--- etc/ossec-server.conf	2025-11-07 00:46:03.000000000 -0800
+++ etc/ossec-server.conf	2026-01-10 15:58:20.321540000 -0800
@@ -20,6 +20,26 @@
     <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
   </global>
 
+  <vulnerability-detection>
+     <enabled>no</enabled>
+     <index-status>yes</index-status>
+     <feed-update-interval>60m</feed-update-interval>
+  </vulnerability-detection>
+
+  <indexer>
+     <enabled>no</enabled>
+     <hosts>
+        <host>https://127.0.0.1:9200</host>
+     </hosts>
+    <ssl>
+      <certificate_authorities>
+        <ca>/usr/local/etc/logstash/certs/root-ca.pem</ca>
+      </certificate_authorities>
+      <certificate>/usr/local/etc/logstash/certs/server1.pem</certificate>
+      <key>/usr/local/etc/logstash/certs/server1-key.pem</key>
+    </ssl>
+  </indexer>
+
   <alerts>
     <log_alert_level>3</log_alert_level>
     <email_alert_level>12</email_alert_level>
@@ -29,6 +49,7 @@
     <connection>secure</connection>
     <port>1514</port>
     <protocol>tcp</protocol>
+    <queue_size>131072</queue_size>
   </remote>
 
   <!-- Policy monitoring -->
@@ -43,7 +64,6 @@
 
     <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
     <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
-    <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>
 
     <skip_nfs>yes</skip_nfs>
   </rootcheck>
@@ -200,7 +220,7 @@
 
   <localfile>
     <log_format>syslog</log_format>
-    <location>/var/log/syslog</location>
+    <location>/var/log/userlog</location>
   </localfile>
 
   <localfile>
@@ -211,7 +231,7 @@
 
   <localfile>
     <log_format>full_command</log_format>
-    <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>
+    <command>(netstat -n -f inet && netstat -n -f inet) | grep -e "udp" -e "tcp" | sed 's/\([[:alnum:]]*\)\ *[[:digit:]]*\ *[[:digit:]]*\ *\([[:digit:]\.]*\)\.\([[:digit:]]*\)\ *\([[:digit:]\.]*\).*/\1 \2 == \3 == \4/' | sort -k4 -g | sed 's/ == \(.*\) ==/.\1/'</command>
     <frequency>360</frequency>
   </localfile>
 
@@ -236,4 +256,32 @@
     <rule_dir>etc/rules</rule_dir>
   </ruleset>
 
+  <!-- Configuration for wazuh-authd -->
+  <auth>
+    <disabled>no</disabled>
+    <port>1515</port>
+    <use_source_ip>no</use_source_ip>
+    <purge>yes</purge>
+    <use_password>yes</use_password>
+    <ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
+    <!-- <ssl_agent_ca></ssl_agent_ca> -->
+    <ssl_verify_host>no</ssl_verify_host>
+    <ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
+    <ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
+    <ssl_auto_negotiate>no</ssl_auto_negotiate>
+  </auth>
+
+  <cluster>
+    <name>wazuh</name>
+    <node_name>indexer1</node_name>
+    <node_type>master</node_type>
+    <key></key>
+    <port>1516</port>
+    <bind_addr>0.0.0.0</bind_addr>
+    <nodes>
+        <node>NODE_IP</node>
+    </nodes>
+    <hidden>no</hidden>
+    <disabled>yes</disabled>
+  </cluster>
 </ossec_config>