<!--
  Wazuh 5.0 agent configuration fragment for a Windows endpoint.

  Merge the <agent> block below into the agent configuration file:
    64-bit Windows : C:\Program Files (x86)\ossec-agent\ossec.conf
    32-bit Windows : C:\Program Files\ossec-agent\ossec.conf

  The agent file keeps the 4.x root element <ossec_config>. Only the manager
  moved to <wazuh_config> in /var/wazuh-manager/etc/wazuh-manager.conf.

  This fragment is deliberately partial: connection, TLS and enrolment only.
  The installer already writes four <localfile> blocks (Application, Security
  and System as eventchannel, plus active-response\active-responses.log as
  syslog). Leave those in place and tune event log collection in the group's
  shared agent.conf on the manager, not here.

  Every tag below appears in the Wazuh 5.0-beta reference for the <agent>
  section. Options not documented there have been left out rather than guessed.

  Verified on Wazuh 5.0.0-beta5, Windows 11 Pro build 26200: the service is
  WazuhSvc, so apply this file and then
      Restart-Service WazuhSvc

  Lesson: https://maheshtata.com/wazuh/wazuh-agent-windows/
-->
<ossec_config>

  <agent>

    <!-- endpoint replaces the 4.x <address> + <port> pair.
         Host is the only mandatory part; the port defaults to 1517. -->
    <manager>
      <endpoint>10.0.0.2</endpoint>
    </manager>

    <!-- Written by the installer as "windows, windows10". It is what makes an
         <agent_config profile="windows10"> block in a shared group file apply
         to this endpoint. Keep it. -->
    <config-profile>windows, windows10</config-profile>

    <!-- verification_mode defaults to none. Raise it once the manager
         presents a certificate the endpoint can validate.
         Values: none | certificate | full | system
         certificate_authorities is required for 'certificate' and 'full'
         and must NOT be set when verification_mode is 'system'. -->
    <ssl>
      <verification_mode>none</verification_mode>
      <!-- <certificate_authorities>C:\Program Files (x86)\ossec-agent\rootCA.pem</certificate_authorities> -->
    </ssl>

    <!-- Seconds between keepalives. Keep below the manager's
         agents_disconnection_time (default 15m). -->
    <notify_time>20</notify_time>

    <auto_restart>yes</auto_restart>

    <enrollment>
      <enabled>yes</enabled>

      <!-- Defaults to the endpoint hostname. ALWAYS set this explicitly on
           image-based deployments: every clone booting with the template
           hostname produces one successful enrolment and N failures. -->
      <agent_name>FIN-LT-0148</agent_name>

      <!-- Comma-separated. Defaults to 'default'.
           EVERY group named here must already exist on the manager or the
           enrolment handshake is rejected. -->
      <groups>windows-workstations</groups>

      <!-- The installer writes this as the relative path "authd.pass", which
           resolves inside the agent folder. Set it only if you keep the
           password file somewhere else. -->
      <authorization_pass_path>authd.pass</authorization_pass_path>

      <delay_after_enrollment>20</delay_after_enrollment>
    </enrollment>

  </agent>

</ossec_config>
