Defined sys. audit files for both linux and windows & removed auxilia…

…ry var.
wazuh · Mar 18, 2020 · 624daa7 · 624daa7
1 parent 96e2e89
commit 624daa7
Showing 1 changed file with 5 additions and 8 deletions.
diff --git a/manifests/params_agent.pp b/manifests/params_agent.pp
@@ -73,9 +73,6 @@
 
  $active_response_ca_verification = 'yes'
 
- ## system audit
- $ossec_rootcheck_system_audit = $::wazuh::params_agent::default_rootcheck_system_audit
-
  # OS specific configurations
  case $::kernel {
  'Linux': {
@@ -119,6 +116,10 @@
  $ossec_rootcheck_rootkit_files = '/var/ossec/etc/shared/rootkit_files.txt'
  $ossec_rootcheck_rootkit_trojans = '/var/ossec/etc/shared/rootkit_trojans.txt'
  $ossec_rootcheck_skip_nfs = 'yes'
+ $ossec_rootcheck_system_audit = [
+ "/var/ossec/etc/shared/system_audit_rcl.txt",
+ "/var/ossec/etc/shared/system_audit_ssh.txt",
+ ]
 
  # SCA
 
@@ -236,11 +237,6 @@
 
  $manage_repo = true
 
- $default_rootcheck_system_audit = [
- "./shared/system_audit_rcl.txt",
- "./shared/system_audit_ssh.txt",
- ]
-
  case $::osfamily {
  'Debian': {
  $service_has_status = false
@@ -409,6 +405,7 @@
  $ossec_rootcheck_windows_disabled = 'no'
  $ossec_rootcheck_windows_windows_apps = './shared/win_applications_rcl.txt'
  $ossec_rootcheck_windows_windows_malware = './shared/win_malware_rcl.txt'
+ $ossec_rootcheck_system_audit = []
 
  # sca
  $sca_windows_enabled = 'yes'