When multiple IPs trigger the same rule simultaneously, they were
sharing the same check_keys value (only rule ID), causing the manager
to abort all but the first execution.
Changed the key to include both rule_id and srcip to make it unique
per source IP, allowing multiple simultaneous blocks while still
preventing duplicate blocks of the same IP.
Fixes#4738
The wazuh model uses configd for additional info, which makes model initialization a bit slower than usual.
When only checking if the module is used, accessing the config object saves a lot of time.
features available in this version:
o Pluggable ossec.conf sections in /usr/local/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/
o Selectable syslog applications (flushed to it's own log file using a format Wazuh understands)
o Suricata (IDPS) log shipping using localfile json parser
o Optional Password authentication (as specified in https://documentation.wazuh.com/current/user-manual/agent-enrollment/security-options/using-password-authentication.html)
o Active response support, including a custom firewall action (opnsense-fw)
o Ignore list for opnsense-fw, using a standard alias which contains networks to skip
o Toggle standard modules (wodle_syscollector, rootcheck, syscheck)
o Log views and format parsers for local insights. (ossec.log, active-responses.log)
o When searching for issues, a debug toggle is available which changes all debug options at once to the requested level
mbedworthandGitHub
Ad Schellevis
KSandGitHub
Franco Fichtner
Andy BinderandGitHub
sophie [⛧-440729]andGitHub