diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf
index fddb7fc6..70bb61fc 100644
--- a/multi-node/config/wazuh_cluster/wazuh_manager.conf
+++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf
@@ -10,6 +10,8 @@
recipient@example.wazuh.com
12
alerts.log
+ 10m
+ 0
@@ -43,8 +45,8 @@
43200
- /var/ossec/etc/rootcheck/rootkit_files.txt
- /var/ossec/etc/rootcheck/rootkit_trojans.txt
+ etc/rootcheck/rootkit_files.txt
+ etc/rootcheck/rootkit_trojans.txt
yes
@@ -79,6 +81,11 @@
yes
yes
yes
+
+
+
+ 10
+
@@ -91,6 +98,7 @@
no
5m
+ 6h
yes
@@ -108,6 +116,7 @@
no
stretch
buster
+ bullseye
1h
@@ -121,6 +130,20 @@
1h
+
+
+ no
+ amazon-linux
+ amazon-linux-2
+ 1h
+
+
+
+
+ no
+ 1h
+
+
yes
@@ -199,70 +222,47 @@
127.0.0.1
^localhost.localdomain$
- 4.3.0.1
- 4.3.0.2
- 208.67.220.220
+ 127.0.0.53
disable-account
- disable-account.sh
- user
+ disable-account
yes
- restart-ossec
- restart-ossec.sh
-
+ restart-wazuh
+ restart-wazuh
firewall-drop
- firewall-drop.sh
- srcip
+ firewall-drop
yes
host-deny
- host-deny.sh
- srcip
+ host-deny
yes
route-null
- route-null.sh
- srcip
+ route-null
yes
win_route-null
- route-null.cmd
- srcip
- yes
-
-
-
- win_route-null-2012
- route-null-2012.cmd
- srcip
+ route-null.exe
yes
netsh
- netsh.cmd
- srcip
- yes
-
-
-
- netsh-win-2016
- netsh-win-2016.cmd
- srcip
+ netsh.exe
yes
@@ -306,21 +306,25 @@
etc/rules
+
+ yes
+ 1
+ 64
+ 15m
+
+
no
1515
no
- yes
- 0
yes
no
- yes
HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH
no
- /var/ossec/etc/sslmanager.cert
- /var/ossec/etc/sslmanager.key
+ etc/sslmanager.cert
+ etc/sslmanager.key
no
@@ -345,4 +349,25 @@
syslog
/var/ossec/logs/active-responses.log
-
+
+
+ syslog
+ /var/log/auth.log
+
+
+
+ syslog
+ /var/log/syslog
+
+
+
+ syslog
+ /var/log/dpkg.log
+
+
+
+ syslog
+ /var/log/kern.log
+
+
+
\ No newline at end of file
diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf
index 30670045..38d72010 100644
--- a/multi-node/config/wazuh_cluster/wazuh_worker.conf
+++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf
@@ -10,6 +10,8 @@
recipient@example.wazuh.com
12
alerts.log
+ 10m
+ 0
@@ -43,8 +45,8 @@
43200
- /var/ossec/etc/rootcheck/rootkit_files.txt
- /var/ossec/etc/rootcheck/rootkit_trojans.txt
+ etc/rootcheck/rootkit_files.txt
+ etc/rootcheck/rootkit_trojans.txt
yes
@@ -79,6 +81,11 @@
yes
yes
yes
+
+
+
+ 10
+
@@ -91,6 +98,7 @@
no
5m
+ 6h
yes
@@ -108,6 +116,7 @@
no
stretch
buster
+ bullseye
1h
@@ -121,6 +130,20 @@
1h
+
+
+ no
+ amazon-linux
+ amazon-linux-2
+ 1h
+
+
+
+
+ no
+ 1h
+
+
yes
@@ -199,70 +222,47 @@
127.0.0.1
^localhost.localdomain$
- 4.3.0.1
- 4.3.0.2
- 208.67.220.220
+ 127.0.0.53
disable-account
- disable-account.sh
- user
+ disable-account
yes
- restart-ossec
- restart-ossec.sh
-
+ restart-wazuh
+ restart-wazuh
firewall-drop
- firewall-drop.sh
- srcip
+ firewall-drop
yes
host-deny
- host-deny.sh
- srcip
+ host-deny
yes
route-null
- route-null.sh
- srcip
+ route-null
yes
win_route-null
- route-null.cmd
- srcip
- yes
-
-
-
- win_route-null-2012
- route-null-2012.cmd
- srcip
+ route-null.exe
yes
netsh
- netsh.cmd
- srcip
- yes
-
-
-
- netsh-win-2016
- netsh-win-2016.cmd
- srcip
+ netsh.exe
yes
@@ -306,21 +306,25 @@
etc/rules
+
+ yes
+ 1
+ 64
+ 15m
+
+
no
1515
no
- yes
- 0
yes
no
- yes
HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH
no
- /var/ossec/etc/sslmanager.cert
- /var/ossec/etc/sslmanager.key
+ etc/sslmanager.cert
+ etc/sslmanager.key
no
@@ -345,4 +349,25 @@
syslog
/var/ossec/logs/active-responses.log
-
+
+
+ syslog
+ /var/log/auth.log
+
+
+
+ syslog
+ /var/log/syslog
+
+
+
+ syslog
+ /var/log/dpkg.log
+
+
+
+ syslog
+ /var/log/kern.log
+
+
+
\ No newline at end of file
diff --git a/multi-node/config/wazuh_indexer_ssl_certs/certs.yml b/multi-node/config/wazuh_indexer_ssl_certs/certs.yml
old mode 100644
new mode 100755
diff --git a/single-node/config/wazuh_indexer_ssl_certs/certs.yml b/single-node/config/wazuh_indexer_ssl_certs/certs.yml
old mode 100644
new mode 100755