Provides the WazuhWodleOsqueryConfiguration which allows to parse the osquery section of the Wazuh local configuration (ossec.conf).

class WazuhWodleOsqueryConfiguration(**kwargs)

Bases: object

Object representation of an agent’s osquery wodle configuration.

Wazuh reference: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-osquery.html

add_labels: bool = True

Indicates whether the agent’s labels are being added to the events.

bin_path: str | None

Absolute path to the directory containing the osqueryd executable

config_path: str | None

Path to the Osquery configuration file.

disabled: bool

Disable the osquery wodle.

log_path: str | None

Absolute path to the Osquery log file.

packs: list[WazuhWodleOsqueryPackConfiguration]

List of query packs.

run_daemon: bool = True

Indicates whether the module’s osqueryd runs as a subprocess or not.

On this page