active-response
The <active-response> section controls Active Response behavior on the Wazuh agent. Use this section to enable or disable Active Response and configure increasing timeout periods for repeated offenders.
Options
disabled
Enables or disables Active Response on the Wazuh agent. Set this option to yes to prevent the agent from executing Active Response commands.
If you omit this option, Active Response is enabled. The <ca_store> and <ca_verification> options that the installer writes in this section are accepted for compatibility with Wazuh 4.x. Configure them in agent-upgrade instead.
Allowed values |
yes, no |
repeated_offenders
Defines increasing timeout periods for repeated offenders. Specify a comma-separated list of up to five values in increasing order.
The timeout configured on the Wazuh manager applies to the first occurrence. The values configured here apply to subsequent occurrences.
Default value |
n/a |
Allowed values |
A positive number (minutes) |
Note
Configure this option directly in the agent's ossec.conf file. It cannot be distributed through agent.conf and is not supported on Windows agents.
Sample Configuration
<active-response>
<disabled>no</disabled>
<repeated_offenders>1,5,10</repeated_offenders>
</active-response>