commit
deaffd9c8e
@ -281,10 +281,10 @@ wazuh_agent_config:
|
|||||||
- format: 'syslog'
|
- format: 'syslog'
|
||||||
location: '/var/ossec/logs/active-responses.log'
|
location: '/var/ossec/logs/active-responses.log'
|
||||||
- format: 'command'
|
- format: 'command'
|
||||||
command: 'df -P'
|
command: df -P -x squashfs -x tmpfs -x devtmpfs
|
||||||
frequency: '360'
|
frequency: '360'
|
||||||
- format: 'full_command'
|
- format: 'full_command'
|
||||||
command: netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
|
command: ss -nutal | awk '{print $1,$5,$6;}' | sort -b | column -t
|
||||||
alias: 'netstat listening ports'
|
alias: 'netstat listening ports'
|
||||||
frequency: '360'
|
frequency: '360'
|
||||||
- format: 'full_command'
|
- format: 'full_command'
|
||||||
|
|||||||
@ -10,3 +10,7 @@
|
|||||||
|
|
||||||
# This is the template of Ansible for the file local_internal_options.conf
|
# This is the template of Ansible for the file local_internal_options.conf
|
||||||
# In this file you could include the configuration settings for your agents
|
# In this file you could include the configuration settings for your agents
|
||||||
|
|
||||||
|
# Logcollector - If it should accept remote commands from the manager
|
||||||
|
logcollector.remote_commands=1
|
||||||
|
|
||||||
|
|||||||
@ -182,10 +182,10 @@ wazuh_manager_config:
|
|||||||
localfiles:
|
localfiles:
|
||||||
common:
|
common:
|
||||||
- format: 'command'
|
- format: 'command'
|
||||||
command: 'df -P'
|
command: df -P -x squashfs -x tmpfs -x devtmpfs
|
||||||
frequency: '360'
|
frequency: '360'
|
||||||
- format: 'full_command'
|
- format: 'full_command'
|
||||||
command: netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
|
command: ss -nutal | awk '{print $1,$5,$6;}' | sort -b | column -t
|
||||||
alias: 'netstat listening ports'
|
alias: 'netstat listening ports'
|
||||||
frequency: '360'
|
frequency: '360'
|
||||||
- format: 'full_command'
|
- format: 'full_command'
|
||||||
|
|||||||
@ -11,11 +11,7 @@
|
|||||||
<alerts_log>{{ wazuh_manager_config.alerts_log }}</alerts_log>
|
<alerts_log>{{ wazuh_manager_config.alerts_log }}</alerts_log>
|
||||||
<logall>{{ wazuh_manager_config.logall }}</logall>
|
<logall>{{ wazuh_manager_config.logall }}</logall>
|
||||||
<logall_json>{{ wazuh_manager_config.logall_json }}</logall_json>
|
<logall_json>{{ wazuh_manager_config.logall_json }}</logall_json>
|
||||||
{% if wazuh_manager_config.email_notification | lower == "yes" %}
|
<email_notification>{{ wazuh_manager_config.email_notification }}</email_notification>
|
||||||
<email_notification>yes</email_notification>
|
|
||||||
{% else %}
|
|
||||||
<email_notification>no</email_notification>
|
|
||||||
{% endif %}
|
|
||||||
{% for to in wazuh_manager_config.mail_to %}
|
{% for to in wazuh_manager_config.mail_to %}
|
||||||
<email_to>{{ to }}</email_to>
|
<email_to>{{ to }}</email_to>
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user