collect outdated wazuh and velo agents (#41)
taylor_socfortress committed
Jul 17, 2023 at 12:06 UTC
a73c2ea08dbe8b566f15c661ca0af7b5635b2c87
4 files changed
+122
-1
backend/app/routes/agents.py
+24
@@ -118,3 +118,27 @@ def get_agent_vulnerabilities(agent_id: str) -> Any:
118
agent_id=agent_id,
119
)
120
return jsonify(agent_vulnerabilities)
121
+
122
+
123
+@bp.route("/agents/wazuh/outdated", methods=["GET"])
124
+def get_outdated_wazuh_agents() -> Any:
125
+ """
126
+ Endpoint to get the outdated Wazuh agents.
127
+ Returns:
128
+ json: A JSON response containing the list of outdated Wazuh agents.
129
+ """
130
+ service = AgentService()
131
+ agents = service.get_outdated_agents_wazuh()
132
+ return jsonify(agents)
133
+
134
+
135
+@bp.route("/agents/velociraptor/outdated", methods=["GET"])
136
+def get_outdated_velociraptor_agents() -> Any:
137
+ """
138
+ Endpoint to get the outdated Velociraptor agents.
139
+ Returns:
140
+ json: A JSON response containing the list of outdated Velociraptor agents.
141
+ """
142
+ service = AgentService()
143
+ agents = service.get_outdated_agents_velociraptor()
144
+ return jsonify(agents)
backend/app/services/Velociraptor/universal.py
+12
@@ -211,6 +211,18 @@ class UniversalService:
211
"""
212
return self.execute_query(vql)["results"][0]["agent_information"]["version"]
213
214
+ def _get_server_version(self, vql: str):
215
+ """
216
+ Executes the VQL query and returns the velociraptor server version.
217
+
218
+ Args:
219
+ vql (str): The VQL query.
220
+
221
+ Returns:
222
+ str: The server version.
223
+ """
224
+ return self.execute_query(vql)["results"][0]["version"]["version"]
225
+
226
def _is_offline(self, last_seen_at: float):
227
"""
228
Determines if the client is offline based on the last_seen_at timestamp.
backend/app/services/agents/agents.py
+42
-1
@@ -61,6 +61,47 @@ class AgentService:
61
"""
62
return db.session.query(AgentMetadata).filter_by(agent_id=agent_id).first()
63
64
+ def get_outdated_agents_wazuh(self) -> List[Dict[str, Union[str, bool]]]:
65
+ """
66
+ Retrieves all agents with outdated Wazuh agent versions from the database.
67
+
68
+ Returns:
69
+ List[dict]: A list of dictionaries where each dictionary represents the serialized data of an outdated agent.
70
+ """
71
+ wazuh_manager = self.get_agent("000")
72
+ if wazuh_manager is None:
73
+ logger.error("Wazuh Manager with agent_id '000' not found.")
74
+ return {"message": "Wazuh Manager with agent_id '000' not found.", "success": False}
75
+
76
+ outdated_wazuh_agents = []
77
+ agents = db.session.query(AgentMetadata).filter(AgentMetadata.agent_id != "000").all()
78
+ for agent in agents:
79
+ if agent.wazuh_agent_version != wazuh_manager.wazuh_agent_version:
80
+ outdated_wazuh_agents.append(agent_metadata_schema.dump(agent))
81
+
82
+ return {"message": "Outdated Wazuh agents retrieved successfully", "success": True, "outdated_wazuh_agents": outdated_wazuh_agents}
83
+
84
+ def get_outdated_agents_velociraptor(self) -> List[Dict[str, Union[str, bool]]]:
85
+ """
86
+ Retrieves all agents with outdated Velociraptor client versions from the database.
87
+
88
+ Returns:
89
+ List[dict]: A list of dictionaries where each dictionary represents the serialized data of an outdated agent.
90
+ """
91
+ outdated_velociraptor_agents = []
92
+ vql_server_version = "select * from config"
93
+ server_version = UniversalService()._get_server_version(vql_server_version)
94
+ agents = db.session.query(AgentMetadata).all()
95
+ for agent in agents:
96
+ if agent.velociraptor_client_version != server_version:
97
+ outdated_velociraptor_agents.append(agent_metadata_schema.dump(agent))
98
+
99
+ return {
100
+ "message": "Outdated Velociraptor agents retrieved successfully",
101
+ "success": True,
102
+ "outdated_velociraptor_agents": outdated_velociraptor_agents,
103
+ }
104
+
105
def mark_agent_criticality(self, agent_id: str, critical: bool) -> Dict[str, Union[str, bool]]:
106
"""
107
Marks a specific agent as critical or non-critical.
@@ -167,7 +208,7 @@ class AgentService:
208
209
def get_velo_metadata(self, agent_name: str) -> Optional[str]:
210
"""
170
- Retrieves the client ID and last_seen_at based on the agent name from Velociraptor.
211
+ Retrieves the client ID, last_seen_at and client version based on the agent name from Velociraptor.
212
213
Args:
214
agent_name (str): The name of the agent.
backend/app/static/swagger.json
+44
@@ -560,6 +560,50 @@
560
}
561
}
562
},
563
+ "/agents/wazuh/outdated": {
564
+ "get": {
565
+ "tags": ["Agents"],
566
+ "summary": "Get outdated Wazuh agents",
567
+ "description": "Endpoint to get the outdated Wazuh agents.",
568
+ "responses": {
569
+ "200": {
570
+ "description": "Successful operation",
571
+ "content": {
572
+ "application/json": {
573
+ "schema": {
574
+ "type": "array",
575
+ "items": {
576
+ "$ref": "#/components/schemas/Agent"
577
+ }
578
+ }
579
+ }
580
+ }
581
+ }
582
+ }
583
+ }
584
+ },
585
+ "/agents/velociraptor/outdated": {
586
+ "get": {
587
+ "tags": ["Agents"],
588
+ "summary": "Get outdated Velociraptor agents",
589
+ "description": "Endpoint to get the outdated Velociraptor agents.",
590
+ "responses": {
591
+ "200": {
592
+ "description": "Successful operation",
593
+ "content": {
594
+ "application/json": {
595
+ "schema": {
596
+ "type": "array",
597
+ "items": {
598
+ "$ref": "#/components/schemas/Agent"
599
+ }
600
+ }
601
+ }
602
+ }
603
+ }
604
+ }
605
+ }
606
+ },
607
"/rule/disable": {
608
"post": {
609
"summary": "Disable a rule",