Search code examples
bashunixdevopsossec

How to automate registering the OSSEC agent ip address on manager server?

I want to automate the process of registering the OSSEC agent IP on the OSSEC manager server. I have explored many links and articles about it but everywhere they have mentioned entering the IP value through prompt using /var/ossec/bin/manage_agents. I was referring below link for setup: https://www.digitalocean.com/community/tutorials/how-to-monitor-ossec-agents-using-an-ossec-server-on-ubuntu-14-04

Solution

  • You may provide the name and IP of the agent using the -a and -n modifiers. For example to add an agent named "test-agent" without any restriction on IP simply run:

    /var/ossec/bin/manage_agents -a any -n test-agent

    You may then extract the key information with the -e modifier and import this into your agent. It will be necessary to restart the manager after adding the agent.

    It's worth noting that Wazuh, which is a fork of OSSEC that heavily improved the original functionality over the last 5 years, includes a self-registration service which can help you automate the process of agent registration and the installers can leverage this through the use of deployment variables.