<!--
  The Command module (wodle name="command") is the other way to run a command.
  It is separate from <localfile><log_format>command</log_format> and has its
  own remote-execution gate: wazuh_command.remote_commands=1 in
  /var/ossec/etc/local_internal_options.conf.

  Unlike localfile, the Command module verifies the hash of the executed
  binary or script before it runs it, and supports day / wday / time
  scheduling. Prefer it for anything that points at a script.

  Reference:
  https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/command-monitoring/configuration.html
  https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/command-monitoring/security-considerations.html
-->

<wodle name="command">
  <disabled>no</disabled>
  <tag>who-user</tag>
  <command>whoami</command>
  <interval>2m</interval>
  <run_on_start>yes</run_on_start>
  <timeout>10</timeout>
</wodle>

<!-- A script, with integrity verification. verify_sha256 only checks the
     FIRST argument of <command>, so the script must be that first argument.
     Recompute the hash every time the script changes, and leave
     skip_verification at no. -->
<wodle name="command">
  <disabled>no</disabled>
  <tag>sudoers-review</tag>
  <command>/usr/local/bin/report-sudoers.sh</command>
  <interval>1d</interval>
  <run_on_start>no</run_on_start>
  <time>03:30</time>
  <timeout>30</timeout>
  <ignore_output>no</ignore_output>
  <skip_verification>no</skip_verification>
  <!-- TODO: replace with the sha256sum of report-sudoers.sh on your endpoints -->
  <verify_sha256>REPLACE_WITH_SHA256_OF_THE_SCRIPT</verify_sha256>
</wodle>
