<agent_config>

    <sca>
        <enabled>yes</enabled>
        <scan_on_start>yes</scan_on_start>
        <interval>15m</interval>
        <skip_nfs>yes</skip_nfs>
        <policies>
            <policy>/var/ossec/etc/shared/sca_drupal.yaml</policy>
            <policy>/var/ossec/etc/shared/sca_systemfiles.yaml</policy>
        </policies>
    </sca>

    <wodle name="command">
        <disabled>no</disabled>
        <tag>ps-list</tag>
        <command>ps -eo user,pid,cmd</command>
        <interval>60s</interval>
        <ignore_output>no</ignore_output>
        <run_on_start>yes</run_on_start>
        <timeout>5</timeout>
    </wodle>

</agent_config>