If this is not included, the API will get the IP automatically. If you are behind a proxy, you must set the option config.BehindProxyServer to yes at config.js.

Allowed values:

IP
IP/NET
ANY

force

Number

Remove the old agent with the same IP if disconnected since <force> seconds.

Example Request:

curl -u foo:bar -X POST -d '{"name":"NewHost","ip":"10.0.0.9"}' -H 'Content-Type:application/json' "http://localhost:55000/agents?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "id": "007",
      "key": "MDA3IE5ld0hvc3QgMTAuMC4wLjkgYzc2YmZiOTEyYzI0MmMyYzFmMjY2ZTZiMzMyMDM4OTlkMzQ5M2E3OTRkOTMyMDU1MzAzZTE3ZDBkN2I0MmM5Yw=="
   }
}

Add agent (quick method)

Adds a new agent with name :agent_name. This agent will use ANY as IP.

Request:

PUT

/agents/:agent_name

Parameters:

Param	Type	Description
`agent_name`	String	Agent name.

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/agents/myNewAgent?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "id": "008",
      "key": "MDA4IG15TmV3QWdlbnQgYW55IGYwNjI0M2Q4YzIyZjI0N2FmNzZjZDFlNjBjZjBjMmE3NTMzY2VmZDQ0NGY4MDk2MTBlYTVlZWI1YjU1OGQzMjY="
   }
}

Insert agent

Insert an agent with an existing id and key.

Request:

POST

/agents/insert

Parameters:

Param	Type	Description
`name`	String	Agent name.
`ip`	String	If this is not included, the API will get the IP automatically. If you are behind a proxy, you must set the option config.BehindProxyServer to yes at config.js. Allowed values: IP IP/NET ANY
`id`	String	Agent ID.
`key`	String	Agent key. Minimum length: 64 characters. Allowed values: ^[a-zA-Z0-9]+$
`force`	Number	Remove the old agent the with same IP if disconnected since <force> seconds.

Example Request:

curl -u foo:bar -X POST -d '{"name":"NewHost_2","ip":"10.0.10.10","id":"123","key":"1abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghi64"}' -H 'Content-Type:application/json' "http://localhost:55000/agents/insert?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "id": "123",
      "key": "1abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghi64"
   }
}

Delete

Delete a list of groups

Removes a list of groups.

Request:

DELETE

/agents/groups

Parameters:

Param	Type	Description
`ids`	String[]	Array of group ID's.

Example Request:

curl -u foo:bar -X DELETE -H "Content-Type:application/json" -d '{"ids":["webserver","database"]}' "http://localhost:55000/agents/groups?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "msg": "All selected groups were removed",
      "ids": [
         "webserver",
         "database"
      ],
      "affected_agents": [
         "002",
         "005",
         "003"
      ]
   }
}

Delete agents

Removes agents, using a list of them or a criterion based on the status or time of the last connection. The Wazuh API must be restarted after removing an agent.

Request:

DELETE

/agents

Parameters:

Param	Type	Description
`ids`	String[]	Array of agent ID's.
`purge`	Boolean	Delete an agent from the key store.
`status`	String	Filters by agent status. Use commas to enter multiple statuses. Allowed values: active pending neverconnected disconnected
`older_than`	String	Filters out disconnected agents for longer than specified. Time in seconds, '[n_days]d', '[n_hours]h', '[n_minutes]m' or '[n_seconds]s'. For never connected agents, uses the register date.

Example Request:

curl -u foo:bar -X DELETE -H "Content-Type:application/json" -d '{"ids":["003","005"]}' "http://localhost:55000/agents?pretty&older_than=10s"

Example Response:

{
   "error": 0,
   "data": {
      "msg": "All selected agents were removed",
      "older_than": "10s",
      "affected_agents": [
         "003",
         "005"
      ],
      "total_affected_agents": 2
   }
}

Delete an agent

Removes an agent.

Request:

DELETE

/agents/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`purge`	String	Delete an agent from the key store.

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/agents/008?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "msg": "All selected agents were removed",
      "affected_agents": [
         "008"
      ]
   }
}

Groups

Create a group

Creates a new group.

Request:

PUT

/agents/groups/:group_id

Parameters:

Param	Type	Description
`group_id`	String	Group ID.

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/agents/groups/pciserver?pretty"

Example Response:

{
   "error": 0,
   "data": "Group 'pciserver' created."
}

Get a file in group

Returns the specified file belonging to the group parsed to JSON.

Request:

GET

/agents/groups/:group_id/files/:filename

Parameters:

Param

Type

Description

group_id

String

Group ID.

file_name

String

Filename

type

String

Type of file.

Allowed values:

conf
rootkit_files
rootkit_trojans
rcl

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/groups/webserver/files/cis_debian_linux_rcl.txt?pretty"

Example Response:

{
    "data": {
        "controls": [
            {
                "...": "..."
            },
            {
                "condition": "all required",
                "name": "CIS - Testing against the CIS Debian Linux Benchmark v1",
                "reference": "CIS_Debian_Benchmark_v1.0pdf",
                "checks": [
                    "f:/etc/debian_version;"
                ]
            }
        ]
    },
    "error": 0
}

Get agents in a group

Returns the list of agents in a group.

Request:

GET

/agents/groups/:group_id

Parameters:

Param	Type	Description
`group_id`	String	Group ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields.
`status`	String	Filters by agent status. Allowed values: active pending neverconnected disconnected

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/groups/dmz?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "status": "Active",
            "configSum": "ab73af41699f13fdd81903b5f23d8d00",
            "group": "dmz",
            "name": "ubuntu",
            "mergedSum": "a83a96777380449bd8c10719f88f0048",
            "ip": "192.168.185.7",
            "node_name": "node01",
            "dateAdd": "2018-08-02 16:52:04",
            "version": "Wazuh v3.5.0",
            "key": "ac7b7eddf95d65374cb82003024096effa8d90789d447805c375427cb62c75a2",
            "manager_host": "wazuh",
            "lastKeepAlive": "2018-08-03 00:26:32",
            "os": {
               "major": "16",
               "name": "Ubuntu",
               "uname": "Linux |ubuntu |4.4.0-131-generic |#157-Ubuntu SMP Thu Jul 12 15:51:36 UTC 2018 |x86_64",
               "platform": "ubuntu",
               "version": "16.04.5 LTS",
               "codename": "Xenial Xerus",
               "arch": "x86_64",
               "minor": "04"
            },
            "id": "001"
         },
         {
            "status": "Never connected",
            "group": "dmz",
            "name": "main_database",
            "ip": "10.0.0.15",
            "node_name": "unknown",
            "dateAdd": "2018-08-03 00:24:46",
            "key": "af1bdfe73ef104254bc654837c4c3f9b882fbbb208a22abe7c3a3e1f42681c8d",
            "id": "004"
         }
      ]
   }
}

Get agents without group

Returns a list with the available agents without group.

Request:

GET

/agents/no_group

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/no_group?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         {
            "status": "Never connected",
            "dateAdd": "2018-08-03 00:25:01",
            "name": "server002",
            "key": "e4df6380401202714d757ca8b37e76c15c13e58256ee6c380022080da7d21f31",
            "ip": "10.0.0.20",
            "id": "006",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-08-03 00:26:34",
            "name": "NewHost",
            "key": "c76bfb912c242c2c1f266e6b33203899d3493a794d932055303e17d0d7b42c9c",
            "ip": "10.0.0.9",
            "id": "007",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-08-03 00:26:34",
            "name": "NewHost_2",
            "key": "1abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghi64",
            "ip": "10.0.10.10",
            "id": "123",
            "node_name": "unknown"
         }
      ]
   }
}

Get group configuration

Returns the group configuration (agent.conf).

Request:

GET

/agents/groups/:group_id/configuration

Parameters:

Param	Type	Description
`group_id`	String	Group ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/groups/dmz/configuration?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1,
      "items": [
         {
            "config": {
               "localfile": [
                  {
                     "log_format": "syslog",
                     "location": "/var/log/linux.log"
                  }
               ]
            },
            "filters": {
               "os": "Linux"
            }
         }
      ]
   }
}

Get group files

Returns the files belonging to the group.

Request:

GET

/agents/groups/:group_id/files

Parameters:

Param	Type	Description
`group_id`	String	Group ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/groups/default/files?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 24,
      "items": [
         {
            "hash": "ab73af41699f13fdd81903b5f23d8d00",
            "filename": "agent.conf"
         },
         {
            "hash": "76d8be9b97d8eae4c239e530ee7e71c8",
            "filename": "ar.conf"
         },
         {
            "hash": "6d9bd718faff778bbeabada6f07f5c2f",
            "filename": "cis_apache2224_rcl.txt"
         },
         {
            "hash": "9beed128b4305943eead1a66a86d27d5",
            "filename": "cis_debian_linux_rcl.txt"
         },
         {
            "hash": "ee520e627150c8751493bc32540b859a",
            "filename": "cis_mysql5-6_community_rcl.txt"
         },
         {
            "hash": "672c92a1f57463e33ff14011b43727de",
            "filename": "cis_mysql5-6_enterprise_rcl.txt"
         },
         {
            "hash": "e03345360941dbff248f63765971f87e",
            "filename": "cis_rhel5_linux_rcl.txt"
         },
         {
            "hash": "d53e584559b759cb6ec3956f23dee46f",
            "filename": "cis_rhel6_linux_rcl.txt"
         },
         {
            "hash": "3b67c8b54d0fa8fdf5afa8d0d43398d8",
            "filename": "cis_rhel7_linux_rcl.txt"
         },
         {
            "hash": "24e83427d2678aada50fa401b921a0cd",
            "filename": "cis_rhel_linux_rcl.txt"
         },
         {
            "hash": "a3978c24aec520c4bcfb7db62bea41b9",
            "filename": "cis_sles11_linux_rcl.txt"
         },
         {
            "hash": "533ec3f8eda8e52edb181e3f6bd44d52",
            "filename": "cis_sles12_linux_rcl.txt"
         },
         {
            "hash": "6d762779c44dda24901673c0e715f5a9",
            "filename": "cis_win2012r2_domainL1_rcl.txt"
         },
         {
            "hash": "18ae1149bf2db6cc942d4fcb0f17a336",
            "filename": "cis_win2012r2_domainL2_rcl.txt"
         },
         {
            "hash": "5f0f6c9c40684b8cdac9bca1fa138ebc",
            "filename": "cis_win2012r2_memberL1_rcl.txt"
         },
         {
            "hash": "10b99529e86bedd78accce983eb402b5",
            "filename": "cis_win2012r2_memberL2_rcl.txt"
         },
         {
            "hash": "f1a9e24e02ba4cc5ea80a9d3feb3bb9a",
            "filename": "merged.mg"
         },
         {
            "hash": "a403c34392032ace267fbb163fc7cfad",
            "filename": "rootkit_files.txt"
         },
         {
            "hash": "b5d427623664d76140acbcb91f42d586",
            "filename": "rootkit_trojans.txt"
         },
         {
            "hash": "6cca8467c592a23fcf62cd5f33608fc3",
            "filename": "system_audit_rcl.txt"
         },
         {
            "hash": "e778eb44e4e8116a1e4c017b9b23eea2",
            "filename": "system_audit_ssh.txt"
         },
         {
            "hash": "0e1f8f16e217a70b9b80047646823587",
            "filename": "win_applications_rcl.txt"
         },
         {
            "hash": "4c2207e003d08db69822754271f9cb60",
            "filename": "win_audit_rcl.txt"
         },
         {
            "hash": "f9c3330533586eb380f294dcbd9918d8",
            "filename": "win_malware_rcl.txt"
         }
      ]
   }
}

Get groups

Returns the list of existing agent groups.

Request:

GET

/agents/groups

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`hash`	String	Select algorithm to generate the sum.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/groups?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         {
            "count": 1,
            "mergedSum": "f1a9e24e02ba4cc5ea80a9d3feb3bb9a",
            "configSum": "ab73af41699f13fdd81903b5f23d8d00",
            "name": "default"
         },
         {
            "count": 2,
            "mergedSum": "bab45db2c0f1440dc60721c468b53265",
            "configSum": "3710695280e1f52b18797c882a28df89",
            "name": "dmz"
         },
         {
            "count": 0,
            "mergedSum": "f1a9e24e02ba4cc5ea80a9d3feb3bb9a",
            "configSum": "ab73af41699f13fdd81903b5f23d8d00",
            "name": "pciserver"
         }
      ]
   }
}

Remove group

Removes the group. Agents that were assigned to the removed group will automatically revert to the 'default' group.

Request:

DELETE

/agents/groups/:group_id

Parameters:

Param	Type	Description
`group_id`	String	Group ID.

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/agents/groups/dmz?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "msg": "All selected groups were removed",
      "ids": [
         "dmz"
      ],
      "affected_agents": [
         "001",
         "004"
      ]
   }
}

Set agent group

Sets an agent to the specified group.

Request:

PUT

/agents/:agent_id/group/:group_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent unique ID.
`group_id`	String	Group ID.

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/agents/004/group/webserver?pretty"

Example Response:

{
   "error": 0,
   "data": "Group 'webserver' set to agent '004'."
}

Unset the agent group

Unsets the group of the agent. The agent will automatically revert to the 'default' group.

Request:

DELETE

/agents/:agent_id/group

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/agents/004/group?pretty"

Example Response:

{
   "error": 0,
   "data": "Group unset for agent '004'."
}

Info

Get OS summary

Returns a summary of the OS.

Request:

GET

/agents/summary/os

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/summary/os?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1,
      "items": [
         "ubuntu"
      ]
   }
}

Get agents summary

Returns a summary of the available agents.

Request:

GET

/agents/summary

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/summary?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "Active": 2,
      "Never connected": 5,
      "Total": 7,
      "Disconnected": 0
   }
}

Get all agents

Returns a list with the available agents.

Request:

GET

/agents

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields.
`status`	String	Filters by agent status. Use commas to enter multiple statuses. Allowed values: active pending neverconnected disconnected
`older_than`	String	Filters out disconnected agents for longer than specified. Time in seconds, '[n_days]d', '[n_hours]h', '[n_minutes]m' or '[n_seconds]s'. For never connected agents, uses the register date.
`os.platform`	String	Filters by OS platform.
`os.version`	String	Filters by OS version.
`manager`	String	Filters by manager hostname to which agents are connected.
`version`	String	Filters by agents version.
`group`	String	Filters by group of agents.
`node`	String	Filters by node name.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents?pretty&offset=0&limit=5&sort=-ip,name"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 7,
      "items": [
         {
            "status": "Active",
            "configSum": "ab73af41699f13fdd81903b5f23d8d00",
            "group": "default",
            "name": "ubuntu",
            "mergedSum": "a83a96777380449bd8c10719f88f0048",
            "ip": "192.168.185.7",
            "node_name": "node01",
            "dateAdd": "2018-08-02 16:52:04",
            "version": "Wazuh v3.5.0",
            "key": "ac7b7eddf95d65374cb82003024096effa8d90789d447805c375427cb62c75a2",
            "manager_host": "wazuh",
            "lastKeepAlive": "2018-08-03 00:26:32",
            "os": {
               "major": "16",
               "name": "Ubuntu",
               "uname": "Linux |ubuntu |4.4.0-131-generic |#157-Ubuntu SMP Thu Jul 12 15:51:36 UTC 2018 |x86_64",
               "platform": "ubuntu",
               "version": "16.04.5 LTS",
               "codename": "Xenial Xerus",
               "arch": "x86_64",
               "minor": "04"
            },
            "id": "001"
         },
         {
            "status": "Active",
            "name": "wazuh",
            "ip": "127.0.0.1",
            "node_name": "node01",
            "dateAdd": "2018-08-02 16:48:58",
            "version": "Wazuh v3.5.0",
            "manager_host": "wazuh",
            "lastKeepAlive": "9999-12-31 23:59:59",
            "os": {
               "major": "18",
               "name": "Ubuntu",
               "uname": "Linux |wazuh |4.15.0-29-generic |#31-Ubuntu SMP Tue Jul 17 15:39:52 UTC 2018 |x86_64",
               "platform": "ubuntu",
               "version": "18.04 LTS",
               "codename": "Bionic Beaver",
               "arch": "x86_64",
               "minor": "04"
            },
            "id": "000"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-08-03 00:26:34",
            "name": "NewHost_2",
            "key": "1abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghi64",
            "ip": "10.0.10.10",
            "id": "123",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-08-03 00:26:34",
            "name": "NewHost",
            "key": "c76bfb912c242c2c1f266e6b33203899d3493a794d932055303e17d0d7b42c9c",
            "ip": "10.0.0.9",
            "id": "007",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "group": "default",
            "name": "server001",
            "ip": "10.0.0.62",
            "node_name": "unknown",
            "dateAdd": "2018-08-03 00:24:35",
            "key": "3cb62630ddc77dccbda46542e8c469728a030e7696384195d61968bd7d107bb7",
            "id": "002"
         }
      ]
   }
}

Get an agent

Returns various information from an agent.

Request:

GET

/agents/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`select`	String	List of selected fields.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/000?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "status": "Active",
      "name": "wazuh",
      "ip": "127.0.0.1",
      "dateAdd": "2018-08-02 16:48:58",
      "version": "Wazuh v3.5.0",
      "manager_host": "wazuh",
      "lastKeepAlive": "9999-12-31 23:59:59",
      "os": {
         "major": "18",
         "name": "Ubuntu",
         "platform": "ubuntu",
         "uname": "Linux |wazuh |4.15.0-29-generic |#31-Ubuntu SMP Tue Jul 17 15:39:52 UTC 2018 |x86_64",
         "version": "18.04 LTS",
         "codename": "Bionic Beaver",
         "arch": "x86_64",
         "minor": "04"
      },
      "id": "000"
   }
}

Get an agent by its name

Returns various information from an agent called :agent_name.

Request:

GET

/agents/name/:agent_name

Parameters:

Param	Type	Description
`agent_name`	String	Agent name.
`select`	String	List of selected fields.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/name/NewHost?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "status": "Never connected",
      "ip": "10.0.0.9",
      "dateAdd": "2018-08-03 00:26:34",
      "id": "007",
      "name": "NewHost"
   }
}

Key

Get agent key

Returns the key of an agent.

Request:

GET

/agents/:agent_id/key

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/004/key?pretty"

Example Response:

{
   "error": 0,
   "data": "MDA0IG1haW5fZGF0YWJhc2UgMTAuMC4wLjE1IGFmMWJkZmU3M2VmMTA0MjU0YmM2NTQ4MzdjNGMzZjliODgyZmJiYjIwOGEyMmFiZTdjM2EzZTFmNDI2ODFjOGQ="
}

Restart

Restart a list of agents

Restarts a list of agents.

Request:

POST

/agents/restart

Parameters:

Param	Type	Description
`ids`	String[]	Array of agent ID's.

Example Request:

curl -u foo:bar -X POST -H "Content-Type:application/json" -d '{"ids":["002","004"]}' "http://localhost:55000/agents/restart?pretty"

Example Response:

{
    "data": "All selected agents were restarted",
    "error": 0
}

Restart all agents

Restarts all agents.

Request:

PUT

/agents/restart

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/agents/restart?pretty"

Example Response:

{
    "data": "Restarting all agents",
    "error": 0
}

Restart an agent

Restarts the specified agent.

Request:

PUT

/agents/:agent_id/restart

Parameters:

Param	Type	Description
`agent_id`	Number	Agent unique ID.

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/agents/007/restart?pretty"

Example Response:

{
    "data": "Restarting agent",
    "error": 0
}

Stats

Get distinct fields in agents

Returns all the different combinations that agents have for the selected fields. It also indicates the total number of agents that have each combination.

Request:

GET

/agents/stats/distinct

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`fields`	String	List of fields affecting the operation.
`select`	String	List of selected fields.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/stats/distinct?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 4,
      "items": [
         {
            "count": 1,
            "version": "Wazuh v3.5.0",
            "group": null,
            "manager_host": "wazuh",
            "os": {
               "major": "18",
               "name": "Ubuntu",
               "uname": "Linux |wazuh |4.15.0-29-generic |#31-Ubuntu SMP Tue Jul 17 15:39:52 UTC 2018 |x86_64",
               "platform": "ubuntu",
               "version": "18.04 LTS",
               "build": null,
               "codename": "Bionic Beaver",
               "arch": "x86_64",
               "minor": "04"
            },
            "node_name": "node01"
         },
         {
            "count": 1,
            "version": "Wazuh v3.5.0",
            "group": "default",
            "manager_host": "wazuh",
            "os": {
               "major": "16",
               "name": "Ubuntu",
               "uname": "Linux |ubuntu |4.4.0-131-generic |#157-Ubuntu SMP Thu Jul 12 15:51:36 UTC 2018 |x86_64",
               "platform": "ubuntu",
               "version": "16.04.5 LTS",
               "build": null,
               "codename": "Xenial Xerus",
               "arch": "x86_64",
               "minor": "04"
            },
            "node_name": "node01"
         },
         {
            "count": 2,
            "version": null,
            "group": "default",
            "manager_host": null,
            "os": {
               "major": null,
               "name": null,
               "uname": null,
               "platform": null,
               "version": null,
               "build": null,
               "codename": null,
               "arch": null,
               "minor": null
            },
            "node_name": "unknown"
         },
         {
            "count": 3,
            "version": null,
            "group": null,
            "manager_host": null,
            "os": {
               "major": null,
               "name": null,
               "uname": null,
               "platform": null,
               "version": null,
               "build": null,
               "codename": null,
               "arch": null,
               "minor": null
            },
            "node_name": "unknown"
         }
      ]
   }
}

Upgrade

Get outdated agents

Returns the list of outdated agents.

Request:

GET

/agents/outdated

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/outdated?pretty"

Example Response:

{
    "data": {
        "totalItems": 2,
        "items": [
            {
                "version": "Wazuh v3.0.0",
                "id": "003",
                "name": "main_database"
            },
            {
                "version": "Wazuh v3.0.0",
                "id": "004",
                "name": "dmz002"
            }
        ]
    },
    "error": 0
}

Get upgrade result from agent

Returns the upgrade result from an agent.

Request:

GET

/agents/:agent_id/upgrade_result

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`timeout`	Number	Seconds to wait for the agent to respond.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/agents/003/upgrade_result?pretty"

Example Response:

{
    "data": "Agent upgraded successfully",
    "error": 0
}

Upgrade agent using custom file

Upgrade the agent using a custom file.

Request:

PUT

/agents/:agent_id/upgrade_custom

Parameters:

Param	Type	Description
`agent_id`	Number	Agent unique ID.
`file_path`	String	WPK file path.
`installer`	String	Installation script.

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/agents/002/upgrade_custom?pretty"

Example Response:

{
    "data": "Installation started",
    "error": 0
}

Upgrade agent using online repository

Upgrade the agent using a WPK file from online repository.

Request:

PUT

/agents/:agent_id/upgrade

Parameters:

Param	Type	Description
`agent_id`	Number	Agent unique ID.
`wpk_repo`	String	WPK repository.
`version`	String	Wazuh version.
`use_http`	Boolean	Use protocol http. If it's false use https. By default the value is set to false.
`force`	number	Force upgrade. Allowed values: 0 1

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/agents/002/upgrade?pretty"

Example Response:

{
    "data": "Upgrade procedure started",
    "error": 0
}

Cache

Delete

Clear group cache

Clears cache of the specified group.

Request:

DELETE

/cache

Parameters:

Param	Type	Description
`group`	String	cache group.

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/cache/mygroup?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "all": [
         "/agents?pretty&offset=0&limit=5&sort=-ip,name",
         "/agents/000?pretty",
         "/agents/name/NewHost?pretty",
         "/agents/stats/distinct?pretty"
      ],
      "groups": {
         "agents": [
            "/agents?pretty&offset=0&limit=5&sort=-ip,name",
            "/agents/000?pretty",
            "/agents/name/NewHost?pretty"
         ],
         "manager": [
            "/agents/stats/distinct?pretty"
         ]
      }
   }
}

Delete cache index

Clears entire cache.

Request:

DELETE

/cache

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/cache?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "all": [],
      "groups": {}
   }
}

Info

Get cache index

Returns current cache index.

Request:

GET

/cache

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/cache?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "all": [],
      "groups": {}
   }
}

Return cache configuration

Returns cache configuration.

Request:

GET

/cache/config

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/cache/config?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "debug": false,
      "defaultDuration": 750,
      "enabled": true,
      "appendKey": [],
      "jsonp": false,
      "redisClient": false
   }
}

Cluster

Configuration

Get the cluster configuration

Returns the cluster configuration

Request:

GET

/cluster/config

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/cluster/config?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "disabled": "no",
      "hidden": "no",
      "name": "wazuh",
      "node_name": "node01",
      "bind_addr": "0.0.0.0",
      "node_type": "master",
      "key": "b36430de0e4f51627cd8c468f1a3c681",
      "nodes": [
         "192.168.185.3"
      ],
      "port": 1516
   }
}

Info

Get info about cluster status

Returns whether the cluster is enabled or disabled

Request:

GET

/cluster/status

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/cluster/status?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "running": "yes",
      "enabled": "yes"
   }
}

Show cluster health

Request:

GET

/cluster/healthcheck

Parameters:

Param	Type	Description
`node`	String	Filter information by node name. *

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/cluster/healthcheck?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "nodes": {
         "node02": {
            "info": {
               "ip": "192.168.185.4",
               "version": "3.5.0",
               "type": "worker",
               "name": "node02",
               "n_active_agents": 0
            },
            "status": {
               "last_sync_agentinfo": {
                  "date_start_master": "n/a",
                  "date_end_master": "n/a",
                  "total_agentinfo": 0
               },
               "sync_integrity_free": true,
               "last_sync_agentgroups": {
                  "date_end_master": "2018-08-02 23:46:16.58",
                  "total_agentgroups": 0,
                  "date_start_master": "2018-08-02 23:46:16.58"
               },
               "last_sync_integrity": {
                  "total_files": {
                     "shared": 1,
                     "missing": 0,
                     "extra_valid": 0,
                     "extra": 0
                  },
                  "date_end_master": "2018-08-03 00:26:20.77",
                  "date_start_master": "2018-08-03 00:26:19.63"
               },
               "sync_agentinfo_free": true,
               "sync_extravalid_free": true
            }
         },
         "node01": {
            "info": {
               "ip": "192.168.185.3",
               "version": "3.5.0",
               "type": "master",
               "name": "node01",
               "n_active_agents": 2
            }
         }
      },
      "n_connected_nodes": 2
   }
}

Nodes

Get local node info

Returns the local node info

Request:

GET

/cluster/node

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/cluster/node?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "node": "node01",
      "cluster": "wazuh",
      "type": "master"
   }
}

Get node info

Returns the node info

Request:

GET

/cluster/nodes/:node_name

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/cluster/nodes/node01?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "ip": "192.168.185.3",
      "version": "3.5.0",
      "type": "master",
      "name": "node01"
   }
}

Get nodes info

Returns the nodes info

Request:

GET

/cluster/nodes

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields.
`type`	String	Filters by node type. *

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/cluster/nodes?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "ip": "192.168.185.4",
            "version": "3.5.0",
            "type": "worker",
            "name": "node02"
         },
         {
            "ip": "192.168.185.3",
            "version": "3.5.0",
            "type": "master",
            "name": "node01"
         }
      ]
   }
}

Decoders

Info

Get all decoders

Returns all decoders included in ossec.conf.

Request:

GET

/decoders

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`file`	String	Filters by filename.
`path`	String	Filters by path.
`status`	String	Filters the decoders by status. Allowed values: enabled disabled all

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/decoders?pretty&offset=0&limit=2&sort=+file,position"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 555,
      "items": [
         {
            "status": "enabled",
            "name": "wazuh",
            "details": {
               "prematch": "^wazuh: "
            },
            "file": "0005-wazuh_decoders.xml",
            "position": 0,
            "path": "/var/ossec/ruleset/decoders"
         },
         {
            "status": "enabled",
            "name": "agent-buffer",
            "details": {
               "regex": "^ '(\\S+)'.",
               "prematch": "^Agent buffer:",
               "parent": "wazuh",
               "order": "level"
            },
            "file": "0005-wazuh_decoders.xml",
            "position": 1,
            "path": "/var/ossec/ruleset/decoders"
         }
      ]
   }
}

Get all decoders files

Returns all decoders files included in ossec.conf.

Request:

GET

/decoders/files

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`status`	String	Filters the decoders by status. Allowed values: enabled disabled all
`file`	String	Filters by filename.
`path`	String	Filters by path.
`download`	String	Downloads the file

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/decoders/files?pretty&offset=0&limit=10&sort=-path"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 93,
      "items": [
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0275-sendmail_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0410-docker_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0440-proxmox-ve_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0065-cisco-ios_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0325-suhosin_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0340-trend-osce_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0195-oscap_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0115-grandstream_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0380-windows_decoders.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/decoders",
            "file": "0005-wazuh_decoders.xml"
         }
      ]
   }
}

Get all parent decoders

Returns all parent decoders included in ossec.conf

Request:

GET

/decoders/parents

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/decoders/parents?pretty&offset=0&limit=2&sort=-file"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 150,
      "items": [
         {
            "status": "enabled",
            "name": "local_decoder_example",
            "details": {
               "program_name": "local_decoder_example"
            },
            "file": "local_decoder.xml",
            "position": 0,
            "path": "/var/ossec/etc/decoders"
         },
         {
            "status": "enabled",
            "name": "pf",
            "details": {
               "program_name": "filterlog"
            },
            "file": "0455-pfsense_decoders.xml",
            "position": 0,
            "path": "/var/ossec/ruleset/decoders"
         }
      ]
   }
}

Get decoders by name

Returns the decoders with the specified name.

Request:

GET

/decoders/:decoder_name

Parameters:

Param	Type	Description
`decoder_name`	String	Decoder name.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/decoders/apache-errorlog?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         {
            "status": "enabled",
            "name": "apache-errorlog",
            "details": {
               "program_name": "^apache2|^httpd"
            },
            "file": "0025-apache_decoders.xml",
            "position": 0,
            "path": "/var/ossec/ruleset/decoders"
         },
         {
            "status": "enabled",
            "name": "apache-errorlog",
            "details": {
               "prematch": "^[warn] |^[notice] |^[error] "
            },
            "file": "0025-apache_decoders.xml",
            "position": 1,
            "path": "/var/ossec/ruleset/decoders"
         },
         {
            "status": "enabled",
            "name": "apache-errorlog",
            "details": {
               "prematch": "^[\\w+ \\w+ \\d+ \\d+:\\d+:\\d+.\\d+ \\d+] [\\S+:warn] |^[\\w+ \\w+ \\d+ \\d+:\\d+:\\d+.\\d+ \\d+] [\\S+:notice] |^[\\w+ \\w+ \\d+ \\d+:\\d+:\\d+.\\d+ \\d+] [\\S*:error] |^[\\w+ \\w+ \\d+ \\d+:\\d+:\\d+.\\d+ \\d+] [\\S+:info] "
            },
            "file": "0025-apache_decoders.xml",
            "position": 2,
            "path": "/var/ossec/ruleset/decoders"
         }
      ]
   }
}

Experimental

Hardware

Get hardware info of all agents

Returns the agent's hardware info

Request:

GET

/experimental/syscollector/hardware

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields.
`ram_free`	String	Filters by ram_free.
`ram_total`	String	Filters by ram_total.
`cpu_cores`	String	Filters by cpu_cores.
`cpu_mhz`	String	Filters by cpu_mhz.
`cpu_name`	String	Filters by cpu_name.
`board_serial`	String	Filters by board_serial.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/experimental/syscollector/hardware?pretty&sort=-ram_free"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "board_serial": "0",
            "agent_id": "000",
            "ram": {
               "usage": 56,
               "total": 6053772,
               "free": 2677484
            },
            "cpu": {
               "cores": 2,
               "mhz": 1991.998,
               "name": "Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz"
            },
            "scan": {
               "id": 208137997,
               "time": "2018/08/02 23:45:54"
            }
         },
         {
            "board_serial": "0",
            "agent_id": "001",
            "ram": {
               "usage": 71,
               "total": 1015976,
               "free": 297140
            },
            "cpu": {
               "cores": 1,
               "mhz": 1991.998,
               "name": "Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz"
            },
            "scan": {
               "id": 2056454263,
               "time": "2018/08/02 17:25:53"
            }
         }
      ]
   }
}

Netaddr

Get network address info of all agents

Returns the agent's network address info

Request:

GET

/experimental/syscollector/netaddr

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`id`	String	Filters by id.
`proto`	String	Filters by proto.
`address`	String	Filters by address.
`broadcast`	String	Filters by broadcast.
`netmask`	String	Filters by netmask.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/experimental/syscollector/netaddr?pretty&limit=2&sort=proto"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 8,
      "items": [
         {
            "scan_id": 483670720,
            "agent_id": "000",
            "proto": "ipv6",
            "address": "fe80::a00:27ff:fed6:8e4f",
            "netmask": "ffff:ffff:ffff:ffff::",
            "id": 17
         },
         {
            "scan_id": 483670720,
            "agent_id": "000",
            "proto": "ipv6",
            "address": "fe80::a00:27ff:fea9:6759",
            "netmask": "ffff:ffff:ffff:ffff::",
            "id": 18
         }
      ]
   }
}

Netiface

Get network interface info of all agents

Returns the agent's network interface info

Request:

GET

/experimental/syscollector/netiface

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`id`	String	Filters by id.
`name`	String	Filters by name.
`adapter`	String	Filters by adapter.
`type`	String	Filters by type.
`state`	String	Filters by state.
`mtu`	String	Filters by mtu.
`tx_packets`	String	Filters by tx_packets.
`rx_packets`	String	Filters by rx_packets.
`tx_bytes`	String	Filters by tx_bytes.
`rx_bytes`	String	Filters by rx_bytes.
`tx_errors`	String	Filters by tx_errors.
`rx_errors`	String	Filters by rx_errors.
`tx_dropped`	String	Filters by tx_dropped.
`rx_dropped`	String	Filters by rx_dropped.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/experimental/syscollector/netiface?pretty&limit=2&sort=rx_bytes"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 4,
      "items": [
         {
            "name": "enp0s3",
            "tx": {
               "packets": 144,
               "errors": 0,
               "bytes": 16993,
               "dropped": 0
            },
            "scan": {
               "id": 483670720,
               "time": "2018/08/02 23:45:54"
            },
            "rx": {
               "packets": 352,
               "errors": 0,
               "bytes": 346608,
               "dropped": 0
            },
            "mac": "08:00:27:D6:8E:4F",
            "mtu": 1500,
            "state": "up",
            "agent_id": "000",
            "type": "ethernet",
            "id": 17
         },
         {
            "name": "enp0s8",
            "tx": {
               "packets": 1580,
               "errors": 0,
               "bytes": 229506,
               "dropped": 0
            },
            "scan": {
               "id": 483670720,
               "time": "2018/08/02 23:45:54"
            },
            "rx": {
               "packets": 6032,
               "errors": 0,
               "bytes": 1600051,
               "dropped": 0
            },
            "mac": "08:00:27:A9:67:59",
            "mtu": 1500,
            "state": "up",
            "agent_id": "000",
            "type": "ethernet",
            "id": 18
         }
      ]
   }
}

Netproto

Get network protocol info of all agents

Returns the agent's network protocol info

Request:

GET

/experimental/syscollector/netproto

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`id`	String	Filters by id.
`iface`	String	Filters by iface.
`type`	String	Filters by type.
`gateway`	String	Filters by gateway.
`dhcp`	String	Filters by dhcp.

Example Request:

curl -u foo:bar -X GET "https://localhost:55000/experimental/syscollector/netproto?pretty&limit=2&sort=type"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 8,
      "items": [
         {
            "scan_id": 483670720,
            "iface": "enp0s3",
            "agent_id": "000",
            "dhcp": "enabled",
            "type": "ipv6",
            "id": 17
         },
         {
            "scan_id": 483670720,
            "iface": "enp0s8",
            "agent_id": "000",
            "dhcp": "enabled",
            "type": "ipv6",
            "id": 18
         }
      ]
   }
}

OS

Get os info of all agents

Returns the agent's os info

Request:

GET

/experimental/syscollector/os

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields.
`os_name`	String	Filters by os_name.
`architecture`	String	Filters by architecture.
`os_version`	String	Filters by os_version.
`version`	String	Filters by version.
`release`	String	Filters by release.

Example Request:

curl -u foo:bar -X GET "https://localhost:55000/experimental/syscollector/os?pretty&sort=-os_name"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "sysname": "Linux",
            "scan": {
               "id": 433934775,
               "time": "2018/08/02 23:45:54"
            },
            "hostname": "wazuh",
            "version": "#31-Ubuntu SMP Tue Jul 17 15:39:52 UTC 2018",
            "agent_id": "000",
            "release": "4.15.0-29-generic",
            "os": {
               "major": "18",
               "name": "Ubuntu",
               "platform": "ubuntu",
               "version": "18.04 LTS (Bionic Beaver)",
               "codename": "Bionic Beaver",
               "minor": "04"
            },
            "architecture": "x86_64"
         },
         {
            "sysname": "Linux",
            "scan": {
               "id": 2004741248,
               "time": "2018/08/02 17:25:53"
            },
            "hostname": "ubuntu",
            "version": "#157-Ubuntu SMP Thu Jul 12 15:51:36 UTC 2018",
            "agent_id": "001",
            "release": "4.4.0-131-generic",
            "os": {
               "major": "16",
               "name": "Ubuntu",
               "platform": "ubuntu",
               "version": "16.04.5 LTS (Xenial Xerus)",
               "codename": "Xenial Xerus",
               "minor": "04"
            },
            "architecture": "x86_64"
         }
      ]
   }
}

Packages

Get packages info of all agents

Returns the agent's packages info

Request:

GET

/experimental/syscollector/packages

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`vendor`	String	Filters by vendor.
`name`	String	Filters by name.
`architecture`	String	Filters by architecture.
`format`	String	Filters by format.
`select`	String	List of selected fields.

Example Request:

curl -u foo:bar -X GET "https://localhost:55000/experimental/syscollector/packages?pretty&sort=-name&limit=2&offset=4"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1107,
      "items": [
         {
            "vendor": "Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>",
            "name": "apache2",
            "scan": {
               "id": 1222412658,
               "time": "2018/08/02 23:45:54"
            },
            "section": "httpd",
            "format": "deb",
            "architecture": "amd64",
            "priority": "optional",
            "version": "2.4.29-1ubuntu4.2",
            "agent_id": "000",
            "size": 520,
            "description": "Apache HTTP Server"
         },
         {
            "vendor": "Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>",
            "name": "amd64-microcode",
            "scan": {
               "id": 1222412658,
               "time": "2018/08/02 23:45:54"
            },
            "section": "non-free/admin",
            "format": "deb",
            "architecture": "amd64",
            "priority": "standard",
            "version": "3.20180524.1~ubuntu0.18.04.1",
            "agent_id": "000",
            "size": 74,
            "description": "Processor microcode firmware for AMD CPUs"
         }
      ]
   }
}

Ports

Get ports info of all agents

Returns the agent's ports info

Request:

GET

/experimental/syscollector/ports

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`pid`	Number	Filters by pid.
`protocol`	String	Filters by protocol.
`local_ip`	String	Filters by local_ip.
`local_port`	Number	Filters by local_port.
`remote_ip`	String	Filters by remote_ip.
`tx_queue`	Number	Filters by tx_queue.
`state`	String	Filters by state.

Example Request:

curl -u foo:bar -X GET "https://localhost:55000/experimental/syscollector/ports?pretty&limit=2&sort=protocol"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 16,
      "items": [
         {
            "remote": {
               "ip": "::",
               "port": 0
            },
            "scan": {
               "id": 1219576791,
               "time": "2018/08/02 23:45:56"
            },
            "inode": 164751,
            "state": "listening",
            "tx_queue": 0,
            "agent_id": "000",
            "protocol": "tcp6",
            "rx_queue": 0,
            "local": {
               "ip": "::ffff:127.0.0.1",
               "port": 9600
            }
         },
         {
            "remote": {
               "ip": "::",
               "port": 0
            },
            "scan": {
               "id": 1219576791,
               "time": "2018/08/02 23:45:56"
            },
            "inode": 164667,
            "state": "listening",
            "tx_queue": 0,
            "agent_id": "000",
            "protocol": "tcp6",
            "rx_queue": 0,
            "local": {
               "ip": "::ffff:127.0.0.1",
               "port": 9200
            }
         }
      ]
   }
}

Processes

Get processes info of all agents

Returns the agent's processes info

Request:

GET

/experimental/syscollector/processes

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`pid`	Number	Filters by process pid.
`egroup`	String	Filters by process egroup.
`euser`	String	Filters by process euser.
`fgroup`	String	Filters by process fgroup.
`nlwp`	Number	Filters by process nlwp.
`pgrp`	Number	Filters by process pgrp.
`priority`	Number	Filters by process priority.
`rgroup`	String	Filters by process rgroup.
`ruser`	String	Filters by process ruser.
`sgroup`	String	Filters by process sgroup.
`suser`	String	Filters by process suser.

Example Request:

curl -u foo:bar -X GET "https://localhost:55000/experimental/syscollector/processes?pretty&limit=2&sort=priority"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 206,
      "items": [
         {
            "euser": "root",
            "tty": 0,
            "rgroup": "root",
            "sgroup": "root",
            "scan": {
               "id": 2147483647,
               "time": "2018/08/02 23:45:56"
            },
            "resident": 0,
            "share": 0,
            "start_time": 3,
            "pid": "29",
            "session": 0,
            "stime": 0,
            "vm_size": 0,
            "size": 0,
            "agent_id": "000",
            "ppid": 2,
            "egroup": "root",
            "name": "khugepaged",
            "pgrp": 0,
            "tgid": 29,
            "utime": 0,
            "priority": 39,
            "fgroup": "root",
            "state": "S",
            "ruser": "root",
            "suser": "root",
            "nlwp": 1,
            "processor": 1,
            "nice": 19
         },
         {
            "euser": "logstash",
            "tty": 0,
            "rgroup": "logstash",
            "sgroup": "logstash",
            "scan": {
               "id": 2147483647,
               "time": "2018/08/02 23:45:56"
            },
            "resident": 152574,
            "share": 5026,
            "start_time": 1178,
            "pid": "975",
            "tgid": 975,
            "session": 975,
            "stime": 733,
            "vm_size": 3631444,
            "size": 907861,
            "agent_id": "000",
            "ppid": 1,
            "egroup": "logstash",
            "name": "java",
            "pgrp": 975,
            "argvs": "-Xms1g,-Xmx1g,-XX:+UseParNewGC,-XX:+UseConcMarkSweepGC,-XX:CMSInitiatingOccupancyFraction=75,-XX:+UseCMSInitiatingOccupancyOnly,-Djava.awt.headless=true,-Dfile.encoding=UTF-8,-Djruby.compile.invokedynamic=true,-Djruby.jit.threshold=0,-XX:+HeapDumpOnOutOfMemoryError,-Djava.security.egd=file:/dev/urandom,-cp,/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-1.1.jar:/usr/share/logstash/logstash-core/lib/jars/guava-19.0.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-annotations-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-core-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/janino-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.1.13.0.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-api-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/logstash-core.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.commands-3.6.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.contenttype-3.4.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.expressions-3.4.300.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.filesystem-1.3.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.jobs-3.5.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.resources-3.7.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.runtime-3.7.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.app-1.3.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.common-3.6.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.preferences-3.4.1.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.registry-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.jdt.core-3.10.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.osgi-3.7.1.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.text-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.25.jar,org.logstash.Logstash,--path.settings,/etc/logstash",
            "utime": 13764,
            "cmd": "/usr/bin/java",
            "priority": 39,
            "fgroup": "logstash",
            "state": "S",
            "ruser": "logstash",
            "suser": "logstash",
            "nlwp": 31,
            "processor": 0,
            "nice": 19
         }
      ]
   }
}

Manager

Configuration

Get manager configuration

Returns ossec.conf in JSON format.

Request:

GET

/manager/configuration

Parameters:

Param	Type	Description
`section`	String	Indicates the ossec.conf section: global, rules, syscheck, rootcheck, remote, alerts, command, active-response, localfile.
`field`	String	Indicates a section child, e.g, fields for rule section are: include, decoder_dir, etc.

Example Request:

curl -u foo:bar -X GET "https://localhost:55000/manager/configuration?section=global&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "email_notification": "no",
      "alerts_log": "yes",
      "jsonout_output": "yes",
      "smtp_server": "smtp.example.wazuh.com",
      "queue_size": "131072",
      "email_to": "recipient@example.wazuh.com",
      "logall": "no",
      "email_maxperhour": "12",
      "white_list": [
         "127.0.0.1",
         "^localhost.localdomain$",
         "127.0.0.53"
      ],
      "email_from": "ossecm@example.wazuh.com",
      "logall_json": "no"
   }
}

Info

Get manager information

Returns basic information about manager.

Request:

GET

/manager/info

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/manager/info?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "compilation_date": "Thu Aug  2 16:48:56 UTC 2018",
      "version": "v3.5.0",
      "openssl_support": "yes",
      "max_agents": "14000",
      "ruleset_version": "3500",
      "path": "/var/ossec",
      "tz_name": "UTC",
      "type": "manager",
      "tz_offset": "+0000"
   }
}

Get manager status

Returns the status of the manager processes.

Request:

GET

/manager/status

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/manager/status?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "wazuh-modulesd": "running",
      "ossec-authd": "stopped",
      "wazuh-clusterd": "running",
      "ossec-monitord": "running",
      "ossec-logcollector": "running",
      "ossec-execd": "running",
      "ossec-remoted": "running",
      "ossec-syscheckd": "running",
      "ossec-analysisd": "running",
      "ossec-maild": "stopped"
   }
}

Logs

Get ossec.log

Returns the three last months of ossec.log.

Request:

GET

/manager/logs

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`type_log`	String	Filters by type of log. Allowed values: all error warning info
`category`	String	Filters by category of log.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/manager/logs?offset=0&limit=5&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 29,
      "items": [
         {
            "timestamp": "2018-08-03 00:26:35",
            "tag": "wazuh-modulesd:database",
            "description": "Couldn't get database status for agent '3'.",
            "level": "error"
         },
         {
            "timestamp": "2018-08-03 00:26:35",
            "tag": "wazuh-modulesd:database",
            "description": "Couldn't get database status for agent '5'.",
            "level": "error"
         },
         {
            "timestamp": "2018-08-03 00:26:34",
            "tag": "ossec-remoted",
            "description": "(1409): Authentication file changed. Updating.",
            "level": "info"
         },
         {
            "timestamp": "2018-08-03 00:26:34",
            "tag": "ossec-remoted",
            "description": "(1410): Reading authentication keys file.",
            "level": "info"
         },
         {
            "timestamp": "2018-08-03 00:25:54",
            "tag": "wazuh-db",
            "description": "at wdb_process_insert(): sqlite3_step(): UNIQUE constraint failed: sys_processes.scan_id, sys_processes.pid",
            "level": "error"
         }
      ]
   }
}

Get summary of ossec.log

Returns a summary of the last three months of the <code>ossec.log</code> file.

Request:

GET

/manager/logs/summary

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/manager/logs/summary?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "ossec-remoted": {
         "info": 8,
         "all": 8,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "ossec-analysisd": {
         "info": 0,
         "all": 1,
         "critical": 0,
         "error": 1,
         "debug": 0,
         "warning": 0
      },
      "wazuh-db": {
         "info": 0,
         "all": 2,
         "critical": 0,
         "error": 2,
         "debug": 0,
         "warning": 0
      },
      "ossec-monitord": {
         "info": 16,
         "all": 16,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "wazuh-modulesd:database": {
         "info": 0,
         "all": 2,
         "critical": 0,
         "error": 2,
         "debug": 0,
         "warning": 0
      }
   }
}

Stats

Get manager stats

Returns Wazuh statistical information for the current or specified date.

Request:

GET

/manager/stats

Parameters:

Param	Type	Description
`date`	String	Selects the date for getting the statistical information. Format: YYYYMMDD

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/manager/stats?pretty"

Example Response:

{
    "data": [
        {
            "hour": 5,
            "firewall": 0,
            "alerts": [
                {
                    "level": 3,
                    "sigid": 5715,
                    "times": 4
                },
                {
                    "level": 2,
                    "sigid": 1002,
                    "times": 2
                },
                {
                    "...": "..."
                }
            ],
            "totalAlerts": 107,
            "syscheck": 1257,
            "events": 1483
        },
        {
            "...": "..."
        }
    ],
    "error": 0
}

Get manager stats by hour

Returns Wazuh statistical information per hour. Each number in the averages field represents the average of alerts per hour.

Request:

GET

/manager/stats/hourly

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/manager/stats/hourly?pretty"

Example Response:

{
    "data": {
        "averages": [
            100,
            357,
            242,
            500,
            422,
            "...",
            123
        ],
        "interactions": 0
    },
    "error": 0
}

Get manager stats by week

Returns Wazuh statistical information per week. Each number in the hours field represents the average alerts per hour for that specific day.

Request:

GET

/manager/stats/weekly

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/manager/stats/weekly?pretty"

Example Response:

{
    "data": {
        "Wed": {
            "hours": [
                223,
                "...",
                456
            ],
            "interactions": 0
        },
        "Sun": {
            "hours": [
                332,
                "...",
                313
            ],
            "interactions": 0
        },
        "Thu": {
            "hours": [
                888,
                "...",
                123
            ],
            "interactions": 0
        },
        "Tue": {
            "hours": [
                536,
                "...",
                345
            ],
            "interactions": 0
        },
        "Mon": {
            "hours": [
                444,
                "...",
                556
            ],
            "interactions": 0
        },
        "Fri": {
            "hours": [
                131,
                "...",
                432
            ],
            "interactions": 0
        },
        "Sat": {
            "hours": [
                134,
                "...",
                995
            ],
            "interactions": 0
        }
    },
    "error": 0
}

Rootcheck

Clear

Clear rootcheck database

Clears the rootcheck database for all agents.

Request:

DELETE

/rootcheck

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/rootcheck?pretty"

Example Response:

{
    "data": "Rootcheck database deleted",
    "error": 0
}

Clear rootcheck database of an agent

Clears the rootcheck database for a specific agent.

Request:

DELETE

/rootcheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/rootcheck/000?pretty"

Example Response:

{
    "data": "Rootcheck database deleted",
    "error": 0
}

Info

Get last rootcheck scan

Returns the timestamp of the last rootcheck scan.

Request:

GET

/rootcheck/:agent_id/last_scan

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rootcheck/000/last_scan?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "start": "2018-08-02 23:45:59",
      "end": "2018-08-02 23:46:31"
   }
}

Get rootcheck CIS requirements

Returns the CIS requirements of all rootchecks of the specified agent.

Request:

GET

/rootcheck/:agent_id/cis

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rootcheck/000/cis?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         "1.4 Debian Linux",
         "2.3 Debian Linux",
         "4.13 Debian Linux"
      ]
   }
}

Get rootcheck database

Returns the rootcheck database of an agent.

Request:

GET

/rootcheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`pci`	String	Filters by pci requirement.
`cis`	String	Filters by CIS.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`status`	String	Filters by status.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rootcheck/000?offset=0&limit=2&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 14,
      "items": [
         {
            "status": "outstanding",
            "oldDay": "2018-08-02 16:50:41",
            "cis": "1.4 Debian Linux",
            "readDay": "2018-08-02 23:46:02",
            "event": "System Audit: CIS - Debian Linux - 1.4 - Robust partition scheme - /opt is not on its own partition {CIS: 1.4 Debian Linux}. File: /opt. Reference: https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf ."
         },
         {
            "status": "outstanding",
            "oldDay": "2018-08-02 16:50:41",
            "cis": "1.4 Debian Linux",
            "readDay": "2018-08-02 23:46:02",
            "event": "System Audit: CIS - Debian Linux - 1.4 - Robust partition scheme - /tmp is not on its own partition {CIS: 1.4 Debian Linux}. File: /etc/fstab. Reference: https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf ."
         }
      ]
   }
}

Get rootcheck pci requirements

Returns the PCI requirements of all rootchecks of the agent.

Request:

GET

/rootcheck/:agent_id/pci

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rootcheck/000/pci?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         "2.2.2",
         "2.2.4",
         "4.1"
      ]
   }
}

Run

Run rootcheck scan in all agents

Runs syscheck and rootcheck on all agents (Wazuh launches both processes simultaneously).

Request:

PUT

/rootcheck

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/rootcheck?pretty"

Example Response:

{
    "data": "Restarting Syscheck/Rootcheck on all agents",
    "error": 0
}

Run rootcheck scan in an agent

Runs syscheck and rootcheck on a specified agent (Wazuh launches both processes simultaneously)

Request:

PUT

/rootcheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/rootcheck/000?pretty"

Example Response:

{
   "error": 0,
   "data": "Restarting Syscheck/Rootcheck locally"
}

Rules

Info

Get all rules

Returns all rules.

Request:

GET

/rules

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`status`	String	Filters the rules by status. Allowed values: enabled disabled all
`group`	String	Filters the rules by group.
`level`	Range	Filters the rules by level. level=2 or level=2-5.
`path`	String	Filters the rules by path.
`file`	String	Filters the rules by file name.
`pci`	String	Filters the rules by pci requirement.
`gdpr`	String	Filters the rules by gdpr.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rules?offset=0&limit=2&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1644,
      "items": [
         {
            "status": "enabled",
            "pci": [],
            "description": "Generic template for all syslog rules.",
            "file": "0010-rules_config.xml",
            "level": 0,
            "path": "/var/ossec/ruleset/rules",
            "details": {
               "category": "syslog",
               "noalert": "1"
            },
            "groups": [
               "syslog"
            ],
            "id": 1,
            "gdpr": []
         },
         {
            "status": "enabled",
            "pci": [],
            "description": "Generic template for all firewall rules.",
            "file": "0010-rules_config.xml",
            "level": 0,
            "path": "/var/ossec/ruleset/rules",
            "details": {
               "category": "firewall",
               "noalert": "1"
            },
            "groups": [
               "firewall"
            ],
            "id": 2,
            "gdpr": []
         }
      ]
   }
}

Get files of rules

Returns the files of all rules.

Request:

GET

/rules/files

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`status`	String	Filters files by status. Allowed values: enabled disabled all
`path`	String	Filters the rules by path.
`file`	String	Filters the rules by filefile.
`download`	String	Downloads the file

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rules/files?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 107,
      "items": [
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0010-rules_config.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0015-ossec_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0016-wazuh_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0020-syslog_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0025-sendmail_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0030-postfix_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0035-spamd_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0040-imapd_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0045-mailscanner_rules.xml"
         },
         {
            "status": "enabled",
            "path": "/var/ossec/ruleset/rules",
            "file": "0050-ms-exchange_rules.xml"
         }
      ]
   }
}

Get rule gdpr requirements

Returns the GDPR requirements of all rules.

Request:

GET

/rules/gdpr

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rules/gdpr?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 4,
      "items": [
         "II_5.1.f",
         "IV_30.1.g",
         "IV_32.2",
         "IV_35.7.d"
      ]
   }
}

Get rule groups

Returns the groups of all rules.

Request:

GET

/rules/groups

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rules/groups?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 292,
      "items": [
         "access_control",
         "access_denied",
         "accesslog",
         "account_changed",
         "active_response",
         "adduser",
         "agent",
         "agent_flooding",
         "agent_restarting",
         "agentless"
      ]
   }
}

Get rule pci requirements

Returns the PCI requirements of all rules.

Request:

GET

/rules/pci

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rules/pci?offset=0&limit=10&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 38,
      "items": [
         "1.1.1",
         "1.3.4",
         "1.4",
         "10.1",
         "10.2.1",
         "10.2.2",
         "10.2.4",
         "10.2.5",
         "10.2.6",
         "10.2.7"
      ]
   }
}

Get rules by id

Returns the rules with the specified id.

Request:

GET

/rules/:rule_id

Parameters:

Param	Type	Description
`id`	Number	rule.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/rules/1002?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 1,
      "items": [
         {
            "status": "enabled",
            "pci": [],
            "description": "Unknown problem somewhere in the system.",
            "file": "0020-syslog_rules.xml",
            "level": 2,
            "path": "/var/ossec/ruleset/rules",
            "details": {
               "match": "$BAD_WORDS"
            },
            "groups": [
               "gpg13_4.3",
               "syslog",
               "errors"
            ],
            "id": 1002,
            "gdpr": []
         }
      ]
   }
}

Syscheck

Clear

Clear syscheck database

Clears the syscheck database for all agents.

Request:

DELETE

/syscheck

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/syscheck?pretty"

Example Response:

{
    "data": "Syscheck database deleted",
    "error": 0
}

Clear syscheck database of an agent

Clears the syscheck database for the specified agent.

Request:

DELETE

/syscheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -X DELETE "http://localhost:55000/syscheck/000?pretty"

Example Response:

{
    "data": "Syscheck database deleted",
    "error": 0
}

Info

Get last syscheck scan

Return the timestamp of the last syscheck scan.

Request:

GET

/syscheck/:agent_id/last_scan

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscheck/000/last_scan?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "start": "2018-08-02 23:45:55",
      "end": "2018-08-02 23:45:59"
   }
}

Get syscheck files

Returns the syscheck files of an agent.

Request:

GET

/syscheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`event`	String	Filters files by event. Allowed values: added readded modified deleted
`file`	String	Filters file by filename.
`filetype`	String	Selects type of file. Allowed values: file registry
`summary`	String	Returns a summary grouping by filename. Allowed values: yes no
`md5`	String	Returns the files with the specified md5 hash.
`sha1`	String	Returns the files with the specified sha1 hash.
`hash`	String	Returns the files with the specified hash (md5 or sha1).

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscheck/000?offset=0&limit=2&pretty"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 3494,
      "items": [
         {
            "sha1": "4d6b55312cbfedc71a7f52158de7d2eb59443bde",
            "group": "root",
            "uid": 0,
            "scanDate": "2018-08-02 16:50:19",
            "gid": 0,
            "user": "root",
            "file": "/boot/System.map-4.15.0-29-generic",
            "modificationDate": "2018-07-17 08:57:50",
            "octalMode": "100600",
            "permissions": "-rw-------",
            "md5": "b8f99e91ffa3c53c05b7e03cdbdf408d",
            "inode": 535047,
            "event": "modified",
            "size": 4040379
         },
         {
            "sha1": "7a604af2743cee6a5b19b0f7e0728c824f69efd5",
            "group": "root",
            "uid": 0,
            "scanDate": "2018-08-02 16:50:19",
            "gid": 0,
            "user": "root",
            "file": "/boot/initrd.img-4.15.0-23-generic",
            "modificationDate": "2018-07-10 01:08:40",
            "octalMode": "100644",
            "permissions": "-rw-r--r--",
            "md5": "66b71b3d5881277a3620972a702e631f",
            "inode": 524297,
            "event": "modified",
            "size": 54209624
         }
      ]
   }
}

Run

Run syscheck scan in all agents

Runs syscheck and rootcheck on all agents (Wazuh launches both processes simultaneously).

Request:

PUT

/syscheck

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/syscheck?pretty"

Example Response:

{
    "data": "Restarting Syscheck/Rootcheck on all agents",
    "error": 0
}

Run syscheck scan in an agent

Runs syscheck and rootcheck on an agent (Wazuh launches both processes simultaneously).

Request:

PUT

/syscheck/:agent_id

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.

Example Request:

curl -u foo:bar -X PUT "http://localhost:55000/syscheck/000?pretty"

Example Response:

{
   "error": 0,
   "data": "Restarting Syscheck/Rootcheck locally"
}

Syscollector

Hardware

Get hardware info

Returns the agent's hardware info

Request:

GET

/syscollector/:agent_id/hardware

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`select`	String	List of selected fields.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscollector/000/hardware?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "board_serial": "0",
      "ram": {
         "usage": 56,
         "total": 6053772,
         "free": 2677484
      },
      "cpu": {
         "cores": 2,
         "mhz": 1991.998,
         "name": "Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz"
      },
      "scan": {
         "id": 208137997,
         "time": "2018/08/02 23:45:54"
      }
   }
}

Netaddr

Get network address info of an agent

Returns the agent's network address info

Request:

GET

/syscollector/:agent_id/netaddr

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`id`	String	Filters by id.
`proto`	String	Filters by proto.
`address`	String	Filters by address.
`broadcast`	String	Filters by broadcast.
`netmask`	String	Filters by netmask.

Example Request:

curl -u foo:bar -X GET "http://localhosr:55000/syscollector/000/netaddr?pretty&limit=2&sort=proto"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 4,
      "items": [
         {
            "id": 17,
            "scan_id": 483670720,
            "address": "fe80::a00:27ff:fed6:8e4f",
            "netmask": "ffff:ffff:ffff:ffff::",
            "proto": "ipv6"
         },
         {
            "id": 18,
            "scan_id": 483670720,
            "address": "fe80::a00:27ff:fea9:6759",
            "netmask": "ffff:ffff:ffff:ffff::",
            "proto": "ipv6"
         }
      ]
   }
}

Netiface

Get network interface info of an agent

Returns the agent's network interface info

Request:

GET

/syscollector/:agent_id/netiface

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`id`	String	Filters by id.
`name`	String	Filters by name.
`adapter`	String	Filters by adapter.
`type`	String	Filters by type.
`state`	String	Filters by state.
`mtu`	String	Filters by mtu.
`tx_packets`	String	Filters by tx_packets.
`rx_packets`	String	Filters by rx_packets.
`tx_bytes`	String	Filters by tx_bytes.
`rx_bytes`	String	Filters by rx_bytes.
`tx_errors`	String	Filters by tx_errors.
`rx_errors`	String	Filters by rx_errors.
`tx_dropped`	String	Filters by tx_dropped.
`rx_dropped`	String	Filters by rx_dropped.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscollector/000/netiface?pretty&limit=2&sort=state"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "name": "enp0s3",
            "tx": {
               "packets": 144,
               "errors": 0,
               "bytes": 16993,
               "dropped": 0
            },
            "scan": {
               "id": 483670720,
               "time": "2018/08/02 23:45:54"
            },
            "rx": {
               "packets": 352,
               "errors": 0,
               "bytes": 346608,
               "dropped": 0
            },
            "mac": "08:00:27:D6:8E:4F",
            "mtu": 1500,
            "state": "up",
            "type": "ethernet",
            "id": 17
         },
         {
            "name": "enp0s8",
            "tx": {
               "packets": 1580,
               "errors": 0,
               "bytes": 229506,
               "dropped": 0
            },
            "scan": {
               "id": 483670720,
               "time": "2018/08/02 23:45:54"
            },
            "rx": {
               "packets": 6032,
               "errors": 0,
               "bytes": 1600051,
               "dropped": 0
            },
            "mac": "08:00:27:A9:67:59",
            "mtu": 1500,
            "state": "up",
            "type": "ethernet",
            "id": 18
         }
      ]
   }
}

Netproto

Get network protocol info of an agent

Returns the agent's network protocol info

Request:

GET

/syscollector/:agent_id/netproto

Parameters:

Param	Type	Description
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`id`	String	Filters by id.
`iface`	String	Filters by iface.
`type`	String	Filters by type.
`gateway`	String	Filters by gateway.
`dhcp`	String	Filters by dhcp.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscollector/000/netproto?pretty&limit=2&sort=type"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 4,
      "items": [
         {
            "dhcp": "enabled",
            "scan_id": 483670720,
            "iface": "enp0s3",
            "type": "ipv6",
            "id": 17
         },
         {
            "dhcp": "enabled",
            "scan_id": 483670720,
            "iface": "enp0s8",
            "type": "ipv6",
            "id": 18
         }
      ]
   }
}

OS

Get os info

Returns the agent's OS info

Request:

GET

/syscollector/:agent_id/os

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`select`	String	List of selected fields.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscollector/000/os?pretty"

Example Response:

{
   "error": 0,
   "data": {
      "sysname": "Linux",
      "version": "#31-Ubuntu SMP Tue Jul 17 15:39:52 UTC 2018",
      "architecture": "x86_64",
      "scan": {
         "id": 433934775,
         "time": "2018/08/02 23:45:54"
      },
      "release": "4.15.0-29-generic",
      "hostname": "wazuh",
      "os": {
         "major": "18",
         "name": "Ubuntu",
         "platform": "ubuntu",
         "version": "18.04 LTS (Bionic Beaver)",
         "codename": "Bionic Beaver",
         "minor": "04"
      }
   }
}

Packages

Get packages info

Returns the agent's packages info

Request:

GET

/syscollector/:agent_id/packages

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`search`	String	Looks for elements with the specified string.
`select`	String	List of selected fields.
`vendor`	String	Filters by vendor.
`name`	String	Filters by name.
`architecture`	String	Filters by architecture.
`format`	String	Filters by format.
`version`	String	Filters by version.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscollector/000/packages?pretty&limit=2&offset=10&sort=-name"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 644,
      "items": [
         {
            "vendor": "Martin Pitt <martin.pitt@ubuntu.com>",
            "name": "apport",
            "scan": {
               "id": 1222412658,
               "time": "2018/08/02 23:45:54"
            },
            "section": "utils",
            "format": "deb",
            "priority": "optional",
            "version": "2.20.9-0ubuntu7",
            "architecture": "all",
            "size": 764,
            "description": "automatically generate crash reports for debugging"
         },
         {
            "vendor": "Ubuntu Developers <ubuntu-motu@lists.ubuntu.com>",
            "name": "apport-symptoms",
            "scan": {
               "id": 1222412658,
               "time": "2018/08/02 23:45:54"
            },
            "section": "utils",
            "format": "deb",
            "priority": "optional",
            "version": "0.20",
            "architecture": "all",
            "size": 75,
            "description": "symptom scripts for apport"
         }
      ]
   }
}

Ports

Get ports info of an agent

Returns the agent's ports info

Request:

GET

/syscollector/:agent_id/ports

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`pid`	Number	Filters by pid.
`protocol`	String	Filters by protocol.
`local_ip`	String	Filters by local_ip.
`local_port`	Number	Filters by local_port.
`remote_ip`	String	Filters by remote_ip.
`tx_queue`	Number	Filters by tx_queue.
`state`	String	Filters by state.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscollector/000/ports?pretty&sort=-protocol&limit=2"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 14,
      "items": [
         {
            "remote": {
               "ip": "0.0.0.0",
               "port": 0
            },
            "scan": {
               "id": 1219576791,
               "time": "2018/08/02 23:45:56"
            },
            "inode": 33140,
            "state": "listening",
            "tx_queue": 0,
            "protocol": "tcp",
            "rx_queue": 0,
            "local": {
               "ip": "0.0.0.0",
               "port": 5601
            }
         },
         {
            "remote": {
               "ip": "0.0.0.0",
               "port": 0
            },
            "scan": {
               "id": 1219576791,
               "time": "2018/08/02 23:45:56"
            },
            "inode": 168808,
            "state": "listening",
            "tx_queue": 0,
            "protocol": "tcp",
            "rx_queue": 0,
            "local": {
               "ip": "0.0.0.0",
               "port": 1516
            }
         }
      ]
   }
}

Processes

Get processes info

Returns the agent's processes info

Request:

GET

/syscollector/:agent_id/processes

Parameters:

Param	Type	Description
`agent_id`	Number	Agent ID.
`offset`	Number	First element to return in the collection.
`limit`	Number	Maximum number of elements to return.
`sort`	String	Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
`select`	String	List of selected fields.
`pid`	Number	Filters by process pid.
`egroup`	String	Filters by process egroup.
`euser`	String	Filters by process euser.
`fgroup`	String	Filters by process fgroup.
`nlwp`	Number	Filters by process nlwp.
`pgrp`	Number	Filters by process pgrp.
`priority`	Number	Filters by process priority.
`rgroup`	String	Filters by process rgroup.
`ruser`	String	Filters by process ruser.
`sgroup`	String	Filters by process sgroup.
`suser`	String	Filters by process suser.

Example Request:

curl -u foo:bar -X GET "http://localhost:55000/syscollector/000/processes?pretty&limit=2&offset=10&sort=-name"

Example Response:

{
   "error": 0,
   "data": {
      "totalItems": 111,
      "items": [
         {
            "euser": "root",
            "tty": 34816,
            "rgroup": "root",
            "sgroup": "root",
            "scan": {
               "id": 2147483647,
               "time": "2018/08/02 23:45:56"
            },
            "resident": 1294,
            "share": 835,
            "start_time": 2172,
            "pid": "1780",
            "session": 1780,
            "stime": 16,
            "vm_size": 21540,
            "size": 5385,
            "ppid": 1447,
            "egroup": "root",
            "name": "bash",
            "pgrp": 1780,
            "tgid": 1780,
            "utime": 27,
            "cmd": "-bash",
            "priority": 20,
            "fgroup": "root",
            "state": "S",
            "ruser": "root",
            "suser": "root",
            "nlwp": 1,
            "processor": 0,
            "nice": 0
         },
         {
            "euser": "root",
            "tty": 0,
            "rgroup": "root",
            "sgroup": "root",
            "scan": {
               "id": 2147483647,
               "time": "2018/08/02 23:45:56"
            },
            "resident": 0,
            "share": 0,
            "start_time": 105,
            "pid": "121",
            "session": 0,
            "stime": 0,
            "vm_size": 0,
            "size": 0,
            "nlwp": 1,
            "egroup": "root",
            "name": "charger_manager",
            "pgrp": 0,
            "tgid": 121,
            "utime": 0,
            "priority": 0,
            "fgroup": "root",
            "state": "I",
            "ruser": "root",
            "suser": "root",
            "ppid": 2,
            "processor": 1
         }
      ]
   }
}