Our API allows for easy management of the Wazuh agents. Although, for never connected agents, we need to look into the dateAdd date because the agent never reported to the manager (there is no a keep alive).
lastKeepAlive: Last date the agent sent a keep alive.įor disconnected agents, we are interested in the lastKeepAlive date, since it is the last time the agent was connected to the manager.If we use the API to retrieve the agent list, we will see two date fields: This post describes how to purge these kinds of agents from the manager’s agent list by using the Wazuh API. Wazuh agents move through all the stages of their life cycle, sometimes leaving the agents permanently disconnected (i.e: terminated instances) or never connected (i.e: firewall issues).
0 kommentar(er)
