Wazuh 4.8 upgrade (#249)
* feat: Add Wazuh Manager version check for agent vulnerabilities The code changes in this commit add a Wazuh Manager version check for agent vulnerabilities. The `get_wazuh_manager_version` function fetches the version of the Wazuh Manager, and the `check_wazuh_manager_version` function checks if the version is 4.8.0 or higher. This check is used in the `get_agent_vulnerabilities` function to determine whether to collect vulnerabilities using the new method or the old method. * precommit fixes
taylor_socfortress committed
Jun 21, 2024 at 13:29 UTC
34b04777a9a9a1808923b6acd5b7a7988c800ca6
2 files changed
+55
-2
backend/app/agents/routes/agents.py
+42
-2
@@ -6,6 +6,7 @@ from fastapi import Depends
6
from fastapi import HTTPException
7
from fastapi import Security
8
from loguru import logger
9
+from packaging import version
10
from sqlalchemy import delete
11
from sqlalchemy.ext.asyncio import AsyncSession
12
from sqlalchemy.future import select
@@ -30,16 +31,53 @@ from app.agents.wazuh.services.agents import upgrade_wazuh_agent
31
from app.agents.wazuh.services.sca import collect_agent_sca
32
from app.agents.wazuh.services.sca import collect_agent_sca_policy_results
33
from app.agents.wazuh.services.vulnerabilities import collect_agent_vulnerabilities
34
+from app.agents.wazuh.services.vulnerabilities import collect_agent_vulnerabilities_new
35
36
# App specific imports
37
from app.auth.routes.auth import AuthHandler
38
+from app.connectors.wazuh_manager.utils.universal import send_get_request
39
from app.db.db_session import get_db
40
41
# App specific imports
42
# from app.db.db_session import session
43
from app.db.universal_models import Agents
44
42
-# from app.agents.wazuh.services.vulnerabilities import collect_agent_vulnerabilities_new
45
+
46
+async def get_wazuh_manager_version() -> str:
47
+ """
48
+ Fetches the version of the Wazuh Manager.
49
+
50
+ Returns:
51
+ str: The version of the Wazuh Manager.
52
+
53
+ Raises:
54
+ HTTPException: If there is an error fetching the version of the Wazuh Manager.
55
+ """
56
+ try:
57
+ response = await send_get_request(endpoint="/")
58
+ logger.info(f"Fetched Wazuh Manager version: {response}")
59
+ return response["data"]["data"]["api_version"]
60
+ except Exception as e:
61
+ logger.error(f"Failed to fetch Wazuh Manager version: {e}")
62
+ raise HTTPException(
63
+ status_code=500,
64
+ detail=f"Failed to fetch Wazuh Manager version: {e}",
65
+ )
66
+
67
+
68
+async def check_wazuh_manager_version() -> bool:
69
+ """
70
+ Checks the version of the Wazuh Manager.
71
+
72
+ Returns:
73
+ bool: True if the version of the Wazuh Manager is 4.8.0 or higher, False otherwise.
74
+ """
75
+ try:
76
+ wazuh_manager_version = await get_wazuh_manager_version()
77
+ return version.parse(wazuh_manager_version) >= version.parse("4.8.0")
78
+ except Exception as e:
79
+ logger.error(f"Failed to check Wazuh Manager version: {e}")
80
+ return False
81
82
83
agents_router = APIRouter()
@@ -410,8 +448,10 @@ async def get_agent_vulnerabilities(agent_id: str) -> WazuhAgentVulnerabilitiesR
448
WazuhAgentVulnerabilitiesResponse: The response containing the agent vulnerabilities.
449
"""
450
logger.info(f"Fetching agent {agent_id} vulnerabilities")
451
+ wazuh_new = await check_wazuh_manager_version()
452
+ if wazuh_new is True:
453
+ return await collect_agent_vulnerabilities_new(agent_id)
454
return await collect_agent_vulnerabilities(agent_id)
414
- # return await collect_agent_vulnerabilities_new(agent_id)
455
456
457
@agents_router.get(
backend/app/agents/wazuh/services/vulnerabilities.py
+13
@@ -13,6 +13,7 @@ from app.connectors.wazuh_manager.utils.universal import send_get_request
13
async def collect_agent_vulnerabilities(agent_id: str):
14
"""
15
Collect agent vulnerabilities from Wazuh Manager.
16
+ Used when Wazuh Manager is below 4.8.0
17
18
Args:
19
agent_id (str): The ID of the agent.
@@ -28,6 +29,7 @@ async def collect_agent_vulnerabilities(agent_id: str):
29
endpoint=f"/vulnerability/{agent_id}",
30
)
31
if agent_vulnerabilities["success"] is False:
32
+ return None
33
raise HTTPException(status_code=500, detail=agent_vulnerabilities["message"])
34
35
processed_vulnerabilities = process_agent_vulnerabilities(
@@ -69,6 +71,17 @@ def process_agent_vulnerabilities(
71
72
73
async def collect_agent_vulnerabilities_new(agent_id: str):
74
+ """
75
+ Collects vulnerabilities for a specific agent from the Wazuh Indexer Index.
76
+ Used when Wazuh-Manager is 4.8.0 or above.
77
+
78
+ Args:
79
+ agent_id (str): The ID of the agent for which to collect vulnerabilities.
80
+
81
+ Returns:
82
+ WazuhAgentVulnerabilitiesResponse: An object containing the collected vulnerabilities,
83
+ along with a success flag and a message indicating the success status.
84
+ """
85
logger.info(f"Collecting agent {agent_id} vulnerabilities from Wazuh Indexer Index")
86
es = await create_wazuh_indexer_client("Wazuh-Indexer")
87
indices = await collect_indices(all_indices=True)