Wazuh

The Wazuh connector enables seamless integration with Swimlane Turbine, allowing users to automate security monitoring and threat response actions.

Wazuh is a powerful security monitoring solution that helps organizations ensure compliance, monitor security events, and perform incident response. The Wazuh Turbine Connector allows users to integrate Wazuh's capabilities directly into Swimlane Turbine's low-code automation platform. This integration empowers users to automate policy management, agent operations, and threat intelligence analysis, enhancing their security posture and response capabilities within the Swimlane ecosystem.

Prerequisites

To effectively utilize the Wazuh connector within Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with the following parameters:

URL: The endpoint URL for the Wazuh API.

Username: The username for accessing the Wazuh API.

Password: The password associated with the provided username.

Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments.

Asset Setup

Wazuh Connector supports the following:

Basic Authentication using username and password.

The port must be set to 55000 when connecting to Wazuh.

Capabilities

The Wazuh Connector has the following capabilities:

Add Policies

Assign Agent to Group

Delete Policies

Get Key

Get Current User Info

Get MITRE Groups

Get MITRE Metadata

Get MITRE Mitigations

Get MITRE References

Get MITRE Software

Get MITRE Tactics

Get MITRE Techniques

Get Results

Get Vulnerabilities

List Agent ... and so on

Notes

More information on Wazuh can be found here

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Policies

Adds a new policy to Wazuh with specified details, requiring both 'name' and 'policy' fields in the JSON body.

Endpoint

URL: /security/policies

Method: POST

Input

Argument Name	Type	Required	Description
parameters.pretty	boolean	Optional	Parameters for the Add Policies action
parameters.wait_for_complete	boolean	Optional	Parameters for the Add Policies action
name	string	Optional	Name of the resource
policy	object	Optional	Parameter for Add Policies
policy.actions	array	Required	Parameter for Add Policies
policy.resources	array	Required	Parameter for Add Policies
policy.effect	string	Required	Parameter for Add Policies

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false},"json_body":{"name":"normal_policy","policy":{"actions":["security:delete"],"resources":["agent:id:001"],"effect":"allow"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
policy	object	Output field: policy
policy.actions	array	Output field: policy.actions
policy.resources	array	Output field: policy.resources
policy.effect	string	Output field: policy.effect

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"normal_policy","policy":{"actions":[],"resources":[],"effect":"allow"}}}

Assign Agent to Group

Assign a specified agent to a group in Wazuh using the agent's ID and the group's ID.

Endpoint

URL: /agents/{{agent_id}}/group/{{group_id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	Agent ID. All possible values from 000 onwards and this will be >= 3 characters
path_parameters.group_id	string	Required	Parameters for the Assign Agent to Group action
parameters.pretty	boolean	Optional	Parameters for the Assign Agent to Group action
parameters.wait_for_complete	boolean	Optional	Parameters for the Assign Agent to Group action
parameters.force_single_group	boolean	Optional	Parameters for the Assign Agent to Group action

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false,"force_single_group":false},"path_parameters":{"agent_id":"001","group_id":"003"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":1,"total_failed_items":0,"failed_items":[]},"message":"All selected agents were assigned to group3","error":0}}

Delete Policies

Deletes specified policies from Wazuh by policy IDs or all system policies, excluding linked roles.

Endpoint

URL: /security/policies

Method: DELETE

Input

Argument Name	Type	Required	Description
parameters.policy_ids	array	Required	Parameters for the Delete Policies action
parameters.pretty	boolean	Optional	Parameters for the Delete Policies action
parameters.wait_for_complete	boolean	Optional	Parameters for the Delete Policies action

Input Example

{"parameters":{"policy_ids":["100"],"pretty":false,"wait_for_complete":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.id	number	Response data
data.affected_items.name	string	Response data
data.affected_items.policy	object	Response data
data.affected_items.policy.actions	array	Response data
data.affected_items.policy.resources	array	Response data
data.affected_items.policy.effect	string	Response data
data.affected_items.roles	array	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

Get Current User Information

Retrieve details about the current user in Wazuh, including roles and permissions.

Endpoint

URL: /security/users/me

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pretty	boolean	Optional	Parameters for the Get Current User Information action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get Current User Information action

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.id	number	Response data
data.affected_items.username	string	Response data
data.affected_items.allow_run_as	boolean	Response data
data.affected_items.roles	array	Response data
data.affected_items.roles.id	number	Response data
data.affected_items.roles.name	string	Response data
data.affected_items.roles.rule	object	Response data
data.affected_items.roles.rule.FIND	object	Response data
data.affected_items.roles.policies	array	Response data
data.affected_items.roles.policies.id	number	Response data
data.affected_items.roles.policies.name	string	Response data
data.affected_items.roles.policies.policy	object	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

Get Key

Retrieves the authentication key for a specified agent in Wazuh using the agent's ID.

Endpoint

URL: /agents/{{agent_id}}/key

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	Agent ID. All possible values from 000 onwards and this will be >= 3 characters.
parameters.pretty	boolean	Optional	Parameters for the Get Key action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get Key action

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false},"path_parameters":{"agent_id":"002"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.id	string	Response data
data.affected_items.key	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

Get MITRE Groups

Retrieve groups from the MITRE database within Wazuh, providing an overview of threat actor groupings.

Endpoint

URL: /mitre/groups

Method: GET

Input

Argument Name	Type	Required	Description
parameters.group_ids	array	Optional	List of MITRE's group IDs (separated by comma).
parameters.pretty	boolean	Optional	Parameters for the Get MITRE Groups action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get MITRE Groups action
parameters.offset	number	Optional	Parameters for the Get MITRE Groups action
parameters.limit	number	Optional	Maximum number of elements to return. Although up to 100.000 can be specified, it is recommended not to exceed 500 elements.
parameters.sort	string	Optional	Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.
parameters.search	string	Optional	Look for elements containing the specified string. To obtain a complementary search, use '-' at the beginning.
parameters.select	string	Optional	Select which fields to return (separated by comma).Use '.' for nested fields.
parameters.q	string	Optional	Query to filter results by. For example q="status=active".
parameters.distinct	boolean	Optional	Parameters for the Get MITRE Groups action

Input Example

{"parameters":{"group_ids":["intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340"],"pretty":false,"wait_for_complete":false,"offset":0,"limit":500,"sort":"field1: field2","search":"-search","select":"field1: field2","q":"status=active","distinct":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.mitre_version	string	Response data
data.affected_items.deprecated	number	Response data
data.affected_items.description	string	Response data
data.affected_items.name	string	Response data
data.affected_items.id	string	Response data
data.affected_items.modified_time	string	Response data
data.affected_items.created_time	string	Response data
data.affected_items.software	array	Response data
data.affected_items.techniques	array	Response data
data.affected_items.references	array	Response data
data.affected_items.references.url	string	Response data
data.affected_items.references.description	string	Response data
data.affected_items.references.source	string	Response data
data.affected_items.references.external_id	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":111,"total_failed_items":0,"failed_items":[]},"message":"MITRE groups information was returned","error":0}}

Get MITRE Metadata

Retrieve metadata from the MITRE database using the Wazuh connector.

Endpoint

URL: /mitre/metadata

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pretty	boolean	Optional	Parameters for the Get MITRE Metadata action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get MITRE Metadata action

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.key	string	Response data
data.affected_items.value	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":2,"total_failed_items":0,"failed_items":[]},"message":"MITRE metadata information was returned","error":0}}

Get MITRE Mitigations

Retrieve a list of mitigation strategies from the MITRE database using Wazuh.

Endpoint

URL: /mitre/mitigations

Method: GET

Input

Argument Name	Type	Required	Description
parameters.mitigation_ids	array	Optional	Parameters for the Get MITRE Mitigations action
parameters.pretty	boolean	Optional	Parameters for the Get MITRE Mitigations action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get MITRE Mitigations action
parameters.offset	number	Optional	Parameters for the Get MITRE Mitigations action
parameters.limit	number	Optional	Parameters for the Get MITRE Mitigations action
parameters.sort	string	Optional	Parameters for the Get MITRE Mitigations action
parameters.search	string	Optional	Parameters for the Get MITRE Mitigations action
parameters.select	string	Optional	Parameters for the Get MITRE Mitigations action
parameters.q	string	Optional	Parameters for the Get MITRE Mitigations action
parameters.distinct	boolean	Optional	Parameters for the Get MITRE Mitigations action

Input Example

{"parameters":{"mitigation_ids":["course-of-action--02f0f92a-0a51-4c94-9bda-6437b9a93f22"],"pretty":false,"wait_for_complete":false,"offset":0,"limit":500,"sort":"field1: field2","search":"-search","select":"field1: field2","q":"status=active","distinct":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.mitre_version	string	Response data
data.affected_items.deprecated	number	Response data
data.affected_items.description	string	Response data
data.affected_items.name	string	Response data
data.affected_items.id	string	Response data
data.affected_items.modified_time	string	Response data
data.affected_items.created_time	string	Response data
data.affected_items.techniques	array	Response data
data.affected_items.references	array	Response data
data.affected_items.references.url	string	Response data
data.affected_items.references.source	string	Response data
data.affected_items.references.external_id"	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":266,"total_failed_items":0,"failed_items":[]},"message":"MITRE mitigations information was returned","error":0}}

Get MITRE References

Retrieve MITRE database references to enhance threat intelligence and inform security strategies.

Endpoint

URL: /mitre/references

Method: GET

Input

Argument Name	Type	Required	Description
parameters.reference_ids	array	Optional	List of MITRE's references IDs (separated by comma)
parameters.pretty	boolean	Optional	Parameters for the Get MITRE References action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get MITRE References action
parameters.offset	number	Optional	First element to return in the collection and this will be >= 0 .
parameters.limit	number	Optional	Maximum number of elements to return. Although up to 100.000 can be specified, it is recommended not to exceed 500 elements.
parameters.sort	string	Optional	Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order. Use '.' for nested fields.
parameters.search	string	Optional	Look for elements containing the specified string. To obtain a complementary search, use '-' at the beginning.
parameters.select	string	Optional	Select which fields to return (separated by comma). Use '.' for nested fields.
parameters.q	string	Optional	Query to filter results by. For example q="status=active" .

Input Example

{"parameters":{"reference_ids":["attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298"],"pretty":false,"wait_for_complete":false,"offset":0,"limit":500,"sort":"field1: field2","search":"-search","select":"field1: field2","q":"status=active"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.url	string	Response data
data.affected_items.description	string	Response data
data.affected_items.source	string	Response data
data.affected_items.id	string	Response data
data.affected_items.type	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":5212,"total_failed_items":0,"failed_items":[]},"message":"MITRE references information was returned","error":0}}

Get MITRE Software

Retrieve software details from the MITRE database using Wazuh, providing insights into known tools and techniques.

Endpoint

URL: /mitre/software

Method: GET

Input

Argument Name	Type	Required	Description
parameters.software_ids	array	Optional	List of MITRE's software IDs (separated by comma).
parameters.pretty	boolean	Optional	Parameters for the Get MITRE Software action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get MITRE Software action
parameters.offset	number	Optional	First element to return in the collection and this will be >= 0 .
parameters.limit	number	Optional	Maximum number of elements to return. Although up to 100.000 can be specified, it is recommended not to exceed 500 elements.
parameters.sort	string	Optional	Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.
parameters.search	string	Optional	Look for elements containing the specified string. To obtain a complementary search, use '-' at the beginning.
parameters.select	string	Optional	Select which fields to return (separated by comma). Use '.' for nested fields.
parameters.q	string	Optional	Query to filter results by. For example q="status=active" .
parameters.distinct	boolean	Optional	Parameters for the Get MITRE Software action

Input Example

{"parameters":{"software_ids":["007b44b6-e4c5-480b-b5b9-56f2081b1b7b"],"pretty":false,"wait_for_complete":false,"offset":0,"limit":500,"sort":"field1: field2","search":"-search","select":"field1: field2","q":"status=active","distinct":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.mitre_version	string	Response data
data.affected_items.deprecated	number	Response data
data.affected_items.description	string	Response data
data.affected_items.name	string	Response data
data.affected_items.id	string	Response data
data.affected_items.modified_time	string	Response data
data.affected_items.created_time	string	Response data
data.affected_items.groups	array	Response data
data.affected_items.techniques	array	Response data
data.affected_items.references	array	Response data
data.affected_items.references.url	string	Response data
data.affected_items.references.description	string	Response data
data.affected_items.references.source	string	Response data
data.affected_items.references.external_id	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":444,"total_failed_items":0,"failed_items":[]},"message":"MITRE software information was returned","error":0}}

Get MITRE Tactics

Retrieve a list of tactics from the MITRE ATT&CK database using the Wazuh integration.

Endpoint

URL: /mitre/tactics

Method: GET

Input

Argument Name	Type	Required	Description
parameters.tactic_ids	array	Optional	List of MITRE's tactics IDs (separated by comma).
parameters.pretty	boolean	Optional	Parameters for the Get MITRE Tactics action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get MITRE Tactics action
parameters.offset	number	Optional	First element to return in the collection and this will be >=0 .
parameters.limit	number	Optional	Maximum number of elements to return. Although up to 100.000 can be specified, it is recommended not to exceed 500 elements.
parameters.sort	string	Optional	Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.
parameters.search	string	Optional	Look for elements containing the specified string. To obtain a complementary search, use '-' at the beginning.
parameters.select	string	Optional	Select which fields to return (separated by comma). Use '.' for nested fields.
parameters.q	string	Optional	Query to filter results by. For example q="status=active" .
parameters.distinct	boolean	Optional	Parameters for the Get MITRE Tactics action

Input Example

{"parameters":{"tactic_ids":["x-mitre-tactic--7141578b-e50b-4dcc-bfa4-08a8dd689e9e"],"pretty":false,"wait_for_complete":false,"offset":0,"limit":500,"sort":"field1: field2","search":"-search","select":"field1: field2","q":"status=active","distinct":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.description	string	Response data
data.affected_items.name	string	Response data
data.affected_items.id	string	Response data
data.affected_items.modified_time	string	Response data
data.affected_items.created_time	string	Response data
data.affected_items.short_name	string	Response data
data.affected_items.techniques	array	Response data
data.affected_items.references	array	Response data
data.affected_items.references.url	string	Response data
data.affected_items.references.source	string	Response data
data.affected_items.references.external_id	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":14,"total_failed_items":0,"failed_items":[]},"message":"All tactics information was returned","error":0}}

Get MITRE Techniques

Retrieve MITRE ATT&CK techniques from the Wazuh platform's integrated database.

Endpoint

URL: /mitre/techniques

Method: GET

Input

Argument Name	Type	Required	Description
parameters.technique_ids	array	Optional	List of MITRE's techniques IDs (separated by comma).
parameters.pretty	boolean	Optional	Parameters for the Get MITRE Techniques action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get MITRE Techniques action
parameters.offset	number	Optional	First element to return in the collection and this will be >=0
parameters.limit	number	Optional	Maximum number of elements to return. Although up to 100.000 can be specified, it is recommended not to exceed 500 elements.
parameters.sort	string	Optional	Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.
parameters.search	string	Optional	Look for elements containing the specified string. To obtain a complementary search, use '-' at the beginning.
parameters.select	string	Optional	Select which fields to return (separated by comma). Use '.' for nested fields.
parameters.q	string	Optional	Query to filter results by. For example q="status=active" .
parameters.distinct	boolean	Optional	Parameters for the Get MITRE Techniques action

Input Example

{"parameters":{"technique_ids":["attack-pattern--9d48cab2-7929-4812-ad22-f536665f0109"],"pretty":false,"wait_for_complete":false,"offset":0,"limit":500,"sort":"field1: field2","search":"-search","select":"field1: field2","q":"status=active","distinct":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.mitre_version	string	Response data
data.affected_items.network_requirements	number	Response data
data.affected_items.remote_support	number	Response data
data.affected_items.mitre_detection	string	Response data
data.affected_items.id	string	Response data
data.affected_items.modified_time	string	Response data
data.affected_items.deprecated	number	Response data
data.affected_items.created_time	string	Response data
data.affected_items.name	string	Response data
data.affected_items.description	string	Response data
data.affected_items.tactics	array	Response data
data.affected_items.mitigations	array	Response data
data.affected_items.software	array	Response data
data.affected_items.groups	array	Response data
data.affected_items.references	array	Response data
data.affected_items.references.source	string	Response data
data.affected_items.references.description	string	Response data
data.affected_items.references.url	string	Response data
data.affected_items.references.external_id	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":1,"total_failed_items":0,"failed_items":[]},"message":"MITRE techniques information was returned","error":0}}

Get Results

Retrieve the rootcheck database for a specified agent in Wazuh using the agent's ID.

Endpoint

URL: /rootcheck/{{agent_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	Agent ID. All possible values from 000 onwards and this will be >= 3 characters .
parameters.pretty	boolean	Optional	Parameters for the Get Results action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get Results action
parameters.offset	number	Optional	First element to return in the collection and this will be >=0
parameters.limit	number	Optional	Maximum number of elements to return. Although up to 100.000 can be specified, it is recommended not to exceed 500 elements.
parameters.sort	string	Optional	Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.
parameters.search	string	Optional	Look for elements containing the specified string. To obtain a complementary search, use '-' at the beginning.
parameters.select	string	Optional	Select which fields to return (separated by comma). Use '.' for nested fields.
parameters.q	string	Optional	Query to filter results by. For example q="status=active".
parameters.distinct	boolean	Optional	Parameters for the Get Results action
parameters.status	string	Optional	Parameters for the Get Results action
parameters.pci_dss	string	Optional	Filter by PCI_DSS requirement name.
parameters.cis	string	Optional	Filter by CIS requirement.

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false,"offset":0,"limit":500,"sort":"field1: field2","search":"-search","select":"field1: field2","q":"status=active","distinct":false,"status":"status","pci_dss":"PCI_DSS","cis":"CIS"},"path_parameters":{"agent_id":[23487414]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.date_first	string	Response data
data.affected_items.log	string	Response data
data.affected_items.date_last	string	Response data
data.affected_items.status	string	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":2,"total_failed_items":0,"failed_items":[]},"message":"All selected rootcheck information was returned","error":0}}

Get Vulnerabilities

Retrieve a list of vulnerabilities associated with a specified agent in Wazuh using the agent's unique identifier.

Endpoint

URL: /vulnerability/{{agent_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	Agent ID. All possible values from 000 onwards and this will be >= 3 characters.
parameters.pretty	boolean	Optional	Parameters for the Get Vulnerabilities action
parameters.wait_for_complete	boolean	Optional	Parameters for the Get Vulnerabilities action
parameters.offset	number	Optional	First element to return in the collection and this will be >=0
parameters.limit	number	Optional	Maximum number of elements to return. Although up to 100.000 can be specified, it is recommended not to exceed 500 elements.
parameters.sort	string	Optional	Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.
parameters.search	string	Optional	Look for elements containing the specified string. To obtain a complementary search, use '-' at the beginning.
parameters.select	array	Optional	Select which fields to return (separated by comma). Use '.' for nested fields.
parameters.q	string	Optional	Query to filter results by. For example q="status=active".
parameters.distinct	boolean	Optional	Parameters for the Get Vulnerabilities action
parameters.architecture	string	Optional	Parameters for the Get Vulnerabilities action
parameters.cve	string	Optional	Parameters for the Get Vulnerabilities action
parameters.name	string	Optional	Parameters for the Get Vulnerabilities action
parameters.version	string	Optional	Parameters for the Get Vulnerabilities action
parameters.type	string	Optional	Filter by CVE type.
parameters.status	string	Optional	Filter by CVE status.
parameters.severity	string	Optional	Parameters for the Get Vulnerabilities action

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false,"offset":0,"limit":500,"sort":"field1: field2","search":"-search","select":["field1: field2"],"q":"status=active","distinct":false,"architecture":"amd64","cve":"cve","name":"binutils","version":"2.34-6ubuntu1.3","type":"PACKAGE","status":"VALID","severity":"High"},"path_parameters":{"agent_id":[23487414]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.severity	string	Response data
data.affected_items.updated	string	Response data
data.affected_items.version	string	Response data
data.affected_items.type	string	Response data
data.affected_items.name	string	Response data
data.affected_items.external_references	array	Response data
data.affected_items.condition	string	Response data
data.affected_items.detection_time	string	Response data
data.affected_items.cvss3_score	number	Response data
data.affected_items.published	string	Response data
data.affected_items.architecture	string	Response data
data.affected_items.cve	string	Response data
data.affected_items.status	string	Response data
data.affected_items.title	string	Response data
data.affected_items.cvss2_score	number	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":2,"total_failed_items":0,"failed_items":[]},"message":"All selected vulnerabilities were returned","error":0}}

List Agents

Retrieve details on all available agents or a specified subset within the Wazuh platform.

Endpoint

URL: /agents

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pretty	boolean	Optional	Parameters for the List Agents action
parameters.wait_for_complete	boolean	Optional	Parameters for the List Agents action
parameters.agents_list	array	Optional	List of agent IDs (separated by comma), all agents selected by default if not specified.
parameters.offset	number	Optional	First element to return in the collection and this will be >=0
parameters.limit	number	Optional	Maximum number of elements to return. Although up to 100.000 can be specified, it is recommended not to exceed 500 elements.
parameters.select	array	Optional	Select which fields to return (separated by comma). Use '.' for nested fields.
parameters.sort	string	Optional	Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.
parameters.search	string	Optional	Look for elements containing the specified string. To obtain a complementary search, use '-' at the beginning
parameters.status	array	Optional	Filter by agent status (use commas to enter multiple statuses).
parameters.q	string	Optional	Query to filter results by. For example q="status=active".
parameters.older_than	string	Optional	Filter out agents whose time lapse from last keep alive signal is longer than specified. Time in seconds, ‘[n_days]d’, ‘[n_hours]h’, ‘[n_minutes]m’ or ‘[n_seconds]s’. For never_connected agents, uses the register date.
parameters.os.platform	string	Optional	Parameters for the List Agents action
parameters.os.version	string	Optional	Parameters for the List Agents action
parameters.os.name	string	Optional	Parameters for the List Agents action
parameters.manager	string	Optional	Filter by manager hostname where agents are connected to .
parameters.version	string	Optional	Filter by agents version using one of the following formats 'X.Y.Z', 'vX.Y.Z', 'wazuh X.Y.Z' or 'wazuh vX.Y.Z'.
parameters.group	string	Optional	Parameters for the List Agents action
parameters.node_name	string	Optional	Parameters for the List Agents action
parameters.name	string	Optional	Parameters for the List Agents action
parameters.ip	string	Optional	Filter by the IP used by the agent to communicate with the manager. If it's not available, it will have the same value as registerIP.
parameters.registerIP	string	Optional	Filter by the IP used when registering the agent.
parameters.group_config_status	string	Optional	Agent groups configuration sync status.
parameters.distinct	boolean	Optional	Parameters for the List Agents action

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false,"agents_list":["001"],"offset":0,"limit":500,"select":["filed1.filed2"],"sort":"field1: field2","search":"-search","status":["pending"],"q":"status=active","older_than":"7d","os.platform":"os platform","os.version":"os version","os.name":"os name","manager":"hostname","version":"4.4.0","group":"group","node_name":"node","name":"wazuh","ip":"ip","registerIP":"registerip","group_config_status":"synced","distinct":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.os	object	Response data
data.affected_items.os.arch	string	Response data
data.affected_items.os.codename	string	Response data
data.affected_items.os.major	string	Response data
data.affected_items.os.minor	string	Response data
data.affected_items.os.name	string	Response data
data.affected_items.os.platform	string	Response data
data.affected_items.os.uname	string	Response data
data.affected_items.os.version	string	Response data
data.affected_items.lastKeepAlive	string	Response data
data.affected_items.id	string	Response data
data.affected_items.dateAdd	string	Response data
data.affected_items.configSum	string	Response data
data.affected_items.manager	string	Response data
data.affected_items.group	array	Response data
data.affected_items.registerIP	string	Response data
data.affected_items.ip	string	Response data
data.affected_items.name	string	Response data
data.affected_items.status	string	Response data
data.affected_items.mergedSum	string	Response data
data.affected_items.version	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":3,"total_failed_items":0,"failed_items":[]},"message":"All selected agents information was returned","error":0}}

List Policies

Retrieve all policies within the Wazuh system, including details of the administrator policy.

Endpoint

URL: /security/policies

Method: GET

Input

Argument Name	Type	Required	Description
parameters.policy_ids	array	Optional	Parameters for the List Policies action
parameters.limit	number	Optional	Parameters for the List Policies action
parameters.offset	number	Optional	Parameters for the List Policies action
parameters.pretty	boolean	Optional	Parameters for the List Policies action
parameters.search	string	Optional	Parameters for the List Policies action
parameters.select	array	Optional	Parameters for the List Policies action
parameters.sort	string	Optional	Parameters for the List Policies action
parameters.wait_for_complete	boolean	Optional	Parameters for the List Policies action
parameters.q	string	Optional	Parameters for the List Policies action
parameters.distinct	boolean	Optional	Parameters for the List Policies action

Input Example

{"parameters":{"policy_ids":["100"],"limit":100,"offset":0,"pretty":false,"search":"-search","select":["filed1.filed2"],"sort":"field1: field2","wait_for_complete":false,"q":"status=active","distinct":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.id	number	Response data
data.affected_items.name	string	Response data
data.affected_items.policy	object	Response data
data.affected_items.policy.actions	array	Response data
data.affected_items.policy.resources	array	Response data
data.affected_items.policy.effect	string	Response data
data.affected_items.roles	array	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":35,"total_failed_items":0,"failed_items":[]},"message":"All specified policies were returned","error":0}}

Logout Current User

Invalidates all access tokens for the current user in Wazuh, ensuring secure session termination.

Endpoint

URL: /security/user/authenticate

Method: DELETE

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.message	string	Response data
data.error	number	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"message":"User wazuh was successfully logged out","error":0}}}

Restart Agent

Initiates a restart process for a specified agent in Wazuh using the agent's unique ID.

Endpoint

URL: /agents/{{agent_id}}/restart

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	Agent ID. All possible values from 000 onwards and this will be >= 3 characters.
parameters.pretty	boolean	Optional	Parameters for the Restart Agent action
parameters.wait_for_complete	boolean	Optional	Parameters for the Restart Agent action

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false},"path_parameters":{"agent_id":"002"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

Run Scan

Initiates a rootcheck scan across all agents or specified ones within the Wazuh platform.

Endpoint

URL: /rootcheck

Method: PUT

Input

Argument Name	Type	Required	Description
parameters.pretty	boolean	Optional	Parameters for the Run Scan action
parameters.wait_for_complete	boolean	Optional	Parameters for the Run Scan action
parameters.agents_list	array	Optional	List of agent IDs (separated by comma), all agents selected by default if not specified.

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false,"agents_list":["001"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":4,"total_failed_items":0,"failed_items":[]},"message":"Rootcheck scan was restarted on returned agents","error":0}}

Run Vulnerability Detector Scan

Initiates a vulnerability detector scan across all nodes in Wazuh, identifying potential security threats.

Endpoint

URL: /vulnerability

Method: PUT

Input

Argument Name	Type	Required	Description
parameters.pretty	boolean	Optional	Parameters for the Run Vulnerability Detector Scan action
parameters.wait_for_complete	boolean	Optional	Parameters for the Run Vulnerability Detector Scan action

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"affected_items":[],"total_affected_items":3,"total_failed_items":0,"failed_items":[]},"message":"A vulnerability detector scan was requested in all nodes","error":0}}

Update Policies

Modify an existing policy in Wazuh by specifying the policy_id and at least one policy property to update.

Endpoint

URL: /security/policies/{{policy_id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.policy_id	string	Required	Specify a policy id.
parameters.pretty	boolean	Optional	Parameters for the Update Policies action
parameters.wait_for_complete	boolean	Optional	Parameters for the Update Policies action
name	string	Optional	Policy name and this will be <= 64 characters.
policy	object	Optional	Parameter for Update Policies
policy.actions	array	Required	Parameter for Update Policies
policy.resources	array	Required	Parameter for Update Policies
policy.effect	array	Required	Parameter for Update Policies

Input Example

{"parameters":{"pretty":false,"wait_for_complete":false},"json_body":{"name":"policy name","policy":{"actions":["security:delete"],"resources":["resources"],"effect":["deny"]}},"path_parameters":{"policy_id":["100"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.affected_items	array	Response data
data.affected_items.id	number	Response data
data.affected_items.name	string	Response data
data.affected_items.policy	object	Response data
data.affected_items.policy.actions	array	Response data
data.affected_items.policy.resources	array	Response data
data.affected_items.policy.effect	string	Response data
data.affected_items.roles	array	Response data
data.total_affected_items	number	Response data
data.total_failed_items	number	Response data
data.failed_items	array	Response data
message	string	Response message
error	number	Error message if any

Output Example

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT