How to Configure Wazuh Agent Groups (Centralized Configuration)

Wazuh agent groups let administrators apply the same configuration, rules and shared files to many agents at once. Each agent belongs to one or more groups, and the manager pushes a shared agent.conf to every member automatically.

1. Create a new group

Use agent_groups on the Wazuh manager to add a group:

/var/ossec/bin/agent_groups -a -g linux-servers -q

2. Assign agents to the group

/var/ossec/bin/agent_groups -a -i 001 -g linux-servers -q

3. Edit the shared agent.conf

Shared configuration lives in /var/ossec/etc/shared/<group>/agent.conf. Edit it to push FIM, log collection or active response settings to every agent in the group:

<agent_config>
  <syscheck>
    <directories check_all="yes" realtime="yes">/etc,/usr/bin</directories>
  </syscheck>
</agent_config>

4. Verify

List groups and their members:

/var/ossec/bin/agent_groups -l
/var/ossec/bin/agent_groups -l -g linux-servers

Need help structuring groups for thousands of endpoints? Our team designs Wazuh deployments that scale, reach out via contact.