9a3f715dd5
- Change include by import_tasks in the playbooks. - Change version from Elastic Stack to 5.6.3
202 lines
4.8 KiB
YAML
202 lines
4.8 KiB
YAML
---
|
|
wazuh_manager_fqdn: "wazuh-server"
|
|
|
|
wazuh_manager_config:
|
|
json_output: 'yes'
|
|
alerts_log: 'yes'
|
|
logall: 'no'
|
|
log_format: 'plain'
|
|
connection:
|
|
- type: 'secure'
|
|
port: '1514'
|
|
protocol: 'tcp'
|
|
authd:
|
|
enable: enable
|
|
port: 1515
|
|
use_source_ip: 'no'
|
|
force_insert: 'no'
|
|
force_time: 0
|
|
purge: 'no'
|
|
use_password: 'no'
|
|
ssl_agent_ca: null
|
|
ssl_verify_host: 'no'
|
|
ssl_manager_cert: null
|
|
ssl_manager_key: null
|
|
ssl_auto_negotiate: 'no'
|
|
email_notification: 'no'
|
|
mail_to:
|
|
- 'admin@example.net'
|
|
mail_smtp_server: localhost
|
|
mail_from: wazuh-server@example.com
|
|
extra_emails:
|
|
- enable: false
|
|
mail_to: 'admin@example.net'
|
|
format: full
|
|
level: 7
|
|
event_location: null
|
|
group: null
|
|
do_not_delay: false
|
|
do_not_group: false
|
|
rule_id: null
|
|
reports:
|
|
- enable: false
|
|
category: 'syscheck'
|
|
title: 'Daily report: File changes'
|
|
email_to: 'admin@example.net'
|
|
location: null
|
|
group: null
|
|
rule: null
|
|
level: null
|
|
srcip: null
|
|
user: null
|
|
showlogs: null
|
|
syscheck:
|
|
frequency: 43200
|
|
scan_on_start: 'yes'
|
|
auto_ignore: 'no'
|
|
alert_new_files: 'yes'
|
|
ignore:
|
|
- /etc/mtab
|
|
- /etc/mnttab
|
|
- /etc/hosts.deny
|
|
- /etc/mail/statistics
|
|
- /etc/random-seed
|
|
- /etc/random.seed
|
|
- /etc/adjtime
|
|
- /etc/httpd/logs
|
|
- /etc/utmpx
|
|
- /etc/wtmpx
|
|
- /etc/cups/certs
|
|
- /etc/dumpdates
|
|
- /etc/svc/volatile
|
|
no_diff:
|
|
- /etc/ssl/private.key
|
|
directories:
|
|
- dirs: /etc,/usr/bin,/usr/sbin
|
|
checks: 'check_all="yes"'
|
|
- dirs: /bin,/sbin
|
|
checks: 'check_all="yes"'
|
|
rootcheck:
|
|
frequency: 43200
|
|
openscap:
|
|
timeout: 1800
|
|
interval: '1d'
|
|
scan_on_start: 'yes'
|
|
log_level: 1
|
|
email_level: 12
|
|
localfiles:
|
|
- format: 'syslog'
|
|
location: '/var/log/messages'
|
|
- format: 'syslog'
|
|
location: '/var/log/secure'
|
|
- format: 'command'
|
|
command: 'df -P'
|
|
frequency: '360'
|
|
- format: 'full_command'
|
|
command: 'netstat -tln | grep -v 127.0.0.1 | sort'
|
|
frequency: '360'
|
|
- format: 'full_command'
|
|
command: 'last -n 20'
|
|
frequency: '360'
|
|
globals:
|
|
- '127.0.0.1'
|
|
- '192.168.2.1'
|
|
commands:
|
|
- name: 'disable-account'
|
|
executable: 'disable-account.sh'
|
|
expect: 'user'
|
|
timeout_allowed: 'yes'
|
|
- name: 'restart-ossec'
|
|
executable: 'restart-ossec.sh'
|
|
expect: ''
|
|
timeout_allowed: 'no'
|
|
- name: 'win_restart-ossec'
|
|
executable: 'restart-ossec.cmd'
|
|
expect: ''
|
|
timeout_allowed: 'no'
|
|
- name: 'firewall-drop'
|
|
executable: 'firewall-drop.sh'
|
|
expect: 'srcip'
|
|
timeout_allowed: 'yes'
|
|
- name: 'host-deny'
|
|
executable: 'host-deny.sh'
|
|
expect: 'srcip'
|
|
timeout_allowed: 'yes'
|
|
- name: 'route-null'
|
|
executable: 'route-null.sh'
|
|
expect: 'srcip'
|
|
timeout_allowed: 'yes'
|
|
- name: 'win_route-null'
|
|
executable: 'route-null.cmd'
|
|
expect: 'srcip'
|
|
timeout_allowed: 'yes'
|
|
active_responses:
|
|
- command: 'restart-ossec'
|
|
location: 'local'
|
|
rules_id: '100002'
|
|
- command: 'win_restart-ossec'
|
|
location: 'local'
|
|
rules_id: '100003'
|
|
- command: 'host-deny'
|
|
location: 'local'
|
|
level: 6
|
|
timeout: 600
|
|
syslog_outputs:
|
|
- server: null
|
|
port: null
|
|
format: null
|
|
|
|
wazuh_agent_configs:
|
|
- type: os
|
|
type_value: Linux
|
|
syscheck:
|
|
frequency: 43200
|
|
scan_on_start: 'yes'
|
|
auto_ignore: 'no'
|
|
alert_new_files: 'yes'
|
|
ignore:
|
|
- /etc/mtab
|
|
- /etc/mnttab
|
|
- /etc/hosts.deny
|
|
- /etc/mail/statistics
|
|
- /etc/svc/volatile
|
|
no_diff:
|
|
- /etc/ssl/private.key
|
|
directories:
|
|
- dirs: /etc,/usr/bin,/usr/sbin
|
|
checks: 'check_all="yes"'
|
|
- dirs: /bin,/sbin
|
|
checks: 'check_all="yes"'
|
|
rootcheck:
|
|
frequency: 43200
|
|
cis_distribution_filename: null
|
|
localfiles:
|
|
- format: 'syslog'
|
|
location: '/var/log/messages'
|
|
- format: 'syslog'
|
|
location: '/var/log/secure'
|
|
- format: 'syslog'
|
|
location: '/var/log/maillog'
|
|
- format: 'apache'
|
|
location: '/var/log/httpd/error_log'
|
|
- format: 'apache'
|
|
location: '/var/log/httpd/access_log'
|
|
- format: 'apache'
|
|
location: '/var/ossec/logs/active-responses.log'
|
|
- type: os
|
|
type_value: Windows
|
|
syscheck:
|
|
frequency: 43200
|
|
scan_on_start: 'yes'
|
|
auto_ignore: 'no'
|
|
alert_new_files: 'yes'
|
|
windows_registry:
|
|
- key: 'HKEY_LOCAL_MACHINE\Software\Classes\batfile'
|
|
arch: 'both'
|
|
- key: 'HKEY_LOCAL_MACHINE\Software\Classes\Folder'
|
|
localfiles:
|
|
- format: 'Security'
|
|
location: 'eventchannel'
|
|
- format: 'System'
|
|
location: 'eventlog'
|