module Wazuh module Api module Endpoints module Agents # # Returns a list with the available agents. # # @option options [String] :offset # First element to return in the collection. # @option options [String] :limit # Maximum number of elements to return. # @option options [String] :select # Select which fields to return (separated by comma). # @option options [String] :sort # Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order. # @option options [String] :search # Looks for elements with the specified string. # @option options [String] :status # Filters by agent status. Use commas to enter multiple statuses. # Allowed values: active, pending, neverconnected, disconnected # @option options [String] :order_than # Filters out disconnected agents for longer than specified. Time in seconds, ‘[n_days]d’, ‘[n_hours]h’, ‘[n_minutes]m’ or ‘[n_seconds]s’. For never connected agents, uses the register date. # @return [Array] Returns Array containing agents # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#get-all-agents def all_agents(options = {}) offset_request('get', '/agents', options) end # Returns various information from an agent. # # @param [String] agent_id # ID to agent # @option options [select] :select # List of selected fields separated by commas. # @return [Sawyer::Resource] Returns Sawyer::Resource # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#get-an-agent def agent(agent_id, options = {}) get "/agents/#{agent_id}", options end # Returns various information from an agent called :agent_name. # # @param [String] agent_name # Name to agent # @option options [select] :select # List of selected fields separated by commas. # @return [Sawyer::Resource] Returns Sawyer::Resource # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#get-an-agent-by-its-name def agent_by_name(agent_name, options = {}) get "/agents/name/#{agent_name}", options end # Get agent key # Returns the key of an agent. # # @param [String] agent_id # ID to agent # @return [String] Returns the key of an agent # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#get-agent-key def agent_key(agent_id, options = {}) get "/agents/#{agent_id}/key" end # Restarts a list of agents. # # @option options [ids] :ids # Array of agent ID’s. # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#restart-a-list-of-agents def restart_agents(options = {}) post '/agents/restart', options end # Restarts all agents. # def restart_all_agents() put '/agents/restart' end # Restart an agent. # # @param [String] agent_id # Agent unique ID. # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#restart-an-agent def restart_an_agents(agent_id, options = {}) put "/agents/#{agent_id}/restart" end # Returns all the different combinations that agents have for the selected fields. It also indicates the total number of agents that have each combination. # # @option options [offset] :offset # First element to return in the collection. # @option options [limit] :limit # Maximum number of elements to return. # @option options [sort] :sort # Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order. # @option options [search] :search # Looks for elements with the specified string. # @option options [fileds] :fileds # List of fields affecting the operation. # @option options [select] :select # List of selected fields separated by commas. # @option options [q] :q # Query to filter result. For example q=”status=Active” # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#get-distinct-fields-in-agents def distinct_fields_in_agents(options = {}) get '/agents/stats/distinct', options end # Returns the list of outdated agents. # # @option options [offset] :offset # First element to return in the collection. # @option options [limit] :limit # Maximum number of elements to return. # @option options [sort] :sort # Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order. # @option options [q] :q # Query to filter result. For example q=”status=Active” # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#get-outdated-agents def outdated_agents(options = {}) get '/agents/outdated', options end # Returns the upgrade result from an agent. # # @param [String] agent_id # ID to agent # @option options [timeout] :timeout # Seconds to wait for the agent to respond. def upgrade_result_from_agent(agent_id, options = {}) get "/agents/#{agent_id}/upgrade_result", options end # Upgrade agent using custom file. # # @param [String] :agent_id # Agent unique ID. # @option options [String] :file_path # Path to the WPK file. The file must be on a folder on the Wazuh’s installation directory (by default, /var/ossec). # @option options [String] :installer # Installation script. # @see https://documentation.wazuh.com/3.12/user-manual/api/reference.html#upgrade-agent-using-custom-file def agent_upgrade_custom(agent_id, options = {}) put "/agents/#{agent_id}/upgrade_custom", options end # Upgrade agent using online repository # # Upgrade the agent using a WPK file from online repository. # @param [String] :agent_id # @option options [String] :wpk_repo # WPK repository. # @option options [String] :version # Wazuh version # @option options [Boolean] :use_http # Use protocol HTTP. If it is false use HTTPS. By default the value is set to false. # @option options [Integer] :force # Force upgrade. Allow values: 0 or 1. # @see https://documentation.wazuh.com/3.12/user-manual/api/reference.html#upgrade-agent-using-online-repository def agent_upgrade(agent_id, options = {}) put "/agents/#{agent_id}/upgrade", options end # Add a new agent # # @option options [name] :name # Name to agent # @option options [ip] :ip # IP to agent # If this is not included, the API will get the IP automatically. # If you are behind a proxy, you must set the option config.BehindProxyServer to yes at config.js. # Allowed values: IP, IP/NET, ANY # @option options [force] :force # Remove the old agent with the same IP if disconnected since seconds. # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#add-agent def add_agent(options = {}) post '/agents', options end # Delete an agent # Removes an agent. # # @param [String] agent_id # @option options [Bool] purge # Delete an agent from the key store. This parameter is only valid if purge is set to no in the manager’s ossec.conf. # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#delete-an-agent def delete_agent(agent_id, options = {}) delete "/agents/#{agent_id}", options end # Delete agents # Removes agents, using a list of them or a criterion based on the status or time of the last connection. # @option options [String] ids # Agent IDs separated by commas. # @option options [Bool] purge # Delete an agent from the key store. This parameter is only valid if purge is set to no in the manager’s ossec.conf. # @option options [String] status # Filters by agent status. Use commas to enter multiple statuses. Allowed values: active, pending, neverconnected, disconnected # @option options [String] older_than # Filters out disconnected agents for longer than specified. Time in seconds, ‘[n_days]d’, ‘[n_hours]h’, ‘[n_minutes]m’ or ‘[n_seconds]s’. For never connected agents, uses the register date. Default value: 7d. def delete_agents(options = {}) delete '/agents', options end # Adds a new agent with name :agent_name. This agent will use ANY as IP. # # @param [String] agent_name # Name to agent # @see https://documentation.wazuh.com/3.10/user-manual/api/reference.html#add-agent-quick-method def add_agent_quick(agent_name) put "/agents/#{agent_name}" end # Insert an agent with an existing id and key. # # @option options [name] :name # Name to agent # @option options [ip] :ip # If this is not included, the API will get the IP automatically. If you are behind a proxy, you must set the option config.BehindProxyServer to yes at config.js. # Allowed values: IP, IP/NET, ANY # @option options [id] :id # ID to agent # @option options [key] :key # Agent key. Minimum length: 64 characters. Allowed values: ^[a-zA-Z0-9]+$ # @option options [force] :force # Remove the old agent the with same IP if disconnected since seconds. def insert_agent(options = {}) post '/agents/insert', options end # Get active configuration # @param [String] agent_id # @param [String] component # Selected component. Alowed values see document # @param [String] configuration # Selected component. Alowed values see document # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#get-active-configuration def agent_config(agent_id, component, configuration) get "/agents/#{agent_id}/config/#{component}/#{configuration}" end # Delete a list of groups # @param [String] ids # @see http://documentation.wazuh.com/3.11/user-manual/api/reference.html#delete-a-list-of-groups def delete_agent_by_group(ids) delete '/agents/groups', {ids: ids} end # Get sync status of agent # Returns the sync status in JSON format # # @param [String] agent_id # Agent ID # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#get-sync-status-of-agent def agent_sync_status(agent_id) get "/agent/#{agent_id}/group/is_sync" end # Add a list of agents to a group # Adds a list of agents to the specified group # # @param [Array[String]] ids # List of agent ID # @param [String] group_id # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#add-a-list-of-agents-to-a-group def add_agents_to_group(ids, group_id) post "/agents/group/#{group_id}", {ids: ids} end # Add agent group # Adds an agent to the specified group. # # @param [String] agent_id # Agent unique ID # @param [String] group_id # Group ID # @option options [Bool] force_single_group # Whether to append new group to current agent’s group or replace it. # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#add-agent-group def add_agent_to_group(agent_id, group_id, options = {}) put "/agents/#{agent_id}/group/#{group_id}", options end # Create a group # Creates a new group. # # @param [String] group_id # Group ID # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#create-a-group def create_group(group_id) put "/agents/groups/#{group_id}" end # Get a file in group # Returns the specified file belonging to the group parsed to JSON. # # @param [String] group_id # Group ID # @param [String] filename # Filename # @option options [String] type # @option options [String] format # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#add-agent-group def get_file_in_group(group_id, filename, options = {}) get "agents/groups/#{group_id}/files/#{filename}", options end # Get agents in a group # Returns the list of agents in a group. # # @param [String] group_id # Group ID # @option options [Number] offset # @option options [Number] limit # @option options [String] select # @option options [String] sort # @option options [String] search # @option options [String] status # @option options [String] q # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#get-agents-in-a-group def agents_by_group(group_id, options = {}) offset_request('get', "/agents/groups/#{group_id}", options) end # Get agents without group # Returns a list with the available agents without group. # # @option options [Number] offset # @option options [Number] limit # @option options [String] select # @option options [String] sort # @option options [String] search # @option options [String] status # @option options [String] q # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#get-agents-without-group def agents_by_no_group(options = {}) get 'agents/no_group', options end # Get group configuration # # @param [String] group_id # @option options [Number] offset # @option options [Number] limit # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#get-group-configuration def group_configuration(group_id, options = {}) get "/agents/groups/#{group_id}/configuration", options end # Get group files # Returns the files belonging to the group. # # @param [String] group_id # @option options [Number] offset # @option options [Number] limit # @option options [String] sort # @option options [String] search # @option options [String] hash # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#get-group-files def group_files(group_id, options = {}) get "/agents/groups/#{group_id}/files", options end # Get groups # Returns the list of existing agent groups. # # @option options [Number] offset # @option options [Number] limit # @option options [String] sort # @option options [String] search # @option options [String] hash # @option options [String] q def groups(options = {}) get '/agents/groups', options end # Put configuration file (agent.conf) into a group # Upload the group configuration (agent.conf). # # @param [String] group_id # @param [String] config # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#put-configuration-file-agent-conf-into-a-group def update_group_ossec_configuration(group_id, config) # post "/agents/groups/#{group_id}/configuration" # TODO : use Content-type: application/xml raise "This method not yet implement" end # Remove a single group of an agent # Remove the group of the agent but will leave the rest of its group if it belongs to a multigroup. # # @param [String] agent_id # @param [String] group_id # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#remove-a-single-group-of-an-agent def remove_agent_of_group(agent_id, group_id) delete "/agents/#{agent_id}/group/#{group_id}" end # Remove a single group of multiple agents # Remove a list of agents of a group. # # @param [String] ids # @param [String] group_id # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#remove-a-single-group-of-multiple-agents def remove_agents_of_group(ids, groups) delete "/agents/group/#{group_id}", {ids: ids} end # Remove all agent groups. # Removes the group of the agent. The agent will automatically revert to the ‘default’ group. # # @param [String] agent_id # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#remove-all-agent-groups def remove_all_agent_of_group(agent_id) delete "/agents/#{agent_id}/group" end # Remove group # Removes the group. Agents that were assigned to the removed group will automatically revert to the ‘default’ group. # # @param [String] group_id # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#remove-group def remove_group(group_id) delete "/agents/groups/#{group_id}" end # Get OS summary # Returns a summary of the OS. # # @option options [Number] offset # @option options [Number] limit # @option options [String] sort # @option options [String] search # @option options [String] q # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#get-os-summary def agent_os_summary(options = {}) get "/agents/summary/os" end # Get agents summary # Returns a summary of the available agents. # # @see https://documentation.wazuh.com/3.11/user-manual/api/reference.html#get-agents-summary def agent_summary get "/agents/summary" end end end end end