when sync agents to now include velociraptor details (#34)
taylor_socfortress committed
Jul 15, 2023 at 11:38 UTC
f2b3cbea04c0fd741694f53666eefce74e979113
1 file changed
+36
-1
backend/app/services/agents/agents.py
+36
-1
@@ -1,4 +1,4 @@
1
-# services.py
1
+# agents.py
2
from datetime import datetime
3
from typing import Dict
4
from typing import List
@@ -16,6 +16,7 @@ from app.models.agents import agent_metadatas_schema
16
from app.models.connectors import Connector
17
from app.models.connectors import WazuhManagerConnector
18
from app.models.connectors import connector_factory
19
+from app.services.Velociraptor.universal import UniversalService
20
21
22
class AgentService:
@@ -130,6 +131,8 @@ class AgentService:
131
os=agent["agent_os"],
132
last_seen=agent_last_seen, # Use the datetime object
133
critical_asset=False,
134
+ client_id=agent["client_id"],
135
+ client_last_seen=agent["client_last_seen"],
136
)
137
logger.info(f"Agent metadata: {agent_metadata}")
138
@@ -175,6 +178,8 @@ class AgentService:
178
agent_metadata.os = agent["agent_os"]
179
agent_metadata.last_seen = agent_last_seen # Use the datetime object
180
agent_metadata.critical_asset = False
181
+ agent_metadata.client_id = agent["client_id"]
182
+ agent_metadata.client_last_seen = agent["client_last_seen"]
183
logger.info(f"Agent metadata: {agent_metadata}")
184
185
try:
@@ -209,6 +214,33 @@ class AgentService:
214
"success": False,
215
}
216
217
+ def get_velo_metadata(self, agent_name: str) -> Optional[str]:
218
+ """
219
+ Retrieves the client ID and last_seen_at based on the agent name from Velociraptor.
220
+
221
+ Args:
222
+ agent_name (str): The name of the agent.
223
+
224
+ Returns:
225
+ str: The client ID if found, None otherwise.
226
+ str: The last seen at timestamp if found, Default timsetamp otherwise.
227
+ """
228
+ client_id = UniversalService().get_client_id(agent_name)["results"][0]["client_id"]
229
+ try:
230
+ vql_last_seen_at = f"select last_seen_at from clients(search='host:{agent_name}')"
231
+ last_seen_at = UniversalService()._get_last_seen_timestamp(vql_last_seen_at)
232
+ client_last_seen = datetime.fromtimestamp(
233
+ int(last_seen_at) / 1000000,
234
+ )
235
+ return client_id, client_last_seen
236
+ except Exception as e:
237
+ logger.error(f"Failed to get last seen at from Velociraptor. Setting to default time. Error: {e}")
238
+ client_last_seen = datetime.strptime(
239
+ "1970-01-01T00:00:00+00:00",
240
+ "%Y-%m-%dT%H:%M:%S+00:00",
241
+ )
242
+ return client_id, client_last_seen
243
+
244
245
class AgentSyncService:
246
def __init__(self):
@@ -311,6 +343,9 @@ class AgentSyncService:
343
for agent in wazuh_agents_list:
344
agent_info = self.agent_service.get_agent(agent["agent_id"])
345
logger.info(f"Agent info: {agent_info}")
346
+ client_id, client_last_seen = self.agent_service.get_velo_metadata(agent["agent_name"])
347
+ agent["client_id"] = client_id
348
+ agent["client_last_seen"] = client_last_seen
349
self.agent_service.update_agent(agent)
350
if "message" in agent_info:
351
self.agent_service.create_agent(agent)