Comparer le texte

Encuentra la diferencia entre dos archivos de texto

Real-time diff
Unified diff
Collapse lines
Highlight change
Syntax highlighting
Outils
Diffchecker Desktop icon
Diffchecker Desktop The most secure way to run Diffchecker. Get the Diffchecker Desktop app: your diffs never leave your computer!Get Desktop

macOS default vs macOS Ansible

Created Diff never expires
26 removals
Lines
Total
Removed
Words
Total
Removed
To continue using this feature, upgrade to
Diffchecker logo
Diffchecker Pro
162 lines
55 additions
Lines
Total
Added
Words
Total
Added
To continue using this feature, upgrade to
Diffchecker logo
Diffchecker Pro
182 lines
<!-- Ansible managed -->
<!--
<!--
Wazuh - Agent - Default configuration for darwin 21.1
Wazuh - Agent
More info at: https://documentation.wazuh.com
More info at: https://documentation.wazuh.com
Mailing list: https://groups.google.com/forum/#!forum/wazuh
Mailing list: https://groups.google.com/forum/#!forum/wazuh
-->
-->


<ossec_config>
<ossec_config>
<client>
<client>
<server>
<server>
<address></address>
<address>3.88.154.40</address>
<port>1514</port>
<port>1514</port>
<protocol>tcp</protocol>
<protocol>tcp</protocol>
<max_retries>5</max_retries>
<retry_interval>5</retry_interval>
</server>
</server>
<config-profile>darwin, darwin21, darwin21.1</config-profile>
<config-profile>darwin, darwin21, darwin21.1</config-profile>
<notify_time>10</notify_time>
<notify_time>10</notify_time>
<time-reconnect>60</time-reconnect>
<time-reconnect>60</time-reconnect>
<auto_restart>yes</auto_restart>
<auto_restart>yes</auto_restart>
<crypto_method>aes</crypto_method>
<crypto_method>aes</crypto_method>


</client>
</client>


<client_buffer>
<client_buffer>
<!-- Agent buffer options -->
<!-- Agent buffer options -->
<disabled>no</disabled>
<disabled>no</disabled>
<queue_size>5000</queue_size>
<queue_size>5000</queue_size>
<events_per_second>500</events_per_second>
<events_per_second>500</events_per_second>
</client_buffer>
</client_buffer>


<!-- Policy monitoring -->
<rootcheck>
<rootcheck>
<disabled>no</disabled>
<disabled>no</disabled>
<check_files>yes</check_files>
<check_files>yes</check_files>
<check_trojans>yes</check_trojans>
<check_trojans>yes</check_trojans>
<check_dev>yes</check_dev>
<check_dev>yes</check_dev>
<check_sys>yes</check_sys>
<check_sys>yes</check_sys>
<check_pids>yes</check_pids>
<check_pids>yes</check_pids>
<check_ports>yes</check_ports>
<check_ports>yes</check_ports>
<check_if>yes</check_if>
<check_if>yes</check_if>


<!-- Frequency that rootcheck is executed - every 12 hours -->
<!-- Frequency that rootcheck is executed - every 12 hours -->
<frequency>43200</frequency>
<frequency>43200</frequency>


<rootkit_files>etc/shared/rootkit_files.txt</rootkit_files>
<rootkit_files>etc/shared/rootkit_files.txt</rootkit_files>
<rootkit_trojans>etc/shared/rootkit_trojans.txt</rootkit_trojans>
<rootkit_trojans>etc/shared/rootkit_trojans.txt</rootkit_trojans>

<skip_nfs>yes</skip_nfs>
<skip_nfs>yes</skip_nfs>

</rootcheck>
</rootcheck>





<!-- Osquery integration -->
<!-- Osquery integration -->
<wodle name="osquery">
<wodle name="osquery">
<disabled>yes</disabled>
<disabled>yes</disabled>
<run_daemon>yes</run_daemon>
<run_daemon>yes</run_daemon>
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
<config_path>/etc/osquery/osquery.conf</config_path>
<config_path>/etc/osquery/osquery.conf</config_path>
<add_labels>yes</add_labels>
<add_labels>yes</add_labels>
</wodle>
</wodle>


<!-- System inventory -->
<!-- System inventory -->
<wodle name="syscollector">
<wodle name="syscollector">
<disabled>no</disabled>
<disabled>no</disabled>
<interval>1h</interval>
<interval>1h</interval>
<scan_on_start>yes</scan_on_start>
<scan_on_start>yes</scan_on_start>
<hardware>yes</hardware>
<hardware>yes</hardware>
<os>yes</os>
<os>yes</os>
<network>yes</network>
<network>yes</network>
<packages>yes</packages>
<packages>yes</packages>
<ports all="no">yes</ports>
<ports all="no">yes</ports>
<processes>yes</processes>
<processes>yes</processes>

<!-- Database synchronization settings -->
<synchronization>
<max_eps>10</max_eps>
</synchronization>
</wodle>
</wodle>


<sca>
<sca>
<enabled>yes</enabled>
<enabled>yes</enabled>
<scan_on_start>yes</scan_on_start>
<scan_on_start>yes</scan_on_start>
<interval>12h</interval>
<interval>12h</interval>
<skip_nfs>yes</skip_nfs>
<skip_nfs>yes</skip_nfs>
</sca>
</sca>

<!-- File integrity monitoring -->

<!-- Directories to check (perform all possible verifications) -->
<syscheck>
<syscheck>
<disabled>no</disabled>
<disabled>no</disabled>

<!-- Frequency that syscheck is executed default every 12 hours -->
<frequency>43200</frequency>
<frequency>43200</frequency>

<scan_on_start>yes</scan_on_start>
<scan_on_start>yes</scan_on_start>
<!-- Directories to check (perform all possible verifications) -->
<directories >/etc,/usr/bin,/usr/sbin</directories>
<directories >/bin,/sbin</directories>


<!-- Directories to check (perform all possible verifications) -->
<!-- Directories to check (perform all possible verifications) -->
<directories>/etc,/usr/bin,/usr/sbin</directories>
<directories>/bin,/sbin</directories>


<!-- Files/directories to ignore -->
<!-- Files/directories to ignore -->
<ignore>/etc/mtab</ignore>
<ignore>/etc/mtab</ignore>
<ignore>/etc/hosts.deny</ignore>
<ignore>/etc/hosts.deny</ignore>
<ignore>/etc/mail/statistics</ignore>
<ignore>/etc/mail/statistics</ignore>
<ignore>/etc/random-seed</ignore>
<ignore>/etc/random-seed</ignore>
<ignore>/etc/random.seed</ignore>
<ignore>/etc/random.seed</ignore>
<ignore>/etc/adjtime</ignore>
<ignore>/etc/adjtime</ignore>
<ignore>/etc/httpd/logs</ignore>
<ignore>/etc/httpd/logs</ignore>
<ignore>/etc/utmpx</ignore>
<ignore>/etc/utmpx</ignore>
<ignore>/etc/wtmpx</ignore>
<ignore>/etc/wtmpx</ignore>
<ignore>/etc/cups/certs</ignore>
<ignore>/etc/cups/certs</ignore>
<ignore>/etc/dumpdates</ignore>
<ignore>/etc/dumpdates</ignore>
<ignore>/etc/svc/volatile</ignore>
<ignore>/etc/svc/volatile</ignore>


<!-- File types to ignore -->
<!-- File types to ignore -->
<ignore type="sregex">.log$|.swp$</ignore>
<ignore type="sregex">.log$|.swp$</ignore>


<!-- Check the file, but never compute the diff -->

<!-- Files no diff -->
<nodiff>/etc/ssl/private.key</nodiff>
<nodiff>/etc/ssl/private.key</nodiff>


<skip_nfs>yes</skip_nfs>
<skip_nfs>yes</skip_nfs>
<skip_dev>yes</skip_dev>
<skip_dev>yes</skip_dev>
<skip_proc>yes</skip_proc>
<skip_proc>yes</skip_proc>
<skip_sys>yes</skip_sys>
<skip_sys>yes</skip_sys>


<!-- Nice value for Syscheck process -->



<!-- Nice value for Syscheck module -->
<process_priority>10</process_priority>
<process_priority>10</process_priority>


<!-- Maximum output throughput -->
<!-- Maximum output throughput -->
<max_eps>100</max_eps>
<max_eps>100</max_eps>


<!-- Database synchronization settings -->
<!-- Database synchronization settings -->
<synchronization>
<synchronization>
<enabled>yes</enabled>
<enabled>yes</enabled>
<interval>5m</interval>
<interval>5m</interval>
<max_interval>1h</max_interval>
<max_interval>1h</max_interval>
<max_eps>10</max_eps>
<max_eps>10</max_eps>
</synchronization>
</synchronization>
</syscheck>
</syscheck>


<!-- Log analysis -->
<!-- Files to monitor (localfiles) -->


<localfile>
<localfile>
<log_format>full_command</log_format>
<log_format>full_command</log_format>
<command>netstat -an | awk '{if ((/^(tcp|udp)/) && ($4 != "*.*") && ($5 == "*.*")) {print $1" "$4" "$5}}' | sort -u</command>
<command>netstat -an | awk '{if ((/^(tcp|udp)/) && ($4 != "*.*") && ($5 == "*.*")) {print $1" "$4" "$5}}' | sort -u</command>
<frequency>360</frequency>
<alias>netstat listening ports</alias>
<alias>netstat listening ports</alias>
<frequency>360</frequency>
</localfile>
</localfile>


<localfile>
<localfile>
<location>macos</location>
<log_format>macos</log_format>
<log_format>macos</log_format>
<query type="trace,log,activity" level="info">(process == "sudo") or (process == "sessionlogoutd" and message contains "logout is complete.") or (process == "sshd") or (process == "tccd" and message contains "Update Access Record") or (message contains "SessionAgentNotificationCenter") or (process == "screensharingd" and message contains "Authentication") or (process == "securityd" and eventMessage contains "Session" and subsystem == "com.apple.securityd")</query>
<location>macos</location>
<query type="trace,log,activity" level="info">
(process == "sudo")
or (process == "sessionlogoutd" and message contains "logout is complete.")
or (process == "sshd")
or (process == "tccd" and message contains "Update Access Record")
or (message contains "SessionAgentNotificationCenter")
or (process == "screensharingd" and message contains "Authentication")
or (process == "securityd" and eventMessage contains "Session" and subsystem == "com.apple.securityd")
</query>
</localfile>
</localfile>


<!-- Active response -->




<active-response>
<active-response>
<disabled>no</disabled>
<disabled>no</disabled>
<ca_store>etc/wpk_root.pem</ca_store>
<ca_store>
etc/wpk_root.pem
</ca_store>
<ca_verification>yes</ca_verification>
<ca_verification>yes</ca_verification>
</active-response>
</active-response>


<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
<logging>
<logging>
<log_format>plain</log_format>
<log_format>plain</log_format>
</logging>
</logging>


</ossec_config>
</ossec_config>


Les différences enregistrées