44 lines
992 B
YAML
44 lines
992 B
YAML
---
|
|
# vars file for ossec-agent
|
|
ossec_agent_config:
|
|
frequency_check: 43200
|
|
syscheck_scan_on_start: 'yes'
|
|
ignore_files:
|
|
- /etc/mtab
|
|
- /etc/mnttab
|
|
- /etc/hosts.deny
|
|
- /etc/mail/statistics
|
|
- /etc/random-seed
|
|
- /etc/random.seed
|
|
- /etc/adjtime
|
|
- /etc/httpd/logs
|
|
- /etc/utmpx
|
|
- /etc/wtmpx
|
|
- /etc/cups/certs
|
|
- /etc/dumpdates
|
|
- /etc/svc/volatile
|
|
no_diff:
|
|
- /etc/ssl/private.key
|
|
directories:
|
|
- check_all: 'yes'
|
|
dirs: /etc,/usr/bin,/usr/sbin
|
|
- check_all: 'yes'
|
|
dirs: /bin,/sbin
|
|
localfiles:
|
|
- format: 'syslog'
|
|
location: '/var/log/messages'
|
|
- format: 'syslog'
|
|
location: '/var/log/secure'
|
|
- format: 'command'
|
|
command: 'df -P'
|
|
frequency: '360'
|
|
- format: 'full_command'
|
|
command: 'netstat -tln | grep -v 127.0.0.1 | sort'
|
|
frequency: '360'
|
|
- format: 'full_command'
|
|
command: 'last -n 20'
|
|
frequency: '360'
|
|
globals:
|
|
- '127.0.0.1'
|
|
- '192.168.2.1'
|