122 lines
3.3 KiB
Django/Jinja
122 lines
3.3 KiB
Django/Jinja
<ossec_config>
|
|
<global>
|
|
<jsonout_output>yes</jsonout_output>
|
|
<alerts_log>yes</alerts_log>
|
|
<logall>no</logall>
|
|
<logall_json>no</logall_json>
|
|
<email_notification>no</email_notification>
|
|
<smtp_server>localhost</smtp_server>
|
|
<email_from>wazuh@{{ ansible_hostname }}</email_from>
|
|
<email_to>admin@company.com</email_to>
|
|
<hostname>{{ ansible_hostname }}</hostname>
|
|
<description>Wazuh manager</description>
|
|
</global>
|
|
|
|
<alerts>
|
|
<log_alert_level>3</log_alert_level>
|
|
<email_alert_level>12</email_alert_level>
|
|
</alerts>
|
|
|
|
<remote>
|
|
<connection>secure</connection>
|
|
<port>1514</port>
|
|
<protocol>udp</protocol>
|
|
<queue_size>131072</queue_size>
|
|
</remote>
|
|
|
|
<auth>
|
|
<disabled>no</disabled>
|
|
<port>1515</port>
|
|
<use_source_ip>no</use_source_ip>
|
|
<purge>yes</purge>
|
|
<use_password>no</use_password>
|
|
<ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
|
|
<ssl_agent_ca></ssl_agent_ca>
|
|
<ssl_verify_host>no</ssl_verify_host>
|
|
<ssl_manager_cert>/var/ossec/etc/sslmanager.cert</ssl_manager_cert>
|
|
<ssl_manager_key>/var/ossec/etc/sslmanager.key</ssl_manager_key>
|
|
<ssl_auto_negotiate>no</ssl_auto_negotiate>
|
|
</auth>
|
|
|
|
<monitoring>
|
|
<frequency>120</frequency>
|
|
<queue_size>16384</queue_size>
|
|
<rlimit_nofile>65536</rlimit_nofile>
|
|
</monitoring>
|
|
|
|
<indexer>
|
|
<enabled>yes</enabled>
|
|
<hosts>
|
|
<host>https://127.0.0.1:9200</host>
|
|
</hosts>
|
|
<ssl>
|
|
<certificate_authorities>
|
|
<ca>/etc/wazuh-indexer/certs/root-ca.pem</ca>
|
|
</certificate_authorities>
|
|
<certificate>/etc/wazuh-indexer/certs/wazuh.manager.pem</certificate>
|
|
<key>/etc/wazuh-indexer/certs/wazuh.manager-key.pem</key>
|
|
</ssl>
|
|
</indexer>
|
|
|
|
<vulnerability-detector>
|
|
<enabled>yes</enabled>
|
|
<interval>5m</interval>
|
|
<min_full_scan_interval>6h</min_full_scan_interval>
|
|
<run_on_start>yes</run_on_start>
|
|
|
|
<provider name="canonical">
|
|
<enabled>yes</enabled>
|
|
<os>trusty</os>
|
|
<os>xenial</os>
|
|
<os>bionic</os>
|
|
<os>focal</os>
|
|
<os>jammy</os>
|
|
<update_interval>1h</update_interval>
|
|
</provider>
|
|
</vulnerability-detector>
|
|
|
|
<!-- Log analysis -->
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/auth.log</location>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/syslog</location>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>apache</log_format>
|
|
<location>/var/log/apache2/access.log</location>
|
|
</localfile>
|
|
|
|
<!-- Rootcheck -->
|
|
<rootcheck>
|
|
<disabled>no</disabled>
|
|
<check_files>yes</check_files>
|
|
<check_trojans>yes</check_trojans>
|
|
<check_dev>yes</check_dev>
|
|
<check_sys>yes</check_sys>
|
|
<check_pids>yes</check_pids>
|
|
<check_ports>yes</check_ports>
|
|
<check_if>yes</check_if>
|
|
</rootcheck>
|
|
|
|
<!-- File integrity monitoring -->
|
|
<syscheck>
|
|
<disabled>no</disabled>
|
|
<frequency>79200</frequency>
|
|
<scan_on_start>yes</scan_on_start>
|
|
|
|
<!-- Directories to check -->
|
|
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
|
|
<directories check_all="yes">/bin,/sbin,/boot</directories>
|
|
|
|
<!-- Files/directories to ignore -->
|
|
<ignore>/etc/mtab</ignore>
|
|
<ignore>/etc/hosts.deny</ignore>
|
|
<ignore>/etc/mail/statistics</ignore>
|
|
</syscheck>
|
|
</ossec_config>
|