Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change Wazuh Puppet rules to work with wazuh output logs #802

Merged
merged 1 commit into from
Dec 1, 2020
Merged

Change Wazuh Puppet rules to work with wazuh output logs #802

merged 1 commit into from
Dec 1, 2020

Conversation

palaciosjeremias
Copy link

@palaciosjeremias palaciosjeremias commented Nov 30, 2020 •
edited

Related issue
#796

Description

This PR adapts Wazuh Puppet rules to work with output logs using both ossec and wazuh tag

Tests

  • Run /var/ossec/bin/ossec-logtest with log wazuh: output: 'timestamp_puppet and check that rule 80090 is triggered.

@palaciosjeremias palaciosjeremias changed the base branch from master to dev-wstack-rules November 30, 2020 13:44
@palaciosjeremias palaciosjeremias marked this pull request as draft November 30, 2020 13:45
@palaciosjeremias palaciosjeremias self-assigned this Nov 30, 2020
@palaciosjeremias palaciosjeremias linked an issue Nov 30, 2020 that may be closed by this pull request
Update the puppet rules to make use of wazuh #796
Closed
@palaciosjeremias palaciosjeremias marked this pull request as ready for review November 30, 2020 22:10
pereyra-m
pereyra-m approved these changes Nov 30, 2020
View reviewed changes
Copy link
Member

@pereyra-m pereyra-m left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@palaciosjeremias palaciosjeremias force-pushed the dev-796-change-ossec-from-puppet-rules branch from 7f21fd2 to ccc999f Compare November 30, 2020 23:58
DProvinciani
DProvinciani approved these changes Dec 1, 2020
View reviewed changes
Copy link
Contributor

@DProvinciani DProvinciani left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@DProvinciani DProvinciani merged commit c933b4d into dev-wstack-rules Dec 1, 2020
@DProvinciani DProvinciani deleted the dev-796-change-ossec-from-puppet-rules branch December 1, 2020 00:10
@DProvinciani DProvinciani mentioned this pull request Dec 1, 2020
Closed
@DProvinciani DProvinciani added this to the Sprint 121 - Core/Bugman milestone Dec 2, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DProvinciani DProvinciani DProvinciani approved these changes

@pereyra-m pereyra-m pereyra-m approved these changes

Assignees

@palaciosjeremias palaciosjeremias

Labels
None yet
Projects
None yet
Milestone
Sprint 121 - Core/Bugman
Development

Successfully merging this pull request may close these issues.

Update the puppet rules to make use of wazuh
3 participants
@palaciosjeremias @DProvinciani @pereyra-m