Wodle | <command>

[John Carry]

Dear Wazuh/Everyone,

Can anyone help me out by correcting the wodle please, It's been long I've been traying to figure it our but no success yet.

The requirement my end is that I want to correct the <command> part inside wodle section, where I want to run a python script siem.py that is placed on path /Sophos-Central-SIEM-Integration.

You can find the current configuration below but it is giving me error Returned code 1 inside ossec.conf.

The professionals are requested to help me out.

Note: No issue in the script, Manually running the file provides the output successfully when executed through both ./siem.py and python3.6 siem.py.

Regards,

John

[Pablo Ariel Gonzalez]

Hi John, 

      Could you tell me if you are trying to do this configuration in a particular agent or in wazuh manager? I would also need you to share with us the permissions assigned to that script at this moment.

Thanks,