Wazuh modules

[Adebabay Gelaw]

How to disable/remove modules?

I want only security events and integrity monitoring (FIM) modules form all wazuh  modules

[victor....@wazuh.com]

Hello adebabay,

You can disable all unwanted modules by changing the manager/agent's configuration (/var/ossec/etc/ossec.conf). In order to do that, change the disabled field value to yes and the enabled to no of every module you want to disable.

If you only want to use FIM and the log data collection module, you should disable the following: rootcheck, syscollector, sca and vulnerability detector :

  <rootcheck>
    <disabled>yes</disabled>
...
  </rootcheck>


  <wodle name="syscollector">
    <disabled>yes</disabled>
...
  </wodle>

  <sca>
    <enabled>no</enabled>
...
  </sca>

  <vulnerability-detector>
    <enabled>no</enabled>
...
  </vulnerability-detector>

  <active-response>
    <disabled>yes</disabled>
...
  </active-response>


If you have multiple agents in which you want to disable certain modules I recommend you to use a centralized configuration. In order to do that follow this documentation page https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html


If you have any doubt do not hesitate to ask

[Adebabay Gelaw]

Thanks a lot !

And how to remove unwanted modules in Wazuh gui?

[victor....@wazuh.com]

You need to go to Management > Configuration and select Edit configuration.

Now, you can edit your manager ossec.conf configuration file. Remember that every change in the Wazuh configuration requires saving the file and restarting the manager.

[Adebabay Gelaw]

In this we can disable the function , but am trying to say is how to remove some modules from  in kibana GUI ???

[victor....@wazuh.com]

Sorry for the late reply.
The visibility of some UI modules can be configured through the Settings > Modules menu. The other modules can not be disabled without changing the code of the app.

[Naveed Ahmed]

Hi Team,
I have setup Wazuh on docker and I noticed some module were disabled like AWS etc, once I restarted docker.
Can anyone please help on how to keep modules enabled even when I stop and start docker.

[João Paulo Bittencourt]

The new version 4.8 no have the option modules for DISABLE and ENABLE ?

[João Paulo Bittencourt]

Does anyone have an answer for this? Or has this function really been removed?