Added support for localfile blocks deployment

[72nomada]

Related issue
#16751

This solves the need to deploy extra localfile configuration blocks for ossec.conf based on OS and OS Version.
The new file is called localfile-extra.template. Files should be created under the etc/template/config folder structure.

Current problem was to add the shown localfile block on some macOS versions to use the ULS collection capabilities.

<localfile>
  <location>macos</location>
  <log_format>macos</log_format>
  <query type="trace,log,activity" level="info">(process == "sudo") or (process == "sessionlogoutd" and message contains "logout is complete.") or (process == "sshd") or (process == "tccd" and message contains "Update Access Record") or (message contains "SessionAgentNotificationCenter") or (process == "screensharingd" and message contains "Authentication") or (process == "securityd" and eventMessage contains "Session" and subsystem == "com.apple.securityd")</query>
</localfile>

Test - Agent with localfile-extra.template files

We have created a macOS package using this modification in https://github.com/wazuh/wazuh/pull/16078/files

After package installation, we can verify the correct localfile block is included in the wazuh-agent ossec.conf file:

  ...
  <!-- Log analysis -->
  <localfile>
    <log_format>full_command</log_format>
    <command>netstat -an | awk '{if ((/^(tcp|udp)/) && ($4 != "*.*") && ($5 == "*.*")) {print $1" "$4" "$5}}' | sort -u</command>
    <alias>netstat listening ports</alias>
    <frequency>360</frequency>
  </localfile>

  <localfile>
    <location>macos</location>
    <log_format>macos</log_format>
    <query type="trace,log,activity" level="info">(process == "sudo") or (process == "sessionlogoutd" and message contains "logout is complete.") or (process == "sshd") or (process == "tccd" and message contains "Update Access Record") or (message contains "SessionAgentNotificationCenter") or (process == "screensharingd" and message contains "Authentication") or (process == "securityd" and eventMessage contains "Session" and subsystem == "com.apple.securityd")</query>
  </localfile>

  <!-- Active response -->
  ...

Test - Agent with NO localfile-extra.template files

We tested the packet for an RHEL 9 system with no need for localfile-extra.template configuration. Wazh-agent was installed and worked as expected.

[juliamagan]

QA review

• Type: Manual testing.
• Status: Approved 🟢
• Testing issue: Test support for localfile blocks deployment wazuh-qa#4119
• Comments: Test support for localfile blocks deployment wazuh-qa#4119 (comment)