docs: enhance sysmon config deployment documentation (#422)
taylor_socfortress committed
Mar 10, 2025 at 09:05 UTC
5767cebb5ca5afc35c29710571123485727a8110
1 file changed
+28
backend/app/active_response/routes/sysmon_config.py
+28
@@ -114,5 +114,33 @@ async def deploy_sysmon_config(customer_code: str, session: AsyncSession = Depen
114
"""
115
Deploy a customer's Sysmon config to the Wazuh master.
116
Fetches the config from MinIO storage and sends it to the Wazuh master.
117
+ The Wazuh Master needs to be running the Customer-Provisioning-Worker application.
118
+ Currently we are invoking this via a wodle command that must be placed in the wazuh agent group.
119
+ <wodle name="command">
120
+ <disabled>no</disabled>
121
+ <tag>sysmon-reload</tag>
122
+ <command>"C:\Program Files (x86)\ossec-agent\active-response\bin\run_sysmon_config_reload.cmd"</command>
123
+ <interval>24h</interval>
124
+ <ignore_output>yes</ignore_output>
125
+ <run_on_start>yes</run_on_start>
126
+ <timeout>0</timeout>
127
+ </wodle>
128
+ Might revisit in the future to use the Wazuh API directly to invoke the active response.
129
+ The current limitation with the active-response is that we have to wait for the manager to pass the new sysmon_config.xml
130
+ file to the agent.
131
+ I.E:
132
+ {
133
+ "endpoint": "/active-response",
134
+ "arguments": [],
135
+ "command": "sysmon_config_reload",
136
+ "custom": true,
137
+ "alert": {
138
+ "action": "sysmon_config_reload"
139
+ },
140
+ "params": {
141
+ "wait_for_complete": true,
142
+ "agents_list": ["085"]
143
+ }
144
+ }
145
"""
146
return await deploy_sysmon_config_to_worker(customer_code=customer_code, session=session)