The wazuh model uses configd for additional info, which makes model initialization a bit slower than usual.
When only checking if the module is used, accessing the config object saves a lot of time.
features available in this version:
o Pluggable ossec.conf sections in /usr/local/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/
o Selectable syslog applications (flushed to it's own log file using a format Wazuh understands)
o Suricata (IDPS) log shipping using localfile json parser
o Optional Password authentication (as specified in https://documentation.wazuh.com/current/user-manual/agent-enrollment/security-options/using-password-authentication.html)
o Active response support, including a custom firewall action (opnsense-fw)
o Ignore list for opnsense-fw, using a standard alias which contains networks to skip
o Toggle standard modules (wodle_syscollector, rootcheck, syscheck)
o Log views and format parsers for local insights. (ossec.log, active-responses.log)
o When searching for issues, a debug toggle is available which changes all debug options at once to the requested level
Franco Fichtner
KSandGitHub
Ad Schellevis