diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index 1bac9008..fca86f9c 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -78,6 +78,8 @@ VOLUME ["/var/ossec/etc"] VOLUME ["/var/ossec/logs"] VOLUME ["/var/ossec/queue"] VOLUME ["/var/ossec/var/multigroups"] +VOLUME ["/var/ossec/integrations"] +VOLUME ["/var/ossec/active-response/bin"] VOLUME ["/etc/filebeat"] VOLUME ["/etc/postfix"] VOLUME ["/var/lib/filebeat"] diff --git a/wazuh/config/permanent_data.env b/wazuh/config/permanent_data.env index 8d44feaa..2ae1126c 100644 --- a/wazuh/config/permanent_data.env +++ b/wazuh/config/permanent_data.env @@ -5,6 +5,8 @@ PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" +PERMANENT_DATA[((i++))]="/var/ossec/integrations" +PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin" PERMANENT_DATA[((i++))]="/etc/filebeat" PERMANENT_DATA[((i++))]="/etc/postfix" export PERMANENT_DATA @@ -12,6 +14,28 @@ export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh" export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted diff --git a/wazuh/config/permanent_data.sh b/wazuh/config/permanent_data.sh index 00d08ab1..7a9d55b4 100644 --- a/wazuh/config/permanent_data.sh +++ b/wazuh/config/permanent_data.sh @@ -14,9 +14,9 @@ mkdir ${EXCLUSION_PATH} for exclusion_file in "${PERMANENT_DATA_EXCP[@]}"; do # Create the directory for the exclusion file if it does not exist - if [ ! -e ${EXCLUSION_PATH}/${exclusion_file} ] + DIR=$(dirname "${exclusion_file}") + if [ ! -e ${EXCLUSION_PATH}/${DIR} ] then - DIR=$(dirname "${exclusion_file}") mkdir -p ${EXCLUSION_PATH}/${DIR} fi @@ -29,9 +29,9 @@ mkdir ${PERMANENT_PATH} for permanent_dir in "${PERMANENT_DATA[@]}"; do # Create the directory for the permanent file if it does not exist - if [ ! -e ${PERMANENT_PATH}${permanent_dir} ] + DIR=$(dirname "${permanent_dir}") + if [ ! -e ${PERMANENT_PATH}${DIR} ] then - DIR=$(dirname "${permanent_dir}") mkdir -p ${PERMANENT_PATH}${DIR} fi