#######################################################################
# ConfigMap to easily change values in the ossec.conf file without
# having to create a custom Docker image
#######################################################################

apiVersion: v1
kind: ConfigMap
metadata:
  name: wazuh-manager-worker-0-conf
  namespace: wazuh
data:
  # /var/ossec/etc-template/ossec.conf
  ossec.conf: |-
    <!--
      Wazuh - Manager - Default configuration for ubuntu 16.04
      More info at: https://documentation.wazuh.com
      Mailing list: https://groups.google.com/forum/#!forum/wazuh

      Customization: TCP on port 1514
      Customization: Cluster mode enabled, worker node
    -->
    <ossec_config>
      <global>
        <jsonout_output>yes</jsonout_output>
        <alerts_log>yes</alerts_log>
        <logall>no</logall>
        <logall_json>no</logall_json>
        <email_notification>no</email_notification>
        <smtp_server>smtp.example.wazuh.com</smtp_server>
        <email_from>ossecm@example.wazuh.com</email_from>
        <email_to>recipient@example.wazuh.com</email_to>
        <email_maxperhour>12</email_maxperhour>
        <queue_size>131072</queue_size>
      </global>

      <alerts>
        <log_alert_level>3</log_alert_level>
        <email_alert_level>12</email_alert_level>
      </alerts>

      <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
      <logging>
        <log_format>plain</log_format>
      </logging>

      <remote>
        <connection>secure</connection>
        <port>1514</port>
        <protocol>tcp</protocol>
        <queue_size>131072</queue_size>
      </remote>

      <!-- Policy monitoring -->
      <rootcheck>
        <disabled>no</disabled>
        <check_unixaudit>yes</check_unixaudit>
        <check_files>yes</check_files>
        <check_trojans>yes</check_trojans>
        <check_dev>yes</check_dev>
        <check_sys>yes</check_sys>
        <check_pids>yes</check_pids>
        <check_ports>yes</check_ports>
        <check_if>yes</check_if>

        <!-- Frequency that rootcheck is executed - every 12 hours -->
        <frequency>43200</frequency>

        <rootkit_files>/var/ossec/etc/rootcheck/rootkit_files.txt</rootkit_files>
        <rootkit_trojans>/var/ossec/etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>

        <system_audit>/var/ossec/etc/rootcheck/system_audit_rcl.txt</system_audit>
        <system_audit>/var/ossec/etc/rootcheck/system_audit_ssh.txt</system_audit>

        <skip_nfs>yes</skip_nfs>
      </rootcheck>

      <wodle name="open-scap">
        <disabled>yes</disabled>
        <timeout>1800</timeout>
        <interval>1d</interval>
        <scan-on-start>yes</scan-on-start>
      </wodle>

      <wodle name="cis-cat">
        <disabled>yes</disabled>
        <timeout>1800</timeout>
        <interval>1d</interval>
        <scan-on-start>yes</scan-on-start>

        <java_path>wodles/java</java_path>
        <ciscat_path>wodles/ciscat</ciscat_path>
      </wodle>

      <!-- Osquery integration -->
      <wodle name="osquery">
        <disabled>yes</disabled>
        <run_daemon>yes</run_daemon>
        <log_path>/var/log/osquery/osqueryd.results.log</log_path>
        <config_path>/etc/osquery/osquery.conf</config_path>
        <add_labels>yes</add_labels>
      </wodle>

      <!-- System inventory -->
      <wodle name="syscollector">
        <disabled>no</disabled>
        <interval>1h</interval>
        <scan_on_start>yes</scan_on_start>
        <hardware>yes</hardware>
        <os>yes</os>
        <network>yes</network>
        <packages>yes</packages>
        <ports all="no">yes</ports>
        <processes>yes</processes>
      </wodle>

      <wodle name="vulnerability-detector">
        <disabled>yes</disabled>
        <interval>1m</interval>
        <run_on_start>yes</run_on_start>
        <feed name="ubuntu-18">
          <disabled>yes</disabled>
          <update_interval>1h</update_interval>
        </feed>
        <feed name="redhat-7">
          <disabled>yes</disabled>
          <update_interval>1h</update_interval>
        </feed>
        <feed name="debian-9">
          <disabled>yes</disabled>
          <update_interval>1h</update_interval>
        </feed>
      </wodle>

      <!-- File integrity monitoring -->
      <syscheck>
        <disabled>no</disabled>

        <!-- Frequency that syscheck is executed default every 12 hours -->
        <frequency>43200</frequency>

        <scan_on_start>yes</scan_on_start>

        <!-- Generate alert when new file detected -->
        <alert_new_files>yes</alert_new_files>

        <!-- Don't ignore files that change more than 'frequency' times -->
        <auto_ignore frequency="10" timeframe="3600">no</auto_ignore>

        <!-- Directories to check  (perform all possible verifications) -->
        <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
        <directories check_all="yes">/bin,/sbin,/boot</directories>

        <!-- Files/directories to ignore -->
        <ignore>/etc/mtab</ignore>
        <ignore>/etc/hosts.deny</ignore>
        <ignore>/etc/mail/statistics</ignore>
        <ignore>/etc/random-seed</ignore>
        <ignore>/etc/random.seed</ignore>
        <ignore>/etc/adjtime</ignore>
        <ignore>/etc/httpd/logs</ignore>
        <ignore>/etc/utmpx</ignore>
        <ignore>/etc/wtmpx</ignore>
        <ignore>/etc/cups/certs</ignore>
        <ignore>/etc/dumpdates</ignore>
        <ignore>/etc/svc/volatile</ignore>
        <ignore>/sys/kernel/security</ignore>
        <ignore>/sys/kernel/debug</ignore>

        <!-- Check the file, but never compute the diff -->
        <nodiff>/etc/ssl/private.key</nodiff>

        <skip_nfs>yes</skip_nfs>

        <!-- Remove not monitored files -->
        <remove_old_diff>yes</remove_old_diff>

        <!-- Allow the system to restart Auditd after installing the plugin -->
        <restart_audit>yes</restart_audit>
      </syscheck>

      <!-- Active response -->
      <global>
        <white_list>127.0.0.1</white_list>
        <white_list>^localhost.localdomain$</white_list>
        <white_list>10.66.0.2</white_list>
      </global>

      <command>
        <name>disable-account</name>
        <executable>disable-account.sh</executable>
        <expect>user</expect>
        <timeout_allowed>yes</timeout_allowed>
      </command>

      <command>
        <name>restart-ossec</name>
        <executable>restart-ossec.sh</executable>
        <expect></expect>
      </command>

      <command>
        <name>firewall-drop</name>
        <executable>firewall-drop.sh</executable>
        <expect>srcip</expect>
        <timeout_allowed>yes</timeout_allowed>
      </command>

      <command>
        <name>host-deny</name>
        <executable>host-deny.sh</executable>
        <expect>srcip</expect>
        <timeout_allowed>yes</timeout_allowed>
      </command>

      <command>
        <name>route-null</name>
        <executable>route-null.sh</executable>
        <expect>srcip</expect>
        <timeout_allowed>yes</timeout_allowed>
      </command>

      <command>
        <name>win_route-null</name>
        <executable>route-null.cmd</executable>
        <expect>srcip</expect>
        <timeout_allowed>yes</timeout_allowed>
      </command>

      <command>
        <name>win_route-null-2012</name>
        <executable>route-null-2012.cmd</executable>
        <expect>srcip</expect>
        <timeout_allowed>yes</timeout_allowed>
      </command>

      <command>
        <name>netsh</name>
        <executable>netsh.cmd</executable>
        <expect>srcip</expect>
        <timeout_allowed>yes</timeout_allowed>
      </command>

      <command>
        <name>netsh-win-2016</name>
        <executable>netsh-win-2016.cmd</executable>
        <expect>srcip</expect>
        <timeout_allowed>yes</timeout_allowed>
      </command>

      <!--
      <active-response>
        active-response options here
      </active-response>
      -->

      <!-- Log analysis -->
      <localfile>
        <log_format>command</log_format>
        <command>df -P</command>
        <frequency>360</frequency>
      </localfile>

      <localfile>
        <log_format>full_command</log_format>
        <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
        <alias>netstat listening ports</alias>
        <frequency>360</frequency>
      </localfile>

      <localfile>
        <log_format>full_command</log_format>
        <command>last -n 20</command>
        <frequency>360</frequency>
      </localfile>

      <ruleset>
        <!-- Default ruleset -->
        <decoder_dir>ruleset/decoders</decoder_dir>
        <rule_dir>ruleset/rules</rule_dir>
        <rule_exclude>0215-policy_rules.xml</rule_exclude>
        <list>etc/lists/audit-keys</list>
        <list>etc/lists/amazon/aws-sources</list>
        <list>etc/lists/amazon/aws-eventnames</list>

        <!-- User-defined ruleset -->
        <decoder_dir>etc/decoders</decoder_dir>
        <rule_dir>etc/rules</rule_dir>
      </ruleset>

      <!-- Configuration for ossec-authd
        To enable this service, run:
        ossec-control enable auth
      -->
      <auth>
        <disabled>no</disabled>
        <port>1515</port>
        <use_source_ip>no</use_source_ip>
        <force_insert>no</force_insert>
        <force_time>0</force_time>
        <purge>no</purge>
        <use_password>no</use_password>
        <limit_maxagents>yes</limit_maxagents>
        <ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
        <!-- <ssl_agent_ca></ssl_agent_ca> -->
        <ssl_verify_host>no</ssl_verify_host>
        <ssl_manager_cert>/var/ossec/etc/sslmanager.cert</ssl_manager_cert>
        <ssl_manager_key>/var/ossec/etc/sslmanager.key</ssl_manager_key>
        <ssl_auto_negotiate>no</ssl_auto_negotiate>
      </auth>

      <cluster>
        <name>wazuh</name>
        <node_name>wazuh-manager-worker-0</node_name>
        <node_type>worker</node_type>
        <!-- TODO: Don't hardcode the key! (and change it) -->
        <key>123a45bc67def891gh23i45jk67l8mn9</key>
        <interval>10s</interval>
        <port>1516</port>
        <bind_addr>0.0.0.0</bind_addr>
        <nodes>
            <node>wazuh-manager-master-0.wazuh-cluster.wazuh.svc.cluster.local</node>
        </nodes>
        <hidden>no</hidden>
        <disabled>no</disabled>
      </cluster>
    </ossec_config>

    <ossec_config>
      <localfile>
        <log_format>syslog</log_format>
        <location>/var/ossec/logs/active-responses.log</location>
      </localfile>

      <localfile>
        <log_format>syslog</log_format>
        <location>/var/log/syslog</location>
      </localfile>

      <localfile>
        <log_format>syslog</log_format>
        <location>/var/log/dpkg.log</location>
      </localfile>
    </ossec_config>
