Wazuh Agent Registration

[kl3ss]

Hey all,

Was wondering what are my options for registering new Wazuh Agents? I understand I can run so-wazuh-agent-manage to register new agents, However I want to register many multiple agents at once. Is there other options for doing this rather than manually registering each agent?

Cheers

kl3ss

[RobertClum]

Hey,

I just had to learn this, there are a a few options, here are the instructions I used to figure out the commands.

https://docs.securityonion.net/en/2.3/wazuh.html

https://documentation.wazuh.com/3.13/user-manual/registering/index.html

Make sure you run the so-allow to configure the firewall rule for all Wazuh components on the security onion server this will allow your host to communicate to Wazuh manager.

Hope this helps!

[kl3ss]

@RobertClum Thanks for that. Just to clarify, If I want to point my Wazuh Agents to a Security Onion Forward Node would I need to run the so-allow on the Forward Node itself? Previously have been using so-firewall on the manager and then using salt to push the config out to the Forward Nodes.

[RobertClum]

@kl3ss I am using a standalone, so I am not 100 percent sure, but this is from the SO documentation.

https://docs.securityonion.net/en/2.3/wazuh.html

"When using ossec-authd, be sure to add a firewall exception for agents to access port 1515/tcp on the Wazuh manager node by running so-allow and choosing the r option."

So I would say whatever your manager note is the for the agents is where you would open up the firewall using so-allow, which is need to register the agent over port 1515/tcp.