From 429b9cab2f03464755e17925bcbce9eb374eb91c Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Tue, 7 Dec 2021 16:22:07 -0500
Subject: [PATCH] set ip for ossec.conf

---
 salt/wazuh/files/agent/ossec.conf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/salt/wazuh/files/agent/ossec.conf b/salt/wazuh/files/agent/ossec.conf
index 7e33f5599..6ae873875 100644
--- a/salt/wazuh/files/agent/ossec.conf
+++ b/salt/wazuh/files/agent/ossec.conf
@@ -4,6 +4,9 @@
   {%- set ip = salt['pillar.get']('elasticsearch:mainip', '') %}
 {%- elif grains['role'] == 'so-sensor' %}
   {%- set ip = salt['pillar.get']('sensor:mainip', '') %}
+{%- else %}
+  {%- set mainint = salt['pillar.get']('host:mainint') %}
+  {%- set ip = salt['grains.get']('ip_interfaces:' ~ mainint)[0] %}
 {%- endif %}
 <!--
   Wazuh - Agent Configuration