mirror of
https://github.com/wazuh/wazuh-docker.git
synced 2025-10-23 06:11:57 +00:00
Add wazuh agent image build and deploy
This commit is contained in:
vcerenu
194
wazuh-agent/config/wazuh-agent-conf
Normal file
194
wazuh-agent/config/wazuh-agent-conf
Normal file
@@ -0,0 +1,194 @@
|
||||
<!--
|
||||
Wazuh - Agent - Default configuration for amzn 2023
|
||||
More info at: https://documentation.wazuh.com
|
||||
Mailing list: https://groups.google.com/forum/#!forum/wazuh
|
||||
-->
|
||||
|
||||
<ossec_config>
|
||||
<client>
|
||||
<server>
|
||||
<address>CHANGE_MANAGER_IP</address>
|
||||
<port>CHANGE_MANAGER_PORT</port>
|
||||
<protocol>tcp</protocol>
|
||||
</server>
|
||||
<config-profile>amzn, amzn2023</config-profile>
|
||||
<notify_time>10</notify_time>
|
||||
<time-reconnect>60</time-reconnect>
|
||||
<auto_restart>yes</auto_restart>
|
||||
<crypto_method>aes</crypto_method>
|
||||
<enrollment>
|
||||
<enabled>yes</enabled>
|
||||
<manager_address>CHANGE_ENROLL_IP</manager_address>
|
||||
<port>CHANGE_ENROLL_PORT</port>
|
||||
<agent_name>CHANGEE_AGENT_NAME</agent_name>
|
||||
<authorization_pass_path>etc/authd.pass</authorization_pass_path>
|
||||
</enrollment>
|
||||
</client>
|
||||
|
||||
<client_buffer>
|
||||
<!-- Agent buffer options -->
|
||||
<disabled>no</disabled>
|
||||
<queue_size>5000</queue_size>
|
||||
<events_per_second>500</events_per_second>
|
||||
</client_buffer>
|
||||
|
||||
<!-- Policy monitoring -->
|
||||
<rootcheck>
|
||||
<disabled>no</disabled>
|
||||
<check_files>yes</check_files>
|
||||
<check_trojans>yes</check_trojans>
|
||||
<check_dev>yes</check_dev>
|
||||
<check_sys>yes</check_sys>
|
||||
<check_pids>yes</check_pids>
|
||||
<check_ports>yes</check_ports>
|
||||
<check_if>yes</check_if>
|
||||
|
||||
<!-- Frequency that rootcheck is executed - every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<rootkit_files>etc/shared/rootkit_files.txt</rootkit_files>
|
||||
<rootkit_trojans>etc/shared/rootkit_trojans.txt</rootkit_trojans>
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
|
||||
<ignore>/var/lib/containerd</ignore>
|
||||
<ignore>/var/lib/docker/overlay2</ignore>
|
||||
</rootcheck>
|
||||
|
||||
<wodle name="cis-cat">
|
||||
<disabled>yes</disabled>
|
||||
<timeout>1800</timeout>
|
||||
<interval>1d</interval>
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
|
||||
<java_path>wodles/java</java_path>
|
||||
<ciscat_path>wodles/ciscat</ciscat_path>
|
||||
</wodle>
|
||||
|
||||
<!-- Osquery integration -->
|
||||
<wodle name="osquery">
|
||||
<disabled>yes</disabled>
|
||||
<run_daemon>yes</run_daemon>
|
||||
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
|
||||
<config_path>/etc/osquery/osquery.conf</config_path>
|
||||
<add_labels>yes</add_labels>
|
||||
</wodle>
|
||||
|
||||
<!-- System inventory -->
|
||||
<wodle name="syscollector">
|
||||
<disabled>no</disabled>
|
||||
<interval>1h</interval>
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
<hardware>yes</hardware>
|
||||
<os>yes</os>
|
||||
<network>yes</network>
|
||||
<packages>yes</packages>
|
||||
<ports all="no">yes</ports>
|
||||
<processes>yes</processes>
|
||||
|
||||
<!-- Database synchronization settings -->
|
||||
<synchronization>
|
||||
<max_eps>10</max_eps>
|
||||
</synchronization>
|
||||
</wodle>
|
||||
|
||||
<sca>
|
||||
<enabled>yes</enabled>
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
<interval>12h</interval>
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
</sca>
|
||||
|
||||
<!-- File integrity monitoring -->
|
||||
<syscheck>
|
||||
<disabled>no</disabled>
|
||||
|
||||
<!-- Frequency that syscheck is executed default every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
|
||||
<!-- Directories to check (perform all possible verifications) -->
|
||||
<directories>/etc,/usr/bin,/usr/sbin</directories>
|
||||
<directories>/bin,/sbin,/boot</directories>
|
||||
|
||||
<!-- Files/directories to ignore -->
|
||||
<ignore>/etc/mtab</ignore>
|
||||
<ignore>/etc/hosts.deny</ignore>
|
||||
<ignore>/etc/mail/statistics</ignore>
|
||||
<ignore>/etc/random-seed</ignore>
|
||||
<ignore>/etc/random.seed</ignore>
|
||||
<ignore>/etc/adjtime</ignore>
|
||||
<ignore>/etc/httpd/logs</ignore>
|
||||
<ignore>/etc/utmpx</ignore>
|
||||
<ignore>/etc/wtmpx</ignore>
|
||||
<ignore>/etc/cups/certs</ignore>
|
||||
<ignore>/etc/dumpdates</ignore>
|
||||
<ignore>/etc/svc/volatile</ignore>
|
||||
|
||||
<!-- File types to ignore -->
|
||||
<ignore type="sregex">.log$|.swp$</ignore>
|
||||
|
||||
<!-- Check the file, but never compute the diff -->
|
||||
<nodiff>/etc/ssl/private.key</nodiff>
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
<skip_dev>yes</skip_dev>
|
||||
<skip_proc>yes</skip_proc>
|
||||
<skip_sys>yes</skip_sys>
|
||||
|
||||
<!-- Nice value for Syscheck process -->
|
||||
<process_priority>10</process_priority>
|
||||
|
||||
<!-- Maximum output throughput -->
|
||||
<max_eps>50</max_eps>
|
||||
|
||||
<!-- Database synchronization settings -->
|
||||
<synchronization>
|
||||
<enabled>yes</enabled>
|
||||
<interval>5m</interval>
|
||||
<max_eps>10</max_eps>
|
||||
</synchronization>
|
||||
</syscheck>
|
||||
|
||||
<!-- Log analysis -->
|
||||
<localfile>
|
||||
<log_format>command</log_format>
|
||||
<command>df -P</command>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<localfile>
|
||||
<log_format>full_command</log_format>
|
||||
<command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
|
||||
<alias>netstat listening ports</alias>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<localfile>
|
||||
<log_format>full_command</log_format>
|
||||
<command>last -n 20</command>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<!-- Active response -->
|
||||
<active-response>
|
||||
<disabled>no</disabled>
|
||||
<ca_store>etc/wpk_root.pem</ca_store>
|
||||
<ca_verification>yes</ca_verification>
|
||||
</active-response>
|
||||
|
||||
<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
|
||||
<logging>
|
||||
<log_format>plain</log_format>
|
||||
</logging>
|
||||
|
||||
</ossec_config>
|
||||
|
||||
<ossec_config>
|
||||
<localfile>
|
||||
<log_format>syslog</log_format>
|
||||
<location>/var/ossec/logs/active-responses.log</location>
|
||||
</localfile>
|
||||
|
||||
</ossec_config>
|
||||
11
wazuh-agent/docker-compose.yml
Normal file
11
wazuh-agent/docker-compose.yml
Normal file
@@ -0,0 +1,11 @@
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh.agent:
|
||||
image: wazuh/wazuh-agent:4.10.1
|
||||
restart: always
|
||||
environment:
|
||||
- WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
|
||||
volumes:
|
||||
- ./config/wazuh-agent-conf:/wazuh-config-mount/etc/ossec.conf
|
||||
Reference in New Issue
Block a user