Reflect modified `hostname` in WAZUH - Security monitoring solution

Question

After installing wazuh-agent service in a Ubuntu box( or in Windows ). if hostname is changed then, which is the best way to correct the wazuh-agent configuration to reflect the new hostname in wazuh-server side?. (Please suggest a solution if the same situation in Windows hosts too )

Answer 1

In order to change the Wazuh agent's name to reflect its new hostname the agent must be registered again. If you are using Wazuh 4.x you can achieve this by erasing the agent from the manager and it will automatically enroll again. Auto enrollment is enabled by default and if no name is specified the agent's name will be its hostname.

To learn more about the enrollment variables see the docs: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/client.html#enrollment

Note that this process will assign the agent a new ID. If you wish to keep your agent's ID you can use the add agent full API endpoint with the force_time option enabled, this option will allow you to reuse an agent's ID if it has been disconnected for a given period of time (in seconds).

For example, if you want to re-register agent 001:

Get your API token:

TOKEN=$(curl -u wazuh:wazuh -k -X GET "https://localhost:55000/security/user/authenticate?raw=true")

Register the agent with the new information:

To generate the key you may use the following command: openssl rand -hex 32 .

In name indicate the new name you want, for example, the new hostname.

curl -k -X POST "https://localhost:55000/agents/insert" -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d'
 {
   "name": "newhostname",
   "ip": "any",
   "id": "001",
   "key": "1abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghi64",
   "force_time":1
 }'  

Copy the key provided in the API's reply. Please note that this key is different from the one introduced in the previous step as this one includes all the additional information about the agent (name, IP, ID).

{"data": {"id": "001", "key": "MDAxIG5ld2hvc3RuYW1lIGFueSAxYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5emFiY2RlZmdoaTY0"}, "error": 0}

On the agent use /var/ossec/bin/manage-agents -i to import the new authentication key.

/var/ossec/bin/manage_agents -i MDAxIG5ld2hvc3RuYW1lIGFueSAxYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5emFiY2RlZmdoaTY0

Restart the agent.

  systemctl restart wazuh-agent

To learn more see: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agent_controller.insert_agent