Reference

/active-response/:agent_id

curl -u foo:bar -k -X PUT -d '{"command":"restart-ossec0", "arguments": ["-", "null", "(from_the_server)", "(no_rule_id)"]}' -H 'Content-Type:application/json' "https://127.0.0.1:55000/active-response/001?pretty"

{
    "data": "Command sent.",
    "error": 0
}

/agents

curl -u foo:bar -k -X POST -d '{"name":"NewHost","ip":"10.0.0.9"}' -H 'Content-Type:application/json' "https://127.0.0.1:55000/agents?pretty"

{
   "error": 0,
   "data": {
      "id": "007",
      "key": "MDA3IE5ld0hvc3QgMTAuMC4wLjkgN2Y4OWM2NzVkNWE1NjAwNzA2OTY1ODQwM2NjYzZiNThkMzQ5M2E3OTRkOTMyMDU1MzAzZTE3ZDBkN2I0MmM5Yw=="
   }
}

/agents/:agent_name

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/myNewAgent?pretty"

{
   "error": 0,
   "data": {
      "id": "008",
      "key": "MDA4IG15TmV3QWdlbnQgYW55IGMwNWQzMTdmZWFkNTllM2I5MzJhZThjZDI2OWVlYWMzNTMzY2VmZDQ0NGY4MDk2MTBlYTVlZWI1YjU1OGQzMjY="
   }
}

/agents/insert

curl -u foo:bar -k -X POST -d '{"name":"NewHost_2","ip":"10.0.10.10","id":"123","key":"1abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghi64"}' -H 'Content-Type:application/json' "https://127.0.0.1:55000/agents/insert?pretty"

{
   "error": 0,
   "data": {
      "id": "123",
      "key": "MTIzIE5ld0hvc3RfMiAxMC4wLjEwLjEwIDFhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5emFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6YWJjZGVmZ2hpNjQ="
   }
}

/agents/:agent_id/config/:component/:configuration

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/001/config/logcollector/localfile?pretty"

{
   "error": 0,
   "data": {
      "localfile": [
         {
            "alias": "df -P",
            "logformat": "command",
            "frequency": 360,
            "command": "df -P",
            "target": [
               "agent"
            ]
         },
         {
            "alias": "netstat listening ports",
            "logformat": "full_command",
            "frequency": 360,
            "command": "netstat -tulpn | sed 's/\\([[:alnum:]]\\+\\)\\ \\+[[:digit:]]\\+\\ \\+[[:digit:]]\\+\\ \\+\\(.*\\):\\([[:digit:]]*\\)\\ \\+\\([0-9\\.\\:\\*]\\+\\).\\+\\ \\([[:digit:]]*\\/[[:alnum:]\\-]*\\).*/\\1 \\2 == \\3 == \\4 \\5/' | sort -k 4 -g | sed 's/ == \\(.*\\) ==/:\\1/' | sed 1,2d",
            "target": [
               "agent"
            ]
         },
         {
            "alias": "last -n 20",
            "logformat": "full_command",
            "frequency": 360,
            "command": "last -n 20",
            "target": [
               "agent"
            ]
         },
         {
            "logformat": "syslog",
            "target": [
               "agent"
            ],
            "file": "/var/ossec/logs/active-responses.log"
         },
         {
            "logformat": "syslog",
            "target": [
               "agent"
            ],
            "file": "/var/log/auth.log"
         },
         {
            "logformat": "syslog",
            "target": [
               "agent"
            ],
            "file": "/var/log/syslog"
         },
         {
            "logformat": "syslog",
            "target": [
               "agent"
            ],
            "file": "/var/log/dpkg.log"
         },
         {
            "logformat": "syslog",
            "target": [
               "agent"
            ],
            "file": "/var/log/kern.log"
         }
      ]
   }
}

/agents/groups

curl -u foo:bar -X DELETE -H "Content-Type:application/json" -d '{"ids":["webserver","database"]}' "http://localhost:55000/agents/groups?pretty"

{
   "error": 0,
   "data": {
      "msg": "All selected groups were removed",
      "ids": [
         "webserver",
         "database"
      ],
      "affected_agents": [
         "002",
         "005",
         "003"
      ]
   }
}

/agents

curl -u foo:bar -k -X DELETE -H "Content-Type:application/json" -d '{"ids":["003","005"]}' "https://127.0.0.1:55000/agents?pretty&older_than=10s&purge"

{
   "error": 0,
   "data": {
      "msg": "All selected agents were removed",
      "older_than": "10s",
      "affected_agents": [
         "003",
         "005"
      ],
      "total_affected_agents": 2
   }
}

/agents/:agent_id

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/agents/008?pretty&purge"

{
   "error": 0,
   "data": {
      "msg": "All selected agents were removed",
      "affected_agents": [
         "008"
      ]
   }
}

/agents/:agent_id/group/is_sync

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/001/group/is_sync?pretty"

{
   "error": 0,
   "data": {
      "synced": true
   }
}

/agents/group/:group_id

curl -u foo:bar -X POST -H "Content-Type:application/json" -d '{"ids":["001","002"]}' "https://localhost:55000/agents/group/dmz?pretty" -k

{
   "error": 0,
   "data": {
      "msg": "Some agents were not assigned to group dmz",
      "failed_ids": [
         "002"
      ],
      "affected_agents": [
         "001"
      ]
   }
}

/agents/:agent_id/group/:group_id

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/004/group/dmz?pretty"

{
   "error": 0,
   "data": "Agent '004' already belongs to group 'dmz'."
}

/agents/groups/:group_id

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/groups/pciserver?pretty"

{
   "error": 0,
   "data": "Group 'pciserver' created."
}

/agents/groups/:group_id/files/:filename

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups/webserver/files/cis_debian_linux_rcl.txt?pretty"

{
    "data": {
        "controls": [
            {
                "...": "..."
            },
            {
                "condition": "all required",
                "name": "CIS - Testing against the CIS Debian Linux Benchmark v1",
                "reference": "CIS_Debian_Benchmark_v1.0pdf",
                "checks": [
                    "f:/etc/debian_version;"
                ]
            }
        ]
    },
    "error": 0
}

/agents/groups/:group_id

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups/dmz?pretty"

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "status": "Active",
            "configSum": "ab73af41699f13fdd81903b5f23d8d00",
            "group": [
               "default",
               "dmz"
            ],
            "name": "agent1",
            "mergedSum": "f1a9e24e02ba4cc5ea80a9d3feb3bb9a",
            "ip": "192.168.185.7",
            "dateAdd": "2018-10-11 09:38:47",
            "node_name": "node02",
            "manager": "manager",
            "version": "Wazuh v3.8.2",
            "lastKeepAlive": "2018-10-11 13:58:08",
            "os": {
               "major": "16",
               "name": "Ubuntu",
               "uname": "Linux |ubuntu |4.4.0-135-generic |#161-Ubuntu SMP Mon Aug 27 10:45:01 UTC 2018 |x86_64",
               "platform": "ubuntu",
               "version": "16.04.5 LTS",
               "codename": "Xenial Xerus",
               "arch": "x86_64",
               "minor": "04"
            },
            "id": "001"
         },
         {
            "status": "Never connected",
            "group": [
               "dmz"
            ],
            "name": "main_database",
            "ip": "10.0.0.15",
            "node_name": "unknown",
            "dateAdd": "2018-10-11 13:58:11",
            "id": "004"
         }
      ]
   }
}

/agents/no_group

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/no_group?pretty"

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         {
            "status": "Never connected",
            "dateAdd": "2018-10-11 13:58:11",
            "name": "server002",
            "ip": "10.0.0.20",
            "id": "006",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-10-11 13:58:22",
            "name": "NewHost",
            "ip": "10.0.0.9",
            "id": "007",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-10-11 13:58:23",
            "name": "NewHost_2",
            "ip": "10.0.10.10",
            "id": "123",
            "node_name": "unknown"
         }
      ]
   }
}

/agents/groups/:group_id/configuration

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups/dmz/configuration?pretty"

{
   "error": 0,
   "data": {
      "totalItems": 1,
      "items": [
         {
            "config": {
               "localfile": [
                  {
                     "log_format": "syslog",
                     "location": "/var/log/linux.log"
                  }
               ]
            },
            "filters": {
               "os": "Linux"
            }
         }
      ]
   }
}

/agents/groups/:group_id/files

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups/default/files?pretty"

{
   "error": 0,
   "data": {
      "totalItems": 24,
      "items": [
         {
            "hash": "ab73af41699f13fdd81903b5f23d8d00",
            "filename": "agent.conf"
         },
         {
            "hash": "76d8be9b97d8eae4c239e530ee7e71c8",
            "filename": "ar.conf"
         },
         {
            "hash": "6d9bd718faff778bbeabada6f07f5c2f",
            "filename": "cis_apache2224_rcl.txt"
         },
         {
            "hash": "9beed128b4305943eead1a66a86d27d5",
            "filename": "cis_debian_linux_rcl.txt"
         },
         {
            "hash": "ee520e627150c8751493bc32540b859a",
            "filename": "cis_mysql5-6_community_rcl.txt"
         },
         {
            "hash": "672c92a1f57463e33ff14011b43727de",
            "filename": "cis_mysql5-6_enterprise_rcl.txt"
         },
         {
            "hash": "e03345360941dbff248f63765971f87e",
            "filename": "cis_rhel5_linux_rcl.txt"
         },
         {
            "hash": "d53e584559b759cb6ec3956f23dee46f",
            "filename": "cis_rhel6_linux_rcl.txt"
         },
         {
            "hash": "3b67c8b54d0fa8fdf5afa8d0d43398d8",
            "filename": "cis_rhel7_linux_rcl.txt"
         },
         {
            "hash": "24e83427d2678aada50fa401b921a0cd",
            "filename": "cis_rhel_linux_rcl.txt"
         },
         {
            "hash": "a3978c24aec520c4bcfb7db62bea41b9",
            "filename": "cis_sles11_linux_rcl.txt"
         },
         {
            "hash": "533ec3f8eda8e52edb181e3f6bd44d52",
            "filename": "cis_sles12_linux_rcl.txt"
         },
         {
            "hash": "6d762779c44dda24901673c0e715f5a9",
            "filename": "cis_win2012r2_domainL1_rcl.txt"
         },
         {
            "hash": "18ae1149bf2db6cc942d4fcb0f17a336",
            "filename": "cis_win2012r2_domainL2_rcl.txt"
         },
         {
            "hash": "5f0f6c9c40684b8cdac9bca1fa138ebc",
            "filename": "cis_win2012r2_memberL1_rcl.txt"
         },
         {
            "hash": "10b99529e86bedd78accce983eb402b5",
            "filename": "cis_win2012r2_memberL2_rcl.txt"
         },
         {
            "hash": "f1a9e24e02ba4cc5ea80a9d3feb3bb9a",
            "filename": "merged.mg"
         },
         {
            "hash": "a403c34392032ace267fbb163fc7cfad",
            "filename": "rootkit_files.txt"
         },
         {
            "hash": "b5d427623664d76140acbcb91f42d586",
            "filename": "rootkit_trojans.txt"
         },
         {
            "hash": "6cca8467c592a23fcf62cd5f33608fc3",
            "filename": "system_audit_rcl.txt"
         },
         {
            "hash": "e778eb44e4e8116a1e4c017b9b23eea2",
            "filename": "system_audit_ssh.txt"
         },
         {
            "hash": "0e1f8f16e217a70b9b80047646823587",
            "filename": "win_applications_rcl.txt"
         },
         {
            "hash": "4c2207e003d08db69822754271f9cb60",
            "filename": "win_audit_rcl.txt"
         },
         {
            "hash": "f9c3330533586eb380f294dcbd9918d8",
            "filename": "win_malware_rcl.txt"
         }
      ]
   }
}

/agents/groups

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/groups?pretty"

{
   "error": 0,
   "data": {
      "totalItems": 3,
      "items": [
         {
            "count": 2,
            "mergedSum": "f1a9e24e02ba4cc5ea80a9d3feb3bb9a",
            "configSum": "ab73af41699f13fdd81903b5f23d8d00",
            "name": "default"
         },
         {
            "count": 2,
            "mergedSum": "2c9d1cc2609a8ff8062c2e2dded3221c",
            "configSum": "53b61b583230d823a57ff68a9b94eaf6",
            "name": "dmz"
         },
         {
            "count": 0,
            "configSum": "ab73af41699f13fdd81903b5f23d8d00",
            "name": "pciserver"
         }
      ]
   }
}

/agents/groups/:group_id/configuration

curl -u foo:bar -X POST -H 'Content-type: application/xml' -d @agent.conf.xml "https://127.0.0.1:55000/agents/groups/dmz/configuration?pretty" -k

{
    "data": "Agent configuration was updated successfully",
    "error": 0
}

/agents/:agent_id/group/:group_id

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/agents/004/group/dmz?pretty"

{
   "error": 0,
   "data": "Group 'dmz' unset for agent '004'."
}

/agents/group/:group_id

curl -u foo:bar -X DELETE -H "Content-Type:application/json" -d '{"ids":["001","002"]}' "https://localhost:55000/agents/group/dmz?pretty" -k

{
   "error": 0,
   "data": {
      "msg": "Some agents were not removed to group dmz",
      "failed_ids": [
         "002"
      ],
      "affected_agents": [
         "001"
      ]
   }
}

/agents/:agent_id/group

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/agents/004/group?pretty"

{
   "error": 0,
   "data": "Group unset for agent '004'."
}

/agents/groups/:group_id

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/agents/groups/dmz?pretty"

{
   "error": 0,
   "data": {
      "msg": "All selected groups were removed",
      "ids": [
         "dmz"
      ],
      "affected_agents": [
         "001"
      ]
   }
}

/agents/groups/:group_id/files/:file_name

curl -u foo:bar -X POST -H 'Content-type: application/xml' -d @agent.conf.xml "https://127.0.0.1:55000/agents/groups/dmz/files/agent.conf?pretty" -k

{
    "data": "Agent configuration was updated successfully",
    "error": 0
}

/agents/summary/os

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/summary/os?pretty"

{
   "error": 0,
   "data": {
      "totalItems": 1,
      "items": [
         "ubuntu"
      ]
   }
}

/agents/summary

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/summary?pretty"

{
   "error": 0,
   "data": {
      "Active": 2,
      "Never connected": 5,
      "Total": 7,
      "Disconnected": 0,
      "Pending": 0
   }
}

/agents

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents?pretty&offset=0&limit=5&sort=-ip,name"

{
   "error": 0,
   "data": {
      "totalItems": 7,
      "items": [
         {
            "status": "Active",
            "configSum": "ab73af41699f13fdd81903b5f23d8d00",
            "group": [
               "default"
            ],
            "name": "agent1",
            "mergedSum": "f1a9e24e02ba4cc5ea80a9d3feb3bb9a",
            "ip": "192.168.185.7",
            "manager": "manager",
            "node_name": "node02",
            "dateAdd": "2018-10-11 09:38:47",
            "version": "Wazuh v3.8.2",
            "lastKeepAlive": "2018-10-11 13:58:08",
            "os": {
               "major": "16",
               "name": "Ubuntu",
               "uname": "Linux |ubuntu |4.4.0-135-generic |#161-Ubuntu SMP Mon Aug 27 10:45:01 UTC 2018 |x86_64",
               "platform": "ubuntu",
               "version": "16.04.5 LTS",
               "codename": "Xenial Xerus",
               "arch": "x86_64",
               "minor": "04"
            },
            "id": "001"
         },
         {
            "status": "Active",
            "name": "manager",
            "ip": "127.0.0.1",
            "manager": "manager",
            "node_name": "node01",
            "dateAdd": "2018-10-11 09:37:23",
            "version": "Wazuh v3.8.2",
            "lastKeepAlive": "9999-12-31 23:59:59",
            "os": {
               "major": "18",
               "name": "Ubuntu",
               "uname": "Linux |manager |4.15.0-36-generic |#39-Ubuntu SMP Mon Sep 24 16:19:09 UTC 2018 |x86_64",
               "platform": "ubuntu",
               "version": "18.04.1 LTS",
               "codename": "Bionic Beaver",
               "arch": "x86_64",
               "minor": "04"
            },
            "id": "000"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-10-11 13:58:23",
            "name": "NewHost_2",
            "ip": "10.0.10.10",
            "id": "123",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-10-11 13:58:22",
            "name": "NewHost",
            "ip": "10.0.0.9",
            "id": "007",
            "node_name": "unknown"
         },
         {
            "status": "Never connected",
            "dateAdd": "2018-10-11 13:58:10",
            "group": [
               "default"
            ],
            "name": "server001",
            "ip": "10.0.0.62",
            "id": "002",
            "node_name": "unknown"
         }
      ]
   }
}

/agents/:agent_id

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/000?pretty"

{
   "error": 0,
   "data": {
      "status": "Active",
      "name": "manager",
      "ip": "127.0.0.1",
      "manager": "manager",
      "node_name": "node01",
      "dateAdd": "2018-10-11 09:37:23",
      "version": "Wazuh v3.8.2",
      "lastKeepAlive": "9999-12-31 23:59:59",
      "os": {
         "major": "18",
         "name": "Ubuntu",
         "uname": "Linux |manager |4.15.0-36-generic |#39-Ubuntu SMP Mon Sep 24 16:19:09 UTC 2018 |x86_64",
         "platform": "ubuntu",
         "version": "18.04.1 LTS",
         "codename": "Bionic Beaver",
         "arch": "x86_64",
         "minor": "04"
      },
      "id": "000"
   }
}

/agents/name/:agent_name

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/name/NewHost?pretty"

{
   "error": 0,
   "data": {
      "status": "Never connected",
      "name": "NewHost",
      "ip": "10.0.0.9",
      "node_name": "unknown",
      "dateAdd": "2018-10-11 13:58:22",
      "id": "007"
   }
}

/agents/:agent_id/key

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/004/key?pretty"

{
   "error": 0,
   "data": "MDA0IG1haW5fZGF0YWJhc2UgMTAuMC4wLjE1IDcwYjJiZTVlMTI1ZTZiYTYxNmJhNjRkN2E0NDRkZWFjODgyZmJiYjIwOGEyMmFiZTdjM2EzZTFmNDI2ODFjOGQ="
}

/agents/restart

curl -u foo:bar -k -X POST -H "Content-Type:application/json" -d '{"ids":["002","004"]}' "https://127.0.0.1:55000/agents/restart?pretty"

{
    "data": {
        "msg": "All selected agents were restarted",
        "affected_agents": [
            "002",
            "004"
        ]
    },
    "error": 0
}

/agents/restart

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/restart?pretty"

{
    "data": "Restarting all agents",
    "error": 0
}

/agents/:agent_id/restart

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/007/restart?pretty"

{
    "data": {
        "msg": "All selected agents were restarted",
        "affected_agents": [
            "007"
        ]
    },
    "error": 0
}

/agents/stats/distinct

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/stats/distinct?pretty&fields=os.platform"

{
   "error": 0,
   "data": {
      "totalItems": 7,
      "items": [
         {
            "count": 2,
            "os": {
               "platform": "ubuntu"
            }
         },
         {
            "count": 5
         }
      ]
   }
}

/agents/outdated

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/outdated?pretty"

{
    "data": {
        "totalItems": 2,
        "items": [
            {
                "version": "Wazuh v3.0.0",
                "id": "003",
                "name": "main_database"
            },
            {
                "version": "Wazuh v3.0.0",
                "id": "004",
                "name": "dmz002"
            }
        ]
    },
    "error": 0
}

/agents/:agent_id/upgrade_result

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/agents/003/upgrade_result?pretty"

{
    "data": "Agent upgraded successfully",
    "error": 0
}

/agents/:agent_id/upgrade_custom

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/002/upgrade_custom?pretty"

{
    "data": "Installation started",
    "data": "Installation started",
    "error": 0
}

/agents/:agent_id/upgrade

curl -u foo:bar -k -X PUT "https://127.0.0.1:55000/agents/002/upgrade?pretty"

{
    "data": "Upgrade procedure started",
    "error": 0
}

/cache

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/cache/mygroup?pretty"

{
   "error": 0,
   "data": {
      "all": [
         "/agents/000?pretty",
         "/agents/name/NewHost?pretty",
         "/agents/stats/distinct?pretty&fields=os.platform"
      ],
      "groups": {
         "agents": [
            "/agents/000?pretty",
            "/agents/name/NewHost?pretty",
            "/agents/stats/distinct?pretty&fields=os.platform"
         ]
      }
   }
}

/cache

curl -u foo:bar -k -X DELETE "https://127.0.0.1:55000/cache?pretty"

{
   "error": 0,
   "data": {
      "all": [],
      "groups": {}
   }
}

/cache

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cache?pretty"

{
   "error": 0,
   "data": {
      "all": [],
      "groups": {}
   }
}

/cache/config

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cache/config?pretty"

{
   "error": 0,
   "data": {
      "debug": false,
      "defaultDuration": 750,
      "enabled": true,
      "appendKey": [],
      "jsonp": false,
      "redisClient": false
   }
}

/ciscat/:agent_id/results

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/ciscat/000/results?pretty&sort=-score"

{
    "data": {
        "totalItems": 2,
        "items": [
            {
                "profile": "xccdf_org.cisecurity.benchmarks_profile_Level_2_-_Server",
                "score": 57,
                "error": 0,
                "scan": {
                    "id": 1406741147,
                    "time": "2018-09-06T07:50:15.632-07:00"
                },
                "fail": 79,
                "benchmark": "CIS Ubuntu Linux 16.04 LTS Benchmark",
                "pass": 104,
                "notchecked": 36,
                "unknown": 1
            },
            {
                "profile": "xccdf_org.cisecurity.benchmarks_profile_Level_1_-_Workstation",
                "score": 64,
                "error": 0,
                "scan": {
                    "id": 1406741147,
                    "time": "2018-09-06T07:50:52.630-07:00"
                },
                "fail": 53,
                "benchmark": "CIS Ubuntu Linux 16.04 LTS Benchmark",
                "pass": 96,
                "notchecked": 71,
                "unknown": 0
            }
        ]
    },
    "error": 0
}

/cluster/:node_id/configuration

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/node02/configuration?section=global&pretty"

{
   "error": 0,
   "data": {
      "email_notification": "no",
      "alerts_log": "yes",
      "jsonout_output": "yes",
      "smtp_server": "smtp.example.wazuh.com",
      "email_log_source": "alerts.log",
      "queue_size": "131072",
      "email_to": "recipient@example.wazuh.com",
      "logall": "no",
      "email_maxperhour": "12",
      "white_list": [
         "127.0.0.1",
         "^localhost.localdomain$",
         "127.0.0.53"
      ],
      "email_from": "ossecm@example.wazuh.com",
      "logall_json": "no"
   }
}

/cluster/config

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/config?pretty"

{
   "error": 0,
   "data": {
      "disabled": "no",
      "hidden": "no",
      "name": "wazuh",
      "node_name": "node01",
      "bind_addr": "0.0.0.0",
      "node_type": "master",
      "key": "9d273b53510fef702b54a92e9cffc82e",
      "nodes": [
         "172.17.0.100"
      ],
      "port": 1516
   }
}

/cluster/status

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/status?pretty"

{
   "error": 0,
   "data": {
      "running": "yes",
      "enabled": "yes"
   }
}

/cluster/:node_id/status

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/node02/status?pretty"

{
   "error": 0,
   "data": {
      "wazuh-modulesd": "running",
      "ossec-authd": "stopped",
      "ossec-syscheckd": "running",
      "ossec-monitord": "running",
      "ossec-logcollector": "running",
      "ossec-execd": "running",
      "ossec-remoted": "running",
      "wazuh-clusterd": "running",
      "ossec-analysisd": "running",
      "ossec-maild": "stopped"
   }
}

/cluster/:node_id/info

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/node02/info?pretty"

{
   "error": 0,
   "data": {
      "compilation_date": "Fri Jan 11 18:44:25 UTC 2019",
      "openssl_support": "yes",
      "ruleset_version": "3801",
      "tz_name": "UTC",
      "tz_offset": "+0000",
      "version": "v3.8.2",
      "path": "/var/ossec",
      "max_agents": "14000",
      "type": "manager"
   }
}

/cluster/healthcheck

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/healthcheck?pretty"

{
   "error": 0,
   "data": {
      "nodes": {
         "node02": {
            "info": {
               "ip": "172.17.0.101",
               "version": "3.8.2",
               "type": "worker",
               "name": "node02",
               "n_active_agents": 1
            },
            "status": {
               "last_sync_agentinfo": {
                  "date_start_master": "2019-01-11 18:52:57.72",
                  "date_end_master": "2019-01-11 18:52:57.73",
                  "total_agentinfo": 1
               },
               "sync_integrity_free": true,
               "last_sync_agentgroups": {
                  "date_end_master": "2019-01-11 18:52:51.56",
                  "total_agentgroups": 0,
                  "date_start_master": "2019-01-11 18:52:51.56"
               },
               "last_sync_integrity": {
                  "total_files": {
                     "shared": 2,
                     "missing": 4,
                     "extra_valid": 0,
                     "extra": 0
                  },
                  "date_end_master": "2019-01-11 18:52:45.47",
                  "date_start_master": "2019-01-11 18:52:44.36"
               },
               "last_keep_alive": "2019-01-11 18:52:16.661280",
               "sync_agentinfo_free": true,
               "sync_extravalid_free": true
            }
         },
         "node01": {
            "info": {
               "ip": "172.17.0.100",
               "version": "3.8.2",
               "type": "master",
               "name": "node01",
               "n_active_agents": 1
            }
         }
      },
      "n_connected_nodes": 2
   }
}

/cluster/:node_id/logs

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/node02/logs?offset=0&limit=5&pretty"

{
   "error": 0,
   "data": {
      "totalItems": 595,
      "items": [
         {
            "timestamp": "2019-01-11 18:52:03",
            "tag": "ossec-remoted",
            "description": "(1409): Authentication file changed. Updating.",
            "level": "info"
         },
         {
            "timestamp": "2019-01-11 18:52:03",
            "tag": "ossec-remoted",
            "description": "(1410): Reading authentication keys file.",
            "level": "info"
         },
         {
            "tag": "wazuh-modulesd:syscollector",
            "description": "Evaluation finished.",
            "level": "info"
            "timestamp": "2019-01-11 18:51:54",
         },
         {
            "tag": "wazuh-modulesd:syscollector",
            "description": "Starting evaluation.",
            "level": "info"
            "timestamp": "2019-01-11 18:51:54",
         },
         {
            "tag": "ossec-remoted",
            "description": "(1409): Authentication file changed. Updating.",
            "level": "info"
            "timestamp": "2019-01-11 18:51:54",
         }
      ]
   }
}

/cluster/:node_id/logs/summary

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/node02/logs/summary?pretty"

{
   "error": 0,
   "data": {
      "wazuh-modulesd": {
         "info": 2,
         "all": 616,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 614
      },
      "wazuh-modulesd:oscap": {
         "info": 2,
         "all": 2,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "wazuh-db": {
         "info": 3,
         "all": 3,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "ossec-authd": {
         "info": 8,
         "all": 13,
         "critical": 0,
         "error": 5,
         "debug": 0,
         "warning": 0
      },
      "wazuh-modulesd:ciscat": {
         "info": 2,
         "all": 2,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "wazuh-modulesd:syscollector": {
         "info": 15,
         "all": 15,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "ossec-rootcheck": {
         "info": 6,
         "all": 6,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "ossec-monitord": {
         "info": 3,
         "all": 3,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "ossec-logcollector": {
         "info": 19,
         "all": 19,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "ossec-execd": {
         "info": 4,
         "all": 4,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "ossec-remoted": {
         "info": 115,
         "all": 564,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 449
      },
      "ossec-syscheckd": {
         "info": 55,
         "all": 55,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "wazuh-modulesd:osquery": {
         "info": 2,
         "all": 2,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "wazuh-modulesd:download": {
         "info": 2,
         "all": 2,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "ossec-analysisd": {
         "info": 449,
         "all": 449,
         "critical": 0,
         "error": 0,
         "debug": 0,
         "warning": 0
      },
      "wazuh-modulesd:database": {
         "info": 2,
         "all": 67,
         "critical": 0,
         "error": 65,
         "debug": 0,
         "warning": 0
      }
   }
}

/cluster/node

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/node?pretty"

{
   "error": 0,
   "data": {
      "node": "node01",
      "cluster": "wazuh",
      "type": "master"
   }
}

/cluster/nodes/:node_name

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/nodes/node01?pretty"

{
   "error": 0,
   "data": {
      "ip": "172.17.0.100",
      "version": "3.8.2",
      "type": "master",
      "name": "node01"
   }
}

/cluster/nodes

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/nodes?pretty"

{
   "error": 0,
   "data": {
      "totalItems": 2,
      "items": [
         {
            "ip": "172.17.0.101",
            "version": "3.8.2",
            "type": "worker",
            "name": "node02"
         },
         {
            "ip": "172.17.0.100",
            "version": "3.8.2",
            "type": "master",
            "name": "node01"
         }
      ]
   }
}

/cluster/:node_id/stats/analysisd

curl -u foo:bar -k -X GET "https://127.0.0.1:55000/cluster/node02/analysisd/stats?pretty"

{
    "data": [
        {
            "hour": 5,
            "firewall": 0,
            "alerts": [
                {
                    "level": 3,
                    "sigid": 5715,
                    "times": 4
                },
                {
                    "level": 2,
                    "sigid": 1002,
                    "times": 2
                },
                {
                    "...": "..."
                }
            ],
            "totalAlerts": 107,
            "syscheck": 1257,
            "events": 1483
        },
        {
            "...": "..."
        }
    ],
    "error": 0
}