ wazuh_agent_config.client_buffer.queue_size }}</queue_size>
|
||||
<events_per_second>{{ wazuh_agent_config.client_buffer.events_per_sec }}</events_per_second>
|
||||
</client_buffer>
|
||||
<logging>
|
||||
<log_format>{{ wazuh_agent_config.log_format }}</log_format>
|
||||
</logging>
|
||||
|
||||
<active-response>
|
||||
<disabled>{{ wazuh_agent_config.active_response_disabled|default('no') }}</disabled>
|
||||
<disabled>{{ wazuh_agent_config.active_response.ar|default('no') }}</disabled>
|
||||
<ca_store>{{ wazuh_agent_config.active_response.ca_store }}</ca_store>
|
||||
<ca_verification>{{ wazuh_agent_config.active_response.ca_verification }}</ca_verification>
|
||||
</active-response>
|
||||
|
||||
{% if wazuh_agent_config.rootcheck is defined %}
|
||||
@ -74,15 +82,18 @@
|
||||
</rootcheck>
|
||||
{% endif %}
|
||||
|
||||
<!-- Directories to check (perform all possible verifications) -->
|
||||
{% if wazuh_agent_config.syscheck is defined %}
|
||||
<syscheck>
|
||||
<disabled>no</disabled>
|
||||
{% if ansible_system == "Linux" %}
|
||||
<directories check_all="yes" realtime="yes" restrict="^/var/ossec/etc/shared/agent.conf$">/var/ossec/etc/shared</directories>
|
||||
<!-- #<directories check_all="yes" realtime="yes" restrict="^/var/ossec/etc/shared/agent.conf$">/var/ossec/etc/shared</directories> -->
|
||||
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
|
||||
<directories check_all="yes">/bin,/sbin,/boot</directories>
|
||||
{% endif %}
|
||||
|
||||
<auto_ignore>{{ wazuh_agent_config.syscheck.auto_ignore }}</auto_ignore>
|
||||
<alert_new_files>{{ wazuh_agent_config.syscheck.alert_new_files }}</alert_new_files>
|
||||
<!-- #<alert_new_files>{{ wazuh_agent_config.syscheck.alert_new_files }}</alert_new_files> -->
|
||||
<!-- Frequency that syscheck is executed -- default every 20 hours -->
|
||||
<frequency>{{ wazuh_agent_config.syscheck.frequency }}</frequency>
|
||||
<scan_on_start>{{ wazuh_agent_config.syscheck.scan_on_start }}</scan_on_start>
|
||||
@ -106,6 +117,13 @@
|
||||
<nodiff>{{ no_diff }}</nodiff>
|
||||
{% endfor %}
|
||||
|
||||
<skip_nfs>{{ wazuh_agent_config.syscheck.skip_nfs }}</skip_nfs>
|
||||
<!-- Remove not monitored files -->
|
||||
<remove_old_diff>{{ wazuh_agent_config.syscheck.remove_old_diff }}</remove_old_diff>
|
||||
|
||||
<!-- Allow the system to restart Auditd after installing the plugin -->
|
||||
<restart_audit>{{ wazuh_agent_config.syscheck.restart_audit }}</restart_audit>
|
||||
|
||||
{% if ansible_os_family == "Windows" %}
|
||||
{% for registry_key in wazuh_agent_config.syscheck.windows_registry %}
|
||||
{% if registry_key.arch is defined %}
|
||||
@ -191,6 +209,30 @@
|
||||
</wodle>
|
||||
{% endif %}
|
||||
|
||||
<!-- Osquery integration -->
|
||||
<wodle name="osquery">
|
||||
<disabled>{{ wazuh_agent_config.osquery.disable }}</disabled>
|
||||
<run_daemon>{{ wazuh_agent_config.osquery.run_daemon }}</run_daemon>
|
||||
<log_path>{{ wazuh_agent_config.osquery.log_path }}</log_path>
|
||||
<config_path>{{ wazuh_agent_config.osquery.config_path }}</config_path>
|
||||
<add_labels>{{ wazuh_agent_config.osquery.ad_labels }}</add_labels>
|
||||
</wodle>
|
||||
|
||||
<!-- System inventory -->
|
||||
<wodle name="syscollector">
|
||||
<disabled>{{ wazuh_agent_config.syscollector.disable }}</disabled>
|
||||
<interval>{{ wazuh_agent_config.syscollector.interval }}</interval>
|
||||
<scan_on_start>{{ wazuh_agent_config.syscollector.scan_on_start }}</scan_on_start>
|
||||
<hardware>{{ wazuh_agent_config.syscollector.hardware }}</hardware>
|
||||
<os>{{ wazuh_agent_config.syscollector.os }}</os>
|
||||
<network>{{ wazuh_agent_config.syscollector.network }}</network>
|
||||
<packages>{{ wazuh_agent_config.syscollector.packages }}</packages>
|
||||
<ports all="no">{{ wazuh_agent_config.syscollector.ports_no }}</ports>
|
||||
<processes>{{ wazuh_agent_config.syscollector.processes }}</processes>
|
||||
</wodle>
|
||||
|
||||
|
||||
|
||||
{% if ansible_system == "Linux" and wazuh_agent_config.vuls.disable == 'no' %}
|
||||
<wodle name="command">
|
||||
<disabled>no</disabled>
|
||||
@ -203,7 +245,7 @@
|
||||
{% endif %}
|
||||
|
||||
<!-- Files to monitor (localfiles) -->
|
||||
{% for localfile in wazuh_agent_config.localfiles %}
|
||||
{% for localfile in wazuh_agent_config.localfiles.common %}
|
||||
<localfile>
|
||||
<log_format>{{ localfile.format }}</log_format>
|
||||
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
||||
@ -215,4 +257,31 @@
|
||||
</localfile>
|
||||
{% endfor %}
|
||||
|
||||
{% if ansible_os_family == "Debian" %}
|
||||
{% for localfile in wazuh_agent_config.localfiles.debian %}
|
||||
<localfile>
|
||||
<log_format>{{ localfile.format }}</log_format>
|
||||
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
||||
<command>{{ localfile.command }}</command>
|
||||
<frequency>{{ localfile.frequency }}</frequency>
|
||||
{% else %}
|
||||
<location>{{ localfile.location }}</location>
|
||||
{% endif %}
|
||||
</localfile>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if ansible_os_family == "RedHat" %}
|
||||
{% for localfile in wazuh_agent_config.localfiles.centos %}
|
||||
<localfile>
|
||||
<log_format>{{ localfile.format }}</log_format>
|
||||
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
||||
<command>{{ localfile.command }}</command>
|
||||
<frequency>{{ localfile.frequency }}</frequency>
|
||||
{% else %}
|
||||
<location>{{ localfile.location }}</location>
|
||||
{% endif %}
|
||||
</localfile>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
</ossec_config>
|
||||
|
||||
@ -41,6 +41,7 @@ wazuh_manager_config:
|
||||
- type: 'secure'
|
||||
port: '1514'
|
||||
protocol: 'udp'
|
||||
queue_size: 131072
|
||||
authd:
|
||||
enable: true
|
||||
port: 1515
|
||||
@ -59,6 +60,8 @@ wazuh_manager_config:
|
||||
- 'admin@example.net'
|
||||
mail_smtp_server: localhost
|
||||
mail_from: wazuh-server@example.com
|
||||
mail_maxperhour: 12
|
||||
mail_queue_size: 131072
|
||||
extra_emails:
|
||||
- enable: false
|
||||
mail_to: 'admin@example.net'
|
||||
@ -82,13 +85,13 @@ wazuh_manager_config:
|
||||
user: null
|
||||
showlogs: null
|
||||
syscheck:
|
||||
disable: 'no'
|
||||
frequency: 43200
|
||||
scan_on_start: 'yes'
|
||||
auto_ignore: 'no'
|
||||
alert_new_files: 'yes'
|
||||
ignore:
|
||||
- /etc/mtab
|
||||
- /etc/mnttab
|
||||
- /etc/hosts.deny
|
||||
- /etc/mail/statistics
|
||||
- /etc/random-seed
|
||||
@ -100,13 +103,22 @@ wazuh_manager_config:
|
||||
- /etc/cups/certs
|
||||
- /etc/dumpdates
|
||||
- /etc/svc/volatile
|
||||
- /sys/kernel/security
|
||||
- /sys/kernel/debug
|
||||
no_diff:
|
||||
- /etc/ssl/private.key
|
||||
directories:
|
||||
- dirs: /etc,/usr/bin,/usr/sbin
|
||||
checks: 'check_all="yes"'
|
||||
- dirs: /bin,/sbin
|
||||
- dirs: /bin,/sbin,/boot
|
||||
checks: 'check_all="yes"'
|
||||
auto_ignore_frequency:
|
||||
frequency: 'frequency="10"'
|
||||
timeframe: 'timeframe="3600"'
|
||||
value: 'no'
|
||||
skip_nfs: 'yes'
|
||||
remove_old_diff: 'yes'
|
||||
restart_audit: 'yes'
|
||||
rootcheck:
|
||||
frequency: 43200
|
||||
openscap:
|
||||
@ -121,11 +133,41 @@ wazuh_manager_config:
|
||||
interval: '1d'
|
||||
scan_on_start: 'yes'
|
||||
java_path: '/usr/lib/jvm/java-1.8.0-openjdk-amd64/jre/bin'
|
||||
ciscat_path: '/var/ossec/wodles/ciscat'
|
||||
ciscat_path: 'wodles/ciscat'
|
||||
content:
|
||||
- type: 'xccdf'
|
||||
path: 'benchmarks/CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-xccdf.xml'
|
||||
profile: 'xccdf_org.cisecurity.benchmarks_profile_Level_1_-_Server'
|
||||
osquery:
|
||||
disable: 'yes'
|
||||
run_daemon: 'yes'
|
||||
log_path: '/var/log/osquery/osqueryd.results.log'
|
||||
config_path: '/etc/osquery/osquery.conf'
|
||||
ad_labels: 'yes'
|
||||
syscollector:
|
||||
disable: 'no'
|
||||
interval: '1h'
|
||||
scan_on_start: 'yes'
|
||||
hardware: 'yes'
|
||||
os: 'yes'
|
||||
network: 'yes'
|
||||
packages: 'yes'
|
||||
ports_no: 'yes'
|
||||
processes: 'yes'
|
||||
vul_detector:
|
||||
disable: 'yes'
|
||||
interval: '5m'
|
||||
ignore_time: '6h'
|
||||
run_on_start: 'yes'
|
||||
ubuntu:
|
||||
disable: 'yes'
|
||||
update_interval: '1h'
|
||||
redhat:
|
||||
disable: 'yes'
|
||||
update_interval: '1h'
|
||||
debian:
|
||||
disable: 'yes'
|
||||
update_interval: '1h'
|
||||
vuls:
|
||||
disable: 'yes'
|
||||
interval: '1d'
|
||||
@ -139,21 +181,36 @@ wazuh_manager_config:
|
||||
log_level: 1
|
||||
email_level: 12
|
||||
localfiles:
|
||||
- format: 'syslog'
|
||||
location: '/var/log/auth.log'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/messages'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/secure'
|
||||
common:
|
||||
- format: 'command'
|
||||
command: 'df -P'
|
||||
frequency: '360'
|
||||
- format: 'full_command'
|
||||
command: 'netstat -tln | grep -v 127.0.0.1 | sort'
|
||||
command: netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
|
||||
alias: 'netstat listening ports'
|
||||
frequency: '360'
|
||||
- format: 'full_command'
|
||||
command: 'last -n 20'
|
||||
frequency: '360'
|
||||
- format: 'syslog'
|
||||
location: '/var/ossec/logs/active-responses.log'
|
||||
debian:
|
||||
- format: 'syslog'
|
||||
location: '/var/log/auth.log'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/syslog'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/dpkg.log'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/kern.log'
|
||||
centos:
|
||||
- format: 'syslog'
|
||||
location: '/var/log/messages'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/secure'
|
||||
- format: 'syslog'
|
||||
location: '/var/log/maillog'
|
||||
- format: 'audit'
|
||||
location: '/var/log/audit/audit.log'
|
||||
globals:
|
||||
- '127.0.0.1'
|
||||
- '192.168.2.1'
|
||||
@ -162,10 +219,10 @@ wazuh_manager_config:
|
||||
executable: 'disable-account.sh'
|
||||
expect: 'user'
|
||||
timeout_allowed: 'yes'
|
||||
- name: 'restart-ossec'
|
||||
executable: 'restart-ossec.sh'
|
||||
expect: ''
|
||||
timeout_allowed: 'no'
|
||||
#- name: 'restart-ossec'
|
||||
# executable: 'restart-ossec.sh'
|
||||
# expect: ''
|
||||
# timeout_allowed: 'no'
|
||||
- name: 'win_restart-ossec'
|
||||
executable: 'restart-ossec.cmd'
|
||||
expect: ''
|
||||
@ -186,6 +243,14 @@ wazuh_manager_config:
|
||||
executable: 'route-null.cmd'
|
||||
expect: 'srcip'
|
||||
timeout_allowed: 'yes'
|
||||
- name: 'netsh'
|
||||
executable: 'netsh.cmd'
|
||||
expect: 'srcip'
|
||||
timeout_allowed: 'yes'
|
||||
- name: 'netsh-win-2016'
|
||||
executable: 'netsh-win-2016.cmd'
|
||||
expect: 'srcip'
|
||||
timeout_allowed: 'yes'
|
||||
ruleset:
|
||||
rules_path: 'custom_ruleset/rules/'
|
||||
decoders_path: 'custom_ruleset/decoders/'
|
||||
|
||||
@ -21,47 +21,14 @@
|
||||
{% endfor %}
|
||||
<smtp_server>{{ wazuh_manager_config.mail_smtp_server }}</smtp_server>
|
||||
<email_from>{{ wazuh_manager_config.mail_from }}</email_from>
|
||||
<email_maxperhour>{{ wazuh_manager_config.mail_maxperhour }}</email_maxperhour>
|
||||
<queue_size>{{ wazuh_manager_config.mail_queue_size }}</queue_size>
|
||||
</global>
|
||||
|
||||
<cluster>
|
||||
<disabled>{{ wazuh_manager_config.cluster.disable }}</disabled>
|
||||
<name>{{ wazuh_manager_config.cluster.name }}</name>
|
||||
<node_name>{{ wazuh_manager_config.cluster.node_name }}</node_name>
|
||||
<node_type>{{ wazuh_manager_config.cluster.node_type }}</node_type>
|
||||
<key>{{ wazuh_manager_config.cluster.key }}</key>
|
||||
{% if wazuh_manager_config.cluster.interval is defined %}
|
||||
<interval>{{ wazuh_manager_config.cluster.interval }}</interval>
|
||||
{% endif %}
|
||||
<port>{{ wazuh_manager_config.cluster.port }}</port>
|
||||
<bind_addr>{{ wazuh_manager_config.cluster.bind_addr }}</bind_addr>
|
||||
<nodes>
|
||||
{% for node in wazuh_manager_config.cluster.nodes %}
|
||||
<node>{{ node }}</node>
|
||||
{% endfor %}
|
||||
</nodes>
|
||||
<hidden>{{ wazuh_manager_config.cluster.hidden }}</hidden>
|
||||
</cluster>
|
||||
|
||||
<logging>
|
||||
<log_format>{{ wazuh_manager_config.log_format }}</log_format>
|
||||
</logging>
|
||||
|
||||
{% if wazuh_manager_config.authd.enable == true %}
|
||||
<auth>
|
||||
<disabled>no</disabled>
|
||||
{% if wazuh_manager_config.authd.port is not none %}<port>{{wazuh_manager_config.authd.port}}</port>{% else %}<port>1515</port>{% endif %}
|
||||
{% if wazuh_manager_config.authd.use_source_ip is not none %}<use_source_ip>{{wazuh_manager_config.authd.use_source_ip}}</use_source_ip>{% endif %}
|
||||
{% if wazuh_manager_config.authd.force_insert is not none %}<force_insert>{{wazuh_manager_config.authd.force_insert}}</force_insert>{% endif %}
|
||||
{% if wazuh_manager_config.authd.force_time is not none %}<force_time>{{wazuh_manager_config.authd.force_time}}</force_time>{% endif %}
|
||||
{% if wazuh_manager_config.authd.purge is not none %}<purge>{{wazuh_manager_config.authd.purge}}</purge>{% endif %}
|
||||
{% if wazuh_manager_config.authd.use_password is not none %}<use_password>{{wazuh_manager_config.authd.use_password}}</use_password>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_agent_ca is not none %}<ssl_agent_ca>/var/ossec/etc/{{wazuh_manager_config.authd.ssl_agent_ca | basename}}</ssl_agent_ca>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_verify_host is not none %}<ssl_verify_host>{{wazuh_manager_config.authd.ssl_verify_host}}</ssl_verify_host>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_manager_cert is not none %}<ssl_manager_cert>/var/ossec/etc/{{wazuh_manager_config.authd.ssl_manager_cert | basename}}</ssl_manager_cert>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_manager_key is not none %}<ssl_manager_key>/var/ossec/etc/{{wazuh_manager_config.authd.ssl_manager_key | basename}}</ssl_manager_key>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_auto_negotiate is not none %}<ssl_auto_negotiate>{{wazuh_manager_config.authd.ssl_auto_negotiate}}</ssl_auto_negotiate>{% endif %}
|
||||
</auth>
|
||||
{% endif %}
|
||||
<alerts>
|
||||
<log_alert_level>{{ wazuh_manager_config.log_level }}</log_alert_level>
|
||||
<email_alert_level>{{ wazuh_manager_config.email_level }}</email_alert_level>
|
||||
</alerts>
|
||||
|
||||
{% if wazuh_manager_config.extra_emails is defined %}
|
||||
{% for mail in wazuh_manager_config.extra_emails %}
|
||||
@ -94,29 +61,10 @@
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if wazuh_manager_config.reports is defined %}
|
||||
{% for report in wazuh_manager_config.reports %}
|
||||
{% if report.enable == true %}
|
||||
<reports>
|
||||
<category>{{ report.category }}</category>
|
||||
<title>{{ report.title }}</title>
|
||||
<email_to>{{ report.email_to }}</email_to>
|
||||
{% if report.location is not none %}<location>{{ report.location }}</location>{% endif %}
|
||||
{% if report.group is not none %}<group>{{ report.group }}</group>{% endif %}
|
||||
{% if report.rule is not none %}<rule>{{ report.rule }}</rule>{% endif %}
|
||||
{% if report.level is not none %}<level>{{ report.level }}</level>{% endif %}
|
||||
{% if report.srcip is not none %}<srcip>{{ report.srcip }}</srcip>{% endif %}
|
||||
{% if report.user is not none %}<user>{{ report.user }}</user>{% endif %}
|
||||
{% if report.showlogs is not none %}<showlogs>{{ report.showlogs }}</showlogs>{% endif %}
|
||||
</reports>
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<alerts>
|
||||
<log_alert_level>{{ wazuh_manager_config.log_level }}</log_alert_level>
|
||||
<email_alert_level>{{ wazuh_manager_config.email_level }}</email_alert_level>
|
||||
</alerts>
|
||||
<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
|
||||
<logging>
|
||||
<log_format>{{ wazuh_manager_config.log_format }}</log_format>
|
||||
</logging>
|
||||
|
||||
<remote>
|
||||
{% for connection in wazuh_manager_config.connection %}
|
||||
@ -139,6 +87,27 @@
|
||||
{% endfor %}
|
||||
</remote>
|
||||
|
||||
{% if wazuh_manager_config.reports is defined %}
|
||||
{% for report in wazuh_manager_config.reports %}
|
||||
{% if report.enable == true %}
|
||||
<reports>
|
||||
<category>{{ report.category }}</category>
|
||||
<title>{{ report.title }}</title>
|
||||
<email_to>{{ report.email_to }}</email_to>
|
||||
{% if report.location is not none %}<location>{{ report.location }}</location>{% endif %}
|
||||
{% if report.group is not none %}<group>{{ report.group }}</group>{% endif %}
|
||||
{% if report.rule is not none %}<rule>{{ report.rule }}</rule>{% endif %}
|
||||
{% if report.level is not none %}<level>{{ report.level }}</level>{% endif %}
|
||||
{% if report.srcip is not none %}<srcip>{{ report.srcip }}</srcip>{% endif %}
|
||||
{% if report.user is not none %}<user>{{ report.user }}</user>{% endif %}
|
||||
{% if report.showlogs is not none %}<showlogs>{{ report.showlogs }}</showlogs>{% endif %}
|
||||
</reports>
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
|
||||
<!-- Policy monitoring -->
|
||||
<rootcheck>
|
||||
<disabled>no</disabled>
|
||||
<check_unixaudit>yes</check_unixaudit>
|
||||
@ -164,33 +133,6 @@
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
</rootcheck>
|
||||
|
||||
<syscheck>
|
||||
<auto_ignore>{{ wazuh_manager_config.syscheck.auto_ignore }}</auto_ignore>
|
||||
<alert_new_files>{{ wazuh_manager_config.syscheck.alert_new_files }}</alert_new_files>
|
||||
<!-- Frequency that syscheck is executed -- default every 20 hours -->
|
||||
<frequency>{{ wazuh_manager_config.syscheck.frequency }}</frequency>
|
||||
<scan_on_start>{{ wazuh_manager_config.syscheck.scan_on_start }}</scan_on_start>
|
||||
|
||||
<!-- Directories to check (perform all possible verifications) -->
|
||||
{% if wazuh_manager_config.syscheck.directories is defined %}
|
||||
{% for directory in wazuh_manager_config.syscheck.directories %}
|
||||
<directories {{ directory.checks }}>{{ directory.dirs }}</directories>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<!-- Files/directories to ignore -->
|
||||
{% if wazuh_manager_config.syscheck.ignore is defined %}
|
||||
{% for ignore in wazuh_manager_config.syscheck.ignore %}
|
||||
<ignore>{{ ignore }}</ignore>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<!-- Files no diff -->
|
||||
{% for no_diff in wazuh_manager_config.syscheck.no_diff %}
|
||||
<nodiff>{{ no_diff }}</nodiff>
|
||||
{% endfor %}
|
||||
</syscheck>
|
||||
|
||||
{% if ansible_system == "Linux" and wazuh_manager_config.openscap.disable == 'no' %}
|
||||
<wodle name="open-scap">
|
||||
<disabled>no</disabled>
|
||||
@ -244,14 +186,13 @@
|
||||
</wodle>
|
||||
{% endif %}
|
||||
|
||||
{% if wazuh_manager_config.cis_cat.disable == 'no' %}
|
||||
<wodle name="cis-cat">
|
||||
<disabled>no</disabled>
|
||||
<disabled>{{ wazuh_manager_config.cis_cat.disable}}</disabled>
|
||||
<timeout>{{ wazuh_manager_config.cis_cat.timeout }}</timeout>
|
||||
<interval>{{ wazuh_manager_config.cis_cat.interval }}</interval>
|
||||
<scan-on-start>{{ wazuh_manager_config.cis_cat.scan_on_start }}</scan-on-start>
|
||||
{% if wazuh_manager_config.cis_cat.install_java == 'yes' %}
|
||||
<java_path>/usr/bin</java_path>
|
||||
<java_path>wodles/java</java_path>
|
||||
{% else %}
|
||||
<java_path>{{ wazuh_manager_config.cis_cat.java_path }}</java_path>
|
||||
{% endif %}
|
||||
@ -262,8 +203,174 @@
|
||||
</content>
|
||||
{% endfor %}
|
||||
</wodle>
|
||||
|
||||
<!-- Osquery integration -->
|
||||
<wodle name="osquery">
|
||||
<disabled>{{ wazuh_manager_config.osquery.disable }}</disabled>
|
||||
<run_daemon>{{ wazuh_manager_config.osquery.run_daemon }}</run_daemon>
|
||||
<log_path>{{ wazuh_manager_config.osquery.log_path }}</log_path>
|
||||
<config_path>{{ wazuh_manager_config.osquery.config_path }}</config_path>
|
||||
<add_labels>{{ wazuh_manager_config.osquery.ad_labels }}</add_labels>
|
||||
</wodle>
|
||||
|
||||
<!-- System inventory -->
|
||||
<wodle name="syscollector">
|
||||
<disabled>{{ wazuh_manager_config.syscollector.disable }}</disabled>
|
||||
<interval>{{ wazuh_manager_config.syscollector.interval }}</interval>
|
||||
<scan_on_start>{{ wazuh_manager_config.syscollector.scan_on_start }}</scan_on_start>
|
||||
<hardware>{{ wazuh_manager_config.syscollector.hardware }}</hardware>
|
||||
<os>{{ wazuh_manager_config.syscollector.os }}</os>
|
||||
<network>{{ wazuh_manager_config.syscollector.network }}</network>
|
||||
<packages>{{ wazuh_manager_config.syscollector.packages }}</packages>
|
||||
<ports all="no">{{ wazuh_manager_config.syscollector.ports_no }}</ports>
|
||||
<processes>{{ wazuh_manager_config.syscollector.processes }}</processes>
|
||||
</wodle>
|
||||
|
||||
<wodle name="vulnerability-detector">
|
||||
<disabled>{{ wazuh_manager_config.vul_detector.disable }}</disabled>
|
||||
<interval>{{ wazuh_manager_config.vul_detector.interval }}</interval>
|
||||
<ignore_time>{{ wazuh_manager_config.vul_detector.ignore_time }}</ignore_time>
|
||||
<run_on_start>{{ wazuh_manager_config.vul_detector.run_on_start }}</run_on_start>
|
||||
<feed name="ubuntu-18">
|
||||
<disabled>{{ wazuh_manager_config.vul_detector.ubuntu.disable }}</disabled>
|
||||
<update_interval>{{ wazuh_manager_config.vul_detector.ubuntu.update_interval }}</update_interval>
|
||||
</feed>
|
||||
<feed name="redhat-7">
|
||||
<disabled>{{ wazuh_manager_config.vul_detector.redhat.disable }}</disabled>
|
||||
<update_interval>{{ wazuh_manager_config.vul_detector.redhat.update_interval }}</update_interval>
|
||||
</feed>
|
||||
<feed name="debian-9">
|
||||
<disabled>{{ wazuh_manager_config.vul_detector.debian.disable }}</disabled>
|
||||
<update_interval>{{ wazuh_manager_config.vul_detector.debian.update_interval }}</update_interval>
|
||||
</feed>
|
||||
</wodle>
|
||||
|
||||
<!-- File integrity monitoring -->
|
||||
<syscheck>
|
||||
<disabled>{{ wazuh_manager_config.syscheck.disable }}</disabled>
|
||||
<auto_ignore>{{ wazuh_manager_config.syscheck.auto_ignore }}</auto_ignore>
|
||||
<alert_new_files>{{ wazuh_manager_config.syscheck.alert_new_files }}</alert_new_files>
|
||||
<!-- Frequency that syscheck is executed -- default every 20 hours -->
|
||||
<frequency>{{ wazuh_manager_config.syscheck.frequency }}</frequency>
|
||||
<scan_on_start>{{ wazuh_manager_config.syscheck.scan_on_start }}</scan_on_start>
|
||||
|
||||
<!-- Don't ignore files that change more than 'frequency' times -->
|
||||
{% if wazuh_manager_config.syscheck.auto_ignore_frequency is defined %}
|
||||
<auto_ignore {{ wazuh_manager_config.syscheck.auto_ignore_frequency.frequency }} {{ wazuh_manager_config.syscheck.auto_ignore_frequency.timeframe }}>{{wazuh_manager_config.syscheck.auto_ignore_frequency.value }}</auto_ignore>
|
||||
{% endif %}
|
||||
|
||||
<!-- Directories to check (perform all possible verifications) -->
|
||||
{% if wazuh_manager_config.syscheck.directories is defined %}
|
||||
{% for directory in wazuh_manager_config.syscheck.directories %}
|
||||
<directories {{ directory.checks }}>{{ directory.dirs }}</directories>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<!-- Files/directories to ignore -->
|
||||
{% if wazuh_manager_config.syscheck.ignore is defined %}
|
||||
{% for ignore in wazuh_manager_config.syscheck.ignore %}
|
||||
<ignore>{{ ignore }}</ignore>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<!-- Files no diff -->
|
||||
{% for no_diff in wazuh_manager_config.syscheck.no_diff %}
|
||||
<nodiff>{{ no_diff }}</nodiff>
|
||||
{% endfor %}
|
||||
|
||||
{% if wazuh_manager_config.syscheck.skip_nfs is defined %}
|
||||
<skip_nfs>{{ wazuh_manager_config.syscheck.skip_nfs }}</skip_nfs>
|
||||
{% endif %}
|
||||
|
||||
<!-- Remove not monitored files -->
|
||||
{% if wazuh_manager_config.syscheck.remove_old_diff is defined %}
|
||||
<remove_old_diff>{{ wazuh_manager_config.syscheck.remove_old_diff }}</remove_old_diff>
|
||||
{% endif %}
|
||||
|
||||
<!-- Allow the system to restart Auditd after installing the plugin -->
|
||||
{% if wazuh_manager_config.syscheck.restart_audit is defined %}
|
||||
<restart_audit>{{ wazuh_manager_config.syscheck.restart_audit }}</restart_audit>
|
||||
{% endif %}
|
||||
</syscheck>
|
||||
|
||||
<global>
|
||||
{% for white_list in wazuh_manager_config.globals %}
|
||||
<white_list>{{ white_list }}</white_list>
|
||||
{% endfor %}
|
||||
</global>
|
||||
|
||||
{% for command in wazuh_manager_config.commands %}
|
||||
<command>
|
||||
<name>{{ command.name }}</name>
|
||||
<executable>{{ command.executable }}</executable>
|
||||
<expect>{{ command.expect }}</expect>
|
||||
<timeout_allowed>{{ command.timeout_allowed }}</timeout_allowed>
|
||||
</command>
|
||||
{% endfor %}
|
||||
|
||||
<!--
|
||||
<active-response>
|
||||
active-response options here
|
||||
</active-response>
|
||||
-->
|
||||
|
||||
<ruleset>
|
||||
<!-- Default ruleset -->
|
||||
<decoder_dir>ruleset/decoders</decoder_dir>
|
||||
<rule_dir>ruleset/rules</rule_dir>
|
||||
{% if wazuh_manager_config.rule_exclude is defined %}
|
||||
{% for rule in wazuh_manager_config.rule_exclude %}
|
||||
<rule_exclude>{{ rule }}</rule_exclude>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if cdb_lists is defined %}
|
||||
{% for list in cdb_lists %}
|
||||
<list>etc/lists/{{ list.name }}</list>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<!-- User-defined ruleset -->
|
||||
<decoder_dir>etc/decoders</decoder_dir>
|
||||
<rule_dir>etc/rules</rule_dir>
|
||||
</ruleset>
|
||||
|
||||
{% if wazuh_manager_config.authd.enable == true %}
|
||||
<auth>
|
||||
<disabled>no</disabled>
|
||||
{% if wazuh_manager_config.authd.port is not none %}<port>{{wazuh_manager_config.authd.port}}</port>{% else %}<port>1515</port>{% endif %}
|
||||
{% if wazuh_manager_config.authd.use_source_ip is not none %}<use_source_ip>{{wazuh_manager_config.authd.use_source_ip}}</use_source_ip>{% endif %}
|
||||
{% if wazuh_manager_config.authd.force_insert is not none %}<force_insert>{{wazuh_manager_config.authd.force_insert}}</force_insert>{% endif %}
|
||||
{% if wazuh_manager_config.authd.force_time is not none %}<force_time>{{wazuh_manager_config.authd.force_time}}</force_time>{% endif %}
|
||||
{% if wazuh_manager_config.authd.purge is not none %}<purge>{{wazuh_manager_config.authd.purge}}</purge>{% endif %}
|
||||
{% if wazuh_manager_config.authd.use_password is not none %}<use_password>{{wazuh_manager_config.authd.use_password}}</use_password>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_agent_ca is not none %}<ssl_agent_ca>/var/ossec/etc/{{wazuh_manager_config.authd.ssl_agent_ca | basename}}</ssl_agent_ca>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_verify_host is not none %}<ssl_verify_host>{{wazuh_manager_config.authd.ssl_verify_host}}</ssl_verify_host>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_manager_cert is not none %}<ssl_manager_cert>/var/ossec/etc/{{wazuh_manager_config.authd.ssl_manager_cert | basename}}</ssl_manager_cert>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_manager_key is not none %}<ssl_manager_key>/var/ossec/etc/{{wazuh_manager_config.authd.ssl_manager_key | basename}}</ssl_manager_key>{% endif %}
|
||||
{% if wazuh_manager_config.authd.ssl_auto_negotiate is not none %}<ssl_auto_negotiate>{{wazuh_manager_config.authd.ssl_auto_negotiate}}</ssl_auto_negotiate>{% endif %}
|
||||
</auth>
|
||||
{% endif %}
|
||||
|
||||
|
||||
<cluster>
|
||||
<disabled>{{ wazuh_manager_config.cluster.disable }}</disabled>
|
||||
<name>{{ wazuh_manager_config.cluster.name }}</name>
|
||||
<node_name>{{ wazuh_manager_config.cluster.node_name }}</node_name>
|
||||
<node_type>{{ wazuh_manager_config.cluster.node_type }}</node_type>
|
||||
<key>{{ wazuh_manager_config.cluster.key }}</key>
|
||||
{% if wazuh_manager_config.cluster.interval is defined %}
|
||||
<interval>{{ wazuh_manager_config.cluster.interval }}</interval>
|
||||
{% endif %}
|
||||
<port>{{ wazuh_manager_config.cluster.port }}</port>
|
||||
<bind_addr>{{ wazuh_manager_config.cluster.bind_addr }}</bind_addr>
|
||||
<nodes>
|
||||
{% for node in wazuh_manager_config.cluster.nodes %}
|
||||
<node>{{ node }}</node>
|
||||
{% endfor %}
|
||||
</nodes>
|
||||
<hidden>{{ wazuh_manager_config.cluster.hidden }}</hidden>
|
||||
</cluster>
|
||||
|
||||
{% if ansible_system == "Linux" and wazuh_manager_config.vuls.disable == 'no' %}
|
||||
<wodle name="command">
|
||||
<disabled>no</disabled>
|
||||
@ -290,43 +397,8 @@
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<global>
|
||||
{% for white_list in wazuh_manager_config.globals %}
|
||||
<white_list>{{ white_list }}</white_list>
|
||||
{% endfor %}
|
||||
</global>
|
||||
|
||||
{% for command in wazuh_manager_config.commands %}
|
||||
<command>
|
||||
<name>{{ command.name }}</name>
|
||||
<executable>{{ command.executable }}</executable>
|
||||
<expect>{{ command.expect }}</expect>
|
||||
<timeout_allowed>{{ command.timeout_allowed }}</timeout_allowed>
|
||||
</command>
|
||||
{% endfor %}
|
||||
|
||||
|
||||
<ruleset>
|
||||
<!-- Default ruleset -->
|
||||
<decoder_dir>ruleset/decoders</decoder_dir>
|
||||
<rule_dir>ruleset/rules</rule_dir>
|
||||
{% if wazuh_manager_config.rule_exclude is defined %}
|
||||
{% for rule in wazuh_manager_config.rule_exclude %}
|
||||
<rule_exclude>{{ rule }}</rule_exclude>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if cdb_lists is defined %}
|
||||
{% for list in cdb_lists %}
|
||||
<list>etc/lists/{{ list.name }}</list>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<!-- User-defined ruleset -->
|
||||
<decoder_dir>etc/decoders</decoder_dir>
|
||||
<rule_dir>etc/rules</rule_dir>
|
||||
</ruleset>
|
||||
|
||||
<!-- Active Response Config -->
|
||||
<!-- Active Response Config
|
||||
{% for response in wazuh_manager_config.active_responses %}
|
||||
<active-response>
|
||||
<disabled>{% if response.disabled is defined %}{{ response.disabled }}{% else %}no{% endif %}</disabled>
|
||||
@ -340,9 +412,10 @@
|
||||
{%if response.repeated_offenders is defined %}<repeated_offenders>{{ response.repeated_offenders }}</repeated_offenders>{% endif %}
|
||||
</active-response>
|
||||
{% endfor %}
|
||||
-->
|
||||
|
||||
<!-- Files to monitor (localfiles) -->
|
||||
{% for localfile in wazuh_manager_config.localfiles %}
|
||||
{% for localfile in wazuh_manager_config.localfiles.common %}
|
||||
<localfile>
|
||||
<log_format>{{ localfile.format }}</log_format>
|
||||
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
||||
@ -378,6 +451,82 @@
|
||||
</localfile>
|
||||
{% endfor %}
|
||||
|
||||
{% if ansible_os_family == "Debian" %}
|
||||
{% for localfile in wazuh_manager_config.localfiles.debian %}
|
||||
<localfile>
|
||||
<log_format>{{ localfile.format }}</log_format>
|
||||
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
||||
<command>{{ localfile.command }}</command>
|
||||
{% if localfile.alias is defined %}
|
||||
<alias>{{ localfile.alias }}</alias>
|
||||
{% endif %}
|
||||
{% if localfile.frequency is defined %}
|
||||
<frequency>{{ localfile.frequency }}</frequency>
|
||||
{% endif %}
|
||||
{% else %}
|
||||
<location>{{ localfile.location }}</location>
|
||||
{% if localfile.format == 'eventchannel' %}
|
||||
{% if localfile.only_future_events is defined %}
|
||||
<only-future-events>{{ localfile.only_future_events }}</only_future_events>
|
||||
{% endif %}
|
||||
{% if localfile.query is defined %}
|
||||
<query>{{ localfile.query }}</query>
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if localfile.format == 'json' and localfile.labels is defined %}
|
||||
{% for key, value in localfile.labels.iteritems() %}
|
||||
<label key="{{ key }}">{{ value }}</label>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if localfile.target is defined %}
|
||||
<target>{{ localfile.target }}</target>
|
||||
{% endif %}
|
||||
{% if localfile.out_format is defined %}
|
||||
<out_format>{{ localfile.out_format }}</out_format>
|
||||
{% endif %}
|
||||
</localfile>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if ansible_os_family == "RedHat" %}
|
||||
{% for localfile in wazuh_manager_config.localfiles.centos %}
|
||||
<localfile>
|
||||
<log_format>{{ localfile.format }}</log_format>
|
||||
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
||||
<command>{{ localfile.command }}</command>
|
||||
{% if localfile.alias is defined %}
|
||||
<alias>{{ localfile.alias }}</alias>
|
||||
{% endif %}
|
||||
{% if localfile.frequency is defined %}
|
||||
<frequency>{{ localfile.frequency }}</frequency>
|
||||
{% endif %}
|
||||
{% else %}
|
||||
<location>{{ localfile.location }}</location>
|
||||
{% if localfile.format == 'eventchannel' %}
|
||||
{% if localfile.only_future_events is defined %}
|
||||
<only-future-events>{{ localfile.only_future_events }}</only_future_events>
|
||||
{% endif %}
|
||||
{% if localfile.query is defined %}
|
||||
<query>{{ localfile.query }}</query>
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if localfile.format == 'json' and localfile.labels is defined %}
|
||||
{% for key, value in localfile.labels.iteritems() %}
|
||||
<label key="{{ key }}">{{ value }}</label>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if localfile.target is defined %}
|
||||
<target>{{ localfile.target }}</target>
|
||||
{% endif %}
|
||||
{% if localfile.out_format is defined %}
|
||||
<out_format>{{ localfile.out_format }}</out_format>
|
||||
{% endif %}
|
||||
</localfile>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if wazuh_manager_config.syslog_outputs is defined %}
|
||||
{% for syslog_output in wazuh_manager_config.syslog_outputs %}
|
||||
{% if syslog_output.server is not none %}
|
||||
|
||||
@ -7,3 +7,81 @@ cdb_lists:
|
||||
audit-wazuh-a:attribute
|
||||
audit-wazuh-x:execute
|
||||
audit-wazuh-c:command
|
||||
- name: 'aws-source'
|
||||
content: |
|
||||
ec2.amazonaws.com:
|
||||
elasticloadbalancing.amazonaws.com:
|
||||
iam.amazonaws.com:
|
||||
signin.amazonaws.com:
|
||||
kms.amazonaws.com:
|
||||
s3.amazonaws.com:
|
||||
- name: 'aws-eventnames'
|
||||
content: |
|
||||
AddUserToGroup:
|
||||
AllocateAddress:
|
||||
AssociateAddress:
|
||||
AssociateDhcpOptions:
|
||||
AssociateRouteTable:
|
||||
AttachGroupPolicy:
|
||||
AttachNetworkInterface:
|
||||
AttachRolePolicy:
|
||||
AttachUserPolicy:
|
||||
AttachVolume:
|
||||
AuthorizeSecurityGroupIngress:
|
||||
ConsoleLogin:
|
||||
CopySnapshot:
|
||||
CreateAccountAlias:
|
||||
CreateGroup:
|
||||
CreateImage:
|
||||
CreateLoadBalancer:
|
||||
CreatePlacementGroup:
|
||||
CreatePolicy:
|
||||
CreateRole:
|
||||
CreateRouteTable:
|
||||
CreateSecurityGroup:
|
||||
CreateSnapshot:
|
||||
CreateSubnet:
|
||||
CreateTags:
|
||||
CreateUser:
|
||||
CreateVolume:
|
||||
CreateVpc:
|
||||
DeleteAccountAlias:
|
||||
DeleteLoadBalancer:
|
||||
DeletePlacementGroup:
|
||||
DeleteSecurityGroup:
|
||||
DeleteSnapshot:
|
||||
DeleteTags:
|
||||
DeleteUser:
|
||||
DeleteVolume:
|
||||
DeregisterImage:
|
||||
DetachGroupPolicy:
|
||||
DetachNetworkInterface:
|
||||
DetachRolePolicy:
|
||||
DetachVolume:
|
||||
DisableKey:
|
||||
DisassociateAddress:
|
||||
DisassociateAddress:
|
||||
DisassociateRouteTable:
|
||||
GetGroup:
|
||||
ListAliases:
|
||||
ListGroups:
|
||||
ListUsers:
|
||||
ModifyImageAttribute:
|
||||
ModifyInstanceAttribute:
|
||||
ModifyNetworkInterfaceAttribute:
|
||||
ModifySnapshotAttribute:
|
||||
ModifySubnetAttribute:
|
||||
ModifyVolumeAttribute:
|
||||
MonitorInstances:
|
||||
RebootInstances:
|
||||
RegisterImage:
|
||||
RemoveUserFromGroup:
|
||||
RevokeSecurityGroupIngress:
|
||||
RunInstances:
|
||||
StartInstances:
|
||||
StopInstances:
|
||||
TerminateInstances:
|
||||
UnmonitorInstances:
|
||||
UpdateAccessKey:
|
||||
UpdateAccountPasswordPolicy:
|
||||
UpdateInstanceAlias:
|
||||
|
||||
Loading…
Reference in New Issue
Block a user