Create subgroups in Endpoint groups in Wazuh

[Mário Araújo Xavier]

Hello everyone,

I am making endpoint groups in Wazuh by every branch of my company. 

I need know if is possible make subgroups in Wazuh, because i will use it syncing wazuh subgroups with sub-departments of my company.

If is possible make subgroups in Wazuh, i will can create hierarchy of company in Wazuh

Thanks for your help

See you!

Mario

[Bony V John]

Hi Mario,

In Wazuh agent grouping, you can add an agent to one or more groups. Each agent group has its own agent.conf file on the manager, which is shared with the agents in that group.

In your case, you can create a group for your company (let's name the group "company") and add all the agents to it. If you have a set of common configurations that need to be applied to all agents in the company, you can add these configurations to the agent.conf file of the "company" group.

If you need to group HR endpoints, you can create a group called "HR," add the HR agents to it, and apply the configurations specific to HR endpoints. Similarly, you can create groups for other departments. For instance, if you have a common configuration for the Dev team and Ops team, you can create a "dev-ops" group and apply the configurations to that group.

For more information, you can refer to the Wazuh centralized agent configuration documentation.

Note: When using Wazuh agent centralized configuration, ensure that remote commands for agent modules are enabled. To do this, add the following line to the /var/ossec/etc/local_internal_options.conf file on the agent:
wazuh_command.remote_commands=1

I hope this helps! Let me know if you have any questions.

Regards,

[Mário Araújo Xavier]

Thanks so much Bony!!

[Bony V John]

Hi,

I hope the above information helped you. Please let us know if you have any doubts.

Regards,