diff --git a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml index e08b891d9..32c8bdcc0 100644 --- a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml @@ -281,10 +281,10 @@ wazuh_agent_config: - format: 'syslog' location: '/var/ossec/logs/active-responses.log' - format: 'command' - command: 'df -P' + command: df -P -x squashfs -x tmpfs -x devtmpfs frequency: '360' - format: 'full_command' - command: netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d + command: ss -nutal | awk '{print $1,$5,$6;}' | sort -b | column -t alias: 'netstat listening ports' frequency: '360' - format: 'full_command' diff --git a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-local-internal-options.conf.j2 b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-local-internal-options.conf.j2 index 6e3c86a84..81979e595 100644 --- a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-local-internal-options.conf.j2 +++ b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-local-internal-options.conf.j2 @@ -10,3 +10,7 @@ # This is the template of Ansible for the file local_internal_options.conf # In this file you could include the configuration settings for your agents + +# Logcollector - If it should accept remote commands from the manager +logcollector.remote_commands=1 + diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index b9817a3a8..71796d9d2 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -183,10 +183,10 @@ wazuh_manager_config: localfiles: common: - format: 'command' - command: 'df -P' + command: df -P -x squashfs -x tmpfs -x devtmpfs frequency: '360' - format: 'full_command' - command: netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d + command: ss -nutal | awk '{print $1,$5,$6;}' | sort -b | column -t alias: 'netstat listening ports' frequency: '360' - format: 'full_command' diff --git a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 index 71201e925..7fa9dad4e 100644 --- a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 +++ b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 @@ -11,11 +11,7 @@ {{ wazuh_manager_config.alerts_log }} {{ wazuh_manager_config.logall }} {{ wazuh_manager_config.logall_json }} - {% if wazuh_manager_config.email_notification | lower == "yes" %} - yes - {% else %} - no - {% endif %} + {{ wazuh_manager_config.email_notification }} {% for to in wazuh_manager_config.mail_to %} {{ to }} {% endfor %}