Merge branch 'devel' into wazuh-release-v3.11.1_7.5.1

cookbooks/wazuh_agent/attributes/localfile.rb

@@ -92,6 +92,12 @@
         'location' => '/var/log/secure'
         }
     },
+    {
+      'content!' => {
+        'log_format' => 'syslog',
+        'location' => '/var/log/maillog'
+        }
+    },
   ]
 else
   raise "Currently platforn not supported yet. Feel free to open an issue on https://www.github.com/wazuh/wazuh-chef if you consider that support for a specific OS should be added"

cookbooks/wazuh_agent/attributes/logging.rb

@@ -0,0 +1 @@
+default['ossec']['conf']['logging']['log_format'] = 'plain'

cookbooks/wazuh_agent/attributes/sca.rb

@@ -2,5 +2,4 @@
 default['ossec']['conf']['sca']['enabled'] = true
 default['ossec']['conf']['sca']['scan_on_start'] = true
 default['ossec']['conf']['sca']['interval'] = "12h"
-default['ossec']['conf']['sca']['skip_nfs'] = true
-default['ossec']['conf']['sca']['policies']['policy'] = [ 'cis_debian_linux_rcl.yml', 'system_audit_rcl.yml', 'system_audit_ssh.yml', 'system_audit_pw.yml']
+default['ossec']['conf']['sca']['skip_nfs'] = true

cookbooks/wazuh_agent/attributes/version.rb

@@ -1 +1,2 @@
-default['wazuh-agent']['version'] = "3.11.1"
+default['wazuh-agent']['version'] = "3.11.1"
+

cookbooks/wazuh_agent/attributes/wodle.rb

@@ -1,10 +1,4 @@
 default['ossec']['conf']['wodle'] = [
-   {   '@name' => 'open-scap',
-        'disabled' => 'yes',
-        'timeout' => '1800',
-        'interval' => '1d',
-        'scan-on-start' => 'yes'
-     },
      {   '@name' => 'cis-cat',
         'disabled' => 'yes',
         'timeout' => '1800',

cookbooks/wazuh_elastic/attributes/kibana.rb

@@ -1,4 +1,4 @@
 default['wazuh-elastic']['kibana_server_host'] = '0.0.0.0'
 default['wazuh-elastic']['kibana_server_port'] = '5601'
 default['wazuh-elastic']['kibana_elasticsearch_server_hosts'] = "http://#{node['wazuh-elastic']['elasticsearch_ip']}:#{node['wazuh-elastic']['elasticsearch_port']}"
-default['wazuh-elastic']['kibana_api_credentials'] = [ { id: "default", url: "http://localhost", port: "55000", user: "foo", password: "bar" } ]
+default['wazuh-elastic']['kibana_wazuh_api_credentials'] = [ { id: "default", url: "http://localhost", port: "55000", user: "foo", password: "bar" } ]

cookbooks/wazuh_elastic/templates/default/wazuh.yml.erb

@@ -124,8 +124,8 @@
 #     user: <user>
 #     password: <password>
 hosts:
-<% if node['wazuh-elastic']['kibana_api_credentials'].length > 0 %>
-<%   node['wazuh-elastic']['kibana_api_credentials'].each do |api| -%>
+<% if node['wazuh-elastic']['kibana_wazuh_api_credentials'].length > 0 %>
+<%   node['wazuh-elastic']['kibana_wazuh_api_credentials'].each do |api| -%>
   - <%= api[:id] %>:
       url: <%= api[:url] %>
       port: <%= api[:port] %>

cookbooks/wazuh_manager/attributes/sca.rb

@@ -2,5 +2,4 @@
 default['ossec']['conf']['sca']['enabled'] = true
 default['ossec']['conf']['sca']['scan_on_start'] = true
 default['ossec']['conf']['sca']['interval'] = "12h"
-default['ossec']['conf']['sca']['skip_nfs'] = true
-default['ossec']['conf']['sca']['policies']['policy'] = [ 'cis_debian_linux_rcl.yml', 'system_audit_rcl.yml', 'system_audit_ssh.yml', 'system_audit_pw.yml']
+default['ossec']['conf']['sca']['skip_nfs'] = true

cookbooks/wazuh_manager/attributes/vulnerability-detector.rb

@@ -0,0 +1,26 @@
+default['ossec']['conf']['vulnerability-detector']['enabled'] = 'no'
+default['ossec']['conf']['vulnerability-detector']['interval'] = '5m'
+default['ossec']['conf']['vulnerability-detector']['ignore_time'] = '6h'
+default['ossec']['conf']['vulnerability-detector']['run_on_start'] = 'yes'
+default['ossec']['conf']['vulnerability-detector']['provider'] = [
+    {   '@name' => 'canonical',
+        'enabled' => 'no',
+        'os' => ['precise', 'trusty', 'xenial', 'bionic'],
+        'update_interval' => '1h'
+    },
+    {   '@name' => 'debian',
+        'enabled' => 'no',
+        'os' => ['wheezy', 'stretch', 'jessie', 'buster'],
+        'update_interval' => '1h'
+    },
+    {   '@name' => 'redhat',
+        'enabled' => 'no',
+        'update_from_year' => '2010',
+        'update_interval' => '1h'
+    },
+    {   '@name' => 'nvd',
+        'enabled' => 'no',
+        'update_from_year' => '2010',
+        'update_interval' => '1h'
+    }
+]

cookbooks/wazuh_manager/attributes/wodle.rb

@@ -30,26 +30,5 @@
         'packages' => 'yes',
         'ports' => { '@all' => 'no', 'content!' => 'yes'},
         'processes' => 'yes'
-     },
-     {   '@name' => 'vulnerability-detector',
-        'disabled' => 'yes',
-        'interval' => '5m',
-        'ignore_time' => '6h',
-        'run_on_start' => 'yes',
-        'feed' => [
-            {   '@name' => "ubuntu-18",
-                'disabled' => "yes",
-                'update_interval' => '1h'
-            },
-            {   '@name' => "redhat",
-                'disabled' => "yes",
-                'update_from_year' => '2010',
-                'update_interval' => '1h'
-            },
-            {   '@name' => "debian-9",
-                'disabled' => "yes",
-                'update_interval' => '1h'
-            }
-        ]
-    }
+     }
 ]