API tools faq
paste
Advertisement
koval_r

ossec.conf

koval_r
May 4th, 2025 (edited)
276
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
XML 5.81 KB | None | 0 0
raw download clone embed print report
  1. cat /var/ossec/etc/ossec.conf
  2. <!--
  3.  Wazuh - Agent - Default configuration for almalinux 9.5
  4.  More info at: https://documentation.wazuh.com
  5.  Mailing list: https://groups.google.com/forum/#!forum/wazuh
  6. -->
  7.  
  8. <ossec_config>
  9.   <client>
  10.     <server>
  11.       <address>__SENSETIVE-INFO__</address>
  12.       <port>1514</port>
  13.       <protocol>tcp</protocol>
  14.     </server>
  15.     <config-profile>almalinux, almalinux9, almalinux9.5</config-profile>
  16.     <notify_time>10</notify_time>
  17.     <time-reconnect>60</time-reconnect>
  18.     <auto_restart>yes</auto_restart>
  19.     <crypto_method>aes</crypto_method>
  20.     <enrollment>
  21.       <enabled>yes</enabled>
  22.       <agent_name>__SENSETIVE-INFO__</agent_name>
  23.       <groups>default</groups>
  24.       <authorization_pass_path>etc/authd.pass</authorization_pass_path>
  25.     </enrollment>
  26.   </client>
  27.  
  28.   <client_buffer>
  29.     <!-- Agent buffer options -->
  30.     <disabled>no</disabled>
  31.     <queue_size>5000</queue_size>
  32.     <events_per_second>500</events_per_second>
  33.   </client_buffer>
  34.  
  35.   <!-- Policy monitoring -->
  36.   <rootcheck>
  37.     <disabled>no</disabled>
  38.     <check_files>yes</check_files>
  39.     <check_trojans>yes</check_trojans>
  40.     <check_dev>yes</check_dev>
  41.     <check_sys>yes</check_sys>
  42.     <check_pids>yes</check_pids>
  43.     <check_ports>yes</check_ports>
  44.     <check_if>yes</check_if>
  45.  
  46.     <!-- Frequency that rootcheck is executed - every 12 hours -->
  47.     <frequency>43200</frequency>
  48.  
  49.     <rootkit_files>etc/shared/rootkit_files.txt</rootkit_files>
  50.     <rootkit_trojans>etc/shared/rootkit_trojans.txt</rootkit_trojans>
  51.  
  52.     <skip_nfs>yes</skip_nfs>
  53.  
  54.     <ignore>/var/lib/containerd</ignore>
  55.     <ignore>/var/lib/docker/overlay2</ignore>
  56.   </rootcheck>
  57.  
  58.   <wodle name="cis-cat">
  59.     <disabled>yes</disabled>
  60.     <timeout>1800</timeout>
  61.     <interval>1d</interval>
  62.     <scan-on-start>yes</scan-on-start>
  63.  
  64.     <java_path>wodles/java</java_path>
  65.     <ciscat_path>wodles/ciscat</ciscat_path>
  66.   </wodle>
  67.  
  68.   <!-- Osquery integration -->
  69.   <wodle name="osquery">
  70.     <disabled>yes</disabled>
  71.     <run_daemon>yes</run_daemon>
  72.     <log_path>/var/log/osquery/osqueryd.results.log</log_path>
  73.     <config_path>/etc/osquery/osquery.conf</config_path>
  74.     <add_labels>yes</add_labels>
  75.   </wodle>
  76.  
  77.   <!-- System inventory -->
  78.   <wodle name="syscollector">
  79.     <disabled>no</disabled>
  80.     <interval>1h</interval>
  81.     <scan_on_start>yes</scan_on_start>
  82.     <hardware>yes</hardware>
  83.     <os>yes</os>
  84.     <network>yes</network>
  85.     <packages>yes</packages>
  86.     <ports all="no">yes</ports>
  87.     <processes>yes</processes>
  88.  
  89.     <!-- Database synchronization settings -->
  90.     <synchronization>
  91.       <max_eps>10</max_eps>
  92.     </synchronization>
  93.   </wodle>
  94.  
  95.   <sca>
  96.     <enabled>yes</enabled>
  97.     <scan_on_start>yes</scan_on_start>
  98.     <interval>12h</interval>
  99.     <skip_nfs>yes</skip_nfs>
  100.   </sca>
  101.  
  102.   <!-- File integrity monitoring -->
  103.   <syscheck>
  104.     <disabled>no</disabled>
  105.  
  106.     <!-- Frequency that syscheck is executed default every 12 hours -->
  107.     <frequency>43200</frequency>
  108.  
  109.     <scan_on_start>yes</scan_on_start>
  110.  
  111.     <!-- Directories to check  (perform all possible verifications) -->
  112.     <directories>/etc,/usr/bin,/usr/sbin</directories>
  113.     <directories>/bin,/sbin,/boot</directories>
  114.  
  115.     <!-- Files/directories to ignore -->
  116.     <ignore>/etc/mtab</ignore>
  117.     <ignore>/etc/hosts.deny</ignore>
  118.     <ignore>/etc/mail/statistics</ignore>
  119.     <ignore>/etc/random-seed</ignore>
  120.     <ignore>/etc/random.seed</ignore>
  121.     <ignore>/etc/adjtime</ignore>
  122.     <ignore>/etc/httpd/logs</ignore>
  123.     <ignore>/etc/utmpx</ignore>
  124.     <ignore>/etc/wtmpx</ignore>
  125.     <ignore>/etc/cups/certs</ignore>
  126.     <ignore>/etc/dumpdates</ignore>
  127.     <ignore>/etc/svc/volatile</ignore>
  128.  
  129.     <!-- File types to ignore -->
  130.     <ignore type="sregex">.log$|.swp$</ignore>
  131.  
  132.     <!-- Check the file, but never compute the diff -->
  133.     <nodiff>/etc/ssl/private.key</nodiff>
  134.  
  135.     <skip_nfs>yes</skip_nfs>
  136.     <skip_dev>yes</skip_dev>
  137.     <skip_proc>yes</skip_proc>
  138.     <skip_sys>yes</skip_sys>
  139.  
  140.     <!-- Nice value for Syscheck process -->
  141.     <process_priority>10</process_priority>
  142.  
  143.     <!-- Maximum output throughput -->
  144.     <max_eps>50</max_eps>
  145.  
  146.     <!-- Database synchronization settings -->
  147.     <synchronization>
  148.       <enabled>yes</enabled>
  149.       <interval>5m</interval>
  150.       <max_eps>10</max_eps>
  151.     </synchronization>
  152.   </syscheck>
  153.  
  154.   <!-- Log analysis -->
  155.   <localfile>
  156.     <log_format>command</log_format>
  157.     <command>df -P</command>
  158.     <frequency>360</frequency>
  159.   </localfile>
  160.  
  161.   <localfile>
  162.     <log_format>full_command</log_format>
  163.     <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
  164.     <alias>netstat listening ports</alias>
  165.     <frequency>360</frequency>
  166.   </localfile>
  167.  
  168.   <localfile>
  169.     <log_format>full_command</log_format>
  170.     <command>last -n 20</command>
  171.     <frequency>360</frequency>
  172.   </localfile>
  173.  
  174.   <!-- Active response -->
  175.   <active-response>
  176.     <disabled>no</disabled>
  177.     <ca_store>etc/wpk_root.pem</ca_store>
  178.     <ca_verification>yes</ca_verification>
  179.   </active-response>
  180.  
  181.   <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  182.   <logging>
  183.     <log_format>plain</log_format>
  184.   </logging>
  185.  
  186. </ossec_config>
  187.  
  188. <ossec_config>
  189.   <localfile>
  190.     <log_format>journald</log_format>
  191.     <location>journald</location>
  192.   </localfile>
  193.  
  194.   <localfile>
  195.     <log_format>audit</log_format>
  196.     <location>/var/log/audit/audit.log</location>
  197.   </localfile>
  198.  
  199.   <localfile>
  200.     <log_format>syslog</log_format>
  201.     <location>/var/ossec/logs/active-responses.log</location>
  202.   </localfile>
  203.  
  204. </ossec_config>
  205.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!