<ossec_config>

  <global>

    <jsonout_output>yes</jsonout_output>

    <alerts_log>yes</alerts_log>

    <logall>no</logall>

    <logall_json>no</logall_json>

    <email_notification>no</email_notification>

  </global>

  <alerts>

    <log_alert_level>3</log_alert_level>

  </alerts>

  <remote>

    <connection>secure</connection>

    <port>1514</port>

    <protocol>tcp</protocol>

    <queue_size>131072</queue_size>

  </remote>

  <auth>

    <disabled>no</disabled>

    <port>1515</port>

    <use_source_ip>no</use_source_ip>

    <force>

      <enabled>yes</enabled>

      <after_registration_time>1h</after_registration_time>

    </force>

    <purge>yes</purge>

    <use_password>no</use_password>

  </auth>

  <ruleset>

    <decoder_dir>ruleset/decoders</decoder_dir>

    <rule_dir>ruleset/rules</rule_dir>

    <decoder_dir>etc/decoders</decoder_dir>

    <rule_dir>etc/rules</rule_dir>

    <list>etc/lists/cti-malicious-ip</list>

    <list>etc/lists/cti-malicious-domain</list>

    <list>etc/lists/cti-malware-hash</list>

  </ruleset>

  <integration>

    <name>custom-thehive</name>

    <hook_url>SET_FROM_ENV_SHUFFLE_WEBHOOK_URL</hook_url>

    <level>10</level>

    <alert_format>json</alert_format>

  </integration>

  <command>

    <name>firewall-drop</name>

    <executable>firewall-drop</executable>

    <timeout_allowed>yes</timeout_allowed>

  </command>

  <active-response>

    <command>firewall-drop</command>

    <location>local</location>

    <rules_id>100210</rules_id>

    <timeout>600</timeout>

  </active-response>

  <vulnerability-detection>

    <enabled>yes</enabled>

    <index-status>yes</index-status>

  </vulnerability-detection>

</ossec_config>