Xor290/ansible-mln
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update

Browse Source
This commit is contained in:
Xor290
2026-08-08 12:04:57 +02:00
parent 56aef1fa9b
commit 8e36acd812
76 changed files with 12710 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
monitoring/security/wazuh/config/wazuh_manager/agent.conf
+63
View File
@@ -0,0 +1,63 @@
<!-- Configuration centralisée distribuée aux agents Wazuh -->
<!-- Déposée dans /var/ossec/etc/shared/default/agent.conf sur le manager -->
<agent_config>
<!-- ── Logs nginx ──────────────────────────────────────────────────── -->
<localfile>
<log_format>apache</log_format>
<location>/var/log/nginx/access.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/nginx/error.log</location>
</localfile>
<!-- ── Auth system ───────────────────────────────────────────────── -->
<localfile>
<log_format>syslog</log_format>
<location>/var/log/auth.log</location>
</localfile>
<!-- ── Syslog ────────────────────────────────────────────────────── -->
<localfile>
<log_format>syslog</log_format>
<location>/var/log/syslog</location>
</localfile>
<!-- ── Unattended-upgrades (patchs de sécurité auto) ───────────────── -->
<localfile>
<log_format>syslog</log_format>
<location>/var/log/unattended-upgrades/unattended-upgrades.log</location>
</localfile>
<!-- ── auditd (regles CIS 6.2.3.x deployees via ansible/hardening) ─── -->
<localfile>
<log_format>audit</log_format>
<location>/var/log/audit/audit.log</location>
</localfile>
</agent_config>
<!-- ── Logs backend Go (prod-mln) ────────────────────────────────── -->
<!-- "command" (pas full_command) = chaque ligne de docker logs → event séparé -->
<!-- Chaque ligne [GIN] devient son propre event → decoder peut extraire srcip/url/status -->
<agent_config name="prod-mln">
<localfile>
<log_format>command</log_format>
<command>docker logs --since 65s gestion-backend 2>&1</command>
<alias>backend</alias>
<frequency>60</frequency>
</localfile>
</agent_config>
<!-- ── Logs backend Go (pre-prod-mln) ───────────────────────────── -->
<agent_config name="pre-prod-mln">
<localfile>
<log_format>command</log_format>
<command>docker logs --since 65s gestion-backend 2>&1</command>
<alias>backend</alias>
<frequency>60</frequency>
</localfile>
</agent_config>