Velo agents healthcheck (#455)
* Add unhealthy status checks for Wazuh and Velociraptor agents * precommit fixes
taylor_socfortress committed
Jun 15, 2025 at 16:00 UTC
a5cd6f99fd57181819d370b8c08eec904ee6fb6b
2 files changed
+11
-1
backend/app/connectors/grafana/schema/dashboards.py
+1
-1
@@ -25,7 +25,7 @@ class GrafanaDashboardResponse(BaseModel):
25
class WazuhDashboard(Enum):
26
WAZUH_SUMMARY = ("Wazuh", "summary.json")
27
EDR_WINDOWS_EVENT_LOGS = ("Wazuh", "edr_windows_event_logs.json")
28
- #EDR_WAZUH_INVENOTRY = ("Wazuh", "edr_wazuh_inventory.json")
28
+ # EDR_WAZUH_INVENOTRY = ("Wazuh", "edr_wazuh_inventory.json")
29
EDR_USERS_AND_GROUPS = ("Wazuh", "edr_users_and_groups.json")
30
EDR_SYSTEM_VULNERABILITIES = ("Wazuh", "edr_system_vulnerabilities.json")
31
EDR_SYSTEM_SECURITY_AUDIT = ("Wazuh", "edr_system_security_audit.json")
backend/app/healthchecks/agents/services/agents.py
+10
@@ -33,6 +33,11 @@ def is_wazuh_agent_unhealthy(
33
Returns:
34
ExtendedAgentModel: An extended agent model with the unhealthy status updated.
35
"""
36
+ # If wazuh_last_seen is None, consider it unhealthy
37
+ if agent.wazuh_last_seen is None:
38
+ logger.info(f"Agent {agent.hostname} (ID: {agent.agent_id}) has no Wazuh last seen time - marking as unhealthy")
39
+ return ExtendedAgentModel(**agent.dict(), unhealthy_wazuh_agent=True)
40
+
41
current_time = datetime.now()
42
wazuh_last_seen = agent.wazuh_last_seen
43
@@ -64,6 +69,11 @@ def is_velociraptor_agent_unhealthy(
69
Returns:
70
ExtendedAgentModel: An extended agent model with the unhealthy_velociraptor_agent flag set.
71
"""
72
+ # If velociraptor_id is None or velociraptor_last_seen is None, consider it unhealthy
73
+ if agent.velociraptor_id is None or agent.velociraptor_last_seen is None:
74
+ logger.info(f"Agent {agent.hostname} (ID: {agent.agent_id}) has no Velociraptor ID or last seen time - marking as unhealthy")
75
+ return ExtendedAgentModel(**agent.dict(), unhealthy_velociraptor_agent=True)
76
+
77
current_time = datetime.now()
78
velociraptor_last_seen = agent.velociraptor_last_seen
79