Change to Wazuh Manager

docker exec -it single-node-wazuh.manager-1 /bin/bash

/var/ossec/etc/ossec.conf

Code

<integration>
<name>virustotal</name>
<api_key>insert </api_key>
<group>syscheck</group>
<alert_format>json</alert_format>
</integration>

/var/ossec/bin/wazuh-control restart

Yuhan@redback

/var/ossec/etc/ossec.conf in Wazuh agent

<syscheck>
<directories check_all="yes"
realtime="yes">/home/virustotaltest</directories>
</syscheck>

Make a directory inside home - virustest

sudo curl -Lo /media/user/software/suspicious-file.exe https://secure.eicar.org/eicar.com

Wazuh