Connector configuration

The connector reads /etc/vesper/connector.yaml. The installer writes a working default; most installs never need to touch it.

The default configuration

# Vesper Connector configuration.
# Targets default to localhost — the connector runs on the Wazuh node.
# Credentials are LEFT BLANK on purpose: the connector auto-discovers them from
# the local Wazuh install (indexer creds from the filebeat keystore, Wazuh API
# creds from the dashboard config / .kibana). Set them here only to override.
# Nothing read here ever leaves this machine.
connect_url: "wss://connect.vesper.wazuh.com"
indexer:
  url: "https://localhost:9200"
  insecure_skip_verify: true
wazuh_api:
  url: "https://localhost:55000"
  insecure_skip_verify: true
active_response:
  enabled: true
exec:
  enabled: false
heartbeat_seconds: 30
request_timeout_seconds: 30

Credentials: auto-discovered, never uploaded

The indexer and Wazuh API credential fields are intentionally blank. On start, the connector discovers them from the local Wazuh install itself (the filebeat keystore for the indexer, the dashboard configuration for the API). Set explicit values only to override discovery, for example when the indexer is not local to this node.

Whatever the source, credentials are used on the box to call localhost services and are never sent to Vesper.

active_response

active_response.enabled (default true) lets the agent relay the Wazuh manager's active-response write (for example firewall-drop) when an operator triggers or approves it. It is the only write a default install can perform. Set it to false to keep the connector strictly read-only forever, regardless of what the console asks for.

exec: the fix capability

exec.enabled (default false) lets the agent run shell commands on the host, which is what turns "here is your problem" into "fixed". It is arbitrary remote execution by design, so it is off unless you installed with --enable-exec, and even then every command is:

• gated server-side by the environment's mode ceiling (Read only / Manual / Auto),
• subject to human approval in Manual mode, and
• screened by a safety denylist.

Enabling exec also installs a systemd drop-in (/etc/systemd/system/vesper-connector.service.d/exec.conf) that relaxes the unit's read-only filesystem sandbox; a fix that edits /var/ossec or restarts services cannot work under it. Remove that drop-in and set exec.enabled: false to return the connector to read-only hardening.

Connection settings

Key	Default	Meaning
connect_url	wss://connect.vesper.wazuh.com	The outbound session endpoint.
heartbeat_seconds	30	How often the connector reports in; drives the online/offline status.
request_timeout_seconds	30	Per-request timeout against the local indexer/API.

After editing the file, restart the service:

sudo systemctl restart vesper-connector