From 91fe1215ae69365b48221a5351a8c79c3d145600 Mon Sep 17 00:00:00 2001
From: Victor Carlos Erenu <victor.erenu@wazuh.com>
Date: Fri, 16 Jan 2026 19:51:43 +0700
Subject: [PATCH] Delete Wazuh agent configuration files

---
 wazuh-agent/config/wazuh-agent-conf | 195 ----------------------------
 wazuh-agent/docker-compose.yml      |   2 -
 2 files changed, 197 deletions(-)
 delete mode 100644 wazuh-agent/config/wazuh-agent-conf

diff --git a/wazuh-agent/config/wazuh-agent-conf b/wazuh-agent/config/wazuh-agent-conf
deleted file mode 100644
index ad0d8ece..00000000
--- a/wazuh-agent/config/wazuh-agent-conf
+++ /dev/null
@@ -1,195 +0,0 @@
-<!--
-  Wazuh - Agent - Default configuration for amzn 2023
-  More info at: https://documentation.wazuh.com
-  Mailing list: https://groups.google.com/forum/#!forum/wazuh
--->
-
-<ossec_config>
-  <client>
-    <server>
-      <address>CHANGE_MANAGER_IP</address>
-      <port>CHANGE_MANAGER_PORT</port>
-      <protocol>tcp</protocol>
-    </server>
-    <config-profile>amzn, amzn2023</config-profile>
-    <notify_time>10</notify_time>
-    <time-reconnect>60</time-reconnect>
-    <auto_restart>yes</auto_restart>
-    <crypto_method>aes</crypto_method>
-    <enrollment>
-      <enabled>yes</enabled>
-      <manager_address>CHANGE_ENROLL_IP</manager_address>
-      <port>CHANGE_ENROLL_PORT</port>
-      <agent_name>CHANGE_AGENT_NAME</agent_name>
-      <authorization_pass_path>etc/authd.pass</authorization_pass_path>
-      <groups>CHANGE_AGENT_GROUPS</groups>
-    </enrollment>
-  </client>
-
-  <client_buffer>
-    <!-- Agent buffer options -->
-    <disabled>no</disabled>
-    <queue_size>5000</queue_size>
-    <events_per_second>500</events_per_second>
-  </client_buffer>
-
-  <!-- Policy monitoring -->
-  <rootcheck>
-    <disabled>no</disabled>
-    <check_files>yes</check_files>
-    <check_trojans>yes</check_trojans>
-    <check_dev>yes</check_dev>
-    <check_sys>yes</check_sys>
-    <check_pids>yes</check_pids>
-    <check_ports>yes</check_ports>
-    <check_if>yes</check_if>
-
-    <!-- Frequency that rootcheck is executed - every 12 hours -->
-    <frequency>43200</frequency>
-
-    <rootkit_files>etc/shared/rootkit_files.txt</rootkit_files>
-    <rootkit_trojans>etc/shared/rootkit_trojans.txt</rootkit_trojans>
-
-    <skip_nfs>yes</skip_nfs>
-
-    <ignore>/var/lib/containerd</ignore>
-    <ignore>/var/lib/docker/overlay2</ignore>
-  </rootcheck>
-
-  <wodle name="cis-cat">
-    <disabled>yes</disabled>
-    <timeout>1800</timeout>
-    <interval>1d</interval>
-    <scan-on-start>yes</scan-on-start>
-
-    <java_path>wodles/java</java_path>
-    <ciscat_path>wodles/ciscat</ciscat_path>
-  </wodle>
-
-  <!-- Osquery integration -->
-  <wodle name="osquery">
-    <disabled>yes</disabled>
-    <run_daemon>yes</run_daemon>
-    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
-    <config_path>/etc/osquery/osquery.conf</config_path>
-    <add_labels>yes</add_labels>
-  </wodle>
-
-  <!-- System inventory -->
-  <wodle name="syscollector">
-    <disabled>no</disabled>
-    <interval>1h</interval>
-    <scan_on_start>yes</scan_on_start>
-    <hardware>yes</hardware>
-    <os>yes</os>
-    <network>yes</network>
-    <packages>yes</packages>
-    <ports all="yes">yes</ports>
-    <processes>yes</processes>
-
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <max_eps>10</max_eps>
-    </synchronization>
-  </wodle>
-
-  <sca>
-    <enabled>yes</enabled>
-    <scan_on_start>yes</scan_on_start>
-    <interval>12h</interval>
-    <skip_nfs>yes</skip_nfs>
-  </sca>
-
-  <!-- File integrity monitoring -->
-  <syscheck>
-    <disabled>no</disabled>
-
-    <!-- Frequency that syscheck is executed default every 12 hours -->
-    <frequency>43200</frequency>
-
-    <scan_on_start>yes</scan_on_start>
-
-    <!-- Directories to check  (perform all possible verifications) -->
-    <directories>/etc,/usr/bin,/usr/sbin</directories>
-    <directories>/bin,/sbin,/boot</directories>
-
-    <!-- Files/directories to ignore -->
-    <ignore>/etc/mtab</ignore>
-    <ignore>/etc/hosts.deny</ignore>
-    <ignore>/etc/mail/statistics</ignore>
-    <ignore>/etc/random-seed</ignore>
-    <ignore>/etc/random.seed</ignore>
-    <ignore>/etc/adjtime</ignore>
-    <ignore>/etc/httpd/logs</ignore>
-    <ignore>/etc/utmpx</ignore>
-    <ignore>/etc/wtmpx</ignore>
-    <ignore>/etc/cups/certs</ignore>
-    <ignore>/etc/dumpdates</ignore>
-    <ignore>/etc/svc/volatile</ignore>
-
-    <!-- File types to ignore -->
-    <ignore type="sregex">.log$|.swp$</ignore>
-
-    <!-- Check the file, but never compute the diff -->
-    <nodiff>/etc/ssl/private.key</nodiff>
-
-    <skip_nfs>yes</skip_nfs>
-    <skip_dev>yes</skip_dev>
-    <skip_proc>yes</skip_proc>
-    <skip_sys>yes</skip_sys>
-
-    <!-- Nice value for Syscheck process -->
-    <process_priority>10</process_priority>
-
-    <!-- Maximum output throughput -->
-    <max_eps>50</max_eps>
-
-    <!-- Database synchronization settings -->
-    <synchronization>
-      <enabled>yes</enabled>
-      <interval>5m</interval>
-      <max_eps>10</max_eps>
-    </synchronization>
-  </syscheck>
-
-  <!-- Log analysis -->
-  <localfile>
-    <log_format>command</log_format>
-    <command>df -P</command>
-    <frequency>360</frequency>
-  </localfile>
-
-  <localfile>
-    <log_format>full_command</log_format>
-    <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
-    <alias>netstat listening ports</alias>
-    <frequency>360</frequency>
-  </localfile>
-
-  <localfile>
-    <log_format>full_command</log_format>
-    <command>last -n 20</command>
-    <frequency>360</frequency>
-  </localfile>
-
-  <!-- Active response -->
-  <active-response>
-    <disabled>no</disabled>
-    <ca_store>etc/wpk_root.pem</ca_store>
-    <ca_verification>yes</ca_verification>
-  </active-response>
-
-  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
-  <logging>
-    <log_format>plain</log_format>
-  </logging>
-
-</ossec_config>
-
-<ossec_config>
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/ossec/logs/active-responses.log</location>
-  </localfile>
-
-</ossec_config>
diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml
index ff2c1574..842677e1 100644
--- a/wazuh-agent/docker-compose.yml
+++ b/wazuh-agent/docker-compose.yml
@@ -5,5 +5,3 @@ services:
     restart: always
     environment:
       - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
-    volumes:
-      - ./config/wazuh-agent-conf:/wazuh-config-mount/etc/ossec.conf