wazuh icon indicating copy to clipboard operation
wazuh copied to clipboard

Add analysis to list of sockets using JSON communication protocol in framework

Open mcarmona99 opened this issue 2 years ago • 0 comments

Related issue
https://github.com/wazuh/wazuh/issues/13929

Description

This PR closes https://github.com/wazuh/wazuh/issues/13929

In this pull request, I have added the analysis socket to the list used to indicate the sockets using the JSON protocol, in the get_active_configuration function of core/configuration.py. With this change, all the endpoints in charge of getting the agents or managers' active configurations work properly.

There is no need to add a changelog entry as the behavior/responses do not change. The only thing that changes is the way the framework communicates with the socket in the case of analysisd.

API responses before the changes:

GET /agents/000/config/analysis/global

{
  "title": "Bad Request",
  "detail": "Requested component configuration does not exist: analysis:global",
  "remediation": "Please, visit the official documentation (https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_config) to check available component configurations",
  "dapi_errors": {
    "master-node": {
      "error": "Requested component configuration does not exist: analysis:global"
    }
  },
  "error": 1116
}

API responses after the changes:

GET /agents/000/config/analysis/global

{
  "data": {
    "global": {
      "email_notification": "no",
      "logall": "no",
      "logall_json": "no",
      "integrity_checking": 8,
      "rootkit_detection": 8,
      "host_information": 8,
      "prelude_output": "no",
      "zeromq_output": "no",
      "jsonout_output": "yes",
      "alerts_log": "yes",
      "stats": 4,
      "memory_size": 8192,
      "white_list": [
        "127.0.0.1",
        "8.8.8.8",
        "8.8.4.4",
        "localhost.localdomain"
      ],
      "rotate_interval": 0,
      "max_output_size": 0
    }
  },
  "error": 0
}

GET /cluster/master-node/configuration/analysis/global

{
  "data": {
    "affected_items": [
      {
        "global": {
          "email_notification": "no",
          "logall": "no",
          "logall_json": "no",
          "integrity_checking": 8,
          "rootkit_detection": 8,
          "host_information": 8,
          "prelude_output": "no",
          "zeromq_output": "no",
          "jsonout_output": "yes",
          "alerts_log": "yes",
          "stats": 4,
          "memory_size": 8192,
          "white_list": [
            "127.0.0.1",
            "8.8.8.8",
            "8.8.4.4",
            "localhost.localdomain"
          ],
          "rotate_interval": 0,
          "max_output_size": 0
        }
      }
    ],
    "total_affected_items": 1,
    "total_failed_items": 0,
    "failed_items": []
  },
  "message": "Active configuration was successfully read in specified node",
  "error": 0
}

GET /cluster/master-node/configuration/analysis/active_response

{
  "data": {
    "affected_items": [
      {
        "active-response": []
      }
    ],
    "total_affected_items": 1,
    "total_failed_items": 0,
    "failed_items": []
  },
  "message": "Active configuration was successfully read in specified node",
  "error": 0
}

GET /cluster/worker1/configuration/analysis/alerts

{
  "data": {
    "affected_items": [
      {
        "alerts": {
          "email_alert_level": 12,
          "log_alert_level": 3
        }
      }
    ],
    "total_affected_items": 1,
    "total_failed_items": 0,
    "failed_items": []
  },
  "message": "Active configuration was successfully read in specified node",
  "error": 0
}

GET /manager/configuration/analysis/command

{
  "data": {
    "affected_items": [
      {
        "command": [
          {
            "name": "disable-account",
            "executable": "disable-account",
            "timeout_allowed": 1
          },
          {
            "name": "restart-wazuh",
            "executable": "restart-wazuh",
            "timeout_allowed": 0
          },
          {
            "name": "firewall-drop",
            "executable": "firewall-drop",
            "timeout_allowed": 1
          },
          {
            "name": "host-deny",
            "executable": "host-deny",
            "timeout_allowed": 1
          },
          {
            "name": "route-null",
            "executable": "route-null",
            "timeout_allowed": 1
          },
          {
            "name": "win_route-null",
            "executable": "route-null.exe",
            "timeout_allowed": 1
          },
          {
            "name": "netsh",
            "executable": "netsh.exe",
            "timeout_allowed": 1
          }
        ]
      }
    ],
    "total_affected_items": 1,
    "total_failed_items": 0,
    "failed_items": []
  },
  "message": "Active configuration was successfully read in specified node",
  "error": 0
}

GET /manager/configuration/analysis/internal

{
  "data": {
    "affected_items": [
      {
        "internal": {
          "analysisd": {
            "debug": 0,
            "default_timeframe": 360,
            "stats_maxdiff": 999000,
            "stats_mindiff": 1250,
            "stats_percent_diff": 150,
            "fts_list_size": 32,
            "fts_min_size_for_str": 14,
            "log_fw": 1,
            "decoder_order_size": 256,
            "label_cache_maxage": 10,
            "show_hidden_labels": 0,
            "rlimit_nofile": 458752,
            "min_rotate_interval": 600
          }
        }
      }
    ],
    "total_affected_items": 1,
    "total_failed_items": 0,
    "failed_items": []
  },
  "message": "Active configuration was successfully read in specified node",
  "error": 0
}

mcarmona99 avatar Aug 02 '22 10:08 mcarmona99