diff --git a/CHANGELOG.md b/CHANGELOG.md index a50fa9ef..419ba40f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,12 @@ All notable changes to this project will be documented in this file. - Update to [Wazuh v4.8.0](https://github.com/wazuh/wazuh/blob/v4.8.0/CHANGELOG.md#v480) +## [v4.7.2] + +### Added + +- Update to [Wazuh v4.7.2](https://github.com/wazuh/wazuh/blob/v4.7.2/CHANGELOG.md#v472) + ## [v4.7.1] ### Added diff --git a/README.md b/README.md index 9a28d1d4..f6500870 100644 --- a/README.md +++ b/README.md @@ -18,6 +18,7 @@ These playbooks install and configure Wazuh agent, manager and indexer and dashb |---------------|---------|--------| | v4.8.1 | | | | v4.8.0 | | | +| v4.7.2 | | | | v4.7.1 | | | | v4.7.0 | | | | v4.6.0 | | | diff --git a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml index ded3ec41..a69ca971 100644 --- a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml +++ b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml @@ -6,9 +6,9 @@ wazuh_template_branch: v4.8.1 filebeat_node_name: node-1 filebeat_output_indexer_hosts: - - "localhost:9200" + - "localhost" -filebeat_module_package_name: wazuh-filebeat-0.3.tar.gz +filebeat_module_package_name: wazuh-filebeat-0.4.tar.gz filebeat_module_package_path: /tmp/ filebeat_module_destination: /usr/share/filebeat/module filebeat_module_folder: /usr/share/filebeat/module/wazuh diff --git a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 index 1ae07862..b1a28249 100644 --- a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 +++ b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 @@ -116,11 +116,13 @@ {{ wazuh_dir }}/etc/shared/rootkit_trojans.txt {% endif %} yes + {% endif %} {% if ansible_os_family == "Windows" %} ./shared/win_applications_rcl.txt ./shared/win_malware_rcl.txt {% endif %} + {% endif %} @@ -273,7 +275,6 @@ {% endfor %} {% endif %} {% endif %} - {% endif %} {% if wazuh_agent_config.syscheck.win_directories is defined and ansible_os_family == "Windows" %} diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index c23ba463..c72d9b31 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -144,69 +144,22 @@ wazuh_manager_sca: time: '' ## Vulnerability Detector -wazuh_manager_vulnerability_detector: - enabled: 'no' - interval: '5m' - min_full_scan_interval: '6h' - run_on_start: 'yes' - providers: - - enabled: 'no' - os: - - 'trusty' - - 'xenial' - - 'bionic' - - 'focal' - - 'jammy' - update_interval: '1h' - name: '"canonical"' - - enabled: 'no' - os: - - 'buster' - - 'bullseye' - - 'bookworm' - update_interval: '1h' - name: '"debian"' - - enabled: 'no' - os: - - '5' - - '6' - - '7' - - '8' - - '9' - update_interval: '1h' - name: '"redhat"' - - enabled: 'no' - os: - - '8' - - '9' - update_interval: '1h' - name: '"almalinux"' - - enabled: 'no' - os: - - 'amazon-linux' - - 'amazon-linux-2' - - 'amazon-linux-2023' - update_interval: '1h' - name: '"alas"' - - enabled: 'no' - os: - - '11-server' - - '11-desktop' - - '12-server' - - '12-desktop' - - '15-server' - - '15-desktop' - update_interval: '1h' - name: '"suse"' - - enabled: 'no' - update_interval: '1h' - name: '"arch"' - - enabled: 'no' - update_interval: '1h' - name: '"msu"' - - enabled: 'no' - update_interval: '1h' - name: '"nvd"' +filebeat_node_name: node-1 +filebeat_output_indexer_hosts: + - "localhost" +filebeat_output_indexer_port: 9200 +indexer_security_user: admin +indexer_security_password: changeme +filebeat_ssl_dir: /etc/pki/filebeat + +wazuh_manager_vulnerability_detection: + enabled: 'yes' + indexer_status: 'yes' + feed_update_interval: '60m' + +wazuh_manager_indexer: + enabled: 'yes' + hosts: "{{ filebeat_output_indexer_hosts }}" ## Syscheck wazuh_manager_syscheck: @@ -448,7 +401,8 @@ wazuh_manager_config_defaults: osquery: '{{ wazuh_manager_osquery }}' syscollector: '{{ wazuh_manager_syscollector }}' sca: '{{ wazuh_manager_sca }}' - vulnerability_detector: '{{ wazuh_manager_vulnerability_detector }}' + vulnerability_detection: '{{ wazuh_manager_vulnerability_detection }}' + indexer: '{{ wazuh_manager_indexer }}' log_level: '{{ wazuh_manager_log_level }}' email_level: '{{ wazuh_manager_email_level }}' localfiles: '{{ wazuh_manager_localfiles }}' diff --git a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 index c83dd4fd..d14a7bf6 100644 --- a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 +++ b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 @@ -258,37 +258,30 @@ {% endif %} - - {% if wazuh_manager_config.vulnerability_detector.enabled is defined %} - {{ wazuh_manager_config.vulnerability_detector.enabled }} - {% endif %} - {% if wazuh_manager_config.vulnerability_detector.interval is defined %} - {{ wazuh_manager_config.vulnerability_detector.interval }} - {% endif %} - {% if wazuh_manager_config.vulnerability_detector.min_full_scan_interval is defined %} - {{ wazuh_manager_config.vulnerability_detector.min_full_scan_interval }} - {% endif %} - {% if wazuh_manager_config.vulnerability_detector.run_on_start is defined %} - {{ wazuh_manager_config.vulnerability_detector.run_on_start }} - {% endif %} - {% if wazuh_manager_config.vulnerability_detector.providers is defined %} - {% for provider_ in wazuh_manager_config.vulnerability_detector.providers %} - - {% if provider_.enabled is defined %} - {{ provider_.enabled }} - {% endif %} - {% if provider_.os is defined %} - {% for os_ in provider_.os %} - {{ os_ }} - {% endfor %} - {% endif %} - {% if provider_.update_interval is defined %} - {{ provider_.update_interval }} - {% endif %} - - {% endfor %} - {% endif %} - + + {{ wazuh_manager_config.vulnerability_detection.enabled }} + {{ wazuh_manager_config.vulnerability_detection.indexer_status }} + {{ wazuh_manager_config.vulnerability_detection.feed_update_interval }} + + + + {% if wazuh_manager_config.vulnerability_detection.enabled == 'yes' or wazuh_manager_config.indexer.enabled == 'yes' %}yes{% else %}no{% endif %} + + {% for item in wazuh_manager_config.indexer.hosts %} + https://{{ item }}:{{ filebeat_output_indexer_port }} + {% endfor %} + + + {{ indexer_security_user }} + {{ indexer_security_password }} + + + {{ filebeat_ssl_dir }}/root-ca.pem + + {{ filebeat_ssl_dir }}/{{ filebeat_node_name }}.pem + {{ filebeat_ssl_dir }}/{{ filebeat_node_name }}-key.pem + +