<!--
  Wazuh 5.0 enrolment fragment: the agent-configuration route.

  Merge into the agent configuration file on the endpoint:
    Linux   /var/ossec/etc/ossec.conf
    macOS   /Library/Ossec/etc/ossec.conf
    Windows C:\Program Files (x86)\ossec-agent\ossec.conf   (64-bit)
            C:\Program Files\ossec-agent\ossec.conf         (32-bit)

  In 5.0 enrolment runs over the SAME HTTPS channel and the same TLS material
  as everything else. There is no separate address, port or certificate
  configuration for enrolment any more. The 4.x <enrollment> options
  manager_address, port, ssl_cipher, server_ca_path, agent_certificate_path
  and agent_key_path are read and ignored with an INFO log line.

  Lesson: https://maheshtata.com/wazuh/wazuh-agent-enrollment/
-->
<ossec_config>

  <agent>

    <manager>
      <!-- Host is mandatory; the port defaults to 1517. -->
      <endpoint>10.0.0.2</endpoint>
    </manager>

    <ssl>
      <!-- none | certificate | full | system   (default: none) -->
      <verification_mode>none</verification_mode>
      <!-- Required for 'certificate' and 'full'; must NOT be set for 'system'. -->
      <!-- <certificate_authorities>/var/ossec/etc/rootCA.pem</certificate_authorities> -->

      <!-- Optional mutual TLS. certificate and key must be set together. -->
      <!-- <certificate>/var/ossec/etc/sslagent.cert</certificate> -->
      <!-- <key>/var/ossec/etc/sslagent.key</key> -->
    </ssl>

    <enrollment>
      <enabled>yes</enabled>

      <!-- Unique across the deployment. Defaults to the hostname, which is
           why cloned endpoints collide. A duplicate name is rejected with
           'ERROR: Invalid agent name: <name> (from manager)'. -->
      <agent_name>mac-design-04</agent_name>

      <!-- Comma-separated. Defaults to 'default'.
           EVERY group listed must already exist on the manager, or the
           handshake is rejected and the agent never connects. There is no
           fallback to 'default' for an unknown group in 5.0. -->
      <groups>macos-laptops</groups>

      <!-- Only needed when the password file is not in the agent's etc dir:
             Linux   /var/ossec/etc/authd.pass
             macOS   /Library/Ossec/etc/authd.pass
             Windows C:\Program Files (x86)\ossec-agent\authd.pass -->
      <!-- <authorization_pass_path>/var/ossec/etc/authd.pass</authorization_pass_path> -->

      <!-- Seconds between a successful enrolment and normal operation. -->
      <delay_after_enrollment>20</delay_after_enrollment>

      <!-- Override the auto-detected address when NAT reports the wrong one. -->
      <!-- <agent_address>192.0.2.25</agent_address> -->

      <!-- Record the source address instead of the configured one. -->
      <!-- <use_source_ip>no</use_source_ip> -->
    </enrollment>

  </agent>

</ossec_config>
