#jinja2: lstrip_blocks: True
<!--
  Wazuh - Agent
  More info at: https://documentation.wazuh.com
  Mailing list: https://groups.google.com/forum/#!forum/wazuh
-->

<ossec_config>
  <client>
    <server-ip>{{ wazuh_manager_ip }}</server-ip>
    {% if wazuh_profile is not none %}
    <config-profile>{{ wazuh_profile }}</config-profile>
    {% endif %}
    <protocol>{{ wazuh_manager_proto }}</protocol>
    {% if wazuh_manager_port is defined %}
    <port>{{ wazuh_manager_port }}</port>
    {% endif %}
    {% if wazuh_notify_time is not none and wazuh_time_reconnect is not none %}
    <notify_time>{{ wazuh_notify_time }}</notify_time>
    <time-reconnect>{{ wazuh_time_reconnect }}</time-reconnect>
    {% endif %}
  </client>

  <rootcheck>
    <disabled>no</disabled>
    <check_unixaudit>yes</check_unixaudit>
    <check_files>yes</check_files>
    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
    <check_ports>yes</check_ports>
    <check_if>yes</check_if>

    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>{{ wazuh_agent_config.rootcheck.frequency }}</frequency>

    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
    <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
    <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
    {% if cis_distribution_filename is defined %}
    <system_audit>/var/ossec/etc/shared/{{ cis_distribution_filename }}</system_audit>
    {% endif %}

    <skip_nfs>yes</skip_nfs>
  </rootcheck>

  <syscheck>
    <!-- Frequency that syscheck is executed -- default every 20 hours -->
    <frequency>{{ wazuh_agent_config.syscheck.frequency }}</frequency>
    <scan_on_start>{{ wazuh_agent_config.syscheck.scan_on_start }}</scan_on_start>

    <!-- Directories to check  (perform all possible verifications) -->
    {% if wazuh_agent_config.syscheck.directories is defined %}
    {% for directory in wazuh_agent_config.syscheck.directories %}
    <directories {{ directory.checks }}>{{ directory.dirs }}</directories>
    {% endfor %}
    {% endif %}

    <!-- Files/directories to ignore -->
    {% if wazuh_agent_config.syscheck.ignore is defined %}
    {% for ignore in wazuh_agent_config.syscheck.ignore %}
    <ignore>{{ ignore }}</ignore>
    {% endfor %}
    {% endif %}

    <!-- Files no diff -->
    {% for no_diff in wazuh_agent_config.syscheck.no_diff %}
    <nodiff>{{ no_diff }}</nodiff>
    {% endfor %}
  </syscheck>

  {% if wazuh_agent_config.openscap.disable  == 'no' %}
  <wodle name="open-scap">
    <disabled>no</disabled>
    <timeout>{{ wazuh_agent_config.openscap.timeout }}</timeout>
    <interval>{{ wazuh_agent_config.openscap.interval }}</interval>
    <scan-on-start>{{ wazuh_agent_config.openscap.scan_on_start }}</scan-on-start>
    {% if ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'xenial' %}
    <content type="xccdf" path="ssg-ubuntu-1604-ds.xml">
      <profile>xccdf_org.ssgproject.content_profile_common</profile>
    </content>
    {% elif ansible_distribution == 'Debian' and ansible_distribution_release == 'jessie' %}
    {% if openscap_version_valid.stdout == "0" %}
    <content type="xccdf" path="ssg-debian-8-ds.xml">
      <profile>xccdf_org.ssgproject.content_profile_common</profile>
    </content>
    {% endif %}
    <content type="oval" path="cve-debian-oval.xml"/>
    {% elif ansible_distribution == 'CentOS' %}
      {% if ansible_distribution_major_version == '7' %}
      <content type="xccdf" path="ssg-centos-7-ds.xml">
      {% elif ansible_distribution_major_version == '6' %}
      <content type="xccdf" path="ssg-centos-6-ds.xml">
      {% endif %}
        <profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
        <profile>xccdf_org.ssgproject.content_profile_common</profile>
      </content>
    {% elif ansible_distribution == 'RedHat' %}
      {% if ansible_distribution_major_version == '7' %}
      <content type="xccdf" path="ssg-rhel-7-ds.xml">
      {% elif ansible_distribution_major_version == '6' %}
      <content type="xccdf" path="ssg-rhel-6-ds.xml">
      {% endif %}
        <profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
        <profile>xccdf_org.ssgproject.content_profile_common</profile>
      </content>
      {% if ansible_distribution_major_version == '7' %}
      <content type="oval" path="cve-redhat-7-ds.xml"/>
      {% elif ansible_distribution_major_version == '6' %}
      <content type="oval" path="cve-redhat-6-ds.xml"/>
      {% endif %}
    {% elif ansible_distribution == 'Fedora' %}
      <content type="xccdf" path="ssg-fedora-ds.xml">
        <profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
        <profile>xccdf_org.ssgproject.content_profile_common</profile>
      </content>
    {% endif %}
  </wodle>
  {% endif %}

  <!-- Files to monitor (localfiles) -->
    {% for localfile in wazuh_agent_config.localfiles %}
    <localfile>
        <log_format>{{ localfile.format }}</log_format>
    {% if localfile.format == 'command' or localfile.format == 'full_command' %}
        <command>{{ localfile.command }}</command>
        <frequency>{{ localfile.frequency }}</frequency>
    {% else %}
        <location>{{ localfile.location }}</location>
    {% endif %}
    </localfile>
  {% endfor %}

</ossec_config>