Automate Wazuh-Agent Install with Ansible! - Linux - Let's Deploy a Host Intrusion Detection System

Join me as we install Wazuh Agents via Ansible! Automation for the win! Let's deploy a Host Intrusion Detection System and SIEM with free open source tools. Join me as we explore and learn together.
Documentation: documentation....
Check us out: www.opensecure...
Interact with our demo: www.opensecure...
Hire us: www.opensecure...

[@nithinjose98]

How to deploy agents with internal IP remotely by using Ansible..can you please explain

[@ruienyou8909]

if i alreaddy installed wazuh, can i add on by installing anisble on top ?

[@marciolima174]

Excellent your videos.

[@taylorwalton_socfortress]

Thanks for watching, Marcio!

[@marciolima174]

In the vulnerability guide displayed on Wazuh, I updated everything that was identified, such as does Wazuh identify that everything has been updated and no longer show on the panel?

[@taylorwalton_socfortress]

Hey Marcio, the vulnerability scan is ran via the syscollector woodle. By default it runs every hour but you can change the interval time if you want:
no
1h
yes
yes
documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/running_vu_scan.html
If you resolved the vulnerability, then the next time the syscollector runs it should detect that you fix and not report that vulnerability anymore.

[@marciolima174]

@@taylorwalton_socfortress Perfect, thanks

[@marciolima174]

Hello, when my Notebook gets a different ip the ID that was registered on wazuh agent it changes to a new one and disconnects the old one. How do I if he changes the ip, do not change?

[@taylorwalton_socfortress]

Hey Marcio, check out the use_source_ip and force_insert settings here: documentation.wazuh.com/current/user-manual/reference/ossec-conf/auth.html#use-source-ip
These changes are made within the "" section of the Wazuh Manager's ossec.conf. I advise setting use_source_ip and force_insert both to a "no" value.
Let me know if that helps!

[@marciolima174]

@@taylorwalton_socfortress Thanks

[@eduardfrolov5580]

Can you record a video about how to automatically install Wazup agents on Windows, for example via AD or SCCM ?

[@taylorwalton_socfortress]

Hey Eduard, sure I will look to add a video where we will create a GPO policy to install agents

[@marciolima174]

Can you perform the integration with IDS Snort or another?

[@taylorwalton_socfortress]

Coming soon! Suricata is the IDS I’ll be working with and is in the pipeline.