Wazuh agent class

$configure_active_response

Enables Active Response on this host.

true

Boolean

$active_response_ca_verification

This option enables or disables the WPK validation using the root CA certificate. If this parameter is set to no, the agent will accept any WPK package from the manager.

yes

String

$wazuh_enrollment_enabled

Enables/disables agent enrollment. If this variable is not set to 'yes ', the complete enrollment tag will not be added to /var/ossec/etc/ossec.conf.

undef

String

$wazuh_enrollment_port

Specifies the port on which the manager will send enrollment requests.

Depends on wazuh_enrollment_enabled

undef

String

$wazuh_enrollment_groups

Group name to which the agent belongs.

Depends on wazuh_enrollment_enabled

undef

String

$wazuh_enrollment_ssl_cipher

Override SSL used ciphers.

Depends on wazuh_enrollment_enabled

undef

String

$wazuh_enrollment_agent_cert_path

Required when agent verification is enabled in the manager.

Depends on wazuh_enrollment_enabled

undef

String

$wazuh_enrollment_auth_pass

Enrollment password.

Depends on wazuh_enrollment_enabled

undef

String

$wazuh_enrollment_auto_method

Auto negotiates the most secure common SSL/TLS method with the manager, use "yes " for auto negotiate or "no " for TLS v1.2 only.

Depends on wazuh_enrollment_enabled

undef

String

$wazuh_enrollment_use_source_ip

Force the manager to compute the IP address from the agent message.

Depends on wazuh_enrollment_enabled

undef

String

$wazuh_reporting_endpoint

Specifies the IP address or the hostname of the Wazuh manager to report.

undef

String

$ossec_port

Specifies the port to send events to the manager. This must match the associated listening port configured on the Wazuh manager.

1514

String

$wazuh_max_retries

The number of connection retries.

5

String

$ossec_notify_time

Specifies the time in seconds between agent check-ins to the manager.

10

String

$ossec_auto_restart

Toggles on and off the automatic restart of agents when a new valid configuration is received from the manager.

yes

String

$client_buffer_queue_size

Sets the capacity of the agent buffer in number of events.

5000

Integer

$ossec_local_files

Files list for log analysis These files are listed in params_agent.pp in section $default_local_files . If a change is needed, it should be modified in the params_agent.pp .

Depends on the OS family.

List

$ossec_rootcheck_disabled

Disable rootcheck on this host (Linux).

no

String

$ossec_rootcheck_check_trojans

Enable rootcheck checktrojans option.

yes

String

$ossec_rootcheck_check_sys

Enable the rootcheck checksys option.

yes

String

$ossec_rootcheck_check_ports

Enable the rootcheck checkports option.

yes

String

$ossec_rootcheck_frequency

How often the rootcheck scan will run (in seconds).

36000

String

$ossec_rootcheck_rootkit_files

Change the location of the rootkit files database.

'/var/ossec/etc/shared/rootkit_files.txt'

String

$ossec_rootcheck_skip_nfs

Enable or disable the scanning of network-mounted filesystems (Works on Linux and FreeBSD). Currently, skip_nfs will exclude checking files on CIFS or NFS mounts.

yes

String

$ossec_rootcheck_windows_disabled

Disables rootcheck if the host has a Windows OS.

no

String

$ossec_rootcheck_windows_windows_malware

Specifies the path to a Windows malware definitions file.

'./shared/win_applications_rcl.txt'

String

$configure_sca

Enables SCA section render on this host.

true

boolean

$sca_amazon_scan_on_start

The SCA module will perform the scan immediately when started (Amazon Linux 2).

Depends on configure_sca and apply_template_os

yes

String

$sca_amazon_skip_nfs

Enable or disable the scanning of network-mounted filesystems (Works on Linux and FreeBSD). Currently, skip_nfs will exclude checking files on CIFS or NFS mounts.

Depends on configure_sca and apply_template_os

yes

String

$sca_rhel_scan_on_start

The SCA module will perform the scan immediately when started (RHEL).

Depends on configure_sca and apply_template_os

yes

String

$sca_rhel_skip_nfs

Enable or disable the scanning of network-mounted filesystems (Works on Linux and FreeBSD). Currently, skip_nfs excludes checking files on CIFS or NFS mounts.

Depends on configure_sca and apply_template_os

yes

String

$sca_else_scan_on_start

The SCA module will perform the scan immediately when started (Linux).

Depends on configure_sca and apply_template_os

yes

String

$sca_else_skip_nfs

Enable or disable the scanning of network-mounted filesystems (Works on Linux and FreeBSD). Currently, skip_nfs excludes checking files on CIFS or NFS mounts.

Depends on configure_sca and apply_template_os

yes

String

$configure_syscheck

Enables syscheck section rendering on this host. If this variable is not set to 'true', the complete syscheck tag will not be added to /var/ossec/etc/ossec.conf.

true

Boolean

$ossec_syscheck_frequency

Enables syscheck section rendering on this host.

43200

String

$ossec_syscheck_auto_ignore

Specifies whether or not syscheck will ignore files that change too many times (manager only).

undef

String

$ossec_syscheck_realtime_directories_1

This will enable real-time/continuous monitoring on directories listed on ossec_syscheck_directories_1 . Real time only works with directories, not individual files.

no

String

$ossec_syscheck_directories_2

List of directories to be monitored. The directories should be comma-separated.

'/etc,/usr/bin,/usr/sbin'

String

$ossec_syscheck_whodata_directories_2

This will enable who-data monitoring on directories listed on ossec_syscheck_directories_2 .

no

String

$ossec_syscheck_ignore_list

List of files or directories to be ignored. Ignored files and directories are still being scanned, but the results are not reported.

['/etc/mtab','/etc/hosts.deny', '/etc/mail/statistics', '/etc/random-seed', '/etc/random.seed', '/etc/adjtime', '/etc/httpd/logs', '/etc/utmpx','/etc/wtmpx', '/etc/cups/certs', '/etc/dumpdates', '/etc/svc/volatile', '/sys/kernel/security', '/sys/kernel/debug', '/dev/core',]

String

$ossec_syscheck_ignore_type_2

Another simple regex pattern to filter out files.

'.log$|.swp$'

String

$ossec_syscheck_synchronization_enabled

Specifies whether there will be periodic inventory synchronizations or not.

yes

String

$ossec_syscheck_synchronization_max_eps

Sets the maximum synchronization message throughput.

10

String

$ossec_syscheck_skip_nfs

Specifies if syscheck should scan network-mounted filesystems. This option works on Linux and FreeBSD systems. Currently, skip_nfs will exclude checking files on CIFS or NFS mounts.

yes

String

$configure_wodle_osquery

Enables the Wodle osquery section rendering on this host. If this variable is not set to 'true ', the complete osquery wodle tag will not be added to /var/ossec/etc/ossec.conf.

true

String

$wodle_osquery_run_daemon

Makes the module run osqueryd as a subprocess or let the module monitor the results log without running Osquery.

yes

String

$wodle_osquery_config_path

Path to the Osquery configuration file. This path can be relative to the folder where the Wazuh agent is running.

'/etc/osquery/osquery.conf'

String

$wodle_syscollector_disabled

Disable the Syscollector wodle.

no

String

$wodle_syscollector_scan_on_start

Run a system scan immediately when the service is started.

yes

String

$wodle_syscollector_os

Enables the scan of the OS.

yes

String

$wodle_syscollector_packages

Enables the scan of the packages.

yes

String

$wodle_syscollector_processes

Enables the scan of the processes.

yes

String

$agent_package_name

Defines the package name using params_agent.pp

wazuh-agent

String

$selinux

Whether to install a SELinux policy to allow rotation of OSSEC logs.

false

Boolean

$manage_repo

Install Wazuh through Wazuh repositories.

true

Boolean

$agent_auth_password

Define a password for agent-auth

undef

String