windows-ansible/ansible/playbooks/wazuh.yml

---
- name: Wazuh Agent
  hosts: "meta-win_project_{{ win_project }}" # will need fixed when proxy is added (linux)
  gather_facts: false
  vars_files:
    - ../vars/common.yml
    - ../vars/connection.yml
  vars:
    wazuh_server: 10.22.10.200
    wazuh_url: https://packages.wazuh.com/4.x/windows
    wazuh_msi: wazuh-agent-4.7.2-1.msi
    ansible_password: "{{ vm_password }}"
  tasks:
    - name: Wazuh Agent
      tags: 
        - wazuh
        - wazuh_agent
      block:
        - name: Download agent
          win_shell: 'Invoke-WebRequest -Uri "{{ wazuh_url }}/{{ wazuh_msi }}" -OutFile "$env:temp\{{ wazuh_msi }}"'
          register: download_result

        - name: Install agent
          win_shell: 'msiexec.exe /i $env:temp\{{ wazuh_msi }} /q WAZUH_MANAGER="{{ wazuh_server }}" WAZUH_REGISTRATION_SERVER="{{ wazuh_server }}"'
          when: download_result.rc == 0

        - name: Start Service
          win_service:
            name: WazuhSvc
            start_mode: auto
            state: started

- name: Wazuh Groups
  hosts: eidf-wazuh01
  gather_facts: no
  vars_files:
    - ../vars/common.yml
  tasks:
    - name: Wazuh Groups
      tags: 
        - wazuh
        - wazuh_group
      block:
        - name: wait for agents to be ready
          pause:
            seconds: 20

        - name: Add the space hosts to openstack-vms
          shell: |
            for i in $(sudo /var/ossec/bin/agent_groups -l -g default | grep {{ win_project }} | awk '{ print $2 }')
            do 
              sudo /var/ossec/bin/agent_groups -a -i $i -g openstack-vms -q
            done
    
            for i in $(sudo /var/ossec/bin/agent_groups -l -g default | grep {{ win_project }} | awk '{ print $2 }')
            do 
              sudo /var/ossec/bin/agent_groups -a -i $i -g space-vms -q
            done

    - name: Remove the space hosts from openstack-vms
      shell: |
        for i in $(sudo /var/ossec/bin/agent_groups -l -g default | grep {{ win_project }} | awk '{ print $2 }')
        do 
          sudo /var/ossec/bin/manage_agents -r $i
        done
      tags: 
        - never
        - teardown