Provides the WazuhAgentActiveResponseConfiguration which allows to parse the active_response section of the Wazuh local configuration (ossec.conf).

class WazuhAgentActiveResponseConfiguration(**kwargs)

Bases: object

Object representation of an agent’s active_response configuration section.

Wazuh reference: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/active-response.html

disabled: bool

Toggles the active-response capability on and off.

repeated_offenders: list[int] | None

Sets timeouts in minutes for repeat offenders. This is a list of increasing timeouts that can contain a maximum of 5 entries.

On this page