The Wazuh agent runs on the hosts that you want to monitor.
It is multi-platform and provides the following capabilities:
- Log and data collection
- File integrity monitoring
- Rootkit and malware detection
- Security policy monitoring.
- Configuration assessments
- Software inventory
In addition, it communicates with the Wazuh manager, sending data in near
real-time through an encrypted and authenticated channel.
===> The following configuration options are available for wazuh-agent-4.14.9:
INOTIFY=on: Kevent based real time monitoring
ZEROMQ=off: ZeroMQ support
===> Use 'make config' to modify these settings
security/wazuh*: update to 4.14.9
- Update cpython bundle to 3.11.17
- Remove obsolete patch file
- Use PYTHON_DISTVERSION for avoid temporarily pkg-plist issues when
system python is updated. The best is keep system python and bundle
python with the same version.
ChangeLog at:
https://documentation.wazuh.com/current/release-notes/release-4-14-9.html
PR: 299490
security/wazuh-agent: Remove non-default option PRELUDE
prelude has been defunct for some times and I have marked it deprecated.
PR: 296320
Approved by: acm
security/wazuh-*: Update to 4.14.3
- Fallback to 0 when elapsed-times is a non-numeric value
- Fix getPorts function issues on all versions of FreeBSD
- Update entry about java version into wazuh-indexer/pkg-message file
- Use a modified version of Python async inotify module to
work on FreeBSD (https://github.com/alonsobsd/asyncinotify)
- Define USE=inotify when INOTIFY option is selected
ChangeLog at:
https://documentation.wazuh.com/current/release-notes/release-4-14-3.html
security/wazuh-*: Update to 4.14.2
- Now, Wazuh source code is obtained from
https://github.com/alonsobsd/wazuh-freebsd.
This repository includes all changes to run Wazuh Suite on FreeBSD. dtxdf and
I
will maintain this repository in where will try to add all Wazuh features to
FreeBSD.
- wazuh-dashboards : Update version of opensearch to 2.19.4
ChangeLog at:
https://documentation.wazuh.com/current/release-notes/release-4-14-2.html
Reviewed by: acm dtxdf
Tested by: acm dtxdf
security/wazuh-agent: Add users and groups function support
- Now wazuh-agent can obtain users and groups information
- Fix start_time data to show correct datetime data from wazuh-dashboard
processes option
- Bump PORTREVISION
security/wazuh-agent: Improve port
- Now wazuh-agent use TCP connection by default
- FreeBSD sca,decoders and rules files were updated to fix some conflict
issues.
- Bump PORTREVISION
PR: 291040
security/wazuh-{agent,manager}: Improve getSerialNumber
Instead of returning UNKNOWN_VALUE, we can leverage the sysctl
'kern.hostuuid' so that users can uniquely identify their devices.
Approved by: acm@
security/wazuh-agent: Fix permission denied error for etc/client.keys
wazuh-agentd: ERROR: (1103): Could not open file 'etc/client.keys' due to
[(13)-(Permission denied)].
Approved by: acm@
security/wazuh-*: Improve ports
- agent and manager: Avoid change permissions to local.sqlite file.
Now it uses read-only mode.
- manager: dos2unix to api.yaml file
- server: logstash8 was updated to 8.19.9 and it needs openjdk21+
- Bump PORTREVISION
Reported by: dtxdf
security/wazuh-agent: Reimplement getPackages() using SQLite
- getPackages() is a function used to get a set of information about
the packages installed on the system where the manager and agent
are installed. To obtain this information, pkg-query(8) was used;
however, prior to this commit, it was assumed that pkg(8) was
installed on the system, which could be wrong, especially on systems
such as jails, where pkg(8) is normally used from the host. With
this change, we leverage SQLite to read the pkg(8) database and
obtain information about the packages, which is also much more
efficient than executing a command. This also fixes the segmentation
fault in wazuh-modulesd when this condition occurs.
- Bump PORTREVISION
security/wazuh: Update to 4.14.1
- Python bundle update to 3.11.4
- wazuh-agent and wazuh-manager : Add support for 15-RELEASE and 16-CURRENT
- wazuh-agent and wazuh-manager : Improve FreeBSD system information functions
- wazuh-dashboards : Update version of opensearch to 2.19.3
- wazuh-manager: Update pkg-message with entries about vulnerability detector
and indexer connector configuration
ChangeLog at:
https://documentation.wazuh.com/current/release-notes/release-4-14-1.html
PR: 290771290782291040
security/wazuh-*: Update to 4.9.2
- wazuh-manager: Remove support for freebsd13-aarch64
- wazuh-manager: Cache files were generated from python3.11 instead of
python3.10
- wazuh-manager: Remove obsolete patch files
- wazuh-dashboards : Use opensearch-dashboards230 instead of
opensearch-dashboards210
ChangeLog at: https://github.com/wazuh/wazuh/releaseshttps://github.com/wazuh/wazuh-dashboard-plugins/releases
PR: 282160
Reported by: Ian Dickens <ian at south-border.com>
security/wazuh-*: Update to 4.7.5
- Fix build/installation on aarch64
- Fix runtime issues on 14.x and 15.x because of openssl3 support [1]
PR: 279363
Reported by: girgen [1]
security/wazuh-*: Update to 4.7.2
- Install FreeBSD rules, decoders and SCA files by default
- Strip python binary and so files
- Add devel/libffi and databases/arrow to LIB_DEPENDS
- Update pkg-message files
- Othe minor modifications
ChangeLog
at: https://documentation.wazuh.com/current/release-notes/release-4-7-2.html
security/wazuh: Update to 4.7.0
- Fix ssl=openssl build [1]
- Fix permissions of backup/db directory. Now backup are generated without
problems
- Add support for get ports info
- Add support for get processes info
- Add a better way for get memory info
- Add new decoders and rules files (https://github.com/alonsobsd/wazuh-freebsd)
- Update FreeBSD sca files (https://github.com/alonsobsd/wazuh-freebsd)
- Minor changes to SysInfo::getPackages function
- Another minor modifications
PR: 275008
Reported by: franco _at_ opnsense.org [1]
security/wazuh-*: Update to 4.6.0
- security/wazuh-manager: Deactivate CIS files. The are renamed to
yml.deprecated
- security/wazuh-agent: Don't install all CIS files
- Turn security.keys a sample file. It helps to avoid remove client.keys on
update
- Update pkg-message.in files
- Another minor modifications
security/wazuh-*: Update to 4.5.3
- security/wazuh-agent: Enable INOTIFY option by default. It enables Kevent
based real time monitoring. See some examples like use it at:
https://wazuh.com/blog/detecting-common-linux-persistence-techniques-with-wazuh/
- security/wazuh-manager: Add entries to pkg-message.in about FreeBSD SCA files
and FreeBSD decoders and rules files. I'll maintain update versions of these
files at https://github.com/alonsobsd/wazuh-freebsd
- security/wazuh-dashboard: Update project url to new one
- Othe minor modifications
security/wazuh-*: Update to 4.5.0
- wazuh-indexer and wazuh-dashboards now use 2.9.0 version of opensearch and
opensearch-dashboard
- Revert beats dependency to beats7 (filebeat) at security/wazuh-server. beats8
has some issues with filebeat (Take a look at PR/272701)
security/wazuh-*: Update to 4.4.4
- Add python path files from lang/python39/files
- wazuh-indexer and wazuh-dashboards now use 2.8.0 version of opensearch and
opensearch-dashboard
- Update beats dependency to beats8 (filebeat) at security/wazuh-server
security/wazuh-*: Update to 4.4.3
- Mark IGNORE on FreeBSD 12-aarch64
- Use makepatch to generate patch files
- Fix typo at wazuh-agent and wazuh-manager pkg-message files [1]
- Fix some linking issues when devel/libsysinfo is installed (using ports).
wazuh-manager compile/install a library with the same name like libsysinfo and
it is used by syscollector feature.
- wazuh-dashboard use opensearch-dashboards 2.7.0
- Some other modifications
ChangeLog at: https://github.com/wazuh/wazuh/releases
PR: 271376
Reported by: lambert _ at _ sanesecurityguy.com [1]
*/*: Update path set in BUILD_DEPENDS for CMake
Commit b23ea4e2d2f51b53d8915fe9fd7b4efbdd575e38 changed its location to
devel/cmake-core
Approved by: portmgr (blanket)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/wazuh-*: update to 4.3.7
- Add better way to install python wheels. It could fix issues when fbsd is
updated to security patch or minor release
ChangeLog at: https://github.com/wazuh/wazuh/releases/tag/v4.3.7
*/*: Remove redundant '-*' from CONFLICTS definitions
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
security/wazuh-agent: Update to 4.1.4 and fix dirs
Fixes dirs and permissions so the agent can start after install.
PR: 248656
Reported by: Felipe Zipitria <fzipitria@perceptyx.com>
Approved by: Michael Muenz <m.muenz@gmail.com> (maintainer)
security/wazuh-agent: Update 3.11.3 -> 3.12.0; Mark BROKEN on i386
Mark i386 as broken since external OpenSSL dependency does not compile. Until
vendo will fix this in build scripts it's marked as broken.
PR: 245194
Submitted by: Michael Muenz <m.muenz@gmail.com> (maintainer)
security/wazuh-agent: Update to 3.10.2 and remove irrelevant dependency on curl
PR: 241016
Submitted by: Michael Muenz <m.muenz@gmail.com> (maintainer)
The Wazuh agent runs on the hosts that you want to monitor.
It is multi-platform and provides the following capabilities:
- Log and data collection
- File integrity monitoring
- Rootkit and malware detection
- Security policy monitoring.
- Configuration assessments
- Software inventory
In addition, it communicates with the Wazuh manager, sending data in near
real-time through an encrypted and authenticated channel.
WWW: https://github.com/wazuh/wazuh
PR: 237900
Submitted by: Michael Muenz <m.muenz@gmail.com>
