From 7ac1c8d668718dcf2e9186612ee6e2bdad49f09d Mon Sep 17 00:00:00 2001
From: abrown38 <a.brown@epcc.ed.ac.uk>
Date: Mon, 8 Apr 2024 12:46:35 +0000
Subject: [PATCH] Install wazuah agent and add hosts to groups

---
 ansible/playbooks/wazuh.yml | 73 +++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 ansible/playbooks/wazuh.yml

diff --git a/ansible/playbooks/wazuh.yml b/ansible/playbooks/wazuh.yml
new file mode 100644
index 0000000..965cf9a
--- /dev/null
+++ b/ansible/playbooks/wazuh.yml
@@ -0,0 +1,73 @@
+---
+- name: Wazuh Agent
+  hosts: "meta-win_project_{{ win_project }}"
+  gather_facts: false
+  vars_files:
+    - ../vars/common.yml
+    - ../vars/connection.yml
+  vars:
+    wazuh_server: 10.22.10.200
+    wazuh_url: https://packages.wazuh.com/4.x/windows
+    wazuh_msi: wazuh-agent-4.7.2-1.msi
+    ansible_password: "{{ vm_password }}"
+  tasks:
+    - name: Wazuh Agent
+      tags: 
+        - wazuh
+        - wazuh_agent
+      block:
+        - name: Download agent
+          win_shell: 'Invoke-WebRequest -Uri "{{ wazuh_url }}/{{ wazuh_msi }}" -OutFile "$env:temp\{{ wazuh_msi }}"'
+          register: download_result
+
+        - name: Install agent
+          win_shell: 'msiexec.exe /i $env:temp\{{ wazuh_msi }} /q WAZUH_MANAGER="{{ wazuh_server }}" WAZUH_REGISTRATION_SERVER="{{ wazuh_server }}"'
+          when: download_result.rc == 0
+
+        - name: Start Service
+          win_service:
+            name: WazuhSvc
+            start_mode: auto
+            state: started
+
+- name: Wazuh Groups
+  hosts: eidf-wazuh01
+  gather_facts: no
+  vars_files:
+    - ../vars/common.yml
+  vars:
+    ansible_ssh_private_key_file: /etc/ansible/keys/rundeck.key
+    ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+  remote_user: rundeck
+  tasks:
+    - name: Wazuh Groups
+      tags: 
+            - wazuh
+            - wazuh_group
+      block:
+        - name: wait for agents to be ready
+          pause:
+            seconds: 20
+
+        - name: Add the space hosts to openstack-vms
+          shell: |
+            for i in $(sudo /var/ossec/bin/agent_groups -l -g default | grep {{ win_project }} | awk '{ print $2 }')
+            do 
+              sudo /var/ossec/bin/agent_groups -a -i $i -g openstack-vms -q
+            done
+    
+            for i in $(sudo /var/ossec/bin/agent_groups -l -g default | grep {{ win_project }} | awk '{ print $2 }')
+            do 
+              sudo /var/ossec/bin/agent_groups -a -i $i -g space-vms -q
+            done
+
+    - name: Remove the space hosts from openstack-vms
+      shell: |
+        for i in $(sudo /var/ossec/bin/agent_groups -l -g default | grep {{ win_project }} | awk '{ print $2 }')
+        do 
+          sudo /var/ossec/bin/manage_agents -r $i
+        done
+      tags: 
+        - never
+        - teardown
+        
\ No newline at end of file