linux.conf

Configuração do grupo de agentes Linux, aplicada em /var/ossec/etc/shared/linux/agent.conf.

<!--
  Wazuh 4.14.4 - Grupo de agentes "linux"
  Destino no manager: /var/ossec/etc/shared/linux/agent.conf
  Criar grupo antes: /var/ossec/bin/agent_groups -a -g linux
  Atribuir agente: /var/ossec/bin/agent_groups -a -i <id_agente> -g linux
-->
<agent_config>

  <localfile>
    <location>/var/log/auth.log</location>
    <log_format>syslog</log_format>
  </localfile>

  <localfile>
    <location>/var/log/secure</location>
    <log_format>syslog</log_format>
  </localfile>

  <localfile>
    <location>/var/log/syslog</location>
    <log_format>syslog</log_format>
  </localfile>

  <localfile>
    <location>/var/log/messages</location>
    <log_format>syslog</log_format>
  </localfile>

  <localfile>
    <location>/var/log/dpkg.log</location>
    <log_format>syslog</log_format>
  </localfile>

  <localfile>
    <location>/var/log/yum.log</location>
    <log_format>syslog</log_format>
  </localfile>

  <!-- File Integrity Monitoring -->
  <syscheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
    <scan_on_start>yes</scan_on_start>

    <directories check_all="yes" realtime="yes">/etc</directories>
    <directories check_all="yes" realtime="yes">/usr/bin,/usr/sbin</directories>
    <directories check_all="yes" realtime="yes">/bin,/sbin,/boot</directories>

    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore>/etc/random-seed</ignore>
    <ignore>/etc/adjtime</ignore>
    <ignore type="sregex">.log$|.swp$</ignore>
  </syscheck>

  <!-- Security Configuration Assessment -->
  <sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
  </sca>

  <rootcheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
  </rootcheck>

  <!-- Auditd (necessario auditd instalado e rodando no host) -->
  <wodle name="audit">
    <disabled>no</disabled>
    <audit_key>wazuh_fim</audit_key>
    <startup_healthcheck>no</startup_healthcheck>
  </wodle>

  <!-- Inventário -->
  <wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports all="no">yes</ports>
    <processes>yes</processes>
  </wodle>

</agent_config>