Wazuh Agent Protocol Change

[kl3ss]

Hey All,

By default i've noticed my installation of security onion is telling wazuh agents to communicate with the wazuh manager on each of the security onion forward nodes using UDP Protocol.

What would be the best way and how do I go about changing this to TCP?

Ive copied ossec.conf for agent and server into

/opt/so/saltstack/local/salt/wazuh/files/agent
and
/opt/so/saltstack/local/salt/wazuh/files/server

Ive made changes in both of those ossec.conf files to use TCP.

However when I run salt if does not push this config out and the Manager still continues to use UDP. Is this the correct / recommended way of doing this?

I look forward to hearing from you all.

Cheers

kl3ss

[dougburks]

Salt does not manage the Wazuh configuration. You can make the change manually on each node or come up with your own method to automate this.