From 8a014959689e74b06a03ca3ae0f459fdd45d379f Mon Sep 17 00:00:00 2001 From: dfolcha Date: Fri, 27 Aug 2021 10:47:45 +0200 Subject: [PATCH 1/3] Update AR files --- wazuh-odfe/config/permanent_data.env | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 9c2556d8..47f5c06b 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -20,23 +20,21 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff" From 25cb1fa872030cb1c4d6e30109d733c9839b2cfc Mon Sep 17 00:00:00 2001 From: dfolcha Date: Fri, 27 Aug 2021 12:01:58 +0200 Subject: [PATCH 2/3] Fix wrong OD version --- build-from-sources.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-from-sources.yml b/build-from-sources.yml index 2ab4d2ac..637556e1 100644 --- a/build-from-sources.yml +++ b/build-from-sources.yml @@ -31,7 +31,7 @@ services: - filebeat_var:/var/lib/filebeat elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.13.3 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch restart: always ports: From 137f0ba88fbe05f505605706b2591e0075df132c Mon Sep 17 00:00:00 2001 From: dfolcha Date: Fri, 27 Aug 2021 12:11:00 +0200 Subject: [PATCH 3/3] Update goss tests --- .goss.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index 198f523f..049c8121 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -95,17 +95,17 @@ group: process: filebeat: running: true - ossec-analysisd: + wazuh-analysisd: running: true - ossec-authd: + wazuh-authd: running: true - ossec-execd: + wazuh-execd: running: true - ossec-monitord: + wazuh-monitord: running: true - ossec-remoted: + wazuh-remoted: running: true - ossec-syscheckd: + wazuh-syscheckd: running: true s6-supervise: running: true