--- etc/ossec-agent.conf	2024-05-10 13:50:56.929321000 -0700
+++ etc/ossec-agent.conf	2024-05-10 14:08:22.272131000 -0700
@@ -8,8 +8,10 @@
   <client>
     <server>
       <address>IP</address>
+      <port>1514</port>
+      <protocol>udp</protocol>
     </server>
-    <config-profile>debian, debian8</config-profile>
+    <config-profile>freebsd, freebsd%%FBSD_MAJOR_VERSION%%</config-profile>
     <crypto_method>aes</crypto_method>
   </client>
 
@@ -32,7 +34,7 @@
 
     <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
     <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
-    <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>
+    <system_audit>/var/ossec/etc/shared/cis_freebsd%%FBSD_MAJOR_VERSION%%.yml</system_audit>
 
     <skip_nfs>yes</skip_nfs>
   </rootcheck>
@@ -135,10 +137,25 @@
 
   <localfile>
     <log_format>syslog</log_format>
-    <location>/var/log/syslog</location>
+    <location>/var/log/cron</location>
   </localfile>
 
   <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/daemon.log</location>
+  </localfile>
+    
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/debug.log</location>
+  </localfile>
+
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/userlog</location>
+  </localfile>
+
+  <localfile>
     <log_format>command</log_format>
     <command>df -P</command>
     <frequency>360</frequency>
@@ -146,7 +163,7 @@
 
   <localfile>
     <log_format>full_command</log_format>
-    <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>
+    <command>(netstat -n -f inet && netstat -n -f inet) | grep -e "udp" -e "tcp" | sed 's/\([[:alnum:]]*\)\ *[[:digit:]]*\ *[[:digit:]]*\ *\([[:digit:]\.]*\)\.\([[:digit:]]*\)\ *\([[:digit:]\.]*\).*/\1 \2 == \3 == \4/' | sort -k4 -g | sed 's/ == \(.*\) ==/.\1/'</command>
     <frequency>360</frequency>
   </localfile>