chris/wazuh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
chris
2026-06-05 18:32:20 +00:00
parent 1dc9a0f85b
commit 249cc4cf71
1 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+36
View File
@@ -2,6 +2,42 @@
Self-hosted Wazuh all-in-one deployment (Manager + Indexer + Dashboard) running on a Proxmox VM converted from the official Wazuh Amazon Machine Image (AMI) OVA.
# Important File Paths
| Wazuh Manager or Agent | Important File Paths | Description |
|------------------------|----------------------|-------------|
| Manager | `/var/ossec/etc/ossec.conf` | Main server config (remoted, vulnerability detector, integrations, active response) |
| Manager | `/var/ossec/etc/rules/local_rules.xml` | Custom/override rules |
| Manager | `/var/ossec/etc/decoders/local_decoder.xml` | Custom decoders |
| Manager | `/var/ossec/etc/lists/` | CDB lists for lookups |
| Manager | `/var/ossec/etc/shared/default/agent.conf` | Centralized config pushed to agents in the default group |
| Manager | `/var/ossec/etc/client.keys` | Agent registration keys |
| Manager | `/var/ossec/logs/ossec.log` | Main manager log |
| Manager | `/var/ossec/logs/alerts/alerts.json` | Fired alerts (JSON) |
| Manager | `/var/ossec/logs/alerts/alerts.log` | Fired alerts (plain text) |
| Manager | `/var/ossec/logs/archives/archives.json` | All events regardless of alert status (if `<logall_json>` enabled) |
| Manager | `/var/ossec/queue/sockets/` | Internal daemon communication sockets |
| Manager | `/var/ossec/queue/agents-timestamp` | Agent last-seen timestamps |
| Manager | `/var/ossec/stats/` | Hourly/weekly statistics |
| Manager | `/var/ossec/ruleset/rules/` | Stock rule files (override in `local_rules.xml`, don't edit directly) |
| Manager | `/var/ossec/ruleset/decoders/` | Stock decoders (override in `local_decoder.xml`, don't edit directly) |
| Manager | `/var/ossec/var/db/global.db` | SQLite agent database |
| Manager | `/var/ossec/wodles/` | Built-in wodle binaries (SCA, syscollector, etc.) |
| Agent (Linux) | `/var/ossec/etc/ossec.conf` | Agent config (server address, enrollment, syscheck, log collection, SCA) |
| Agent (Linux) | `/var/ossec/etc/client.keys` | This agent's registration key |
| Agent (Linux) | `/var/ossec/etc/shared/` | Configs pushed from the manager |
| Agent (Linux) | `/var/ossec/logs/ossec.log` | Main agent log |
| Agent (Linux) | `/var/ossec/queue/sockets/` | Internal sockets |
| Agent (Linux) | `/var/ossec/var/run/` | PID files |
| Agent (Linux) | `/var/ossec/ruleset/sca/` | SCA policy files (CIS benchmarks, etc.) |
| Agent (Linux) | `/var/ossec/tmp/` | Working directory for active response scripts, downloads |
| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\ossec.conf` | Agent config (lives at install root, no `etc\` subfolder) |
| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\client.keys` | This agent's registration key |
| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\shared\` | Pushed group configs |
| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\active-response\bin\` | Active response scripts |
| Agent (Windows) | `C:\Program Files (x86)\ossec-agent\ossec.log` | Main agent log |
## **From the Proxmox host, download the official Wazuh AMI ova file.**
### 1. Download the official AMI. (Version 4.14.5 at time of this commit. Edit as required)
`wget https://packages.wazuh.com/4.x/vm/wazuh-4.14.5.ova`