XDR agent management
Wazuh agent installation was covered under the installation section as it is one of the first steps to be performed when a system is commissioned. Please refer to https://docs.siemonster.com/current/agent-installation for further details.
Agent life cycle
The agent has four different states it can be classified as:
Never connected
This state means the agent was registered but was never connected
Pending
Pending means that the agent has not completed the authentication cycle.
Active
Agent has been registered and is actively communicating with the manager service
Disconnected
Agent is not running, end point may be off or there may be connectivity issues.
Agents are never automatically removed. They have to be manually removed.
⚠️ NOTE: Even though agents are never automatically removed they may still be overwritten by a new registration that uses the same hostname. Care needs to be taken in cases where hostname duplication may be present.
Listing agents
To perform this activity, it is required that you connect to the shell of the primary Wazuh pod. Please see the Kubernetes section for administration and access of the cluster.
Connect to the central Wazuh pod
Type the following command and Press [ENTER]
BASH/var/ossec/bin/manage_agents -l
The above will produce a complete listing of all registered agents. Please note that bash command line operators like pipe ( | ) can be used to redirect the output to other cli tools like grep etc.
Removing agents
Removing agents by CLI
Using the “listing agents” section instructions, you can filter the output to get the agent id’s of the agent you wish to remove. To remove the agent simply run the following command with the example id of 002
/var/ossec/bin/manage_agents -r 002
The output will look like below
****************************************
* Wazuh v4.3.10 Agent manager. *
* The following options are available: *
****************************************
(A)dd an agent (A).
(E)xtract key for an agent (E).
(L)ist already added agents (L).
(R)emove an agent (R).
(Q)uit.
Choose your action: A,E,L,R or Q:
Available agents:
ID: 001, Name: new, IP: any
Provide the ID of the agent to be removed (or '\q' to quit): 002
Confirm deleting it?(y/n): y
Agent '002' removed.
manage_agents: Exiting.
Removing agents by API
In the Wazuh dashboard, you can Navigate to “>_ Tools” and then Click on “API Console”
Removing a single agent:
The following example can be used to delete sample agent id 004
DELETE agents?pretty=true&older_than=0s&agents_list=004&status=all
Removing multiple agents:
The following example can be used to delete sample agent id’s 004 to 006
DELETE agents?pretty=true&older_than=0s&agents_list=004,005,006&status=all
The above allows for faster removal of large numbers of agents
Removing disconnected agents:
DELETE agents?pretty=true&older_than=21d&agents_list=all&status=never_connected,disconnected