System inventory

How it works

As mentioned above, the main purpose of this module is to gather the most relevant information from the monitored system.

Once the agent starts, Syscollector runs periodically scans of defined targets (hardware, OS, packages, etc.), forwarding the new collected data to the manager, which updates the appropriate tables of the database.

The agent's inventory is gathered for different goals. The entire inventory can be found at the inventory tab of the Wazuh APP for each agent, by querying the Wazuh API to retrieve the data from the DB. Also the Dev tools tab is available, with this feature the Wazuh API can be directly queried about the different scans being able to filter by any desired field.

In addition, the packages and hotfixes inventory is used as feed for the Vulnerability detector module.

Available scans

The collected information from Wazuh agents is stored in different SQLite tables. Here the content of each available table is described.

At present, this module is available for Linux, Windows, MacOS, OpenBS and FreeBSD. See the compatibility matrix for more information.

Compatibility matrix

The following table shows the operating systems that this module currently supports.

Using Syscollector information to trigger alerts

Since Wazuh 3.9 version, Syscollector module information can be used to trigger alerts and show that information in the alerts' description.

To allow this configuration, in a rule declaration set the <decoded_as> field as syscollector.

As an example, this rule will be triggered when the interface eth0 of an agent is enabled and will show what IPv4 has that interface.

<rule id="100001" level="5">
  <if_sid>221</if_sid>
  <decoded_as>syscollector</decoded_as>
  <field name="netinfo.iface.name">eth0</field>
  <description>eth0 interface enabled. IP: $(netinfo.iface.ipv4.address)</description>
</rule>

Warning

The tag <if_sid>221</if_sid> is necessary because the events from Syscollector are muted by default with that rule.

When the alerts are triggered they will be displayed in Kibana this way:

Use case: Visualize system inventory in the Wazuh app

The Syscollector module is enabled by default in all compatible systems including all the available scans. Here we can see the default configuration block:

<!-- System inventory -->
<wodle name="syscollector">
  <disabled>no</disabled>
  <interval>1h</interval>
  <scan_on_start>yes</scan_on_start>
  <hardware>yes</hardware>
  <os>yes</os>
  <network>yes</network>
  <packages>yes</packages>
  <ports all="no">yes</ports>
  <processes>yes</processes>
</wodle>

Once the module starts, it will run periodically scans and send the new data in JSON events format to the manager, where it will be decoded and stored into a particular database for each agent.

The current inventory can be consulted in different ways. Let's see an example querying for a particular package in a Debian agent:

• Querying the Database directly on the manager side, located at $install_directory/queue/db/:agent_id.db.

# sqlite3 /var/ossec/queue/db/003.db

SQLite version 3.7.17 2013-05-20 00:56:22
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite>

sqlite> select * from sys_programs where name="wazuh-agent";

696614220|2018/08/06 02:07:30|deb|wazuh-agent|extra|admin|105546|Wazuh, Inc <support@wazuh.com>||3.5.0-1|amd64|||Wazuh helps you to gain security visibility into your infrastructure by monitoring hosts at an operating system and application level. It provides the following capabilities: log analysis, file integrity monitoring, intrusions detection and policy and compliance monitoring||0

• By querying the Wazuh API endpoint GET /syscollector/{agent_id}/packages, which retrieves nested data in JSON format.

# curl -k -X GET "https://localhost:55000/syscollector/003/packages?pretty=true&name=wazuh-agent" -H  "Authorization: Bearer $TOKEN"

{
    "data": {
        "affected_items": [
            {
                "vendor": "Wazuh, Inc <support@wazuh.com>",
                "description": "Wazuh helps you to gain security visibility into your infrastructure by monitoring hosts at an operating system and application level. It provides the following capabilities: log analysis, file integrity monitoring, intrusions detection and policy and compliance monitoring",
                "scan": {"id": 696614220, "time": "2018/08/06 02:07:30"},
                "section": "admin",
                "format": "deb",
                "name": "wazuh-agent",
                "priority": "extra",
                "version": "3.5.0-1",
                "architecture": "amd64",
                "size": 105546,
                "agent_id": "003",
            }
        ],
        "total_affected_items": 1,
        "total_failed_items": 0,
        "failed_items": [],
    },
    "message": "All specified syscollector information was returned",
    "error": 0,
}

Moreover, the same information can be consulted at the Wazuh app, which includes an Inventory tab for each agent. For now, there are available OS, hardware and packages inventories at this tab, which looks like the following screenshot:

The Dev tools tab is also available to query the Wazuh API directly from the Wazuh app as shown below:

You could find more information about how to configure this capability at the Syscollector configuration reference.