This is the documentation for Wazuh 3.1. Check out the docs for the latest version of Wazuh!

global

XML section name

<global>
</global>

Global configuration generally applies to features that affect the system as a whole, rather than a specific component.

Options

alerts_log

This toggles the writing of alerts to /var/ossec/logs/alerts/alerts.log.

Default value yes
Allowed values yes, no

Warning

Disabling JSON and plain text formated alerts simultaneously is not compatible with the integrator, syslog client or email features.

email_notification

This toggles the use of email alerting.

Default value no
Allowed values yes, no

email_to

This specifies the email recipient for alerts.

Note

A base configuration must be included in the section in order to use granular email configurations, .

Default value n/a
Allowed values Any valid email address

This section will only allow for one email address, but the section can be repeated for each email address you would wish include.

email_from

This specifies the “source” address contained in the email alerts.

Default value n/a
Allowed values Any valid email address

email_reply_to

This specifies the “reply-to” address contained in the email alerts.

Default value n/a
Allowed values Any valid email address

smtp_server

In this option defines what SMTP server to use to deliver alerts.

Default value n/a
Allowed values
  • Valid hostname or IP address.
  • Full path to a sendmail-like executable.

email_maxperhour

This sets the maximum number of email alerts that can be sent per hour. All emails beyond this hourly threshold are then queued to be sent together in a single email at the end of the hour.

Note

At the end of the hour, the queued emails will be sent together in one email whether mail grouping is turned on or not.

Default value 12
Allowed values Any number from 1 to 9999

email_idsname

The name will be added to the email headers with the specified value.

Default value n/a
Allowed values Any name

custom_alert_output

The values below may be used with this option to specify the format of the alerts that are written to alerts.log:

Variable name Description
$TIMESTAMP The time the event was processed by OSSEC.
$FTELL Unknown
$RULEALERT Unknown
$HOSTNAME Hostname of the system generating the event.
$LOCATION The file the log messages were saved to.
$RULEID The rule id of the alert.
$RULELEVEL The rule level of the alert.
$RULECOMMENT Unknown
$SRCIP The source IP specified in the log message.
$DSTUSER The destination user specified in the log message.
$FULLLOG The original log message.
$RULEGROUP The group containing the rule.

stats

This sets the severity level for events that are generated by statistical analysis.

Default value 8
Allowed values Any level from 0 to 16

logall

This toggles whether to store events even when they do not trip a rule with results written to /var/ossec/logs/archives/archives.log.

Default value no
Allowed values yes, no

memory_size

This sets the memory size for the event correlation engine.

Default value 1024
Allowed values Any size from 16 to 5096

white_list

This designates IP addresses that should never be blocked with an active response and, though only one IP address can be included in this section, you may repeat this as many times as needed to include additional IP addresses.

Default value n/a
Allowed values Any IP address or netblock

Note

This option is only valid in server and local installs.

host_information

This sets the severity level for events generated by the host change monitor.

Default value 8
Allowed values Can be used any level from 0 to 16

jsonout_output

This toggles the writing of JSON-formated alerts to /var/ossec/logs/alerts/alerts.json which would include the same events that would be sent to alerts.log, only in JSON format.

Default value no
Allowed values yes, no

prelude_output

This toggles Prelude output.

Default value yes
Allowed values yes, no

zeromq_output

This enables ZeroMQ output.

Default value n/a
Allowed values yes, no

zeromq_uri

This specifies the ZeroMQ URI for the publisher socket to bind to.

Default value n/a
Allowed values This URI format is defined by the ZeroMQ project.

For example:

This will listen for ZeroMQ subscribers on IP address 127.0.0.1:11111.

<zeromq_uri>tcp://localhost:11111/</zeromq_uri>

This will listen on port 21212 for ZeroMQ subscribers, binding to the IP address assigned to eth0.

<zeromq_uri>tcp://eth0:21212/</zeromq_uri>

This will listen for zeromq on the Unix Domain socket /alerts-zmq.

<zeromq_uri>ipc:///alerts-zmq</zeromq_uri>

geoip_db_path

This indicates the full path of the MaxMind GeoIP IPv4 database file.

Default value n/a
Allowed values Path to the GeoIP IPv4 database file location

For example:

<geoip_db_path>/etc/GeoLiteCity.dat</geoip_db_path>

rotate_interval

New in version 3.1.0.

This sets the interval between file rotation with min_rotate_interval the highest allowed value.

Default value 0 (disabled)
Allowed values A positive number that should ends with character indicating a time unit, such as, s (seconds), m (minutes), h (hours), d (days).

Example

<rotate_interval>10h</rotate_interval>

max_output_size

New in version 3.1.0.

This sets the size limit of alert files with a maximum allowed value of 1TiB.

Default value 0 (disabled)
Allowed values A positive number that should contain a suffix character indicating a size unit, such as, B (bytes), K (kibibyte), M (mebibyte), G (gibibyte), T (tebibyte).

Example

<max_output_size>20M</max_output_size>

Default configuration

<global>
  <jsonout_output>yes</jsonout_output>
  <alerts_log>yes</alerts_log>
  <logall>no</logall>
  <logall_json>no</logall_json>
  <email_notification>yes</email_notification>
  <smtp_server>smtp.example.wazuh.com</smtp_server>
  <email_from>ossecm@example.wazuh.com</email_from>
  <email_to>recipient@example.wazuh.com</email_to>
  <email_maxperhour>12</email_maxperhour>
</global>