wazuh

package module
v0.0.0-...-0bbb64c Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 4, 2021 License: Apache-2.0 Imports: 15 Imported by: 0

README

Wazuh API in Go

Build Status


Wazuh REST API library

https://documentation.wazuh.com/current/user-manual/api/reference.html

Install

$ go get -u github.com/AtlasInsideCorp/UTMStackCloudWazuhApi

Usage

package main

import (
	"flag"
	"fmt"
	"os"

	"github.com/AtlasInsideCorp/UTMStackCloudWazuhApi"
)

func main() {
	flag.Parse()
	args := flag.Args()

	endpoint := args[0]
	user := args[1]
	pass := args[2]

	client, err := wazuh.New(endpoint, wazuh.WithBasicAuth(user, pass))

	agents, err := client.GetAllAgents()
	if err != nil {
		fmt.Println(err)
		os.Exit(1)
	}
	fmt.Printf("%-20v%-20v\n", "ID", "NAME")
	for _, agent := range *agents {
		if agent.Status == "Active" {
			fmt.Printf("%-20v%-20v\n", agent.ID, agent.Name)
		}
	}
}

see example

Contributing

You are more than welcome to contribute to this project.
Fork and make a Pull Request, or create an Issue if you see any problem.

Documentation

Index

Examples

Constants

This section is empty.

Variables

This section is empty.

Functions

func ClearSyscheckDatabaseRequest

func ClearSyscheckDatabaseRequest(ctx context.Context, client *Client, path string) (*ClearSyscheckDatabaseResponse, error)

func DoDelete

func DoDelete(ctx context.Context, client *Client, path string, intf interface{}) error

func DoGet

func DoGet(ctx context.Context, client httpClient, req *http.Request, intf interface{}) error

func DoPost

func DoPost(ctx context.Context, client httpClient, req *http.Request, intf interface{}) error

func DoPut

func DoPut(ctx context.Context, client httpClient, req *http.Request, intf interface{}) error

func GetAllDecodersRequest

func GetAllDecodersRequest(ctx context.Context, client *Client, path string) (*GetDecodersResponse, error)

func GetAnalysisdStatsRequest

func GetAnalysisdStatsRequest(ctx context.Context, client *Client, path string) (*GetAnalysisdStatsResponse, error)

func GetDecoderByNameRequest

func GetDecoderByNameRequest(ctx context.Context, client *Client, path string) (*GetDecodersResponse, error)

func GetDecoderFilesRequest

func GetDecoderFilesRequest(ctx context.Context, client *Client, path string) (*GetDecoderFilesResponse, error)

func GetHardwareInfoRequest

func GetHardwareInfoRequest(ctx context.Context, client *Client, path string) (*GetHardwareInfoResponse, error)

func GetJson

func GetJson(ctx context.Context, client *Client, path string, intf interface{}) error

func GetLastSyscheckScanRequest

func GetLastSyscheckScanRequest(ctx context.Context, client *Client, path string) (*GetLastSyscheckScanResponse, error)

func GetLogSummaryRequest

func GetLogSummaryRequest(ctx context.Context, client *Client, path string) (*GetLogSummaryResponse, error)

func GetLogsRequest

func GetLogsRequest(ctx context.Context, client *Client, path string) (*GetLogsResponse, error)

func GetManagerConfigurationRequest

func GetManagerConfigurationRequest(ctx context.Context, client *Client, path string) (*GetManagerConfigurationResponse, error)

func GetManagerInformationRequest

func GetManagerInformationRequest(ctx context.Context, client *Client, path string) (*GetManagerInformationResponse, error)

func GetManagerStatsRequest

func GetManagerStatsRequest(ctx context.Context, client *Client, path string) (*GetManagerStatsResponse, error)

func GetManagerStatusRequest

func GetManagerStatusRequest(ctx context.Context, client *Client, path string) (*GetManagerStatusResponse, error)

func GetNetworkAddrInfoRequest

func GetNetworkAddrInfoRequest(ctx context.Context, client *Client, path string) (*GetNetworkAddrInfoResponse, error)

func GetNetworkInterfaceInfoRequest

func GetNetworkInterfaceInfoRequest(ctx context.Context, client *Client, path string) (*GetNetworkInterfaceInfoResponse, error)

func GetNetworkProtocolInfoRequest

func GetNetworkProtocolInfoRequest(ctx context.Context, client *Client, path string) (*GetNetworkProtocolInfoResponse, error)

func GetOSInfoRequest

func GetOSInfoRequest(ctx context.Context, client *Client, path string) (*GetOSInfoResponse, error)

func GetPackagesInfoRequest

func GetPackagesInfoRequest(ctx context.Context, client *Client, path string) (*GetPackagesInfoResponse, error)

func GetParentDecodersRequest

func GetParentDecodersRequest(ctx context.Context, client *Client, path string) (*GetDecodersResponse, error)

func GetPortsInfoRequest

func GetPortsInfoRequest(ctx context.Context, client *Client, path string) (*GetPortsInfoResponse, error)

func GetProcessesInfoRequest

func GetProcessesInfoRequest(ctx context.Context, client *Client, path string) (*GetProcessesInfoResponse, error)

func GetRemotedStatsRequest

func GetRemotedStatsRequest(ctx context.Context, client *Client, path string) (*GetRemotedStatsResponse, error)

func GetRequest

func GetRequest(ctx context.Context, client *Client, path string) (*Response, error)

func GetRuleFilesRequest

func GetRuleFilesRequest(ctx context.Context, client *Client, path string) (*GetRuleFilesResponse, error)

func GetRulesRequest

func GetRulesRequest(ctx context.Context, client *Client, path string) (*GetRulesResponse, error)

func GetScaChecksRequest

func GetScaChecksRequest(ctx context.Context, client *Client, path string) (*GetScaChecksResponse, error)

func GetScaRequest

func GetScaRequest(ctx context.Context, client *Client, path string) (*GetScaResponse, error)

func GetStatsByHourRequest

func GetStatsByHourRequest(ctx context.Context, client *Client, path string) (*GetStatsByHourResponse, error)

func GetSyscheckFilesRequest

func GetSyscheckFilesRequest(ctx context.Context, client *Client, path string) (*GetSyscheckFilesResponse, error)

func GetWeeklyStatsRequest

func GetWeeklyStatsRequest(ctx context.Context, client *Client, path string) (*GetWeeklyStatsResponse, error)

func ParseResponseBody

func ParseResponseBody(body io.ReadCloser, intf interface{}) error

func PostJson

func PostJson(ctx context.Context, client *Client, path string, json []byte, intf interface{}) error

func PutJson

func PutJson(ctx context.Context, client *Client, path string, json []byte, intf interface{}) error

func RunSyscheckAgentRequest

func RunSyscheckAgentRequest(ctx context.Context, client *Client, path string) (*RunSyscheckAgentResponse, error)

func RunSyscheckAllAgentsRequest

func RunSyscheckAllAgentsRequest(ctx context.Context, client *Client, path string) (*RunSyscheckAllAgentsResponse, error)

Types

type AgentInformation

type AgentInformation struct {
	Status        string   `json:"status"`
	Name          string   `json:"name"`
	IP            string   `json:"ip"`
	Manager       string   `json:"manager"`
	NodeName      string   `json:"node_name"`
	DateAdd       string   `json:"dateAdd"`
	Version       string   `json:"version"`
	LastKeepAlive string   `json:"lastKeepAlive"`
	Os            Os       `json:"os"`
	ID            string   `json:"id"`
	ConfigSum     string   `json:"configSum,omitempty"`
	Group         []string `json:"group,omitempty"`
	MergedSum     string   `json:"mergedSum,omitempty"`
}

type AgentInformationData

type AgentInformationData struct {
	TotalItems int                `json:"totalItems"`
	Items      []AgentInformation `json:"items"`
}

type AgentRestartData

type AgentRestartData struct {
	Msg            string   `json:"msg"`
	AffectedAgents []string `json:"affectedAgents"`
}

type AgentRestartResponse

type AgentRestartResponse struct {
	Error int              `json:"error"`
	Data  AgentRestartData `json:"data"`
}

func RestartAgentRequest

func RestartAgentRequest(ctx context.Context, client *Client, path string) (*AgentRestartResponse, error)

type Client

type Client struct {
	Options ClientOptions
	// contains filtered or unexported fields
}

func New

func New(endpoint string, options ...ClientOption) (*Client, error)
Example
wazuh.New("https://wazuh.localhost:55000/")
Output:

Example (WithBasicAuth)
wazuh.New("https://wazuh.localhost:55000/", wazuh.WithBasicAuth("username", "password"))
Output:

Example (WithClientCertificate)
var cert, key []byte
wazuh.New("https://wazuh.localhost:55000/", wazuh.WithClientCertificate(cert, key))
Output:

Example (WithClientCertificateFromFile)
wazuh.New("https://wazuh.localhost:55000/", wazuh.WithClientCertificateFromFile("/path/to/certificate.cert", "/path/to/private.key"))
Output:

func (*Client) ClearSyscheckDatabase

func (client *Client) ClearSyscheckDatabase(agentId string) (*string, error)

Clear syscheck database of an agent Clears the syscheck database for the specified agent. https://documentation.wazuh.com/3.x/user-manual/api/reference.html#id20

func (*Client) ClearSyscheckDatabaseContext

func (client *Client) ClearSyscheckDatabaseContext(ctx context.Context, agentId string) (*string, error)

func (*Client) GetAgentsByGroup

func (client *Client) GetAgentsByGroup(groupId string) (*[]AgentInformation, error)

func (*Client) GetAgentsByGroupContext

func (client *Client) GetAgentsByGroupContext(ctx context.Context, groupId string) (*[]AgentInformation, error)

func (*Client) GetAllAgentsContext

func (client *Client) GetAllAgentsContext(ctx context.Context) (*[]AgentInformation, error)

func (*Client) GetAllDecodersContext

func (client *Client) GetAllDecodersContext(ctx context.Context) (*[]Decoder, error)

func (*Client) GetAllRulesContext

func (client *Client) GetAllRulesContext(ctx context.Context) (*[]Rules, error)

func (*Client) GetAnAgentContext

func (client *Client) GetAnAgentContext(ctx context.Context, agentID string) (*AgentInformation, error)

func (*Client) GetAnalysisdStatsContext

func (client *Client) GetAnalysisdStatsContext(ctx context.Context) (*AnalysisdStats, error)

func (*Client) GetDecoderByNameContext

func (client *Client) GetDecoderByNameContext(ctx context.Context, name string) (*[]Decoder, error)

func (*Client) GetDecoderFilesContext

func (client *Client) GetDecoderFilesContext(ctx context.Context) (*[]DecoderFiles, error)

func (*Client) GetGdprRulesContext

func (client *Client) GetGdprRulesContext(ctx context.Context) (*[]string, error)

func (*Client) GetGroupsContext

func (client *Client) GetGroupsContext(ctx context.Context) (*[]Group, error)

func (*Client) GetHardwareInfo

func (client *Client) GetHardwareInfo(agentID string) (*HardwareInfo, error)

https://documentation.wazuh.com/current/user-manual/api/reference.html#id18

func (*Client) GetHardwareInfoContext

func (client *Client) GetHardwareInfoContext(ctx context.Context, agentID string) (*HardwareInfo, error)

func (*Client) GetLastSyscheckScan

func (client *Client) GetLastSyscheckScan(agentId string) (*LastSyscheckScan, error)

Get last syscheck scan Return the timestamp of the last syscheck scan. https://documentation.wazuh.com/3.x/user-manual/api/reference.html#get-last-syscheck-scan

func (*Client) GetLastSyscheckScanContext

func (client *Client) GetLastSyscheckScanContext(ctx context.Context, agentId string) (*LastSyscheckScan, error)

func (*Client) GetLogSummaryContext

func (client *Client) GetLogSummaryContext(ctx context.Context) (*LogSummary, error)

func (*Client) GetLogsContext

func (client *Client) GetLogsContext(ctx context.Context) (*[]Log, error)

func (*Client) GetManagerConfigurationContext

func (client *Client) GetManagerConfigurationContext(ctx context.Context) (*ManagerConfiguration, error)

func (*Client) GetManagerInformationContext

func (client *Client) GetManagerInformationContext(ctx context.Context) (*ManagerInformation, error)

func (*Client) GetManagerStatsContext

func (client *Client) GetManagerStatsContext(ctx context.Context) (*[]ManagerStats, error)

func (*Client) GetManagerStatusContext

func (client *Client) GetManagerStatusContext(ctx context.Context) (*ManagerStatus, error)

func (*Client) GetNetworkAddrInfoContext

func (client *Client) GetNetworkAddrInfoContext(ctx context.Context, agentID string) (*[]NetworkAddrInfo, error)

func (*Client) GetNetworkInterfaceInfoContext

func (client *Client) GetNetworkInterfaceInfoContext(ctx context.Context, agentID string) (*[]NetworkInterfaceInfo, error)

func (*Client) GetNetworkProtocolInfoContext

func (client *Client) GetNetworkProtocolInfoContext(ctx context.Context, agentID string) (*[]NetworkProtocolInfo, error)

func (*Client) GetOSInfoContext

func (client *Client) GetOSInfoContext(ctx context.Context, agentID string) (*OSInfo, error)

func (*Client) GetPackagesInfoContext

func (client *Client) GetPackagesInfoContext(ctx context.Context, agentID string) (*[]PackagesInfo, error)

func (*Client) GetParentDecodersContext

func (client *Client) GetParentDecodersContext(ctx context.Context) (*[]Decoder, error)

func (*Client) GetPortsInfoContext

func (client *Client) GetPortsInfoContext(ctx context.Context, agentID string) (*[]PortsInfo, error)

func (*Client) GetProcessesInfo

func (client *Client) GetProcessesInfo(agentID string) (*[]ProcessesInfo, error)

https://documentation.wazuh.com/current/user-manual/api/reference.html#get-processes-info

func (*Client) GetProcessesInfoContext

func (client *Client) GetProcessesInfoContext(ctx context.Context, agentID string) (*[]ProcessesInfo, error)

func (*Client) GetRemotedStatsContext

func (client *Client) GetRemotedStatsContext(ctx context.Context) (*RemotedStats, error)

func (*Client) GetRuleFilesContext

func (client *Client) GetRuleFilesContext(ctx context.Context) (*[]RuleFiles, error)

func (*Client) GetRuleGroupsContext

func (client *Client) GetRuleGroupsContext(ctx context.Context) (*[]string, error)

func (*Client) GetRulePCIContext

func (client *Client) GetRulePCIContext(ctx context.Context) (*[]string, error)

func (*Client) GetRulesByIdContext

func (client *Client) GetRulesByIdContext(ctx context.Context, ruleId string) (*[]Rules, error)

func (*Client) GetSca

func (client *Client) GetSca(agentId string) (*[]Sca, error)

Get security configuration assessment (SCA) database Returns the sca database of an agent. https://documentation.wazuh.com/3.x/user-manual/api/reference.html#get-security-configuration-assessment-sca-database

func (*Client) GetScaChecks

func (client *Client) GetScaChecks(agentId, Id string) (*[]ScaCheck, error)

Get security configuration assessment (SCA) checks database Returns the sca checks of an agent https://documentation.wazuh.com/3.x/user-manual/api/reference.html#id19

func (*Client) GetScaChecksContext

func (client *Client) GetScaChecksContext(ctx context.Context, agentId, Id string) (*[]ScaCheck, error)

func (*Client) GetScaContext

func (client *Client) GetScaContext(ctx context.Context, agentId string) (*[]Sca, error)

func (*Client) GetStatsByHour

func (client *Client) GetStatsByHour() (*StatsByHour, error)

func (*Client) GetStatsByHourContext

func (client *Client) GetStatsByHourContext(ctx context.Context) (*StatsByHour, error)

func (*Client) GetSyscheckFiles

func (client *Client) GetSyscheckFiles(agentId string) (*[]SyscheckFiles, error)

Get syscheck files Returns the syscheck files of an agent. https://documentation.wazuh.com/3.x/user-manual/api/reference.html#get-syscheck-files

func (*Client) GetSyscheckFilesContext

func (client *Client) GetSyscheckFilesContext(ctx context.Context, agentId string) (*[]SyscheckFiles, error)

func (*Client) GetWeeklyStatsContext

func (client *Client) GetWeeklyStatsContext(ctx context.Context) (*WeeklyStats, error)

func (*Client) RestartAgent

func (client *Client) RestartAgent(agentId string) (*AgentRestartData, error)

func (*Client) RestartAgentContext

func (client *Client) RestartAgentContext(ctx context.Context, agentId string) (*AgentRestartData, error)

func (*Client) RunSyscheckAgent

func (client *Client) RunSyscheckAgent(agentId string) (*string, error)

Run syscheck scan in an agent Runs syscheck and rootcheck on an agent (Wazuh launches both processes simultaneously). https://documentation.wazuh.com/3.x/user-manual/api/reference.html#run-syscheck-scan-in-an-agent

func (*Client) RunSyscheckAgentContext

func (client *Client) RunSyscheckAgentContext(ctx context.Context, agentId string) (*string, error)

func (*Client) RunSyscheckAllAgents

func (client *Client) RunSyscheckAllAgents() (*string, error)

Run sys check scan in all agents Runs syscheck and rootcheck on all agents (Wazuh launches both processes simultaneously). https://documentation.wazuh.com/3.x/user-manual/api/reference.html#id22

func (*Client) RunSyscheckAllAgentsContext

func (client *Client) RunSyscheckAllAgentsContext(ctx context.Context) (*string, error)

type ClientOption

type ClientOption func(*ClientOptions)

func WithBasicAuth

func WithBasicAuth(username, password string) ClientOption

func WithClientCertificate

func WithClientCertificate(certPEMBlock, keyPEMBlock []byte) ClientOption

func WithClientCertificateFromFile

func WithClientCertificateFromFile(cert string, key string) ClientOption

If you are doing client certificate authentication, use it

type ClientOptions

type ClientOptions struct {
	Endpoint url.URL

	BasicUser string
	BasicPass string
	Raw       string
	// contains filtered or unexported fields
}

type GetAllAgentsResponse

type GetAllAgentsResponse struct {
	Error int                  `json:"error"`
	Data  AgentInformationData `json:"data"`
}

func GetAgentsByGroupRequest

func GetAgentsByGroupRequest(ctx context.Context, client *Client, path string) (*GetAllAgentsResponse, error)

func GetAllAgentsRequest

func GetAllAgentsRequest(ctx context.Context, client *Client, path string) (*GetAllAgentsResponse, error)

type GetAnAgentResponse

type GetAnAgentResponse struct {
	Error int              `json:"error"`
	Data  AgentInformation `json::"data"`
}

func GetAnAgentRequest

func GetAnAgentRequest(ctx context.Context, client *Client, path string) (*GetAnAgentResponse, error)

type GetGroupsResponse

type GetGroupsResponse struct {
	Error int       `json:"error"`
	Data  GroupData `json:"data"`
}

func GetGroupsRequest

func GetGroupsRequest(ctx context.Context, client *Client, path string) (*GetGroupsResponse, error)

type Group

type Group struct {
	Count     int    `json:"count"`
	MergedSum string `json:"mergedSum"`
	ConfigSum string `json:"configSum"`
	Name      string `json:"name"`
}

type GroupData

type GroupData struct {
	TotalItems int     `json:"totalItems"`
	Items      []Group `json:"items"`
}

type Os

type Os struct {
	Major    string `json:"major"`
	Name     string `json:"name"`
	Uname    string `json:"uname"`
	Platform string `json:"platform"`
	Version  string `json:"version"`
	Codename string `json:"codename"`
	Arch     string `json:"arch"`
	Minor    string `json:"minor"`
}

Directories

Path Synopsis
sca
example
sca

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL