Viewing system inventory data

Wazuh API GUI

On the Wazuh dashboard, navigate to Server management > Dev Tools. On the Console, type the following:

GET /syscollector/<AGENT_ID>/

Where <AGENT_ID> corresponds to the agent ID of the endpoint.

The Wazuh dashboard will suggest a list of available tables that you can query via the API.

For example, you can use the command GET /syscollector/<AGENT_ID>/packages to query the inventory data for installed packages on the endpoint. After typing, click the play icon to run the query.

Furthermore, you can query the inventory data for specific information about any property. For example, the command below queries the package inventory to check for the wazuh-agent package:

GET /syscollector/<AGENT_ID>/packages?pretty=true&name=wazuh-agent

Where:

• packages reference the package table in the inventory database, which stores information about the currently installed software on an endpoint. You can reference the table of your interest.

• name=wazuh-agent specifies the wazuh-agent package name. You can use different properties and values.

• pretty=true ensures the output is properly formatted and easy to read.

cURL

Follow the steps below to query the endpoint database from the command line using cURL:

• Generate a JSON Web Token (JWT) for authenticating to the Wazuh server by running the following command. The default API credentials are wazuh:wazuh. Replace <WAZUH_SERVER_IP> with your Wazuh server IP address.

  TOKEN=$(curl -u <USER>:<PASSWORD> -k -X GET "https://<WAZUH_SERVER_IP>:55000/security/user/authenticate?raw=true")
  

  Run the command echo $TOKEN to confirm that you successfully generated the token. The output should be like this:

  eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNjQzMDExMjQ0LCJleHAiOjE2NDMwMTIxNDQsInN1YiI6IndhenVoIiwicnVuX2FzIjpmYWxzZSwicmJhY19yb2xlcyI6WzFdLCJyYmFjX21vZGUiOiJ3aGl0ZSJ9.Ad6zOZvx0BEV7K0J6s3pIXAXTWB-zdVfxaX2fotLfZMQkiYPMkwDaQHUFiOInsWJ_7KZV3y2BbhEs9-kBqlJAMvMAD0NDBPhEQ2qBd_iutZ7QWZECd6eYfIP83xGqH9iqS7uMI6fXOKr3w4aFV13Q6qsHSUQ1A-1LgDnnDGGaqF5ITYo
  

• Query the endpoint information of interest using a command which takes the following format:

  curl -k -X GET "https://<WAZUH_SERVER_IP>:55000/syscollector/<AGENT_ID>/<SYSCOLLECTOR_PROPERTY>?pretty=true" -H "Authorization: Bearer $TOKEN"
  

  For example, to retrieve information about the applications installed on an endpoint with agent ID of 010, the command will be:

  curl -k -X GET "https://<WAZUH_SERVER_IP>:55000/syscollector/010/packages?pretty=true" -H  "Authorization: Bearer $TOKEN"
  

  The other inventory properties are hardware, hotfixes, netaddr, netiface, netproto, os, ports, and processes. These all correspond to the tables in the inventory database. You can learn more about these options in our API documentation.

  {
     "data": {
        "affected_items": [
           {
              "scan": {
                 "id": 0,
                 "time": "2022-09-27T09:16:45+00:00"
              },
              "priority": "optional",
              "multiarch": "foreign",
              "format": "deb",
              "vendor": "Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>",
              "size": 12219,
              "version": "0.4.9-2",
              "description": "encoding data for the poppler PDF rendering library",
              "section": "misc",
              "name": "poppler-data",
              "architecture": "all",
              "agent_id": "010"
           },
           {
              "scan": {
                 "id": 0,
                 "time": "2022-09-27T09:16:45+00:00"
              },
              "priority": "optional",
              "multiarch": "foreign",
              "format": "deb",
              "vendor": "Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>",
              "size": 31,
              "version": "3.20-4",
              "description": "data tables pertaining to HTML",
              "section": "perl",
              "name": "libhtml-tagset-perl",
              "architecture": "all",
              "agent_id": "010"
           },
           {
              "scan": {
                 "id": 0,
                 "time": "2022-09-27T09:16:45+00:00"
              },
              "priority": "optional",
              "multiarch": "same",
              "format": "deb",
              "vendor": "Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>",
              "size": 426,
              "version": "1.17-6ubuntu4.1",
              "description": "MIT Kerberos runtime libraries - krb5 GSS-API Mechanism",
              "section": "libs",
              "source": "krb5",
              "name": "libgssapi-krb5-2",
              "architecture": "amd64",
              "agent_id": "010"
           },
  …
  

  Furthermore, you can query the inventory data to find specific information about any property. For example, the command below queries the package inventory to check if the wazuh-agent package is present.

  curl -k -X GET "https://<WAZUH_SERVER_IP>:55000/syscollector/001/packages?pretty=true&name=wazuh-agent" -H  "Authorization: Bearer $TOKEN"
  

  {
     "data": {
        "affected_items": [
           {
              "scan": {
                 "id": 0,
                 "time": "2025-08-18T16:50:06+00:00"
              },
              "name": "wazuh-agent",
              "section": "System Environment/Daemons",
              "architecture": "x86_64",
              "description": "Wazuh helps you to gain security visibility into your infrastructure by monitoring\nhosts at an operating system and application level. It provides the following capabilities:\nlog analysis, file integrity monitoring, intrusions detection and policy and compliance monitoring",
              "location": " ",
              "source": " ",
              "format": "rpm",
              "install_time": "1755535740",
              "version": "4.12.0-1",
              "size": 30461944,
              "priority": " ",
              "vendor": "Wazuh, Inc <info@wazuh.com>",
              "agent_id": "001"
           }
        ],
        "total_affected_items": 1,
        "total_failed_items": 0,
        "failed_items": []
     },
     "message": "All specified syscollector information was returned",
     "error": 0
  }