yes yes no no no smtp.example.wazuh.com wazuh@example.wazuh.com recipient@example.wazuh.com 12 alerts.log 3 12 plain secure 1514 tcp 131072 no yes yes yes yes yes yes yes 43200 /var/ossec/etc/rootcheck/rootkit_files.txt /var/ossec/etc/rootcheck/rootkit_trojans.txt yes yes 1800 1d yes wodles/java wodles/ciscat yes yes /var/log/osquery/osqueryd.results.log /etc/osquery/osquery.conf yes no 1h yes yes yes yes yes yes yes yes yes 12h yes no 5m yes no trusty xenial bionic focal 1h no stretch buster 1h no 5 6 7 8 1h yes 1h yes 2010 1h no 43200 yes yes no /etc,/usr/bin,/usr/sbin /bin,/sbin,/boot /etc/mtab /etc/hosts.deny /etc/mail/statistics /etc/random-seed /etc/random.seed /etc/adjtime /etc/httpd/logs /etc/utmpx /etc/wtmpx /etc/cups/certs /etc/dumpdates /etc/svc/volatile .log$|.swp$ /etc/ssl/private.key yes yes yes yes 10 100 yes 5m 1h 10 127.0.0.1 ^localhost.localdomain$ 4.3.0.1 4.3.0.2 208.67.220.220 disable-account disable-account.sh user yes restart-ossec restart-ossec.sh firewall-drop firewall-drop.sh srcip yes host-deny host-deny.sh srcip yes route-null route-null.sh srcip yes win_route-null route-null.cmd srcip yes win_route-null-2012 route-null-2012.cmd srcip yes netsh netsh.cmd srcip yes netsh-win-2016 netsh-win-2016.cmd srcip yes command df -P 360 full_command netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d netstat listening ports 360 full_command last -n 20 360 ruleset/decoders ruleset/rules 0215-policy_rules.xml etc/lists/audit-keys etc/lists/amazon/aws-eventnames etc/lists/security-eventchannel etc/decoders etc/rules no 1515 no yes 0 yes no yes HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH no /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key no wazuh worker01 worker c98b6ha9b6169zc5f67rae55ae4z5647 1516 0.0.0.0 wazuh.master no no syslog /var/ossec/logs/active-responses.log