Run command
Action ID:tools.wazuh.active_response
Run an Active Response command on Wazuh agents.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.active_response_controller.run_command
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
string | null
required
List of agent IDs (separated by comma), all agents selected by default if not specified.
string
required
Command running in the agent. If this value starts with !, then it refers to a script name instead of a command name.
integer
Change the token base durationDefault:
900.string | null
URL for the Wazuh WUI API.Default:
null.boolean
If False, disables SSL verification for internal networks.Default:
true.Update agents
Action ID:tools.wazuh.update_agents
Identifies outdated Wazuh agents and updates them.
Reference: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.put_upgrade_agents
Secrets
Required secrets:wazuh_wui: required valuesWAZUH_WUI_USERNAME,WAZUH_WUI_PASSWORD.
Input fields
integer
Change the token base durationDefault:
900.string | null
URL for the Wazuh WUI API.Default:
null.boolean
If False, disables SSL verification for internal networks.Default:
true.