wazuh icon indicating copy to clipboard operation
wazuh copied to clipboard

SPIKE - Initial `Agent comms API` server design

Open Selutario opened this issue 9 months ago • 0 comments

Epic
#22677

Description

We want to, as part of #22677, replace the current wazuh-remoted and wazuh-agentd services. Instead, we intend to develop a service that uses a standard protocol such as HTTP and event-driven communication, where each event can be forwarded to any of the Wazuh servers, unlike the current session-oriented approach where an agent sends all its messages to the server where it is connected.

However, we will also need to maintain a session-oriented connection so that the server can send things to the agents on demand. Some proposals for this other mode of communication could include the use of websockets or gRPC.

We will need to develop two new services (or a dual service) that includes:

  • A new API server that responds to each of the events sent by agents (the connection would be closed after said response)
  • A new server to send things to agents on demand through the open session.

This issue is aimed at working on the following aspects:

  • Investigation of available/candidate and most suitable technologies: websockets, gRPC, etc.
  • Library research: Starlette, FastAPI, Connection, etc, etc.
  • Initial server design that meets the requirements listed in #22677.

[!NOTE] We must collaborate with the Agent team to align on communication protocols and API integration.

Selutario avatar May 14 '24 09:05 Selutario