Provides the WazuhAgentSyscheckWhodataConfiguration which allows to parse the whodata subsection of the syscheck section of the Wazuh local configuration (ossec.conf).

class WazuhAgentSyscheckWhodataConfiguration(**kwargs)

Bases: object

Object representation of an agent’s syscheck.whodata configuration section.

Wazuh reference: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/syscheck.html#whodata

audit_key: list[str]

List of keys which will be used to collect Audit events.

provider: str | None

The who-data provider.

Possible values: [“audit”, “ebpf”]

queue_size: int | None

Maximum capacity of the audit event dispatcher queue.

restart_audit: bool = True

Indicates whether auditd may be restarted by the agent or not.

startup_healthcheck: bool = True

Indicates whether an Audit healthcheck will be performed on startup or not.

On this page