Skip to content

windows.conf

Configuração do grupo de agentes Windows, aplicada em /var/ossec/etc/shared/windows/agent.conf.

<!--
  Wazuh 4.14.4 - Grupo de agentes "windows"
  Destino no manager: /var/ossec/etc/shared/windows/agent.conf
  Criar grupo antes: /var/ossec/bin/agent_groups -a -g windows
  Atribuir agente: /var/ossec/bin/agent_groups -a -i <id_agente> -g windows
-->
<agent_config>

  <!-- Event Channels essenciais -->
  <localfile>
    <location>Application</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <localfile>
    <location>Security</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <localfile>
    <location>System</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <!-- Sysmon (requer Sysmon instalado no host) -->
  <localfile>
    <location>Microsoft-Windows-Sysmon/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <!-- PowerShell logging (requer Script Block Logging habilitado via GPO) -->
  <localfile>
    <location>Microsoft-Windows-PowerShell/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <localfile>
    <location>Windows PowerShell</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <!-- Windows Defender -->
  <localfile>
    <location>Microsoft-Windows-Windows Defender/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <!-- File Integrity Monitoring -->
  <syscheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
    <scan_on_start>yes</scan_on_start>

    <directories check_all="yes" realtime="yes">C:\Windows\System32\drivers\etc</directories>
    <directories check_all="yes" realtime="yes">C:\Windows\System32\config</directories>
    <directories check_all="yes">C:\Program Files</directories>
    <directories check_all="yes">C:\Program Files (x86)</directories>
    <directories check_all="yes" realtime="yes">C:\Users\Public</directories>

    <ignore>C:\Windows\Temp</ignore>
    <ignore>C:\Windows\WinSxS</ignore>

    <windows_audit_interval>3600</windows_audit_interval>
  </syscheck>

  <!-- Security Configuration Assessment -->
  <sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
  </sca>

  <rootcheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
  </rootcheck>

  <!-- Inventário (osquery/syscollector) -->
  <wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports all="no">yes</ports>
    <processes>yes</processes>
  </wodle>

</agent_config>