diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index fddb7fc6..70bb61fc 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -10,6 +10,8 @@ recipient@example.wazuh.com 12 alerts.log + 10m + 0 @@ -43,8 +45,8 @@ 43200 - /var/ossec/etc/rootcheck/rootkit_files.txt - /var/ossec/etc/rootcheck/rootkit_trojans.txt + etc/rootcheck/rootkit_files.txt + etc/rootcheck/rootkit_trojans.txt yes @@ -79,6 +81,11 @@ yes yes yes + + + + 10 + @@ -91,6 +98,7 @@ no 5m + 6h yes @@ -108,6 +116,7 @@ no stretch buster + bullseye 1h @@ -121,6 +130,20 @@ 1h + + + no + amazon-linux + amazon-linux-2 + 1h + + + + + no + 1h + + yes @@ -199,70 +222,47 @@ 127.0.0.1 ^localhost.localdomain$ - 4.3.0.1 - 4.3.0.2 - 208.67.220.220 + 127.0.0.53 disable-account - disable-account.sh - user + disable-account yes - restart-ossec - restart-ossec.sh - + restart-wazuh + restart-wazuh firewall-drop - firewall-drop.sh - srcip + firewall-drop yes host-deny - host-deny.sh - srcip + host-deny yes route-null - route-null.sh - srcip + route-null yes win_route-null - route-null.cmd - srcip - yes - - - - win_route-null-2012 - route-null-2012.cmd - srcip + route-null.exe yes netsh - netsh.cmd - srcip - yes - - - - netsh-win-2016 - netsh-win-2016.cmd - srcip + netsh.exe yes @@ -306,21 +306,25 @@ etc/rules + + yes + 1 + 64 + 15m + + no 1515 no - yes - 0 yes no - yes HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH no - /var/ossec/etc/sslmanager.cert - /var/ossec/etc/sslmanager.key + etc/sslmanager.cert + etc/sslmanager.key no @@ -345,4 +349,25 @@ syslog /var/ossec/logs/active-responses.log - + + + syslog + /var/log/auth.log + + + + syslog + /var/log/syslog + + + + syslog + /var/log/dpkg.log + + + + syslog + /var/log/kern.log + + + \ No newline at end of file diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 30670045..38d72010 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -10,6 +10,8 @@ recipient@example.wazuh.com 12 alerts.log + 10m + 0 @@ -43,8 +45,8 @@ 43200 - /var/ossec/etc/rootcheck/rootkit_files.txt - /var/ossec/etc/rootcheck/rootkit_trojans.txt + etc/rootcheck/rootkit_files.txt + etc/rootcheck/rootkit_trojans.txt yes @@ -79,6 +81,11 @@ yes yes yes + + + + 10 + @@ -91,6 +98,7 @@ no 5m + 6h yes @@ -108,6 +116,7 @@ no stretch buster + bullseye 1h @@ -121,6 +130,20 @@ 1h + + + no + amazon-linux + amazon-linux-2 + 1h + + + + + no + 1h + + yes @@ -199,70 +222,47 @@ 127.0.0.1 ^localhost.localdomain$ - 4.3.0.1 - 4.3.0.2 - 208.67.220.220 + 127.0.0.53 disable-account - disable-account.sh - user + disable-account yes - restart-ossec - restart-ossec.sh - + restart-wazuh + restart-wazuh firewall-drop - firewall-drop.sh - srcip + firewall-drop yes host-deny - host-deny.sh - srcip + host-deny yes route-null - route-null.sh - srcip + route-null yes win_route-null - route-null.cmd - srcip - yes - - - - win_route-null-2012 - route-null-2012.cmd - srcip + route-null.exe yes netsh - netsh.cmd - srcip - yes - - - - netsh-win-2016 - netsh-win-2016.cmd - srcip + netsh.exe yes @@ -306,21 +306,25 @@ etc/rules + + yes + 1 + 64 + 15m + + no 1515 no - yes - 0 yes no - yes HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH no - /var/ossec/etc/sslmanager.cert - /var/ossec/etc/sslmanager.key + etc/sslmanager.cert + etc/sslmanager.key no @@ -345,4 +349,25 @@ syslog /var/ossec/logs/active-responses.log - + + + syslog + /var/log/auth.log + + + + syslog + /var/log/syslog + + + + syslog + /var/log/dpkg.log + + + + syslog + /var/log/kern.log + + + \ No newline at end of file diff --git a/multi-node/config/wazuh_indexer_ssl_certs/certs.yml b/multi-node/config/wazuh_indexer_ssl_certs/certs.yml old mode 100644 new mode 100755 diff --git a/single-node/config/wazuh_indexer_ssl_certs/certs.yml b/single-node/config/wazuh_indexer_ssl_certs/certs.yml old mode 100644 new mode 100755