agent端需要启用在/var/ossec/etc/local_internal_options.conf添加wazuh_command.remote_commands=1manager端分组 ref新建分组，如debian:/var/ossec/bin/agent_groups -a -g debian将id为002的agent添加到debian组:/var/ossec/bin/agent_gr

kibana权限配置1. 新建workspacekibanacurl新建角色kibanacurl新建用户kibanacurl导入dashboardkibanacurl1. 新建workspacekibanacurlcurl --location --request POST 'http://localhost:5601/api/spaces/space' \--header 'kbn-xsrf: