3.2 - Splunk app v2.0.0

SplunkAppForWazuh/appserver/controllers/manager.py

@@ -23,6 +23,40 @@ def setup_logger(level):
     return logger
 logger = setup_logger(logging.DEBUG)
 class manager(controllers.BaseController):
+    # /custom/wazuh/manager/status
+    @expose_page(must_login=False, methods=['GET'])
+    def status(self, **kwargs):
+        opt_username = 'foo'
+        opt_password = 'bar'
+        opt_base_url = 'http://192.168.0.157:55000'
+        auth = requests.auth.HTTPBasicAuth(opt_username, opt_password)
+        verify = False
+        request = requests.get(opt_base_url + '/manager/status', auth=auth, verify=verify)
+        manager_status = json.loads(request.text)['data']
+        data = {}
+        for key in manager_status:
+            data['manager-status_' + key.lower()] = manager_status[key]
+        data = [data]
+        result = json.dumps(data)
+        return result
+
+    # /custom/wazuh/manager/info
+    @expose_page(must_login=False, methods=['GET'])
+    def info(self, **kwargs):
+        opt_username = 'foo'
+        opt_password = 'bar'
+        opt_base_url = 'http://192.168.0.157:55000'
+        auth = requests.auth.HTTPBasicAuth(opt_username, opt_password)
+        verify = False
+        request = requests.get(opt_base_url + '/manager/info', auth=auth, verify=verify)
+        manager_info = json.loads(request.text)['data']
+        data = {}
+        for key in manager_info:
+            data['manager-info_' + key.lower()] = manager_info[key]
+        data = [data]
+        result = json.dumps(data)
+        return result
+
     # /custom/wazuh/manager/logs
     @expose_page(must_login=False, methods=['GET'])
     def logs(self, **kwargs):
@@ -32,8 +66,8 @@ def logs(self, **kwargs):
         auth = requests.auth.HTTPBasicAuth(opt_username, opt_password)
         verify = False
         request = requests.get(opt_base_url + '/manager/logs', auth=auth, verify=verify)
-        manager_info = json.loads(request.text)['data']['items']
-        result = json.dumps(manager_info)
+        manager_logs = json.loads(request.text)['data']['items']
+        result = json.dumps(manager_logs)
         return result
 
     # /custom/wazuh/manager/rules

SplunkAppForWazuh/bin/get_manager_info.py

@@ -0,0 +1,24 @@
+#!/opt/splunk/bin/python
+############################################################
+#
+# GET /manager/logs
+#
+############################################################
+import sys
+import splunk.Intersplunk as si
+import requests
+import json
+
+try:
+    #pass
+    results = []
+    request = requests.get("http://192.168.0.159:8000/en-US/custom/SplunkAppForWazuh/manager/info")
+    # print request.text
+    data = json.loads(request.text)
+except Exception as err:
+        import traceback
+        print err
+        stack = traceback.format_exc()
+        data = si.generateErrorResults("Error : Traceback: " + str(stack))
+
+si.outputResults(data)

SplunkAppForWazuh/bin/get_manager_status.py

@@ -0,0 +1,24 @@
+#!/opt/splunk/bin/python
+############################################################
+#
+# GET /manager/logs
+#
+############################################################
+import sys
+import splunk.Intersplunk as si
+import requests
+import json
+
+try:
+    #pass
+    results = []
+    request = requests.get("http://192.168.0.159:8000/en-US/custom/SplunkAppForWazuh/manager/status")
+    # print request.text
+    data = json.loads(request.text)
+except Exception as err:
+        import traceback
+        print err
+        stack = traceback.format_exc()
+        data = si.generateErrorResults("Error : Traceback: " + str(stack))
+
+si.outputResults(data)

SplunkAppForWazuh/default/commands.conf

@@ -1,11 +1,18 @@
 [getmanagerlogs]
 filename = get_manager_logs.py
 
+[getmanagerinfo]
+filename = get_manager_info.py
+
+[getmanagerstatus]
+filename = get_manager_status.py
+
 [getruleset]
 filename = get_ruleset.py
 
 [getdecoders]
 filename = get_decoders.py
 
 [getagentsummary]
-filename = get_agents_summary.py
+filename = get_agents_summary.py
+

SplunkAppForWazuh/default/data/ui/views/manager_status.xml

@@ -1,63 +1,63 @@
 <dashboard stylesheet="wazuh_decorations.css">
   <label>Manager Status</label>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic" | rename manager-status_ossec-analysisd as analysisd | eval value=if(analysisd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_ossec-analysisd as analysisd | eval value=if(analysisd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value1">$result.value$</set>
       <set token="range1">$result.range$</set>
     </progress>
   </search>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic"  | rename manager-status_ossec-execd as execd| eval value=if(execd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_ossec-execd as execd| eval value=if(execd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value2">$result.value$</set>
       <set token="range2">$result.range$</set>
     </progress>
   </search>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic"  | rename manager-status_ossec-logcollector as logcollector| eval value=if(logcollector="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_ossec-logcollector as logcollector| eval value=if(logcollector="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value3">$result.value$</set>
       <set token="range3">$result.range$</set>
     </progress>
   </search>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic"  | rename manager-status_ossec-monitord as monitord | eval value=if(monitord="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_ossec-monitord as monitord | eval value=if(monitord="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value4">$result.value$</set>
       <set token="range4">$result.range$</set>
     </progress>
   </search>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic"  | rename manager-status_ossec-remoted as remoted | eval value=if(remoted="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_ossec-remoted as remoted | eval value=if(remoted="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value5">$result.value$</set>
       <set token="range5">$result.range$</set>
     </progress>
   </search>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic"  | rename manager-status_ossec-maild as maild  | eval value=if(maild="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_ossec-maild as maild  | eval value=if(maild="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value6">$result.value$</set>
       <set token="range6">$result.range$</set>
     </progress>
   </search>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic"  | rename manager-status_ossec-authd as authd  | eval value=if(authd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_ossec-authd as authd  | eval value=if(authd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value7">$result.value$</set>
       <set token="range7">$result.range$</set>
     </progress>
   </search>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic"  | rename manager-status_wazuh-modulesd as modulesd  | eval value=if(modulesd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_wazuh-modulesd as modulesd  | eval value=if(modulesd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value8">$result.value$</set>
       <set token="range8">$result.range$</set>
     </progress>
   </search>
   <search>
-    <query>index="wazuh_api" sourcetype="wazuh:api:info:basic"  | rename manager-status_ossec-syscheckd as syscheckd  | eval value=if(syscheckd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
+    <query>| getmanagerstatus | rename manager-status_ossec-syscheckd as syscheckd  | eval value=if(syscheckd="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none</query>
     <progress>
       <set token="value9">$result.value$</set>
       <set token="range9">$result.range$</set>
@@ -135,7 +135,7 @@
       <single>
         <title>Total Agents</title>
         <search>
-          <query>index="wazuh_api" sourcetype="wazuh:api:info:basic" | stats latest(agent_summary_total) as "Total Agents"</query>
+          <query>| getagentsummary | stats first(agent_summary_total) as "Total Agents"</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
@@ -147,7 +147,7 @@
       <single>
         <title>Active</title>
         <search>
-          <query>index="wazuh_api" sourcetype="wazuh:api:info:basic" | stats latest(agent_summary_active) as "Active Agents"</query>
+          <query>| getagentsummary | stats first(agent_summary_active) as "Active Agents"</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
@@ -159,7 +159,7 @@
       <single>
         <title>Disconnected</title>
         <search>
-          <query>index="wazuh_api" sourcetype="wazuh:api:info:basic" | stats latest(agent_summary_disconnected) as "Disconnected"</query>
+          <query>| getagentsummary | stats first(agent_summary_disconnected) as "Disconnected"</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
@@ -171,7 +171,7 @@
       <single>
         <title>Never connected</title>
         <search>
-          <query>index="wazuh_api" sourcetype="wazuh:api:info:basic" | stats latest(agent_summary_neverconnected) as "Never"</query>
+          <query>| getagentsummary | stats first(agent_summary_neverconnected) as "Never"</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
@@ -183,7 +183,7 @@
       <single>
         <title>Agent Coverage</title>
         <search>
-          <query>index="wazuh_api" sourcetype="wazuh:api:info:basic" | rename   agent_summary_active as Active, agent_summary_total as Total | eval Coverage=round((Active*100)/Total,2) | eval Coverage=Coverage + " %" | top Coverage showcount=f showperc=f</query>
+          <query>| getagentsummary | rename agent_summary_active as Active, agent_summary_total as Total | eval Coverage=round((Active*100)/Total,2) | eval Coverage=Coverage + " %" | top Coverage showcount=f showperc=f</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>