If this is not included, the API will get the IP automatically. If you are behind a proxy, you must set the option config.BehindProxyServer to yes at config.js.

Allowed values:

IP
IP/NET
ANY

force

Number

Remove the old agent with the same IP if disconnected since <force> seconds.

Example Request:

curl -u foo:bar -k -X POST -d '{"name":"NewHost","ip":"10.0.0.9"}' -H 'Content-Type:application/json' "https://127.0.0.1:55000/agents?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "id": "006",
      "key": "MDA2IE5ld0hvc3QgMTAuMC4wLjkgOTdiZTMyZGYwOTNkNGE1MmMxODM4ZTc0Yjc0MDNjZTQyMGY3YmQ2NWVlM2NjOWRiYWNlNGRmNGM1MTdkNTY1Ng=="
   }
}

Add agent (quick method)

Adds a new agent with name :agent_name. This agent will use ANY as IP.

Request:

PUT

/agents/:agent_name

Parameters:

Param	Type	Description
`agent_name`	String	Agent name.

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/myNewAgent?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "id": "007",
      "key": "MDA3IG15TmV3QWdlbnQgYW55IDljZjBlYTA5NzRkNGU3YWFkZjZiZTNkMjJlMTA4ZDE2YTEzOWY2OTNkZWUzMGU4OTRiZjQ1MmY0YjhlOTBkYzc="
   }
}

Insert agent

Insert an agent with an existing id and key.

Request:

POST

/agents/insert

Parameters:

Param	Type	Description
`name`	String	Agent name.
`ip`	String	If this is not included, the API will get the IP automatically. If you are behind a proxy, you must set the option config.BehindProxyServer to yes at config.js. Allowed values: IP IP/NET ANY
`id`	String	Agent ID.
`key`	String	Agent key. Minimum length: 64 characters. Allowed values: ^[a-zA-Z0-9]+$
`force`	Number	Remove the old agent the with same IP if disconnected since <force> seconds.

Example Request:

curl -u foo:bar -k -X POST -d '{"name":"NewHost_2","ip":"10.0.10.10","id":"123","key":"1abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghi64"}' -H 'Content-Type:application/json' "https://127.0.0.1:55000/agents/insert?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "id": "123",
      "key": "1abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghi64"
   }
}

Delete

Delete a list of groups

Removes a list of groups.

Request:

DELETE

/agents/groups

Parameters:

Param	Type	Description
`ids`	String[]	Array of group ID's.

Example Request:

curl -u foo:bar -k -X DELETE -H "Content-Type:application/json" -d '{"ids":["webserver","database"]}' "https://127.0.0.1:55000/agents/groups?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "msg": "All selected groups were removed",
      "ids": [
         "webserver",
         "database"
      ],
      "affected_agents": [
         "001",
         "005",
         "003"
      ]
   }
}

Delete agents

Removes agents, using a list of them or a criterion based on the status or time of the last connection. The Wazuh API must be restarted after removing an agent.

Request:

DELETE

/agents

Parameters:

Param	Type	Description
`ids`	String[]	Array of agent ID's.
`purge`	Boolean	Delete an agent from the key store.
`status`	String	Filters by agent status. Use commas to enter multiple statuses. Allowed values: active pending neverconnected disconnected
`older_than`	String	Filters out disconnected agents for longer than specified. Time in seconds, '[n_days]d', '[n_hours]h', '[n_minutes]m' or '[n_seconds]s'. For never connected agents, uses the register date.

Example Request:

curl -u foo:bar -k -X DELETE -H "Content-Type:application/json" -d '{"ids":["003","005"]}' "https://127.0.0.1:55000/agents?pretty&older_than=10s"

Example Response:

{
   "error": 0,
   "data": {
      "msg": "All selected agents were removed",
      "older_than": "10s",
      "affected_agents": [
         "003",
         "005"
      ]
   }
}

Delete an agent

Removes an agent.

Request:

DELETE

/agents/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`purge`	String	Delete an agent from the key store.

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/agents/001?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "msg": "All selected agents were removed",
      "affected_agents": [
         "001"
      ]
   }
}

Groups

Create a group

Creates a new group.

Request:

PUT

/agents/groups/:group_id

Parameters:

Param	Type	Description
`group_id`	String	Group ID.

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/groups/pciserver?pretty"

Example Response:

{
   "error": 1711,
   "message": "The group already exists: pciserver"
}

Get a file in group

Returns the specified file belonging to the group parsed to JSON.

Request:

GET

/agents/groups/:group_id/files/:filename

Parameters:

Param

Type

Description

group_id

String

Group ID.

file_name

String

Filename

type

String

Type of file.

Allowed values:

conf
rootkit_files
rootkit_trojans
rcl

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups/webserver/files/cis_debian_linux_rcl.txt?pretty"

Example Response:

{
    "data": {
        "controls": [
            {
                "...": "..."
            },
            {
                "condition": "all required",
                "name": "CIS - Testing against the CIS Debian Linux Benchmark v1",
                "reference": "CIS_Debian_Benchmark_v1.0pdf",
                "checks": [
                    "f:/etc/debian_version;"
                ]
            }
        ]
    },
    "error": 0
}

Get agents in a group

Returns the list of agents in a group.

Request:

GET

/agents/groups/:group_id

Parameters:

Param	Type	Description
`group_id`	String	Group ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups/dmz?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "ip": "10.0.0.12",
            "id": "002",
            "name": "dmz001"
         },
         {
            "ip": "10.0.0.14",
            "id": "004",
            "name": "dmz002"
         }
      ]
   }
}

Get agents without group

Returns a list with the available agents without group.

Request:

GET

/agents/no_group

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/no_group?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         {
            "ip": "10.0.0.9",
            "id": "006",
            "name": "NewHost"
         },
         {
            "ip": "any",
            "id": "007",
            "name": "myNewAgent"
         },
         {
            "ip": "10.0.10.10",
            "id": "123",
            "name": "NewHost_2"
         }
      ]
   }
}

Get group configuration

Returns the group configuration (agent.conf).

Request:

GET

/agents/groups/:group_id/configuration

Parameters:

Param	Type	Description
`group_id`	String	Group ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups/dmz/configuration?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1,
      "items": [
         {
            "config": {},
            "filters": {}
         }
      ]
   }
}

Get group files

Returns the files belonging to the group.

Request:

GET

/agents/groups/:group_id/files

Parameters:

Param	Type	Description
`group_id`	String	Group ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups/default/files?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 20,
      "items": [
         {
            "hash": "ab73af41699f13fdd81903b5f23d8d00",
            "filename": "agent.conf"
         },
         {
            "hash": "76d8be9b97d8eae4c239e530ee7e71c8",
            "filename": "ar.conf"
         },
         {
            "hash": "6d9bd718faff778bbeabada6f07f5c2f",
            "filename": "cis_apache2224_rcl.txt"
         },
         {
            "hash": "9beed128b4305943eead1a66a86d27d5",
            "filename": "cis_debian_linux_rcl.txt"
         },
         {
            "hash": "ee520e627150c8751493bc32540b859a",
            "filename": "cis_mysql5-6_community_rcl.txt"
         },
         {
            "hash": "672c92a1f57463e33ff14011b43727de",
            "filename": "cis_mysql5-6_enterprise_rcl.txt"
         },
         {
            "hash": "e03345360941dbff248f63765971f87e",
            "filename": "cis_rhel5_linux_rcl.txt"
         },
         {
            "hash": "d53e584559b759cb6ec3956f23dee46f",
            "filename": "cis_rhel6_linux_rcl.txt"
         },
         {
            "hash": "3b67c8b54d0fa8fdf5afa8d0d43398d8",
            "filename": "cis_rhel7_linux_rcl.txt"
         },
         {
            "hash": "24e83427d2678aada50fa401b921a0cd",
            "filename": "cis_rhel_linux_rcl.txt"
         },
         {
            "hash": "a3978c24aec520c4bcfb7db62bea41b9",
            "filename": "cis_sles11_linux_rcl.txt"
         },
         {
            "hash": "533ec3f8eda8e52edb181e3f6bd44d52",
            "filename": "cis_sles12_linux_rcl.txt"
         },
         {
            "hash": "d9835ca466a5f6ede52e0684537f76bd",
            "filename": "merged.mg"
         },
         {
            "hash": "a403c34392032ace267fbb163fc7cfad",
            "filename": "rootkit_files.txt"
         },
         {
            "hash": "b5d427623664d76140acbcb91f42d586",
            "filename": "rootkit_trojans.txt"
         },
         {
            "hash": "6cca8467c592a23fcf62cd5f33608fc3",
            "filename": "system_audit_rcl.txt"
         },
         {
            "hash": "e778eb44e4e8116a1e4c017b9b23eea2",
            "filename": "system_audit_ssh.txt"
         },
         {
            "hash": "0e1f8f16e217a70b9b80047646823587",
            "filename": "win_applications_rcl.txt"
         },
         {
            "hash": "4c2207e003d08db69822754271f9cb60",
            "filename": "win_audit_rcl.txt"
         },
         {
            "hash": "f9c3330533586eb380f294dcbd9918d8",
            "filename": "win_malware_rcl.txt"
         }
      ]
   }
}

Get groups

Returns the list of existing agent groups.

Request:

GET

/agents/groups

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         {
            "count": 0,
            "conf_sum": "ab73af41699f13fdd81903b5f23d8d00",
            "merged_sum": "d9835ca466a5f6ede52e0684537f76bd",
            "name": "default"
         },
         {
            "count": 2,
            "conf_sum": "ab73af41699f13fdd81903b5f23d8d00",
            "merged_sum": "7d606d93d0b0f00d292f931c3309e7e8",
            "name": "dmz"
         },
         {
            "count": 0,
            "conf_sum": "ab73af41699f13fdd81903b5f23d8d00",
            "merged_sum": "e58487ce5d5ac77c6a0d199699be003b",
            "name": "pciserver"
         }
      ]
   }
}

Remove group

Removes the group. Agents that were assigned to the removed group will automatically revert to the 'default' group.

Request:

DELETE

/agents/groups/:group_id

Parameters:

Param	Type	Description
`group_id`	String	Group ID.

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/agents/groups/dmz?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "msg": "All selected groups were removed",
      "ids": [
         "dmz"
      ],
      "affected_agents": [
         "002",
         "004"
      ]
   }
}

Set agent group

Sets an agent to the specified group.

Request:

PUT

/agents/:agent_id/group/:group_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent unique ID.
`group_id`	String	Group ID.

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/004/group/webserver?pretty"

Example Response:

{
   "error": 0,
   "data": "Group 'webserver' set to agent '004'."
}

Unset the agent group

Unsets the group of the agent. The agent will automatically revert to the 'default' group.

Request:

DELETE

/agents/:agent_id/group

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/agents/004/group?pretty"

Example Response:

{
   "error": 0,
   "data": "Group unset for agent '004'."
}

Info

Get OS summary

Returns a summary of the OS.

Request:

GET

/agents/summary/os

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/summary/os?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1,
      "items": [
         "centos"
      ]
   }
}

Get agents summary

Returns a summary of the available agents.

Request:

GET

/agents/summary

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/summary?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "Active": 1,
      "Never connected": 5,
      "Total": 6,
      "Disconnected": 0
   }
}

Get all agents

Returns a list with the available agents.

Request:

GET

/agents

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`status`	String	Filters by agent status. Use commas to enter multiple statuses. Allowed values: active pending neverconnected disconnected
`older_than`	String	Filters out disconnected agents for longer than specified. Time in seconds, '[n_days]d', '[n_hours]h', '[n_minutes]m' or '[n_seconds]s'. For never connected agents, uses the register date.
`os.platform`	String	Filters by OS platform.
`os.version`	String	Filters by OS version.
`manager`	String	Filters by manager hostname to which agents are connected.
`version`	String	Filters by agents version.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents?pretty&offset=0&limit=5&sort=-ip,name"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 6,
      "items": [
         {
            "status": "Never connected",
            "dateAdd": "2018-05-25 17:13:07",
            "name": "myNewAgent",
            "ip": "any",
            "id": "007",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-05-25 17:13:07",
            "name": "NewHost_2",
            "ip": "10.0.10.10",
            "id": "123",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-05-25 17:13:06",
            "name": "NewHost",
            "ip": "10.0.0.9",
            "id": "006",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-05-25 17:11:16",
            "group": "default",
            "name": "dmz002",
            "ip": "10.0.0.14",
            "id": "004",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-05-25 17:11:04",
            "group": "default",
            "name": "dmz001",
            "ip": "10.0.0.12",
            "id": "002",
            "node_name": "unknown"
         }
      ]
   }
}

Get an agent

Returns various information from an agent.

Request:

GET

/agents/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/000?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "status": "Active",
      "name": "manager",
      "ip": "127.0.0.1",
      "dateAdd": "2018-05-25 13:31:51",
      "version": "Wazuh v3.2.3",
      "manager_host": "manager",
      "lastKeepAlive": "9999-12-31 23:59:59",
      "os": {
         "major": "7",
         "name": "CentOS Linux",
         "uname": "Linux |manager |3.10.0-693.21.1.el7.x86_64 |#1 SMP Wed Mar 7 19:03:37 UTC 2018 |x86_64",
         "platform": "centos",
         "version": "7",
         "codename": "Core",
         "arch": "x86_64"
      },
      "id": "000"
   }
}

Get an agent by its name

Returns various information from an agent called :agent_name.

Request:

GET

/agents/name/:agent_name

Parameters:

Param	Type	Description
`agent_name`	String	Agent name.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/name/NewHost?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "status": "Never connected",
      "ip": "10.0.0.9",
      "dateAdd": "2018-05-25 17:13:06",
      "id": "006",
      "name": "NewHost"
   }
}

Key

Get agent key

Returns the key of an agent.

Request:

GET

/agents/:agent_id/key

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/004/key?pretty"

Example Response:

{
   "error": 0,
   "data": "MDA0IGRtejAwMiAxMC4wLjAuMTQgYmJlYTI4NDBiM2UyNzc5YzFjZGQ0YzVmNjMxNWU5Y2U5MDRhZDdlMzIxMTY0NDlhNmVjYWZmY2MzMzY5NzUzZQ=="
}

Restart

Restart a list of agents

Restarts a list of agents.

Request:

POST

/agents/restart

Parameters:

Param	Type	Description
`ids`	String[]	Array of agent ID's.

Example Request:

curl -u foo:bar -k -X POST -H "Content-Type:application/json" -d '{"ids":["002","004"]}' "https://127.0.0.1:55000/agents/restart?pretty"

Example Response:

{
    "data": "All selected agents were restarted",
    "error": 0
}

Restart all agents

Restarts all agents.

Request:

PUT

/agents/restart

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/restart?pretty"

Example Response:

{
    "data": "Restarting all agents",
    "error": 0
}

Restart an agent

Restarts the specified agent.

Request:

PUT

/agents/:agent_id/restart

Parameters:

Param	Type	Description
`agent_id`	Number	Agent unique ID.

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/007/restart?pretty"

Example Response:

{
    "data": "Restarting agent",
    "error": 0
}

Upgrade

Get outdated agents

Returns the list of outdated agents.

Request:

GET

/agents/outdated

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/outdated?pretty"

Example Response:

{
    "data": {
        "totalItems": 2,
        "items": [
            {
                "version": "Wazuh v3.0.0",
                "id": "003",
                "name": "main_database"
            },
            {
                "version": "Wazuh v3.0.0",
                "id": "004",
                "name": "dmz002"
            }
        ]
    },
    "error": 0
}

Get upgrade result from agent

Returns the upgrade result from an agent.

Request:

GET

/agents/:agent_id/upgrade_result

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`timeout`	Number	Seconds to wait for the agent to respond.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/003/upgrade_result?pretty"

Example Response:

{
    "data": "Agent upgraded successfully",
    "error": 0
}

Upgrade agent using custom file

Upgrade the agent using a custom file.

Request:

PUT

/agents/:agent_id/upgrade_custom

Parameters:

Param	Type	Description
`agent_id`	Number	Agent unique ID.
`file_path`	String	WPK file path.
`installer`	String	Installation script.

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/002/upgrade_custom?pretty"

Example Response:

{
    "data": "Installation started",
    "error": 0
}

Upgrade agent using online repository

Upgrade the agent using a WPK file from online repository.

Request:

PUT

/agents/:agent_id/upgrade

Parameters:

Param	Type	Description
`agent_id`	Number	Agent unique ID.
`wpk_repo`	String	WPK repository.
`version`	String	Wazuh version.
`force`	number	Force upgrade. Allowed values: 0 1

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/002/upgrade?pretty"

Example Response:

{
    "data": "Upgrade procedure started",
    "error": 0
}

Cache

Delete

Clear group cache

Clears cache of the specified group.

Request:

DELETE

/cache

Parameters:

Param	Type	Description
`group`	String	cache group.

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/cache/mygroup?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "all": [
         "/agents/name/NewHost?pretty"
      ],
      "groups": {
         "agents": [
            "/agents/name/NewHost?pretty"
         ]
      }
   }
}

Delete cache index

Clears entire cache.

Request:

DELETE

/cache

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/cache?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "all": [],
      "groups": {}
   }
}

Info

Get cache index

Returns current cache index.

Request:

GET

/cache

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cache?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "all": [],
      "groups": {}
   }
}

Return cache configuration

Returns cache configuration.

Request:

GET

/cache/config

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cache/config?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "debug": false,
      "defaultDuration": 750,
      "enabled": true,
      "appendKey": [],
      "jsonp": false,
      "redisClient": false
   }
}

Cluster

Configuration

Get the cluster configuration

Returns the cluster configuration

Request:

GET

/cluster/config

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/config?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "disabled": "no",
      "hidden": "no",
      "name": "wazuh",
      "node_name": "node01",
      "bind_addr": "0.0.0.0",
      "node_type": "master",
      "key": "a4c2cc8be9e2e8520fce4e21ccb21828",
      "nodes": [
         "192.168.56.102"
      ],
      "port": 1516
   }
}

Info

Get info about cluster status

Returns whether the cluster is enabled or disabled

Request:

GET

/cluster/status

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/status?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "running": "yes",
      "enabled": "yes"
   }
}

Show cluster health

Request:

GET

/cluster/healthcheck

Parameters:

Param	Type	Description
`node`	String	Filter information by node name. *

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/healthcheck?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "nodes": {
         "node02": {
            "info": {
               "ip": "192.168.56.103",
               "version": "3.2.3",
               "type": "client",
               "name": "node02",
               "n_active_agents": 0
            },
            "status": {
               "last_sync_agentinfo": {
                  "date_start_master": "n/a",
                  "date_end_master": "n/a",
                  "total_agentinfo": 0
               },
               "sync_integrity_free": true,
               "last_sync_agentgroups": {
                  "date_end_master": "2018-05-25 16:17:44.71",
                  "total_agentgroups": 0,
                  "date_start_master": "2018-05-25 16:17:44.70"
               },
               "last_sync_integrity": {
                  "total_files": {
                     "shared": 0,
                     "missing": 0,
                     "extra_valid": 0,
                     "extra": 0
                  },
                  "date_end_master": "2018-05-25 17:13:00.95",
                  "date_start_master": "2018-05-25 17:13:00.94"
               },
               "sync_agentinfo_free": true,
               "sync_extravalid_free": true
            }
         },
         "node01": {
            "info": {
               "ip": "192.168.56.102",
               "version": "3.2.3",
               "type": "master",
               "name": "node01",
               "n_active_agents": 1
            }
         }
      },
      "n_connected_nodes": 2
   }
}

Nodes

Get local node info

Returns the local node info

Request:

GET

/cluster/node

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/node?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "node": "node01",
      "cluster": "wazuh",
      "type": "master"
   }
}

Get node info

Returns the node info

Request:

GET

/cluster/nodes/:node_name

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/nodes/node01?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "ip": "192.168.56.102",
      "version": "3.2.3",
      "type": "master",
      "name": "node01"
   }
}

Get nodes info

Returns the nodes info

Request:

GET

/cluster/nodes

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields. *

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/nodes?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "ip": "192.168.56.103",
            "version": "3.2.3",
            "type": "client",
            "name": "node02"
         },
         {
            "ip": "192.168.56.102",
            "version": "3.2.3",
            "type": "master",
            "name": "node01"
         }
      ]
   }
}

Decoders

Info

Get all decoders

Returns all decoders included in ossec.conf.

Request:

GET

/decoders

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`file`	String	Filters by filename.
`path`	String	Filters by path.
`status`	String	Filters the decoders by status. Allowed values: enabled disabled all

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/decoders?pretty&offset=0&limit=2&sort=+file,position"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 554,
      "items": [
         {
            "status": "enabled",
            "name": "wazuh",
            "details": {
               "prematch": "^wazuh: "
            },
            "file": "0005-wazuh_decoders.xml",
            "position": 0,
            "path": "/var/ossec/ruleset/decoders"
         },
         {
            "status": "enabled",
            "name": "agent-buffer",
            "details": {
               "regex": "^ '(\\S+)'.",
               "prematch": "^Agent buffer:",
               "parent": "wazuh",
               "order": "level"
            },
            "file": "0005-wazuh_decoders.xml",
            "position": 1,
            "path": "/var/ossec/ruleset/decoders"
         }
      ]
   }
}

Get all decoders files

Returns all decoders files included in ossec.conf.

Request:

GET

/decoders/files

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`status`	String	Filters the decoders by status. Allowed values: enabled disabled all
`file`	String	Filters by filename.
`path`	String	Filters by path.
`download`	String	Downloads the file

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/decoders/files?pretty&offset=0&limit=10&sort=-path"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 93,
      "items": [
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0010-active-response_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0015-aix-ipsec_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0025-apache_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0030-arpwatch_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0035-asterisk_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0040-auditd_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0045-barracuda_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0050-checkpoint_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0055-cimserver_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0060-cisco-estreamer_decoders.xml"
         }
      ]
   }
}

Get all parent decoders

Returns all parent decoders included in ossec.conf

Request:

GET

/decoders/parents

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/decoders/parents?pretty&offset=0&limit=2&sort=-file"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 150,
      "items": [
         {
            "status": "enabled",
            "name": "local_decoder_example",
            "details": {
               "program_name": "local_decoder_example"
            },
            "file": "local_decoder.xml",
            "position": 0,
            "path": "/var/ossec/etc/decoders"
         },
         {
            "status": "enabled",
            "name": "pf",
            "details": {
               "program_name": "filterlog"
            },
            "file": "0455-pfsense_decoders.xml",
            "position": 0,
            "path": "/var/ossec/ruleset/decoders"
         }
      ]
   }
}

Get decoders by name

Returns the decoders with the specified name.

Request:

GET

/decoders/:decoder_name

Parameters:

Param	Type	Description
`decoder_name`	String	Decoder name.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/decoders/apache-errorlog?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         {
            "status": "enabled",
            "name": "apache-errorlog",
            "details": {
               "program_name": "^apache2|^httpd"
            },
            "file": "0025-apache_decoders.xml",
            "position": 0,
            "path": "/var/ossec/ruleset/decoders"
         },
         {
            "status": "enabled",
            "name": "apache-errorlog",
            "details": {
               "prematch": "^[warn] |^[notice] |^[error] "
            },
            "file": "0025-apache_decoders.xml",
            "position": 1,
            "path": "/var/ossec/ruleset/decoders"
         },
         {
            "status": "enabled",
            "name": "apache-errorlog",
            "details": {
               "prematch": "^[\\w+ \\w+ \\d+ \\d+:\\d+:\\d+.\\d+ \\d+] [\\S+:warn] |^[\\w+ \\w+ \\d+ \\d+:\\d+:\\d+.\\d+ \\d+] [\\S+:notice] |^[\\w+ \\w+ \\d+ \\d+:\\d+:\\d+.\\d+ \\d+] [\\S*:error] |^[\\w+ \\w+ \\d+ \\d+:\\d+:\\d+.\\d+ \\d+] [\\S+:info] "
            },
            "file": "0025-apache_decoders.xml",
            "position": 2,
            "path": "/var/ossec/ruleset/decoders"
         }
      ]
   }
}

Manager

Configuration

Get manager configuration

Returns ossec.conf in JSON format.

Request:

GET

/manager/configuration

Parameters:

Param	Type	Description
`section`	String	Indicates the ossec.conf section: global, rules, syscheck, rootcheck, remote, alerts, command, active-response, localfile.
`field`	String	Indicates a section child, e.g, fields for rule section are: include, decoder_dir, etc.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/manager/configuration?section=global&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "email_notification": "no",
      "alerts_log": "yes",
      "jsonout_output": "yes",
      "smtp_server": "smtp.example.wazuh.com",
      "email_to": "recipient@example.wazuh.com",
      "logall": "no",
      "email_maxperhour": "12",
      "white_list": [
         "127.0.0.1",
         "^localhost.localdomain$",
         "192.168.0.1"
      ],
      "email_from": "ossecm@example.wazuh.com",
      "logall_json": "no"
   }
}

Info

Get manager information

Returns basic information about manager.

Request:

GET

/manager/info

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/manager/info?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "compilation_date": "Fri May 25 13:31:51 UTC 2018",
      "version": "v3.2.3",
      "openssl_support": "yes",
      "max_agents": "14000",
      "ruleset_version": "3230",
      "path": "/var/ossec",
      "tz_name": "UTC",
      "type": "manager",
      "tz_offset": "+0000"
   }
}

Get manager status

Returns the status of the manager processes.

Request:

GET

/manager/status

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/manager/status?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "wazuh-modulesd": "running",
      "ossec-authd": "stopped",
      "wazuh-clusterd": "running",
      "ossec-monitord": "running",
      "ossec-logcollector": "running",
      "ossec-execd": "running",
      "ossec-remoted": "running",
      "ossec-syscheckd": "running",
      "ossec-analysisd": "running",
      "ossec-maild": "stopped"
   }
}

Logs

Get ossec.log

Returns the three last months of ossec.log.

Request:

GET

/manager/logs

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`type_log`	String	Filters by type of log. Allowed values: all error warning info
`category`	String	Filters by category of log.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/manager/logs?offset=0&limit=5&pretty"

Example Response:

{
    "data": {
        "totalItems": 16480,
        "items": [
            "2016/07/15 09:33:49 ossec-syscheckd: INFO: Syscheck scan frequency: 3600 seconds",
            "2016/07/15 09:33:49 ossec-syscheckd: INFO: Starting syscheck scan (forwarding database).",
            "2016/07/15 09:33:49 ossec-syscheckd: INFO: Starting syscheck database (pre-scan).",
            "2016/07/15 09:33:42 ossec-logcollector: INFO: Started (pid: 2832).",
            "2016/07/15 09:33:42 ossec-logcollector: INFO: Monitoring output of command(360): df -P"
        ]
    },
    "error": 0
}

Get summary of ossec.log

Returns a summary of the last three months of the <code>ossec.log</code> file.

Request:

GET

/manager/logs/summary

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/manager/logs/summary?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "wazuh-modulesd": {
         "info": 7,
         "all": 7,
         "error": 0
      },
      "wazuh-modulesd:oscap": {
         "info": 7,
         "all": 7,
         "error": 0
      },
      "wazuh-db": {
         "info": 13,
         "all": 13,
         "error": 0
      },
      "wazuh-modulesd:ciscat": {
         "info": 7,
         "all": 7,
         "error": 0
      },
      "ossec-rootcheck": {
         "info": 19,
         "all": 19,
         "error": 0
      },
      "ossec-monitord": {
         "info": 13,
         "all": 13,
         "error": 0
      },
      "ossec-logcollector": {
         "info": 69,
         "all": 69,
         "error": 0
      },
      "ossec-execd": {
         "info": 19,
         "all": 19,
         "error": 0
      },
      "ossec-remoted": {
         "info": 34,
         "all": 41,
         "error": 7
      },
      "ossec-syscheckd": {
         "info": 178,
         "all": 178,
         "error": 0
      },
      "ossec-analysisd": {
         "info": 1511,
         "all": 1511,
         "error": 0
      },
      "wazuh-modulesd:database": {
         "info": 7,
         "all": 29,
         "error": 22
      }
   }
}

Stats

Get manager stats

Returns Wazuh statistical information for the current or specified date.

Request:

GET

/manager/stats

Parameters:

Param	Type	Description
`date`	String	Selects the date for getting the statistical information. Format: YYYYMMDD

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/manager/stats?pretty"

Example Response:

{
    "data": [
        {
            "hour": 5,
            "firewall": 0,
            "alerts": [
                {
                    "level": 3,
                    "sigid": 5715,
                    "times": 4
                },
                {
                    "level": 2,
                    "sigid": 1002,
                    "times": 2
                },
                {
                    "...": "..."
                }
            ],
            "totalAlerts": 107,
            "syscheck": 1257,
            "events": 1483
        },
        {
            "...": "..."
        }
    ],
    "error": 0
}

Get manager stats by hour

Returns Wazuh statistical information per hour. Each number in the averages field represents the average of alerts per hour.

Request:

GET

/manager/stats/hourly

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/manager/stats/hourly?pretty"

Example Response:

{
    "data": {
        "averages": [
            100,
            357,
            242,
            500,
            422,
            "...",
            123
        ],
        "interactions": 0
    },
    "error": 0
}

Get manager stats by week

Returns Wazuh statistical information per week. Each number in the hours field represents the average alerts per hour for that specific day.

Request:

GET

/manager/stats/weekly

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/manager/stats/weekly?pretty"

Example Response:

{
    "data": {
        "Wed": {
            "hours": [
                223,
                "...",
                456
            ],
            "interactions": 0
        },
        "Sun": {
            "hours": [
                332,
                "...",
                313
            ],
            "interactions": 0
        },
        "Thu": {
            "hours": [
                888,
                "...",
                123
            ],
            "interactions": 0
        },
        "Tue": {
            "hours": [
                536,
                "...",
                345
            ],
            "interactions": 0
        },
        "Mon": {
            "hours": [
                444,
                "...",
                556
            ],
            "interactions": 0
        },
        "Fri": {
            "hours": [
                131,
                "...",
                432
            ],
            "interactions": 0
        },
        "Sat": {
            "hours": [
                134,
                "...",
                995
            ],
            "interactions": 0
        }
    },
    "error": 0
}

Rootcheck

Clear

Clear rootcheck database

Clears the rootcheck database for all agents.

Request:

DELETE

/rootcheck

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/rootcheck?pretty"

Example Response:

{
    "data": "Rootcheck database deleted",
    "error": 0
}

Clear rootcheck database of an agent

Clears the rootcheck database for a specific agent.

Request:

DELETE

/rootcheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/rootcheck/000?pretty"

Example Response:

{
    "data": "Rootcheck database deleted",
    "error": 0
}

Info

Get last rootcheck scan

Returns the timestamp of the last rootcheck scan.

Request:

GET

/rootcheck/:agent_id/last_scan

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rootcheck/000/last_scan?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "start": "2018-05-25 17:04:10",
      "end": "2018-05-25 17:04:39"
   }
}

Get rootcheck CIS requirements

Returns the CIS requirements of all rootchecks of the specified agent.

Request:

GET

/rootcheck/:agent_id/cis

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rootcheck/000/cis?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 8,
      "items": [
         "1.1.1 RHEL7",
         "1.1.10 RHEL7",
         "1.1.5 RHEL7",
         "4.1.2 RHEL7",
         "4.2.3 RHEL7",
         "4.2.4 RHEL7",
         "6.2.8 RHEL7",
         "6.2.9 RHEL7"
      ]
   }
}

Get rootcheck database

Returns the rootcheck database of an agent.

Request:

GET

/rootcheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`pci`	String	Filters by pci requirement.
`cis`	String	Filters by CIS.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rootcheck/000?offset=0&limit=2&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 21,
      "items": [
         {
            "status": "outstanding",
            "oldDay": "2018-05-24 10:01:45",
            "event": "System Audit: CIS - RHEL7 - 1.1.10 -  Partition /home without 'nodev' set {CIS: 1.1.10 RHEL7} {PCI_DSS: 2.2.4}. File: /etc/fstab. Reference: https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_7_Benchmark_v1.1.0.pdf .",
            "cis": "1.1.10 RHEL7",
            "pci": "2.2.4",
            "readDay": "2018-05-25 17:04:14"
         },
         {
            "status": "outstanding",
            "oldDay": "2018-05-24 10:01:45",
            "event": "System Audit: CIS - RHEL7 - 4.1.2 - Network parameters - IP send redirects enabled {CIS: 4.1.2 RHEL7} {PCI_DSS: 2.2.4}. File: /proc/sys/net/ipv4/conf/all/send_redirects. Reference: https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_7_Benchmark_v1.1.0.pdf .",
            "cis": "4.1.2 RHEL7",
            "pci": "2.2.4",
            "readDay": "2018-05-25 17:04:14"
         }
      ]
   }
}

Get rootcheck pci requirements

Returns the PCI requirements of all rootchecks of the agent.

Request:

GET

/rootcheck/:agent_id/pci

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rootcheck/000/pci?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         "2.2.4",
         "4.1"
      ]
   }
}

Run

Run rootcheck scan in all agents

Runs syscheck and rootcheck on all agents (Wazuh launches both processes simultaneously).

Request:

PUT

/rootcheck

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/rootcheck?pretty"

Example Response:

{
    "data": "Restarting Syscheck/Rootcheck on all agents",
    "error": 0
}

Run rootcheck scan in an agent

Runs syscheck and rootcheck on a specified agent (Wazuh launches both processes simultaneously)

Request:

PUT

/rootcheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/rootcheck/000?pretty"

Example Response:

{
   "error": 0,
   "data": "Restarting Syscheck/Rootcheck locally"
}

Rules

Info

Get all rules

Returns all rules.

Request:

GET

/rules

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`status`	String	Filters the rules by status. Allowed values: enabled disabled all
`group`	String	Filters the rules by group.
`level`	Range	Filters the rules by level. level=2 or level=2-5.
`path`	String	Filters the rules by path.
`file`	String	Filters the rules by file name.
`pci`	String	Filters the rules by pci requirement.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rules?offset=0&limit=2&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1632,
      "items": [
         {
            "status": "enabled",
            "pci": [],
            "description": "Generic template for all syslog rules.",
            "file": "0010-rules_config.xml",
            "level": 0,
            "path": "/var/ossec/ruleset/rules",
            "details": {
               "category": "syslog",
               "noalert": "1"
            },
            "groups": [
               "syslog"
            ],
            "id": 1,
            "gdpr": []
         },
         {
            "status": "enabled",
            "pci": [],
            "description": "Generic template for all firewall rules.",
            "file": "0010-rules_config.xml",
            "level": 0,
            "path": "/var/ossec/ruleset/rules",
            "details": {
               "category": "firewall",
               "noalert": "1"
            },
            "groups": [
               "firewall"
            ],
            "id": 2,
            "gdpr": []
         }
      ]
   }
}

Get files of rules

Returns the files of all rules.

Request:

GET

/rules/files

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`status`	String	Filters files by status. Allowed values: enabled disabled all
`path`	String	Filters the rules by path.
`file`	String	Filters the rules by filefile.
`download`	String	Downloads the file

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rules/files?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 106,
      "items": [
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0010-rules_config.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0015-ossec_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0016-wazuh_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0020-syslog_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0025-sendmail_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0030-postfix_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0035-spamd_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0040-imapd_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0045-mailscanner_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0050-ms-exchange_rules.xml"
         }
      ]
   }
}

Get rule gdpr requirements

Returns the GDPR requirements of all rules.

Request:

GET

/rules/gdpr

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rules/gdpr?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 4,
      "items": [
         "II_5.1.f",
         "IV_30.1.g",
         "IV_32.2",
         "IV_35.7.d"
      ]
   }
}

Get rule groups

Returns the groups of all rules.

Request:

GET

/rules/groups

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rules/groups?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 291,
      "items": [
         "access_control",
         "access_denied",
         "accesslog",
         "account_changed",
         "active_response",
         "adduser",
         "agent",
         "agent_flooding",
         "agent_restarting",
         "agentless"
      ]
   }
}

Get rule pci requirements

Returns the PCI requirements of all rules.

Request:

GET

/rules/pci

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rules/pci?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 38,
      "items": [
         "1.1.1",
         "1.3.4",
         "1.4",
         "10.1",
         "10.2.1",
         "10.2.2",
         "10.2.4",
         "10.2.5",
         "10.2.6",
         "10.2.7"
      ]
   }
}

Get rules by id

Returns the rules with the specified id.

Request:

GET

/rules/:rule_id

Parameters:

Param	Type	Description
`id`	Number	rule.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/rules/1002?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1,
      "items": [
         {
            "status": "enabled",
            "pci": [],
            "description": "Unknown problem somewhere in the system.",
            "file": "0020-syslog_rules.xml",
            "level": 2,
            "path": "/var/ossec/ruleset/rules",
            "details": {
               "match": "$BAD_WORDS"
            },
            "groups": [
               "gpg13_4.3",
               "syslog",
               "errors"
            ],
            "id": 1002,
            "gdpr": []
         }
      ]
   }
}

Syscheck

Clear

Clear syscheck database

Clears the syscheck database for all agents.

Request:

DELETE

/syscheck

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/syscheck?pretty"

Example Response:

{
    "data": "Syscheck database deleted",
    "error": 0
}

Clear syscheck database of an agent

Clears the syscheck database for the specified agent.

Request:

DELETE

/syscheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/syscheck/000?pretty"

Example Response:

{
    "data": "Syscheck database deleted",
    "error": 0
}

Info

Get last syscheck scan

Return the timestamp of the last syscheck scan.

Request:

GET

/syscheck/:agent_id/last_scan

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/syscheck/000/last_scan?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "start": "2018-05-25 17:04:39",
      "end": "2018-05-25 16:59:10"
   }
}

Get syscheck files

Returns the syscheck files of an agent.

Request:

GET

/syscheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`event`	String	Filters files by event. Allowed values: added readded modified deleted
`file`	String	Filters file by filename.
`filetype`	String	Selects type of file. Allowed values: file registry
`summary`	String	Returns a summary grouping by filename. Allowed values: yes no
`md5`	String	Returns the files with the specified md5 hash.
`sha1`	String	Returns the files with the specified sha1 hash.
`hash`	String	Returns the files with the specified hash (md5 or sha1).

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/syscheck/000?offset=0&limit=2&pretty"

Example Response:

{
    "data": {
        "totalItems": 2762,
        "items": [
            {
                "size": 157721,
                "uid": 0,
                "scanDate": "2017-03-02 23:43:28",
                "user": "root",
                "file": "!1488498208 /boot/config-3.16.0-4-amd64",
                "modificationDate": "2016-10-19 06:45:50",
                "octalMode": "100644",
                "inode": 5217,
                "event": "added",
                "permissions": "-rw-r--r--",
                "sha1": "4fed08ccbd0168593a6fffcd925adad65e5ae6d9",
                "group": "root",
                "gid": 0,
                "md5": "46d43391ae54c1084a2d40e8d1b4873c"
            },
            {
                "size": 2679264,
                "uid": 0,
                "scanDate": "2017-03-02 23:43:26",
                "user": "root",
                "file": "!1488498206 /boot/System.map-3.16.0-4-amd64",
                "modificationDate": "2016-10-19 06:45:50",
                "octalMode": "100644",
                "inode": 5216,
                "event": "added",
                "permissions": "-rw-r--r--",
                "sha1": "d48151a3d3638b723f5d7bc1e9c71d478fcde4e6",
                "group": "root",
                "gid": 0,
                "md5": "29cc12246faecd4a14d212b4d9bac0fe"
            }
        ]
    },
    "error": 0
}

Run

Run syscheck scan in all agents

Runs syscheck and rootcheck on all agents (Wazuh launches both processes simultaneously).

Request:

PUT

/syscheck

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/syscheck?pretty"

Example Response:

{
    "data": "Restarting Syscheck/Rootcheck on all agents",
    "error": 0
}

Run syscheck scan in an agent

Runs syscheck and rootcheck on an agent (Wazuh launches both processes simultaneously).

Request:

PUT

/syscheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/syscheck/000?pretty"

Example Response:

{
   "error": 0,
   "data": "Restarting Syscheck/Rootcheck locally"
}

Syscollector

Hardware

Get hardware info

Returns the agent's hardware info

Request:

GET

/syscollector/:agent_id/hardware

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/syscollector/000/hardware?pretty"

Example Response:

{
    "data": {
        "ram": {
            "total": 1883804,
            "free": 1114784
        },
        "scan": {
            "id": 826635219,
            "time": "2018/02/12 23:21:10"
        },
        "cpu": {
            "cores": 1,
            "mhz": 1795.917,
            "name": "Intel(R) Core(TM) i5-3337U CPU @ 1.80GHz"
        },
        "board_serial": "0"
    },
    "error": 0
}

Get hardware info of all agents

Returns the agent's hardware info

Request:

GET

/syscollector/hardware

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/syscollector/hardware?pretty&sort=-ram_free"

Example Response:

{
    "data": {
        "totalItems": 3,
        "items": [
            {
                "ram_free": 5351420,
                "scan_id": 565830616,
                "agent_id": "002",
                "ram_total": 6291000,
                "board_serial": "0",
                "scan_time": "2018/02/12 16:09:45",
                "cpu_mhz": 1796,
                "cpu_name": "Intel(R) Core(TM) i5-3337U CPU @ 1.80GHz",
                "cpu_cores": 1
            },
            {
                "ram_free": 2374568,
                "scan_id": 263523550,
                "agent_id": "001",
                "ram_total": 2988700,
                "board_serial": "0",
                "scan_time": "2018/02/12 16:47:29",
                "cpu_mhz": 1795.917,
                "cpu_name": " Intel(R) Core(TM) i5-3337U CPU @ 1.80GHz",
                "cpu_cores": 1
            },
            {
                "ram_free": 950384,
                "scan_id": 22856332,
                "agent_id": "000",
                "ram_total": 1883804,
                "board_serial": "0",
                "scan_time": "2018/02/13 00:24:30",
                "cpu_mhz": 1795.917,
                "cpu_name": "Intel(R) Core(TM) i5-3337U CPU @ 1.80GHz",
                "cpu_cores": 1
            }
        ]
    },
    "error": 0
}

OS

Get os info

Returns the agent's OS info

Request:

GET

/syscollector/:agent_id/os

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/syscollector/000/os?pretty"

Example Response:

{
    "data": {
        "sysname": "centos",
        "scan": {
            "id": 1363438688,
            "time": "2018/02/12 23:21:10"
        },
        "hostname": "node01",
        "version": "3.10.0-514.el7.x86_64",
        "architecture": "x86_64",
        "release": "Linux",
        "os": {
            "version": "7 (Core)",
            "name": "CentOS Linux"
        }
    },
    "error": 0
}

Get os info of all agents

Returns the agent's os info

Request:

GET

/syscollector/os

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/syscollector/os?pretty&sort=-os_name"

Example Response:

{
    "data": {
        "totalItems": 3,
        "items": [
            {
                "scan_id": 1857569867,
                "os_name": "Microsoft Windows 7 Home Premium",
                "scan_time": "2018/02/12 16:09:44",
                "hostname": "WAZUH-PC",
                "os_version": "6.1.7601",
                "architecture": "i686",
                "agent_id": "002"
            },
            {
                "sysname": "centos",
                "scan_id": 686817457,
                "os_name": "CentOS Linux",
                "version": "3.10.0-514.el7.x86_64",
                "os_version": "7 (Core)",
                "scan_time": "2018/02/13 00:24:30",
                "release": "Linux",
                "hostname": "node01",
                "agent_id": "000",
                "architecture": "x86_64"
            },
            {
                "sysname": "centos",
                "scan_id": 1004984843,
                "os_name": "CentOS Linux",
                "version": "3.10.0-514.el7.x86_64",
                "os_version": "7 (Core)",
                "scan_time": "2018/02/12 16:47:29",
                "release": "Linux",
                "hostname": "manager",
                "agent_id": "001",
                "architecture": "x86_64"
            }
        ]
    },
    "error": 0
}

Packages

Get packages info

Returns the agent's packages info

Request:

GET

/syscollector/:agent_id/packages

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/syscollector/000/packages?pretty&limit=2&offset=10&sort=-name"

Example Response:

{
    "data": {
        "totalItems": 372,
        "items": [
            {
                "scan_id": 1516906568,
                "version": "1.1.0-1.el7",
                "vendor": "CentOS",
                "description": "ALSA tools for uploading firmware to some soundcards",
                "name": "alsa-tools-firmware",
                "format": "rpm",
                "scan_time": "2018/02/12 23:21:10",
                "architecture": "x86_64"
            },
            {
                "scan_id": 1516906568,
                "version": "2.6.5-3.el7",
                "vendor": "CentOS",
                "description": "User space tools for 2.6 kernel auditing",
                "name": "audit",
                "format": "rpm",
                "scan_time": "2018/02/12 23:21:10",
                "architecture": "x86_64"
            }
        ]
    },
    "error": 0
}

Get packages info of all agents

Returns the agent's packages info

Request:

GET

/syscollector/packages

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/syscollector/packages?pretty&sort=-name&limit=2&offset=4"

Example Response:

{
    "data": {
        "totalItems": 2,
        "items": [
            {
                "scan_id": 373751880,
                "version": "1:1.4.0-12.el7",
                "vendor": "CentOS",
                "description": "Wifi plugin for NetworkManager",
                "name": "NetworkManager-wifi",
                "format": "rpm",
                "scan_time": "2018/02/13 00:24:30",
                "architecture": "x86_64",
                "agent_id": "000"
            },
            {
                "scan_id": 373751880,
                "version": "1:1.4.0-12.el7",
                "vendor": "CentOS",
                "description": "NetworkManager curses-based UI",
                "name": "NetworkManager-tui",
                "format": "rpm",
                "scan_time": "2018/02/13 00:24:30",
                "architecture": "x86_64",
                "agent_id": "000"
            }
        ]
    },
    "error": 0
}