How to automate registering the OSSEC agent ip address on manager server?

433 Views Asked by At

I want to automate the process of registering the OSSEC agent IP on the OSSEC manager server. I have explored many links and articles about it but everywhere they have mentioned entering the IP value through prompt using /var/ossec/bin/manage_agents. I was referring below link for setup: https://www.digitalocean.com/community/tutorials/how-to-monitor-ossec-agents-using-an-ossec-server-on-ubuntu-14-04

1

There are 1 best solutions below

0
On BEST ANSWER

You may provide the name and IP of the agent using the -a and -n modifiers. For example to add an agent named "test-agent" without any restriction on IP simply run:

/var/ossec/bin/manage_agents -a any -n test-agent

You may then extract the key information with the -e modifier and import this into your agent. It will be necessary to restart the manager after adding the agent.

It's worth noting that Wazuh, which is a fork of OSSEC that heavily improved the original functionality over the last 5 years, includes a self-registration service which can help you automate the process of agent registration and the installers can leverage this through the use of deployment variables.