Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Network protocols global queries enhancement #28725

Open
7 tasks done
Tracked by #27899
Dwordcito opened this issue Mar 20, 2025 · 5 comments · May be fixed by #28854
Open
7 tasks done
Tracked by #27899

Network protocols global queries enhancement #28725

Dwordcito opened this issue Mar 20, 2025 · 5 comments · May be fixed by #28854
Assignees
@MiguelazoDS
Labels
level/task type/enhancement New feature or request

Comments

@Dwordcito
Copy link
Member

Dwordcito commented Mar 20, 2025 •
edited by MiguelazoDS
Loading

Description

This issue aims develop the necessary steps to index the network protocols data with the suggested mapping template.

Expected changes

  • Add WCS required classes into src/wazuh_modules/inventory_harvester/src/wcsModel using string_views as possible.
  • Add indexer connector instances into systemInventoryOrchestrator.hpp
  • Populate required context src/wazuh_modules/inventory_harvester/src/systemInventory/systemContext.hpp minimizing the copies.
  • Add mapping implementation in src/wazuh_modules/inventory_harvester/src/systemInventory/elements

Expected reflectable json output.

{
  "@timestamp": "2025-03-19T22:05:30.123Z",
  "agent": {
    "host": {
      "architecture": "x86_64",
      "ip": "192.168.1.100"
    },
    "id": "010",
    "name": "agent-10",
    "version": "5.4.0"
  },
  "network": {
    "dhcp": true,
    "gateway": "192.168.1.1",
    "metric": 10,
    "type": "ethernet"
  },
  "observer": {
    "ingress": {
      "interface": {
        "name": "eth0"
      }
    }
  }
}

DoD

  • Development
  • Add tests
  • Documentation
@Dwordcito Dwordcito mentioned this issue Mar 20, 2025
Open
6 tasks
@Dwordcito Dwordcito added type/enhancement New feature or request level/task labels Mar 20, 2025
@wazuhci wazuhci moved this to Triage in XDR+SIEM/Release 4.13.0 Mar 21, 2025
@wazuhci wazuhci moved this from Triage to Backlog in XDR+SIEM/Release 4.13.0 Mar 21, 2025
@wazuhci wazuhci moved this from Backlog to In progress in XDR+SIEM/Release 4.13.0 Mar 27, 2025
@MiguelazoDS
Copy link
Member

Update

The reflactable JSON will have the following format

Where 92245c06b5120c62174799e7f531d4df81619672 is the item_id

{
  "id": "001_92245c06b5120c62174799e7f531d4df81619672",
  "operation": "INSERTED",
  "data": {
    "agent": {
      "ip": "any",
      "id": "001",
      "name": "agent-10",
      "version": "5.4.0"
    },
    "network": {
      "dhcp": true,
      "gateway": "192.168.1.1",
      "metric": 10,
      "type": "ethernet"
    },
    "observer": {
      "ingress": {
        "interface": {
          "name": "eth0"
        }
      }
    }
  }
}

@MiguelazoDS MiguelazoDS linked a pull request Mar 27, 2025 that will close this issue
Open
@MiguelazoDS MiguelazoDS linked a pull request Mar 27, 2025 that will close this issue
Network protocol global queries #28854
Open
@MiguelazoDS
Copy link
Member

Update

On hold until finishing the e2e test for hotfixes. This PR still is under development, needs revision and QA tests are not yet implemented

@wazuhci wazuhci moved this from In progress to On hold in XDR+SIEM/Release 4.13.0 Mar 27, 2025
@wazuhci wazuhci moved this from On hold to In progress in XDR+SIEM/Release 4.13.0 Mar 28, 2025
@MiguelazoDS
Copy link
Member

Update

Implementing QA tests, for some reason the network protocol item_id is empty during the rsync deletion

18:07:58 logger-helper:systemInventoryOrchestrator.hpp:42 run : SystemInventoryOrchestrator::run for agent: '001', operation: '1', component: '3'
18:07:58 logger-helper:upsertElement.hpp:63 handleRequest : UpsertSystemElement::build: {"id":"001_35c9b5749116035dea24e0c8797c8e01358081a0","operation":"INSERTED","data":{"network":{"dhcp":"disabled","gateway":" ","metric":"101","type":"ipv4"},"observer":{"ingress":{"interface":{"name":"eth1"}}},"agent":{"id":"001","name":"centos9","ip":"any","version":"v4.10.1"}}}
18:07:58 logger-helper:systemInventoryOrchestrator.hpp:75 processEvent : SystemInventoryOrchestrator::processEvent finished
18:07:59 logger-helper:systemInventoryOrchestrator.hpp:53 processEvent : SystemInventoryOrchestrator::processEvent
18:07:59 logger-helper:systemInventoryOrchestrator.hpp:42 run : SystemInventoryOrchestrator::run for agent: '001', operation: '0', component: '3'
18:07:59 logger-helper:inventoryHarvesterFacade.cpp:203 operator() : InventoryHarvesterFacade::initSystemEventDispatcher: Network Protocol ID is empty, cannot upsert network protocol element..

@MiguelazoDS
Copy link
Member

Update

Added QA tests, e2e testing finished. Pending Review

@wazuhci wazuhci moved this from In progress to Pending review in XDR+SIEM/Release 4.13.0 Mar 31, 2025
@wazuhci wazuhci moved this from Pending review to In review in XDR+SIEM/Release 4.13.0 Mar 31, 2025
@wazuhci wazuhci moved this from In review to On hold in XDR+SIEM/Release 4.13.0 Apr 1, 2025
@wazuhci wazuhci moved this from On hold to In progress in XDR+SIEM/Release 4.13.0 Apr 1, 2025
@wazuhci wazuhci moved this from In progress to Pending review in XDR+SIEM/Release 4.13.0 Apr 1, 2025
@MiguelazoDS
Copy link
Member

Update

Failing test.

https://github.com/wazuh/wazuh/actions/runs/14198122236/job/39778236509?pr=28854

Currently the workflows are not working. They are cancelled at the beginning

@wazuhci wazuhci moved this from Pending review to In review in XDR+SIEM/Release 4.13.0 Apr 2, 2025
@wazuhci wazuhci moved this from In review to On hold in XDR+SIEM/Release 4.13.0 Apr 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@MiguelazoDS MiguelazoDS

Labels
level/task type/enhancement New feature or request
Projects
XDR+SIEM/Release 4.13.0
Status: On hold
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Network protocol global queries wazuh/wazuh
2 participants
@MiguelazoDS @Dwordcito