HI Dear Team

[kamran ali]

if someone have xml agent.conf file and ossec.conf file for production environment.pleasae share with me .

i need this for win-10 win-11  win-servers-2012,2016,2019 
ubuntu 

redhat

macos

 i need configration for this and also need rules for all this if someone have please share with me i am confusing how to wite and i also have writes but confuse its good or not.

<agent_config> <!-- ===== 1. SYSTEM INVENTORY (Syscollector) ===== --> <wodle name="syscollector"> <disabled>no</disabled> <interval>1h</interval> <scan_on_start>yes</scan_on_start> <hardware>yes</hardware> <os>yes</os> <network>yes</network> <packages>yes</packages> <ports all="no">yes</ports> <processes>yes</processes> <users>yes</users> <groups>yes</groups> <services>yes</services> <hostfixes>yes</hostfixes> <browser_extensions>yes</browser_extensions> <synchronization> <max_eps>10</max_eps> </synchronization> </wodle> <!-- ===== 2. FILE INTEGRITY MONITORING ===== --> <syscheck> <disabled>no</disabled> <frequency>3600</frequency> <scan_on_start>yes</scan_on_start> <alert_new_files>yes</alert_new_files> <auto_ignore frequency="10" timeframe="3600">no</auto_ignore> <!-- System32 & SysWOW64 --> <directories realtime="yes" check_all="yes" report_changes="yes" whodata="yes"> %WINDIR%\System32 </directories> <directories realtime="yes" check_all="yes" whodata="yes"> %WINDIR%\SysWOW64 </directories>
<!-- Registry Persistence Keys --> <windows_registry check_all="yes">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry> <windows_registry check_all="yes">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</windows_registry> <windows_registry check_all="yes">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</windows_registry> <windows_registry check_all="yes">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry> <windows_registry check_all="yes">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies</windows_registry> <!-- Software Installs --> <directories realtime="yes" check_all="yes" whodata="yes"> %PROGRAMFILES% </directories> <directories realtime="yes" check_all="yes" whodata="yes"> %PROGRAMFILES(X86)% </directories> <directories realtime="yes" check_all="yes" whodata="yes"> %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs </directories> <!-- Startup / Persistence --> <directories realtime="yes" check_all="yes" whodata="yes"> %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup </directories> <directories realtime="yes" check_all="yes" whodata="yes"> %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\StartUp </directories> <!-- Downloads — all users, dangerous file types only --> <directories realtime="yes" check_all="yes" whodata="yes" report_changes="yes" restrict=".exe|.msi|.bat|.ps1|.vbs|.zip|.rar|.dll|.jar|.py|.sh|.cmd|.hta|.scr|.pif"> %USERPROFILE%\Downloads </directories> <directories realtime="yes" check_all="yes" whodata="yes" report_changes="yes"> %USERPROFILE%\Desktop </directories> <directories realtime="yes" check_all="yes" whodata="yes" report_changes="yes"> %USERPROFILE%\Documents </directories> <directories realtime="yes" check_all="yes" whodata="yes"> %USERPROFILE%\Pictures </directories> <directories realtime="yes" check_all="yes" whodata="yes"> %USERPROFILE%\Videos </directories> <directories realtime="yes" check_all="yes" whodata="yes"> %USERPROFILE%\Music </directories> <!-- Hosts file --> <directories realtime="yes" check_all="yes" whodata="yes" report_changes="yes"> %WINDIR%\System32\drivers\etc </directories> <!-- PowerShell Profile --> <directories realtime="yes" check_all="yes" whodata="yes"> %USERPROFILE%\Documents\WindowsPowerShell </directories> <!-- Ignores --> <ignore>%WINDIR%\System32\LogFiles</ignore> <ignore>%WINDIR%\System32\wbem\Logs</ignore> <ignore>%WINDIR%\System32\catroot2</ignore> <ignore>%WINDIR%\Prefetch</ignore> <ignore>%PROGRAMDATA%\Microsoft\Windows Defender\Scans</ignore> <ignore>%TEMP%\MpCmdRun.log</ignore> <nodiff>%WINDIR%\System32\*.log</nodiff> <nodiff>%WINDIR%\System32\*.evtx</nodiff> <max_files_per_second>100</max_files_per_second> </syscheck> <!-- ===== 3. WINDOWS EVENT LOGS ===== --> <localfile> <location>Application</location> <log_format>eventchannel</log_format> </localfile> <localfile> <location>Security</location> <log_format>eventchannel</log_format> <query> <![CDATA[ Event/System[EventID=4624 or EventID=4625 or EventID=4648 or EventID=4657 or EventID=4663 or EventID=4688 or EventID=4697 or EventID=4698 or EventID=4699 or EventID=4700 or EventID=4701 or EventID=4720 or EventID=4722 or EventID=4723 or EventID=4724 or EventID=4725 or EventID=4726 or EventID=4728 or EventID=4732 or EventID=4756 or EventID=4776 or EventID=4798 or EventID=4799] ]]> </query> </localfile> localfile> <location>System</location> <log_format>eventchannel</log_format> </localfile> <!-- PowerShell Script Logging --> <localfile> <location>Microsoft-Windows-PowerShell/Operational</location> <log_format>eventchannel</log_format> </localfile> <!-- Sysmon (install on endpoints) --> <localfile> <location>Microsoft-Windows-Sysmon/Operational</location> <log_format>eventchannel</log_format> </localfile> <!-- Windows Defender --> <localfile> <location>Microsoft-Windows-Windows Defender/Operational</location> <log_format>eventchannel</log_format> </localfile> <!-- Task Scheduler --> <localfile> <location>Microsoft-Windows-TaskScheduler/Operational</location> <log_format>eventchannel</log_format> </localfile> <!-- WMI Activity --> <localfile> <location>Microsoft-Windows-WMI-Activity/Operational</location> <log_format>eventchannel</log_format> </localfile> </agent_config>

[jorge....@wazuh.com]

Hello Kamran,

I have reviewed your Windows agent.conf file and here are a couple that will help you with the setup:

There is a missing opening bracket in one of your configuration blocks. It currently looks like this:

localfile>
  <location>System</location>
  <log_format>eventchannel</log_format>
</localfile>

It should be updated to <localfile> to ensure the file parses correctly.

I noticed that whodata="yes" and report_changes="yes" are enabled for big directories like %WINDIR%\System32 and %PROGRAMFILES%. Scanning these highly active directories could cause big CPU and RAM spikes.

You can use instead realtime="yes" for large directories. And keep whodata for highly sensitive folders that are rarely modified.
File Integrity Monitoring Documentation




Regarding your issue with managing multiple operating systems, you should avoid maintaining one massive configuration file. Instead, you can use our Centralized Configuration feature.

You can create distinct groups in your manager (e.g., `windows`, `linux`, `macos`) and assign the respective agents to them. The manager will then automatically push the correct configuration block to each specific group.
Centralized Configuration Documentation

Related to your rules question, keep in mind that Wazuh comes with a comprehensive set of built-in base rules out of the box that cover most standard use cases. However, if you need to build custom rules for your specific environment, we have a step-by-step guide on how to successfully create and test them.

Custom Rules Guide



Let me know if you run into any issues or need further assistance with any of these processes!