#jinja2: trim_blocks: False
<!-- {{ ansible_managed }} -->
<!--
  Wazuh - Agent
  More info at: https://documentation.wazuh.com
  Mailing list: https://groups.google.com/forum/#!forum/wazuh
-->

<ossec_config>
  <client>

    {% for manager in wazuh_managers  %}
    <server>
      <address>{{ manager.address }}</address>
      {% if manager.port is defined %}
      <port>{{ manager.port }}</port>
      {% endif %}
      {% if manager.protocol is defined %}
      <protocol>{{ manager.protocol }}</protocol>
      {% endif %}
    </server>
    {% endfor %}

    {% if wazuh_profile is not none %}
    <config-profile>{{ wazuh_profile }}</config-profile>
    {% endif %}
    {% if wazuh_notify_time is not none and wazuh_time_reconnect is not none %}
    <notify_time>{{ wazuh_notify_time }}</notify_time>
    <time-reconnect>{{ wazuh_time_reconnect }}</time-reconnect>
    {% endif %}
    <auto_restart>{{ wazuh_auto_restart }}</auto_restart>
  </client>

  <logging>
    <log_format>{{ wazuh_agent_config.log_format }}</log_format>
  </logging>

  <active-response>
    <disabled>{{ wazuh_agent_config.active_response_disabled|default('no') }}</disabled>
  </active-response>

  {% if wazuh_agent_config.rootcheck is defined %}
  <rootcheck>
    <disabled>no</disabled>
    <check_unixaudit>yes</check_unixaudit>
    <check_files>yes</check_files>
    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
    <check_ports>yes</check_ports>
    <check_if>yes</check_if>

    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>{{ wazuh_agent_config.rootcheck.frequency }}</frequency>

    {% if ansible_os_family == "Windows" %}
    <windows_audit>./shared/win_audit_rcl.txt</windows_audit>
    <windows_apps>./shared/win_applications_rcl.txt</windows_apps>
    <windows_malware>./shared/win_malware_rcl.txt</windows_malware>
    {% endif %}

    {% if ansible_system == "Linux" %}
    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
    <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
    <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
    {% if cis_distribution_filename is defined %}
    <system_audit>/var/ossec/etc/shared/{{ cis_distribution_filename }}</system_audit>
    {% endif %}
    {% endif %}

    <skip_nfs>yes</skip_nfs>
  </rootcheck>
  {% endif %}

  {% if wazuh_agent_config.syscheck is defined %}
  <syscheck>
    <disabled>no</disabled>
    {% if ansible_system == "Linux" %}
    <directories check_all="yes" realtime="yes" restrict="^/var/ossec/etc/shared/agent.conf$">/var/ossec/etc/shared</directories>
    {% endif %}

    <auto_ignore>{{ wazuh_agent_config.syscheck.auto_ignore }}</auto_ignore>
    <alert_new_files>{{ wazuh_agent_config.syscheck.alert_new_files }}</alert_new_files>
    <!-- Frequency that syscheck is executed -- default every 20 hours -->
    <frequency>{{ wazuh_agent_config.syscheck.frequency }}</frequency>
    <scan_on_start>{{ wazuh_agent_config.syscheck.scan_on_start }}</scan_on_start>

    <!-- Directories to check  (perform all possible verifications) -->
    {% if wazuh_agent_config.syscheck.directories is defined %}
    {% for directory in wazuh_agent_config.syscheck.directories %}
    <directories {{ directory.checks }}>{{ directory.dirs }}</directories>
    {% endfor %}
    {% endif %}

    <!-- Files/directories to ignore -->
    {% if wazuh_agent_config.syscheck.ignore is defined %}
    {% for ignore in wazuh_agent_config.syscheck.ignore %}
    <ignore>{{ ignore }}</ignore>
    {% endfor %}
    {% endif %}

    <!-- Files no diff -->
    {% for no_diff in wazuh_agent_config.syscheck.no_diff %}
    <nodiff>{{ no_diff }}</nodiff>
    {% endfor %}

    {% if ansible_os_family == "Windows" %}
    {% for registry_key in wazuh_agent_config.syscheck.windows_registry %}
    {% if registry_key.arch is defined %}
    <windows_registry arch="{{ registry_key.arch }}">{{ registry_key.key }}</windows_registry>
    {% else %}
    <windows_registry>{{ registry_key.key }}</windows_registry>
    {% endif %}
    {% endfor %}
    {% endif %}
  </syscheck>
  {% endif %}

  {% if ansible_system == "Linux" and wazuh_agent_config.openscap.disable == 'no' %}
  <wodle name="open-scap">
    <disabled>no</disabled>
    <timeout>{{ wazuh_agent_config.openscap.timeout }}</timeout>
    <interval>{{ wazuh_agent_config.openscap.interval }}</interval>
    <scan-on-start>{{ wazuh_agent_config.openscap.scan_on_start }}</scan-on-start>
    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'xenial' %}
    <content type="xccdf" path="ssg-ubuntu-1604-ds.xml">
      <profile>xccdf_org.ssgproject.content_profile_common</profile>
    </content>
    {% elif ansible_distribution == 'Debian' %}
    {% if ansible_distribution_release == 'jessie' %}
    {% if openscap_version_valid.stdout == "0" %}
    <content type="xccdf" path="ssg-debian-8-ds.xml">
      <profile>xccdf_org.ssgproject.content_profile_common</profile>
    </content>
    <content type="oval" path="cve-debian-8-oval.xml"/>
    {% endif %}
    {% elif ansible_distribution_release == 'stretch' %}
    <content type="oval" path="cve-debian-9-oval.xml"/>
    {% endif %}
    {% elif ansible_distribution == 'CentOS' %}
      {% if ansible_distribution_major_version == '7' %}
      <content type="xccdf" path="ssg-centos-7-ds.xml">
      {% elif ansible_distribution_major_version == '6' %}
      <content type="xccdf" path="ssg-centos-6-ds.xml">
      {% endif %}
        <profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
        <profile>xccdf_org.ssgproject.content_profile_common</profile>
      </content>
    {% elif ansible_distribution == 'RedHat' %}
      {% if ansible_distribution_major_version == '7' %}
      <content type="xccdf" path="ssg-rhel-7-ds.xml">
      {% elif ansible_distribution_major_version == '6' %}
      <content type="xccdf" path="ssg-rhel-6-ds.xml">
      {% endif %}
        <profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
        <profile>xccdf_org.ssgproject.content_profile_common</profile>
      </content>
      {% if ansible_distribution_major_version == '7' %}
      <content type="oval" path="cve-redhat-7-ds.xml"/>
      {% elif ansible_distribution_major_version == '6' %}
      <content type="oval" path="cve-redhat-6-ds.xml"/>
      {% endif %}
    {% elif ansible_distribution == 'Fedora' %}
      <content type="xccdf" path="ssg-fedora-ds.xml">
        <profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
        <profile>xccdf_org.ssgproject.content_profile_common</profile>
      </content>
    {% endif %}
  </wodle>
  {% endif %}

  {% if ansible_system == "Linux" and wazuh_agent_config.cis_cat.disable == 'no' %}
  <wodle name="cis-cat">
    <disabled>no</disabled>
    <timeout>{{ wazuh_agent_config.cis_cat.timeout }}</timeout>
    <interval>{{ wazuh_agent_config.cis_cat.interval }}</interval>
    <scan-on-start>{{ wazuh_agent_config.cis_cat.scan_on_start }}</scan-on-start>
    {% if wazuh_agent_config.cis_cat.install_java == 'yes' and ansible_system == "Linux" %}
    <java_path>/usr/bin</java_path>
    {% else %}
    <java_path>{{ wazuh_agent_config.cis_cat.java_path }}</java_path>
    {% endif %}
    <ciscat_path>{{ wazuh_agent_config.cis_cat.ciscat_path }}</ciscat_path>
    {% for benchmark in wazuh_agent_config.cis_cat.content %}
    <content type="{{ benchmark.type }}" path="{{ benchmark.path }}">
      <profile>{{ benchmark.profile }}</profile>
    </content>
    {% endfor %}
  </wodle>
  {% endif %}

  {% if ansible_system == "Linux" and wazuh_agent_config.vuls.disable == 'no' %}
  <wodle name="command">
    <disabled>no</disabled>
    <tag>Wazuh-VULS</tag>
    <command>/usr/bin/python /var/ossec/wodles/vuls/vuls.py{% for arg in wazuh_agent_config.vuls.args %} --{{ arg }}{% endfor %}</command>
    <interval>{{ wazuh_agent_config.vuls.interval }}</interval>
    <ignore_output>yes</ignore_output>
    <run_on_start>{{ wazuh_agent_config.vuls.run_on_start }}</run_on_start>
  </wodle>
  {% endif %}

  <!-- Files to monitor (localfiles) -->
    {% for localfile in wazuh_agent_config.localfiles %}
    <localfile>
        <log_format>{{ localfile.format }}</log_format>
    {% if localfile.format == 'command' or localfile.format == 'full_command' %}
        <command>{{ localfile.command }}</command>
        <frequency>{{ localfile.frequency }}</frequency>
    {% else %}
        <location>{{ localfile.location }}</location>
    {% endif %}
    </localfile>
  {% endfor %}

</ossec_config>