ossec.jinja2

<ossec_config>
  <client>
    <server>
      <address>{{ join_manager_hostname }}</address>
      <port>{{ join_manager_port | default('1514', true) }}</port>
      <protocol>tcp</protocol>
    </server>
    <config-profile>ubuntu, ubuntu20, ubuntu20.04, ubuntu16, ubuntu16.04, centos, windows</config-profile>
    <notify_time>10</notify_time>
    <time-reconnect>30</time-reconnect>
    <auto_restart>yes</auto_restart>
    <crypto_method>aes</crypto_method>
  </client>

  <client_buffer>
    <!-- Agent buffer options -->
    <disabled>no</disabled>
    <queue_size>5000</queue_size>
    <events_per_second>500</events_per_second>
  </client_buffer>

  <!-- Policy monitoring -->
  <rootcheck>
    <disabled>no</disabled>
    <check_files>yes</check_files>
    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
    <check_ports>yes</check_ports>
    <check_if>yes</check_if>

    <!-- Frequency that rootcheck is executed - every 12 hours -->
    <frequency>43200</frequency>

    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>

    <skip_nfs>yes</skip_nfs>

  </rootcheck>

  <wodle name="docker-listener">
    <disabled>yes</disabled>
    <attempts>10</attempts>
    <run_on_start>yes</run_on_start>
    <interval>5m</interval>
  </wodle>

  <wodle name="open-scap">
    <disabled>no</disabled>
    <timeout>1800</timeout>
    <interval>1d</interval>
    <scan-on-start>yes</scan-on-start>

    <content type="xccdf" path="ssg-centos-7-ds.xml">
      <profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
      <profile>xccdf_org.ssgproject.content_profile_common</profile>
    </content>
  </wodle>

  <wodle name="cis-cat">
    <disabled>no</disabled>
    <timeout>600</timeout>
    <interval>15m</interval>
    <scan-on-start>yes</scan-on-start>

    <java_path>/usr/lib/jvm/java-1.8.0-openjdk-amd64/jre/bin</java_path>
    <ciscat_path>wodles/ciscat</ciscat_path>

    <content type="xccdf" path="benchmarks/CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-xccdf.xml">
      <profile>xccdf_org.cisecurity.benchmarks_profile_Level_2_-_Server</profile>
    </content>

  </wodle>

  <!-- Virustotal inegration -->
  <integration>
    <name>virustotal</name>
    <api_key>{{ virus_total_key }}</api_key> <!-- Replace with your VirusTotal API key -->
    <group>syscheck</group>
    <alert_format>json</alert_format>
  </integration>

  <!-- System inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports all="no">yes</ports>
    <processes>yes</processes>
  </wodle>

  <sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
    <skip_nfs>yes</skip_nfs>
  </sca>
  <!-- File integrity monitoring -->
  <syscheck>
    <disabled>no</disabled>

    <!-- Frequency that syscheck is executed default every 12 hours -->
    <frequency>43200</frequency>

    <scan_on_start>yes</scan_on_start>

    <!-- Directories to check  (perform all possible verifications) -->
    <directories>/rootfs/etc,/rootfs/usr/bin,/rootfs/usr/sbin</directories>
    <directories>/rootfs/bin,/rootfs/sbin,/rootfs/boot</directories>
    <directories check_all="yes" realtime="yes">/rootfs/media/user/software</directories>
    <directories check_all="yes" realtime="yes">/rootfs/home</directories>
    <directories check_all="yes" realtime="yes">/rootfs/etc</directories>
     <!-- enable auditd whodata -->
    <directories check_all="yes" whodata="yes">/rootfs/etc,/rootfs/usr/bin,/rootfs/usr/sbin</directories>

    <!-- Files/directories to ignore -->
    <ignore>/dev/</ignore>
    <ignore>/usr/</ignore>
    <ignore>/bin/</ignore>
    <ignore>/rootfs/etc/mtab</ignore>
    <ignore>/rootfs/etc/hosts.deny</ignore>
    <ignore>/rootfs/etc/mail/statistics</ignore>
    <ignore>/rootfs/etc/random-seed</ignore>
    <ignore>/rootfs/etc/random.seed</ignore>
    <ignore>/rootfs/etc/adjtime</ignore>
    <ignore>/rootfs/etc/httpd/logs</ignore>
    <ignore>/rootfs/etc/utmpx</ignore>
    <ignore>/rootfs/etc/wtmpx</ignore>
    <ignore>/rootfs/etc/cups/certs</ignore>
    <ignore>/rootfs/etc/dumpdates</ignore>
    <ignore>/rootfs/etc/svc/volatile</ignore>

    <!-- File types to ignore -->
    <ignore type="sregex">.log$|.swp$</ignore>

    <!-- Check the file, but never compute the diff -->
    <nodiff>/rootfs/etc/ssl/private.key</nodiff>

    <skip_nfs>yes</skip_nfs>
    <skip_dev>yes</skip_dev>
    <skip_proc>yes</skip_proc>
    <skip_sys>yes</skip_sys>

    <!-- Nice value for Syscheck process -->
    <process_priority>10</process_priority>

    <!-- Maximum output throughput -->
    <max_eps>100</max_eps>

    <!-- Database synchronization settings -->
    <synchronization>
      <enabled>yes</enabled>
      <interval>5m</interval>
      <max_interval>1h</max_interval>
      <max_eps>10</max_eps>
    </synchronization>

    <!-- Maximum number of files to be monitored -->
    <file_limit>
        <enabled>no</enabled>
        <entries>1000000</entries>
    </file_limit>
  </syscheck>

  <!-- Log analysis -->

  <localfile>
    <log_format>audit</log_format>
    <location>/rootfs/var/log/audit/audit.log</location>
  </localfile>

  <localfile>
    <log_format>apache</log_format>
    <location>/rootfs/var/log/nginx/access.log</location>
  </localfile>

  <localfile>
    <log_format>apache</log_format>
    <location>/rootfs/var/log/nginx/error.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/rootfs/var/ossec/logs/active-responses.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/rootfs/var/log/auth.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/rootfs/var/log/syslog</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/rootfs/var/log/dpkg.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/rootfs/var/log/kern.log</location>
  </localfile>

  <localfile>
    <log_format>command</log_format>
    <command>df -P</command>
    <frequency>360</frequency>
  </localfile>

  <localfile>
    <log_format>full_command</log_format>
    <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
    <alias>netstat listening ports</alias>
    <frequency>360</frequency>
  </localfile>

  <localfile>
    <log_format>full_command</log_format>
    <command>last -n 20 -f /rootfs/var/log/wtmp</command>
    <frequency>360</frequency>
  </localfile>

  <localfile>
      <location>/rootfs/var/log/*.log</location>
      <log_format>syslog</log_format>
  </localfile>

  <!-- Active response -->
  <active-response>
    <disabled>no</disabled>
    <ca_store>/var/ossec/etc/wpk_root.pem</ca_store>
    <ca_verification>yes</ca_verification>
  </active-response>

  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
  <logging>
    <log_format>plain</log_format>
  </logging>

</ossec_config>