Excluding a single agent feom VirusTotal checks

[toddehb]

Hi,

I am using the free version of VirusTotal, which is limiting me to a certain amount of checks a day. The whole Wazuh setup is in my homelab and there I got 1 machine, which is running pihole. This single machine is consuming 90% of the VirusTotal checks. I want to exclude that agent from using VirusTotal checks. Could that be possible?

cheers, toddehb

[Oluwaseyi Soneye]

Hello @toddehd,

The VirusTotal integration works in collaboration with the Wazuh FIM module (More information here - https://documentation.wazuh.com/current/user-manual/capabilities/malware-detection/virus-total-integration.html). It uses the VirusTotal API to detect malicious content within the files and directories monitored by the File Integrity Monitoring capability of Wazuh.

You can stop VirusTotal from running scans by disabling FIM on the agent. To do this,

modify the following configuration in the /var/ossec/etc/ossec.conf file:

<syscheck>

  ...

  <disabled>yes</disabled>

  ...

</syscheck>

[toddehb]

Ok, but I don't like to disable FIM completely. Is that the only way?

[toddehb]

Any response?