From 75aceb19a47c46406a22c1a6b25675969601dc67 Mon Sep 17 00:00:00 2001
From: Victor Carlos Erenu <victor.erenu@wazuh.com>
Date: Mon, 16 Mar 2026 23:56:55 +0700
Subject: [PATCH] Delete permanent_data folder and exceptions for Active
 Response on Wazuh manager

---
 .../wazuh-manager/config/permanent_data.env        | 14 --------------
 multi-node/docker-compose.yml                      |  2 --
 single-node/docker-compose.yml                     |  1 -
 3 files changed, 17 deletions(-)

diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env
index 5b34c009..7ca694af 100644
--- a/build-docker-images/wazuh-manager/config/permanent_data.env
+++ b/build-docker-images/wazuh-manager/config/permanent_data.env
@@ -5,28 +5,14 @@ PERMANENT_DATA[((i++))]="/var/wazuh-manager/etc"
 PERMANENT_DATA[((i++))]="/var/wazuh-manager/logs"
 PERMANENT_DATA[((i++))]="/var/wazuh-manager/queue"
 PERMANENT_DATA[((i++))]="/var/wazuh-manager/var/multigroups"
-PERMANENT_DATA[((i++))]="/var/wazuh-manager/active-response/bin"
 
 export PERMANENT_DATA
 
 # Files mounted in a volume that should not be permanent
 i=0
 PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/etc/internal_options.conf"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/default-firewall-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/disable-account"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewalld-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewall-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/host-deny"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ip-customblock"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ipfw"
 PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/npf"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/wazuh-slack"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/pf"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart-wazuh"
 PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart.sh"
-PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/route-null"
 
 export PERMANENT_DATA_EXCP
 
diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index 035fd9ab..257d9a1a 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -40,7 +40,6 @@ services:
       - master-wazuh-logs:/var/wazuh-manager/logs
       - master-wazuh-queue:/var/wazuh-manager/queue
       - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
-      - master-wazuh-active-response:/var/wazuh-manager/active-response/bin
       - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
@@ -82,7 +81,6 @@ services:
       - worker-wazuh-logs:/var/wazuh-manager/logs
       - worker-wazuh-queue:/var/wazuh-manager/queue
       - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
-      - worker-wazuh-active-response:/var/wazuh-manager/active-response/bin
       - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./wazuh-certificates/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./wazuh-certificates/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 1519d23f..9dfb76c4 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -40,7 +40,6 @@ services:
       - wazuh_logs:/var/wazuh-manager/logs
       - wazuh_queue:/var/wazuh-manager/queue
       - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
-      - wazuh_active_response:/var/wazuh-manager/active-response/bin
       - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
       - ./wazuh-certificates/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
       - ./wazuh-certificates/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem