Axonius Documentation
  1. Connecting Adapters
  2. Adapters V-Z

Wazuh

Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.

Types of Assets Fetched

This adapter fetches the following types of assets:

  • Devices
  • Software
  • SaaS Applications
  • Aggregated Security Findings

Parameters

  1. Wazuh Domain – Enter the hostname of the Wazuh server.
  2. Port (required, default: 55000) - Enter the port to be used in the connection.
  3. User Name and Password (required) – The username and password for an account that has Read access to the API.
  4. Use API V4 - Select to use API version 4, which allows fetching vulnerabilities data. When cleared, API V3 is selected.
  5. API Rate Limit (Calls per Minute) (default 300) - Configure the API rate per minute (the number of API calls being made).
  6. Is Cloud - Select if you're using Wazuh Cloud instead of an on-premises version of Wazuh.
  7. Verify SSL – Select whether to verify the SSL certificate of the server.
  8. HTTPS Proxy (optional) – Connect the adapter to a proxy instead of directly connecting it to the domain.
wazuh.png

Advanced Settings

Note

Advanced settings can either apply for all connections for this adapter, or you can set different advanced settings and/or different scheduling for a specific connection, refer to ​Advanced Configuration for Adapters.

  1. Fetch vulnerabilities - Select to fetch vulnerabilities for each agent.

Note

Verify that Use API V4 is selected, as API V3 doesn't support this option.

  1. Include agent extra items - Select the extra information to fetch for each agent, such as system inventory items or the scan database. By default, no items are selected. You can select any of the following:
    • Hardware Info, Network Info, Processes Info, Ports Info, Hotfixes Info, Packages Info, OS Info, SCA Database, Netiface Info, Browser Extenstions
      • Browser Extensions - Adds browser extension details to the device, including browser name, extension ID, name, version, vendor, and enabled status. Each browser extension is also recorded as installed software with the software type Browser Extension. Requires Wazuh version 4.14.0 or later.
  2. Fetch policy checks - Select this option to fetch policy checks related to the SCA database items.

Note

To learn more about Adapter Configuration tab advanced settings, see Adapter Advanced Settings.

APIs

Axonius uses the Wazuh API.

Axonius calls the following endpoints:

Endpoint List

  • GET /security/user/authenticate - Authenticate and obtain a token. Used when Use API V4 is selected.

  • GET /agents - Fetch agents (devices).

  • GET /vulnerability/{agent_id} - Fetch the vulnerabilities of each agent. Requires Fetch vulnerabilities.

  • GET /syscollector/{agent_id}/hardware - Fetch hardware information. Requires Hardware Info in Include agent extra items.

  • GET /syscollector/{agent_id}/netaddr - Fetch network information. Requires Network Info in Include agent extra items.

  • GET /syscollector/{agent_id}/processes - Fetch processes. Requires Processes Info in Include agent extra items.

  • GET /syscollector/{agent_id}/ports - Fetch ports. Requires Ports Info in Include agent extra items.

  • GET /syscollector/{agent_id}/hotfixes - Fetch hotfixes. Requires Hotfixes Info in Include agent extra items.

  • GET /syscollector/{agent_id}/packages - Fetch packages. Requires Packages Info in Include agent extra items.

  • GET /syscollector/{agent_id}/os - Fetch operating system information. Requires OS Info in Include agent extra items.

  • GET /sca/{agent_id} - Fetch the SCA database. Requires SCA Database in Include agent extra items.

  • GET /syscollector/{agent_id}/netiface - Fetch network interfaces. Requires Netiface Info in Include agent extra items.

  • GET /syscollector/{agent_id}/browser_extensions - Fetch browser extensions. Requires Browser Extensions in Include agent extra items.

  • GET /sca/{agent_id}/checks/{policy_id} - Fetch the policy checks of each SCA policy. Requires Fetch policy checks.

If Is Cloud is selected, the endpoints are prefixed with /api/wazuh.

Supported From Version

Supported from Axonius version 4.5

Updated 4 days ago

Did this page help you?