Creating a SO commandline for checking wazuh-agent status on the wazuh server

[sleepingbel]

Hello,

Is it possible for creating a so commandline for the checking the wazuh-agent connection on the wazuh server?
This is convenient if you want to check the wazuh agent connection after installing and registering the agent.

And thanks for the development of the new security onion, i have the time of my live now with testing it
Great work

Regards
Bart

[metapolitics]

I'm wondering if there would be more gained from leveraging the Wazuh Kibana Plugin/App to manage agents and associated configuration and reporting ? (particularly for agent status, vulnerability detection, and compliance). (Issue #237)

Aligning the manager and ES/Kibana versions is key. The app compatibility is pretty strict with Elastic 7.9.3 requiring Wazuh 4.0.0/4.0.1 (https://github.com/wazuh/wazuh-kibana-app)

An so-wazuh-agent list would be handy for a quick validation of agent status from the CLI. The script could run the /var/ossec/bin/agent_control -l and clean up the output from:

Wazuh agent_control. List of available agents:
   ID: 000, Name: vpc-ossec-manager (server), IP: 127.0.0.1, Active/Local
   ID: 1040, Name: ip-10-0-0-76, IP: 10.0.0.76, Active
   ID: 006, Name: vpc-agent-windows, IP: 10.0.0.124, Active
   ID: 1024, Name: ip-10-0-0-252, IP: 10.0.0.252, Never connected
   
List of agentless devices:
   ID: 010, Name: agentless-ubuntu, IP: 10.0.0.135, Active

to

+------+-------------------+------------+-----------------+
|  ID  |       Host        |     IP     |     Status      |
+------+-------------------+------------+-----------------+
|  006 | vpc-agent-windows | 10.0.0.124 | Active          |
| 1024 | ip-10-0-0-252     | 10.0.0.252 | Never connected |
+------+-------------------+------------+-----------------+

Alternatively, use the Wazuh API to gather additional agent data for the below output:

+------+-------------------+------------+-------------------+---------------+-----------------+---------------------+
|  ID  |       Host        |     IP     | OS Name & Version | Wazuh Version |     Status      |   Last Keep Alive   |
+------+-------------------+------------+-------------------+---------------+-----------------+---------------------+
|  006 | vpc-agent-windows | 10.0.0.124 | Red Hat 7         |        3.11.3 | Active          | yyyy-MM-dd HH:mm:ss |
| 1024 | ip-10-0-0-252     | 10.0.0.252 | Windows 10        |         4.0.0 | Never connected | yyyy-MM-dd HH:mm:ss |
+------+-------------------+------------+-------------------+---------------+-----------------+---------------------+