178 lines
6.9 KiB
Django/Jinja
178 lines
6.9 KiB
Django/Jinja
#jinja2: trim_blocks: False
|
|
<!--
|
|
Wazuh - Agent
|
|
More info at: https://documentation.wazuh.com
|
|
Mailing list: https://groups.google.com/forum/#!forum/wazuh
|
|
-->
|
|
|
|
<ossec_config>
|
|
<client>
|
|
{% if wazuh_manager_ip is not none %}
|
|
<server-ip>{{ wazuh_manager_ip }}</server-ip>
|
|
{% else %}
|
|
<server-ip>SERVER-IP</server-ip>
|
|
{% endif %}
|
|
{% if wazuh_profile is not none %}
|
|
<config-profile>{{ wazuh_profile }}</config-profile>
|
|
{% endif %}
|
|
<protocol>{{ wazuh_manager_proto }}</protocol>
|
|
{% if wazuh_manager_port is defined %}
|
|
<port>{{ wazuh_manager_port }}</port>
|
|
{% endif %}
|
|
{% if wazuh_notify_time is not none and wazuh_time_reconnect is not none %}
|
|
<notify_time>{{ wazuh_notify_time }}</notify_time>
|
|
<time-reconnect>{{ wazuh_time_reconnect }}</time-reconnect>
|
|
{% endif %}
|
|
</client>
|
|
|
|
<logging>
|
|
<log_format>{{ wazuh_agent_config.log_format }}</log_format>
|
|
</logging>
|
|
|
|
<active-response>
|
|
<disabled>no</disabled>
|
|
</active-response>
|
|
|
|
<rootcheck>
|
|
<disabled>no</disabled>
|
|
<check_unixaudit>yes</check_unixaudit>
|
|
<check_files>yes</check_files>
|
|
<check_trojans>yes</check_trojans>
|
|
<check_dev>yes</check_dev>
|
|
<check_sys>yes</check_sys>
|
|
<check_pids>yes</check_pids>
|
|
<check_ports>yes</check_ports>
|
|
<check_if>yes</check_if>
|
|
|
|
<!-- Frequency that rootcheck is executed - every 12 hours -->
|
|
<frequency>{{ wazuh_agent_config.rootcheck.frequency }}</frequency>
|
|
|
|
{% if ansible_os_family == "Windows" %}
|
|
<windows_audit>./shared/win_audit_rcl.txt</windows_audit>
|
|
<windows_apps>./shared/win_applications_rcl.txt</windows_apps>
|
|
<windows_malware>./shared/win_malware_rcl.txt</windows_malware>
|
|
{% endif %}
|
|
|
|
{% if ansible_system == "Linux" %}
|
|
<rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
|
|
<rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
|
|
<system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
|
|
<system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
|
|
{% if cis_distribution_filename is defined %}
|
|
<system_audit>/var/ossec/etc/shared/{{ cis_distribution_filename }}</system_audit>
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
<skip_nfs>yes</skip_nfs>
|
|
</rootcheck>
|
|
|
|
<syscheck>
|
|
<disabled>no</disabled>
|
|
{% if ansible_os_family == "Windows" %}
|
|
<directories check_all="yes" realtime="yes" restrict="^C:\wazuh-agent/shared/agent.conf$">C:\wazuh-agent</directories>
|
|
{% endif %}
|
|
|
|
{% if ansible_system == "Linux" %}
|
|
<directories check_all="yes" realtime="yes" restrict="^/var/ossec/etc/shared/agent.conf$">/var/ossec/etc/shared</directories>
|
|
{% endif %}
|
|
|
|
<auto_ignore>{{ wazuh_agent_config.syscheck.auto_ignore }}</auto_ignore>
|
|
<alert_new_files>{{ wazuh_agent_config.syscheck.alert_new_files }}</alert_new_files>
|
|
<!-- Frequency that syscheck is executed -- default every 20 hours -->
|
|
<frequency>{{ wazuh_agent_config.syscheck.frequency }}</frequency>
|
|
<scan_on_start>{{ wazuh_agent_config.syscheck.scan_on_start }}</scan_on_start>
|
|
|
|
<!-- Directories to check (perform all possible verifications) -->
|
|
{% if wazuh_agent_config.syscheck.directories is defined %}
|
|
{% for directory in wazuh_agent_config.syscheck.directories %}
|
|
<directories {{ directory.checks }}>{{ directory.dirs }}</directories>
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
<!-- Files/directories to ignore -->
|
|
{% if wazuh_agent_config.syscheck.ignore is defined %}
|
|
{% for ignore in wazuh_agent_config.syscheck.ignore %}
|
|
<ignore>{{ ignore }}</ignore>
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
<!-- Files no diff -->
|
|
{% for no_diff in wazuh_agent_config.syscheck.no_diff %}
|
|
<nodiff>{{ no_diff }}</nodiff>
|
|
{% endfor %}
|
|
|
|
{% if ansible_os_family == "Windows" %}
|
|
{% for registry_key in wazuh_agent_config.syscheck.windows_registry %}
|
|
{% if registry_key.arch is defined %}
|
|
<windows_registry arch="{{ registry_key.arch }}">{{ registry_key.key }}</windows_registry>
|
|
{% else %}
|
|
<windows_registry>{{ registry_key.key }}</windows_registry>
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
</syscheck>
|
|
|
|
{% if wazuh_agent_config.openscap.disable == 'no' and ansible_system == "Linux"%}
|
|
<wodle name="open-scap">
|
|
<disabled>no</disabled>
|
|
<timeout>{{ wazuh_agent_config.openscap.timeout }}</timeout>
|
|
<interval>{{ wazuh_agent_config.openscap.interval }}</interval>
|
|
<scan-on-start>{{ wazuh_agent_config.openscap.scan_on_start }}</scan-on-start>
|
|
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'xenial' %}
|
|
<content type="xccdf" path="ssg-ubuntu-1604-ds.xml">
|
|
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
|
</content>
|
|
{% elif ansible_distribution == 'Debian' and ansible_distribution_release == 'jessie' %}
|
|
{% if openscap_version_valid.stdout == "0" %}
|
|
<content type="xccdf" path="ssg-debian-8-ds.xml">
|
|
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
|
</content>
|
|
{% endif %}
|
|
<content type="oval" path="cve-debian-oval.xml"/>
|
|
{% elif ansible_distribution == 'CentOS' %}
|
|
{% if ansible_distribution_major_version == '7' %}
|
|
<content type="xccdf" path="ssg-centos-7-ds.xml">
|
|
{% elif ansible_distribution_major_version == '6' %}
|
|
<content type="xccdf" path="ssg-centos-6-ds.xml">
|
|
{% endif %}
|
|
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
|
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
|
</content>
|
|
{% elif ansible_distribution == 'RedHat' %}
|
|
{% if ansible_distribution_major_version == '7' %}
|
|
<content type="xccdf" path="ssg-rhel-7-ds.xml">
|
|
{% elif ansible_distribution_major_version == '6' %}
|
|
<content type="xccdf" path="ssg-rhel-6-ds.xml">
|
|
{% endif %}
|
|
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
|
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
|
</content>
|
|
{% if ansible_distribution_major_version == '7' %}
|
|
<content type="oval" path="cve-redhat-7-ds.xml"/>
|
|
{% elif ansible_distribution_major_version == '6' %}
|
|
<content type="oval" path="cve-redhat-6-ds.xml"/>
|
|
{% endif %}
|
|
{% elif ansible_distribution == 'Fedora' %}
|
|
<content type="xccdf" path="ssg-fedora-ds.xml">
|
|
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
|
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
|
</content>
|
|
{% endif %}
|
|
</wodle>
|
|
{% endif %}
|
|
|
|
<!-- Files to monitor (localfiles) -->
|
|
{% for localfile in wazuh_agent_config.localfiles %}
|
|
<localfile>
|
|
<log_format>{{ localfile.format }}</log_format>
|
|
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
|
<command>{{ localfile.command }}</command>
|
|
<frequency>{{ localfile.frequency }}</frequency>
|
|
{% else %}
|
|
<location>{{ localfile.location }}</location>
|
|
{% endif %}
|
|
</localfile>
|
|
{% endfor %}
|
|
|
|
</ossec_config>
|