Added the ignores of type 'os_regex' in the request of the configurat…

[bah07]

Related issue
#3611

Description

Added the ignores of type 'os_regex' in the request of the configuration on demand of Rootcheck and Syscheck modules.

Configuration options

## Syscheck
    <!-- File types to ignore -->
    <ignore type="sregex">^/proc</ignore>
    <ignore type="sregex">.log$|.swp$</ignore>
    <ignore type="sregex">^/sys</ignore>
    <ignore type="sregex">.jpg$|.swf$|.mp4</ignore>

...

## Rootcheck
    <ignore>/etc/group</ignore>
    <ignore>/etc/shadow</ignore>
    <ignore type="sregex">^/etc</ignore>
    <ignore type="sregex">$.conf</ignore>
    <ignore type="sregex">$.log|^/usr/sbin</ignore>

Checked with empty configuration,

Logs/Alerts example

The JSON output in Windows and Linux agent. Windows agent includes os_regex type ignores in registry entries:

Linux

...

         "ignore": [
            "/etc/mtab",
            "/etc/hosts.deny",
            "/etc/mail/statistics",
            "/etc/random-seed",
            "/etc/random.seed",
            "/etc/adjtime",
            "/etc/httpd/logs",
            "/etc/utmpx",
            "/etc/wtmpx",
            "/etc/cups/certs",
            "/etc/dumpdates",
            "/etc/svc/volatile",
            "/sys/kernel/security",
            "/sys/kernel/debug",
            "/dev/core"
         ],
         "ignore_regex": [
            "^/proc",
            ".log$|.swp$",
            "^/sys",
            ".jpg$|.swf$|.mp4"
         ],
         "whodata": {
            "restart_audit": "yes",
            "startup_healthcheck": "yes"
         }
      }
   }
}

Windows agent

...

            {
               "entry": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx",
               "arch": "32bit"
            },
            {
               "entry": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\ADOVMPPackage\\Final",
               "arch": "32bit"
            }
         ],
         "registry_ignore_regex": [
            {
               "entry": "\\Enum$",
               "arch": "32bit"
            }
         ]
      }
   }
}

Rootcheck

         "ignore": [
            "/etc/group",
            "/etc/shadow"
         ],
         "ignore_sregex": [
            "^/etc",
            "$.conf",
            "$.log|^/usr/sbin"
         ]

Tests

Valgrind Report

==1728== 
==1728== LEAK SUMMARY:
==1728==    definitely lost: 0 bytes in 0 blocks
==1728==    indirectly lost: 0 bytes in 0 blocks
==1728==      possibly lost: 544 bytes in 2 blocks
==1728==    still reachable: 2,103,548 bytes in 44,661 blocks
==1728==         suppressed: 0 bytes in 0 blocks
==1728== 
==1728== For counts of detected and suppressed errors, rerun with: -v
==1728== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)

• Compilation without warnings in every supported platform
  • Linux
  • Windows
  • MAC OS X
• Source installation
• Package installation
• Source upgrade
• Package upgrade
• Memory tests
  • Valgrind report for affected components
  • CPU impact
  • RAM usage impact
• Retrocompatibility with older Wazuh versions
• Working on cluster environments
• Configuration on demand reports new parameters
• Review logs syntax and correct language
• QA templates contemplate the added capabilities

[vikman90]

LGTM!