How to update Wazuh ruleset with proxy ?

[NRGLine4Sec]

[NRGLine4Sec]

So I succeeded to check the update with some modifications in /var/ossec/framework/scripts/update_ruleset.py. I added :

http_proxy  = "http://172.16.2.87:3128"
https_proxy = "http://172.16.2.87:3128"

proxyDict = { 
              "http"  : http_proxy, 
              "https" : https_proxy, 
            }

above of def get_new_ruleset(source, url, branch_name=None): And I modify the line f_url = requests.get(url_ruleset) with f_url = requests.get(url_ruleset, proxies=proxyDict). So it works but when I check the file after the update, modifications are gone. How to do it permanently ?

Is there an easier way to update with a proxy ?

[Lopuiz]

Hello!

The update replaces the update_ruleset.py script. The following function do it:

https://github.com/wazuh/wazuh-ruleset/blob/be216805001c0bd66d401b538f36e02feb59cabb/update_ruleset#L251-L318

You should modify it too.

Regards, Eva

[NRGLine4Sec]

Hi Eva, Thanks for your reply. It is in your roadmap to support proxy for Wazuh ruleset update ?

[Lopuiz]

Sorry, I have no idea. I'll stay this issue open to try to support it.

[NRGLine4Sec]

OK, thanks

[NRGLine4Sec]

Hi @Lopuiz, Any update on this issue ?