Assign agents to group
Action ID:tools.wazuh.assign_agents_to_group
Assign agents to a group, e.g. move compromised hosts into a containment group with a restrictive configuration.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.put_multiple_agent_single_group
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string]
required
Agent IDs to assign to the group.
string
required
Group ID (name of the group).
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If true, removes the agents from all their other groups.Default:
false.boolean
If false, disables SSL verification for internal networks.Default:
true.Block IP address
Action ID:tools.wazuh.block_ip
Block an IP address on agents with an Active Response script (firewall-drop by default). The agents must have the script installed.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.active_response_controller.run_command
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string]
required
Agent IDs to block the IP address on.
string
required
IP address to block. Sent as
alert.data.srcip.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string
Active Response script to run. Use
!netsh or !win_route-null for Windows agents.Default: "!firewall-drop".Allowed values: !firewall-drop, !host-deny, !route-null, !netsh, !win_route-null, !firewalld-drop.boolean
If false, disables SSL verification for internal networks.Default:
true.Disable user account
Action ID:tools.wazuh.disable_account
Disable a local user account on Linux or Unix agents with the disable-account Active Response script.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.active_response_controller.run_command
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string]
required
Agent IDs to disable the account on.
string
required
Username to disable. Sent as
alert.data.dstuser.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get agent active configuration
Action ID:tools.wazuh.get_agent_config
Get the configuration an agent is currently running for a component (e.g. syscheck/syscheck, logcollector/localfile, com/active-response, agent/client).
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.get_agent_config
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string
required
Agent component.Allowed values:
agent, agentless, analysis, auth, com, csyslog, integrator, logcollector, mail, monitor, request, syscheck, wazuh-db, wmodules.string
required
Configuration section to read for the component (e.g.
syscheck, rootcheck, localfile, active-response, client, labels, wmodules).string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get agent hardware
Action ID:tools.wazuh.get_agent_hardware
Get the hardware details (CPU, RAM, serial) inventoried on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_hardware_info
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. ram.total).Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get agent hotfixes
Action ID:tools.wazuh.get_agent_hotfixes
List the Microsoft hotfixes (KBs) installed on a Windows agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_hotfix_info
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string | null
Filter by hotfix (e.g.
KB5034441).Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get agent network addresses
Action ID:tools.wazuh.get_agent_netaddr
List the network addresses (IP, netmask, broadcast) inventoried on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_network_address_info
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Filter by IP address.Default:
null.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string | null
Filter by network interface.Default:
null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Filter by IP protocol (
ipv4 or ipv6).Default: null.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get agent network interfaces
Action ID:tools.wazuh.get_agent_netiface
List the network interfaces (MAC, state, traffic counters) inventoried on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_network_interface_info
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.string | null
Filter by interface name.Default:
null.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by state (e.g.
up).Default: null.string | null
Filter by interface type.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get agent OS
Action ID:tools.wazuh.get_agent_os
Get the operating system details inventoried on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_os_info
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get agent packages
Action ID:tools.wazuh.get_agent_packages
List the software packages inventoried on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_packages_info
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Filter by architecture.Default:
null.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string | null
Filter by package format (e.g.
deb, rpm, win).Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.string | null
Filter by package name.Default:
null.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by vendor.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.string | null
Filter by package version.Default:
null.Get agent ports
Action ID:tools.wazuh.get_agent_ports
List the open ports and network connections inventoried on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_ports_info
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.string | null
Filter by local IP.Default:
null.string | null
Filter by local port.Default:
null.integer
First element to return in the collection.Default:
0.string | null
Filter by PID.Default:
null.string | null
Filter by process name.Default:
null.string | null
Filter by protocol (e.g.
tcp).Default: null.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Filter by remote IP.Default:
null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by state (e.g.
listening, established).Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get agent processes
Action ID:tools.wazuh.get_agent_processes
List the running processes inventoried on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_processes_info
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string | null
Filter by effective user.Default:
null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.string | null
Filter by process name.Default:
null.integer
First element to return in the collection.Default:
0.string | null
Filter by process PID.Default:
null.string | null
Filter by parent PID.Default:
null.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by process state.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get CDB list file
Action ID:tools.wazuh.get_cdb_list_file
Get the content of a CDB list file.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cdb_list_controller.get_file
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
CDB list file name (e.g.
malicious-ioc).string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If true, return the file as plain
key:value text instead of JSON.Default: false.boolean
If false, disables SSL verification for internal networks.Default:
true.Get FIM last scan
Action ID:tools.wazuh.get_syscheck_last_scan
Get when the last file integrity monitoring (syscheck) scan started and ended on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscheck_controller.get_last_scan_agent
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get rootcheck last scan
Action ID:tools.wazuh.get_rootcheck_last_scan
Get when the last rootcheck scan started and ended on an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rootcheck_controller.get_last_scan_agent
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Get rules file
Action ID:tools.wazuh.get_rules_file
Get the content of a rules file (e.g. local_rules.xml).
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rule_controller.get_file
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Rules file name (e.g.
local_rules.xml).string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If true, return the file as plain XML text instead of JSON.Default:
false.string | null
Relative directory of the file (e.g.
etc/rules).Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Ingest events
Action ID:tools.wazuh.ingest_events
Send security events to the Wazuh analysis engine. Limited to 100 events per request and 30 requests per minute.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.event_controller.forward_event
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string]
required
Events to ingest. Each event is a raw log line or a JSON string.
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.List agents
Action ID:tools.wazuh.list_agents
List Wazuh agents and filter them by ID, status, name, IP, group, OS, or version.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.get_agents
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string] | null
Agent IDs to return. All agents are returned if not specified.Default:
null.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string | null
Filter by agent group.Default:
null.string | null
Filter by the IP the agent uses to communicate with the manager.Default:
null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.string | null
Filter by agent name.Default:
null.integer
First element to return in the collection.Default:
0.string | null
Filter out agents whose last keep alive is more recent than this (e.g.
1h, 7d).Default: null.string | null
Filter by OS platform (e.g.
ubuntu, windows, darwin).Default: null.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.array[string] | null
Filter by agent status:
active, pending, never_connected, disconnected.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.string | null
Filter by agent version (e.g.
4.13.1).Default: null.List agents in group
Action ID:tools.wazuh.list_agents_in_group
List the agents that belong to a group.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.get_agents_in_group
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Group ID (name of the group).
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.array[string] | null
Filter by agent status:
active, pending, never_connected, disconnected.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.List CDB lists
Action ID:tools.wazuh.list_cdb_lists
List CDB lists (e.g. IP or hash blocklists referenced by rules) and their contents.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cdb_list_controller.get_lists
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.array[string] | null
Filter by CDB list file name.Default:
null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Filter by relative directory (e.g.
etc/lists).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.List decoders
Action ID:tools.wazuh.list_decoders
List log decoders filtered by name, file, or status.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.decoder_controller.get_decoders
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.array[string] | null
Decoder names to return.Default:
null.array[string] | null
Filter by decoder file name.Default:
null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by decoder status.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.List FIM findings
Action ID:tools.wazuh.list_syscheck_findings
List file integrity monitoring (syscheck) findings for an agent, filtered by path, type, or hash.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscheck_controller.get_syscheck_agent
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string | null
Filter by full file path.Default:
null.string | null
Filter by MD5, SHA1, or SHA256 hash.Default:
null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.boolean
If true, return a summary grouped by filename.Default:
false.string | null
Filter by entry type. Registry types are only available on Windows agents.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.List groups
Action ID:tools.wazuh.list_groups
List agent groups with their agent counts and configuration checksums.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.get_list_group
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.array[string] | null
Group IDs to return. All groups are returned if not specified.Default:
null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.List MITRE techniques
Action ID:tools.wazuh.list_mitre_techniques
List MITRE ATT&CK techniques from the Wazuh MITRE database.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.mitre_controller.get_techniques
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.array[string] | null
Wazuh MITRE technique IDs to return.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.List rootcheck findings
Action ID:tools.wazuh.list_rootcheck_findings
List rootcheck findings (rootkits, anomalies, policy checks) for an agent.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rootcheck_controller.get_rootcheck_agent
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string | null
Filter by CIS requirement.Default:
null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Filter by PCI DSS requirement.Default:
null.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by status.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.List rules
Action ID:tools.wazuh.list_rules
List detection rules filtered by ID, level, group, MITRE technique, compliance requirement, or file.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rule_controller.get_rules
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.array[string] | null
Filter by rule file name.Default:
null.string | null
Filter by rule group (e.g.
authentication_failed).Default: null.string | null
Filter by rule level, either a single level (
10) or a range (10-15).Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.string | null
Filter by MITRE ATT&CK technique ID (e.g.
T1110).Default: null.integer
First element to return in the collection.Default:
0.string | null
Filter by PCI DSS requirement.Default:
null.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.array[string] | null
Rule IDs to return.Default:
null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by rule status.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.List SCA policies
Action ID:tools.wazuh.list_sca_policies
List Security Configuration Assessment (SCA) policy results for an agent, including pass, fail, and score.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.sca_controller.get_sca_agent
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.string | null
Filter by policy name.Default:
null.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.List SCA policy checks
Action ID:tools.wazuh.list_sca_policy_checks
List the Security Configuration Assessment (SCA) checks of a policy on an agent, e.g. failed checks with remediation steps.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.sca_controller.get_sca_checks
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Agent ID (e.g.
001). Use 000 for the manager.string
required
SCA policy ID (e.g.
cis_ubuntu22-04).string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Filter by check result.Default:
null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by check title.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.List tasks
Action ID:tools.wazuh.list_tasks
List Wazuh tasks (e.g. agent upgrades) and their status.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.task_controller.get_tasks_status
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string] | null
Filter by agent IDs.Default:
null.string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string | null
Filter by command (e.g.
upgrade).Default: null.integer
Maximum number of elements to return (up to 100000; Wazuh recommends 500 or fewer).Default:
500.string | null
Filter by module (e.g.
upgrade_module).Default: null.integer
First element to return in the collection.Default:
0.string | null
Wazuh query to filter results by (e.g.
status=active;os.platform=ubuntu).Default: null.string | null
Look for elements containing the specified string. Prefix with
- for a complementary search.Default: null.array[string] | null
Fields to return. Use
. for nested fields (e.g. os.name).Default: null.string | null
Fields to sort by, comma separated. Prefix with
+ or - for ascending or descending order.Default: null.string | null
Filter by status (e.g.
In progress, Done, Failed).Default: null.array[string] | null
Filter by task IDs.Default:
null.boolean
If false, disables SSL verification for internal networks.Default:
true.Remove agents from group
Action ID:tools.wazuh.remove_agents_from_group
Remove agents from a group, e.g. release hosts from a containment group.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.delete_multiple_agent_single_group
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string]
required
Agent IDs to remove from the group.
string
required
Group ID (name of the group).
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Restart agents
Action ID:tools.wazuh.restart_agents
Restart one or more Wazuh agents, e.g. to apply new group configuration after a response action.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.restart_agents
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string]
required
Agent IDs to restart.
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Run command
Action ID:tools.wazuh.active_response
Run an Active Response command on Wazuh agents.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.active_response_controller.run_command
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string | null
required
List of agent IDs (separated by comma), all agents selected by default if not specified.
string
required
Command running in the agent. If this value starts with !, then it refers to a script name instead of a command name.
object
Alert context passed to the script, e.g.
{"data": {"srcip": "1.2.3.4"}} for !firewall-drop or {"data": {"dstuser": "alice"}} for !disable-account.Default: {}.array[string]
Extra arguments passed to the Active Response script.Default:
[].integer
Change the token base durationDefault:
900.string | null
URL for the Wazuh WUI API.Default:
null.boolean
If False, disables SSL verification for internal networks.Default:
true.Run FIM scan
Action ID:tools.wazuh.run_syscheck_scan
Run a file integrity monitoring (syscheck) scan on agents.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscheck_controller.put_syscheck
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string]
required
Agent IDs to scan.
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Run logtest
Action ID:tools.wazuh.run_logtest
Test a log event against the ruleset and decoders to see which decoder and rule it matches and whether it raises an alert.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.logtest_controller.run_logtest_tool
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Log event to test.
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.string
Log location (e.g.
/var/log/auth.log).Default: "tracecat".string
Log format (e.g.
syslog, json, eventchannel, audit, command).Default: "syslog".boolean
If false, disables SSL verification for internal networks.Default:
true.Run rootcheck scan
Action ID:tools.wazuh.run_rootcheck_scan
Run a rootcheck (rootkit and policy) scan on agents.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rootcheck_controller.put_rootcheck
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
array[string]
required
Agent IDs to scan.
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Search alerts
Action ID:tools.wazuh.search_alerts
Search Wazuh alerts in the Wazuh indexer by agent, rule, level, rule group, MITRE technique, IP address, time range, or free text. Results are sorted newest first.
Reference: https://documentation.wazuh.com/current/user-manual/wazuh-indexer/wazuh-indexer-api.html
Secrets
Required secrets:wazuh_indexer: required valuesWAZUH_INDEXER_USERNAME,WAZUH_INDEXER_PASSWORD.
Input fields
array[string] | null
Filter by agent IDs (
agent.id).Default: null.string | null
Wazuh indexer URL (e.g. https://wazuh-indexer:9200). Defaults to the
wazuh_indexer.base_url variable.Default: null.string | null
Filter by destination IP address (
data.dstip).Default: null.string | null
End of the time range, as ISO 8601 or date math (e.g.
now).Default: null.array[object] | null
Additional OpenSearch query DSL clauses added to the bool filter (e.g.
[{"term": {"agent.name": "web-01"}}]).Default: null.string
Alerts index pattern.Default:
"wazuh-alerts-*".integer | null
Minimum rule level (
rule.level), from 0 to 15.Default: null.array[string] | null
Filter by MITRE ATT&CK technique IDs (
rule.mitre.id, e.g. T1110).Default: null.string | null
Free text query in OpenSearch simple query string syntax (e.g.
sshd AND "Failed password").Default: null.array[string] | null
Filter by rule groups (
rule.groups). Matches alerts in any of the groups.Default: null.array[string] | null
Filter by rule IDs (
rule.id).Default: null.integer
Maximum number of alerts to return.Default:
100.string | null
Filter by source IP address (
data.srcip).Default: null.string | null
Start of the time range, as ISO 8601 or date math (e.g.
now-24h).Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Search vulnerabilities
Action ID:tools.wazuh.search_vulnerabilities
Search vulnerabilities detected on agents in the Wazuh indexer by agent, CVE, severity, package, or minimum CVSS score.
Reference: https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/index.html
Secrets
Required secrets:wazuh_indexer: required valuesWAZUH_INDEXER_USERNAME,WAZUH_INDEXER_PASSWORD.
Input fields
array[string] | null
Filter by agent IDs (
agent.id).Default: null.string | null
Wazuh indexer URL (e.g. https://wazuh-indexer:9200). Defaults to the
wazuh_indexer.base_url variable.Default: null.array[string] | null
Filter by CVE IDs (
vulnerability.id, e.g. CVE-2024-3094).Default: null.array[object] | null
Additional OpenSearch query DSL clauses added to the bool filter.Default:
null.string
Vulnerability states index pattern.Default:
"wazuh-states-vulnerabilities-*".number | null
Minimum CVSS base score (
vulnerability.score.base).Default: null.string | null
Filter by affected package name (
package.name).Default: null.array[string] | null
Filter by severity (
vulnerability.severity). One or more of Critical, High, Medium, Low.Default: null.integer
Maximum number of vulnerabilities to return.Default:
100.boolean
If false, disables SSL verification for internal networks.Default:
true.Summarize agents status
Action ID:tools.wazuh.get_agents_summary_status
Summarize agent connection status (active, disconnected, never connected, pending) and group sync status.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.get_agents_summary_status
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.Update agents
Action ID:tools.wazuh.update_agents
Identifies outdated Wazuh agents and updates them.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.put_upgrade_agents
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
integer
Change the token base durationDefault:
900.string | null
URL for the Wazuh WUI API.Default:
null.boolean
If False, disables SSL verification for internal networks.Default:
true.Update CDB list file
Action ID:tools.wazuh.update_cdb_list_file
Upload or replace a CDB list file (e.g. add IOCs to a blocklist used by rules). Content uses one key:value entry per line. The manager must be restarted for changes to take effect.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cdb_list_controller.put_file
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Full list content, one
key:value entry per line (e.g. 1.2.3.4:malicious).string
required
CDB list file name (e.g.
malicious-ioc).string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, fails when the file already exists.Default:
false.boolean
If false, disables SSL verification for internal networks.Default:
true.Update rules file
Action ID:tools.wazuh.update_rules_file
Upload or replace a custom rules file (in etc/rules). The manager must be restarted for changes to take effect.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rule_controller.put_file
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string
required
Full XML content of the rules file.
string
required
Rules file name (e.g.
local_rules.xml).string | null
Wazuh server API URL (e.g. https://wazuh-manager:55000). Defaults to the
wazuh.base_url variable.Default: null.boolean
If false, fails when the file already exists.Default:
false.string | null
Relative directory of the file (e.g.
etc/rules).Default: null.boolean
If false, disables SSL verification for internal networks.Default:
true.