<!--
  Wazuh 5.0 agent configuration fragment for a Linux endpoint.

  Merge the <agent> block below into /var/ossec/etc/ossec.conf on the endpoint.
  The agent file keeps the 4.x root element <ossec_config>; only the manager
  moved to <wazuh_config> in /var/wazuh-manager/etc/wazuh-manager.conf.

  This fragment is deliberately partial. It covers connection, TLS and
  enrolment only. Capability blocks (syscheck, sca, localfile, syscollector)
  belong in the group's shared agent.conf on the manager, not here.

  Every tag below appears in the Wazuh 5.0-beta reference for the <agent>
  section. Options not documented there have been left out rather than guessed.

  Lesson: https://maheshtata.com/wazuh/wazuh-agent-linux/
-->
<ossec_config>

  <agent>

    <!-- endpoint replaces the 4.x <address> + <port> pair.
         Host is the only mandatory part; the port defaults to 1517.
         Valid forms: 10.0.0.2
                      manager.example.com:8443/gateway
                      [2001:db8::1]:1517 -->
    <manager>
      <endpoint>10.0.0.2</endpoint>
    </manager>

    <!-- TLS for the agent's HTTPS connection to the manager.
         verification_mode defaults to none. Raise it once the manager
         presents a certificate the endpoint can validate:
           none        no verification (testing only)
           certificate verify against certificate_authorities, no hostname check
           full        verify certificate and hostname
           system      verify against the OS trust store
         certificate_authorities is required for 'certificate' and 'full',
         and must NOT be set when verification_mode is 'system'. -->
    <ssl>
      <verification_mode>none</verification_mode>
      <!-- <certificate_authorities>/var/ossec/etc/rootCA.pem</certificate_authorities> -->
    </ssl>

    <!-- Seconds between keepalives. Keep this below the manager's
         agents_disconnection_time (default 15m) or the manager will mark a
         healthy agent disconnected. -->
    <notify_time>20</notify_time>

    <!-- Restart the agent when the manager sends a new valid shared config. -->
    <auto_restart>yes</auto_restart>

    <enrollment>
      <enabled>yes</enabled>

      <!-- Defaults to the endpoint hostname. Set it explicitly on anything
           cloned from a template: a duplicate name is rejected by the manager. -->
      <agent_name>web-prod-01</agent_name>

      <!-- Comma-separated. Defaults to 'default'.
           EVERY group named here must already exist on the manager or the
           enrolment handshake is rejected and the agent never connects. -->
      <groups>linux-servers</groups>

      <!-- Only needed when the password file is not at the default location
           /var/ossec/etc/authd.pass -->
      <!-- <authorization_pass_path>/var/ossec/etc/authd.pass</authorization_pass_path> -->

      <delay_after_enrollment>20</delay_after_enrollment>
    </enrollment>

  </agent>

</ossec_config>
