Refactor agent retrieval in wazuh.py to get agent by hostname rather than agent id (#159)
taylor_socfortress committed
Feb 15, 2024 at 11:40 UTC
8fba867d74d644381cdd9e31830d524bda873b1b
1 file changed
+3
-3
backend/app/integrations/monitoring_alert/services/wazuh.py
+3
-3
@@ -6,7 +6,7 @@ from fastapi import HTTPException
6
from loguru import logger
7
from sqlalchemy.ext.asyncio import AsyncSession
8
9
-from app.agents.routes.agents import get_agent
9
+from app.agents.routes.agents import get_agent_by_hostname
10
from app.agents.schema.agents import AgentsResponse
11
from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
12
from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
@@ -420,7 +420,7 @@ async def create_and_update_alert_in_iris(
420
"""
421
logger.info("Alert does not exist in IRIS. Creating alert.")
422
alert_details = await create_alert_details(alert_details)
423
- agent_details = await get_agent(alert_details.agent_id, session)
423
+ agent_details = await get_agent_by_hostname(alert_details.agent_name, session)
424
ioc_payload = await build_ioc_payload(alert_details)
425
iris_alert_payload = await build_alert_payload(
426
alert_details=alert_details,
@@ -552,7 +552,7 @@ async def analyze_wazuh_alerts(
552
iris_alert_id,
553
)
554
alert_details = await create_alert_details(alert_details)
555
- agent_details = await get_agent(alert_details.agent_id, session)
555
+ agent_details = await get_agent_by_hostname(alert_details.agent_name, session)
556
asset_payload = await build_asset_payload(
557
agent_data=agent_details,
558
alert_details=alert_details,