Skip to content

Instantly share code, notes, and snippets.

@startergo

startergo/Wazuh_macos.md

Last active February 16, 2024 20:19
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save startergo/e4bc2b384d6a86feddd4bb19908a86fe to your computer and use it in GitHub Desktop.
Save startergo/e4bc2b384d6a86feddd4bb19908a86fe to your computer and use it in GitHub Desktop.
Download ZIP
Remove Wazuh client agent
Raw
Wazuh_macos.md
  • Remove agent:
pkgutil --pkgs | grep wazuh
com.wazuh.pkg.wazuh-agent-etc
com.wazuh.pkg.wazuh-agent 
rm -rf /Library/Ossec
rm -rf /Library/StartupItems/WAZUH
rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
rm -f /private/etc/ossec-init.conf
pkgutil --forget com.wazuh.pkg.wazuh-agent-etc
pkgutil --forget com.wazuh.pkg.wazuh-agent
  • Install agent:
curl -so wazuh-agent.pkg https://packages.wazuh.com/4.x/macos/wazuh-agent-4.7.2-1.intel64.pkg && echo "WAZUH_MANAGER='ip.address.server' && WAZUH_AGENT_GROUP='default' && WAZUH_AGENT_NAME='mbp151'" > /tmp/wazuh_envs && sudo installer -pkg ./wazuh-agent.pkg -target /
  • Start agent:
sudo /Library/Ossec/bin/wazuh-control start
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment