added agent versions for wazuh and velo (#40)
* added agent versions for wazuh and velo * precommit
taylor_socfortress committed
Jul 17, 2023 at 10:32 UTC
90fa126f87e5e354719be7cd205772a7518ff482
4 files changed
+65
-11
backend/app/models/agents.py
+8
@@ -26,6 +26,8 @@ class AgentMetadata(db.Model):
26
last_seen: Column[DateTime] = db.Column(db.DateTime)
27
client_id: Column[String] = db.Column(db.String(100))
28
client_last_seen: Column[DateTime] = db.Column(db.DateTime)
29
+ wazuh_agent_version: Column[String] = db.Column(db.String(100))
30
+ velociraptor_client_version: Column[String] = db.Column(db.String(100))
31
32
def __init__(
33
self,
@@ -37,6 +39,8 @@ class AgentMetadata(db.Model):
39
last_seen: datetime,
40
client_id: str,
41
client_last_seen: datetime,
42
+ wazuh_agent_version: str,
43
+ velociraptor_client_version: str,
44
):
45
"""
46
Initialize a new instance of the AgentMetadata class.
@@ -58,6 +62,8 @@ class AgentMetadata(db.Model):
62
self.last_seen = last_seen
63
self.client_id = client_id
64
self.client_last_seen = client_last_seen
65
+ self.wazuh_agent_version = wazuh_agent_version
66
+ self.velociraptor_client_version = velociraptor_client_version
67
68
def __repr__(self) -> str:
69
"""
@@ -109,6 +115,8 @@ class AgentMetadataSchema(ma.Schema):
115
"last_seen",
116
"client_id",
117
"client_last_seen",
118
+ "wazuh_agent_version",
119
+ "velociraptor_client_version",
120
)
121
122
backend/app/services/Velociraptor/universal.py
+12
-8
@@ -3,17 +3,9 @@ from datetime import datetime
3
4
import grpc
5
import pyvelociraptor
6
-
7
-# import requests
8
-# from elasticsearch7 import Elasticsearch
9
-# from loguru import logger
6
from pyvelociraptor import api_pb2
7
from pyvelociraptor import api_pb2_grpc
8
13
-# from app import db
14
-# from app.models.agents import AgentMetadata
15
-# from app.models.agents import agent_metadata_schema
16
-# from app.models.agents import agent_metadatas_schema
9
from app.models.connectors import Connector
10
from app.models.connectors import connector_factory
11
@@ -207,6 +199,18 @@ class UniversalService:
199
"""
200
return self.execute_query(vql)["results"][0]["last_seen_at"]
201
202
+ def _get_client_version(self, vql: str):
203
+ """
204
+ Executes the VQL query and returns the `agent_information``version` field
205
+
206
+ Args:
207
+ vql (str): The VQL query.
208
+
209
+ Returns:
210
+ str: The client version.
211
+ """
212
+ return self.execute_query(vql)["results"][0]["agent_information"]["version"]
213
+
214
def _is_offline(self, last_seen_at: float):
215
"""
216
Determines if the client is offline based on the last_seen_at timestamp.
backend/app/services/agents/agents.py
+12
-3
@@ -110,6 +110,8 @@ class AgentService:
110
existing_agent.last_seen = agent_last_seen
111
existing_agent.client_id = agent["client_id"]
112
existing_agent.client_last_seen = agent["client_last_seen"]
113
+ existing_agent.wazuh_agent_version = agent["wazuh_agent_version"]
114
+ existing_agent.velociraptor_client_version = agent["velociraptor_client_version"]
115
try:
116
db.session.commit()
117
return existing_agent
@@ -126,6 +128,8 @@ class AgentService:
128
critical_asset=False,
129
client_id=agent["client_id"],
130
client_last_seen=agent["client_last_seen"],
131
+ wazuh_agent_version=agent["wazuh_agent_version"],
132
+ velociraptor_client_version=agent["velociraptor_client_version"],
133
)
134
logger.info(f"Agent metadata: {new_agent}")
135
@@ -179,11 +183,14 @@ class AgentService:
183
client_last_seen = datetime.fromtimestamp(
184
int(last_seen_at) / 1000000,
185
)
182
- return client_id, client_last_seen
186
+ vql_client_version = f"select * from clients(search='host:{agent_name}')"
187
+ client_version = UniversalService()._get_client_version(vql_client_version)
188
+ return client_id, client_last_seen, client_version
189
except Exception as e:
190
logger.error(f"Failed to get last seen at from Velociraptor. Setting to default time. Error: {e}")
191
client_last_seen = self.parse_date("1970-01-01T00:00:00+00:00")
186
- return client_id, client_last_seen
192
+ client_version = "Unknown"
193
+ return client_id, client_last_seen, client_version
194
195
196
class AgentSyncService:
@@ -244,6 +251,7 @@ class AgentSyncService:
251
"agent_ip": agent["ip"],
252
"agent_os": os_name,
253
"agent_last_seen": last_keep_alive,
254
+ "wazuh_agent_version": agent["version"],
255
},
256
)
257
logger.info(f"Collected Wazuh Agent: {agent['name']}")
@@ -285,9 +293,10 @@ class AgentSyncService:
293
294
agents_added_list = []
295
for agent in wazuh_agents_list:
288
- client_id, client_last_seen = self.agent_service.get_velo_metadata(agent["agent_name"])
296
+ client_id, client_last_seen, client_version = self.agent_service.get_velo_metadata(agent["agent_name"])
297
agent["client_id"] = client_id
298
agent["client_last_seen"] = client_last_seen
299
+ agent["velociraptor_client_version"] = client_version
300
agent_obj = self.agent_service.create_or_update_agent(agent)
301
if agent_obj is not None:
302
agents_added_list.append(agent_metadata_schema.dump(agent_obj))
backend/migrations/versions/26d24321c4c5_add.py
new
+33
@@ -0,0 +1,33 @@
1
+"""Add
2
+
3
+Revision ID: 26d24321c4c5
4
+Revises: 8b3946f83ac5
5
+Create Date: 2023-07-17 10:54:02.156039
6
+
7
+"""
8
+import sqlalchemy as sa
9
+from alembic import op
10
+
11
+# revision identifiers, used by Alembic.
12
+revision = "26d24321c4c5"
13
+down_revision = "8b3946f83ac5"
14
+branch_labels = None
15
+depends_on = None
16
+
17
+
18
+def upgrade():
19
+ # ### commands auto generated by Alembic - please adjust! ###
20
+ with op.batch_alter_table("agent_metadata", schema=None) as batch_op:
21
+ batch_op.add_column(sa.Column("wazuh_agent_version", sa.String(length=100), nullable=True))
22
+ batch_op.add_column(sa.Column("velociraptor_client_version", sa.String(length=100), nullable=True))
23
+
24
+ # ### end Alembic commands ###
25
+
26
+
27
+def downgrade():
28
+ # ### commands auto generated by Alembic - please adjust! ###
29
+ with op.batch_alter_table("agent_metadata", schema=None) as batch_op:
30
+ batch_op.drop_column("velociraptor_client_version")
31
+ batch_op.drop_column("wazuh_agent_version")
32
+
33
+ # ### end Alembic commands ###