Merge pull request #8725 from wazuh/merge-4.12-into-4.13.0

Merge 4.12 into 4.13.0

Author: javimed

CHANGELOG.md

@@ -37,11 +37,13 @@ All notable changes to this project will be documented in this file.
 - **Post-release**: Added the *Wazuh AI Analyst service* section to the Cloud service documentation. ([#8690](https://github.com/wazuh/wazuh-documentation/pull/8690))
 - **Post-release**: Added DNF package manager support for installation and configuration steps. ([#8689](https://github.com/wazuh/wazuh-documentation/pull/8689))
 - **Post-release**: Added security update for the `remove-threat.py` script and a warning to the Detecting and removing malware using VirusTotal integration POC guide. ([#8697](https://github.com/wazuh/wazuh-documentation/pull/8697))
+- **Post-release**: Added note about manual replication of `ossec.conf` between master and worker nodes. ([#8720](https://github.com/wazuh/wazuh-documentation/pull/8720))
 
 ### Changed
 
 - Updated Wazuh dashboard package generation guide. ([#7961](https://github.com/wazuh/wazuh-documentation/pull/7961))
 - Updated images in FIM PoC. [#7979](https://github.com/wazuh/wazuh-documentation/pull/7979)
+- Added clarification about PCRE2 case sensitivity and modifiers in the ruleset XML syntax guide. ([#8717](https://github.com/wazuh/wazuh-documentation/pull/8717))
 - Replaced the `--version` parameter with `--commit-sha` in the Wazuh dashboard package generation guide. ([#8216](https://github.com/wazuh/wazuh-documentation/pull/8216))
 - Updated the Filebeat package references in Packages list. ([#8348](https://github.com/wazuh/wazuh-documentation/pull/8348))
 - Updated Microsoft Entra ID SSO setup steps for the administrator role. ([#8399](https://github.com/wazuh/wazuh-documentation/pull/8399)) ([#8424](https://github.com/wazuh/wazuh-documentation/pull/8424))

source/user-manual/ruleset/ruleset-xml-syntax/pcre2.rst

@@ -34,6 +34,7 @@ Case sensitivity
 
 Compared to :ref:`OSRegex <os_regex_syntax>` and :ref:`OSMatch <sregex_os_match_syntax>`, which are case insensitive, PCRE regex are case sensitive by default. This can be changed by using ``(?i)``. Example: ``post`` will match ``(?i)POST|GET|PUT`` regex but not ``POST|GET|PUT``.
 
+
 Groups within groups
 ^^^^^^^^^^^^^^^^^^^^
 

source/user-manual/ruleset/ruleset-xml-syntax/regex.rst

@@ -114,6 +114,8 @@ PCRE2 syntax
 
 It provides features like recursive patterns, look-ahead and look-behind assertions, non-capturing groups, non-greedy quantifiers, extended syntax for characters and character classes, and many others. For more details, please refer to the `PCRE Syntax documentation <https://www.pcre.org/current/doc/html/pcre2syntax.html>`_.
 
+By default, PCRE2 is case-sensitive. Use ``(?i)`` for case-insensitive matching. For example, the string ``post`` matches the regex ``(?i)POST|GET|PUT`` but not ``POST|GET|PUT``.
+
 .. topic:: Supported expressions
 
    +-------------+----------------------------------------------------------------------------+
@@ -197,3 +199,11 @@ It provides features like recursive patterns, look-ahead and look-behind asserti
    +------------+----------------------------------------+
    | {n,}?      | n or more, lazy                        |
    +------------+----------------------------------------+
+
+.. topic:: Modifiers
+
+   +----------+-----------------------------+
+   | Modifier | Effect                      |
+   +==========+=============================+
+   | (?i)     | Case-insensitive matching   |
+   +----------+-----------------------------+

source/user-manual/wazuh-server-cluster/cluster-nodes-configuration.rst

@@ -8,6 +8,12 @@ Wazuh cluster nodes configuration
 
 In a Wazuh server cluster, there can only be one master node in a cluster while all other Wazuh servers are the worker nodes. For both node types, the configuration file ``/var/ossec/etc/ossec.conf`` contains the cluster configuration values. We show how to configure a cluster with a master node and a single worker node.
 
+.. note::
+
+   Configurations applied to the ``/var/ossec/etc/ossec.conf`` file on the master node are not automatically synchronized with the ``/var/ossec/etc/ossec.conf`` file on the worker nodes. You need to manually replicate the configurations to attain synchronization.
+
+   Additionally, restart nodes to apply configuration changes.
+
 Master node
 -----------
 

source/user-manual/wazuh-server-cluster/types-of-nodes.rst

@@ -8,6 +8,12 @@ Types of nodes in a Wazuh server cluster
 
 There are two types of nodes in the Wazuh server cluster, the master node and the worker node. The node types define the tasks of each node within the Wazuh server cluster and establish a hierarchy to determine which node's information takes precedence during :doc:`data synchronizations </user-manual/wazuh-server-cluster/data-synchronization>`. A Wazuh server cluster can only have one master node, during synchronizations, the data from the master node always takes precedence over the data from worker nodes. This ensures uniformity and consistency within the cluster.
 
+.. note::
+
+   Configurations applied to the ``/var/ossec/etc/ossec.conf`` file on the master node are not automatically synchronized with the ``/var/ossec/etc/ossec.conf`` file on the worker nodes. You need to manually replicate the configurations to attain synchronization.
+
+   Additionally, restart nodes to apply configuration changes.
+
 .. _server-cluster-master-node:
 
 Master node