Closed vikman90 closed 4 months ago
Analyzing the root directory of the wazuh/wazuh
repository, we make a first cut with the files and folders that contain files that have to do with the agent and those that do not. For this we take into account the items that were marked as removed in this issue https://github.com/wazuh/wazuh/issues/24037
Color | Description |
---|---|
:green_circle: | Required by agent |
:red_circle: | Not required by agent |
:black_circle: | Required but deprecated |
After the analysis above, where you can see the detail of the directories. We conclude knowing that the following are the components to be migrated:
The following are two component diagrams, paying attention to which parts of the wazuh repository would be on the manager side and which on the agent side.
For illustrative purposes, the agent communication API and the new Engine are added, but the old wazuh modules that should be kept are mentioned.
C4Component
Boundary(manager, "Manager", "") {
Component(agent_comms_api, "Agent-comms-API", "", "")
Component(engine, "Engine", "", "")
Boundary(modules, "Modules", "") {
Component(content_manager, "Content Manager", "", "")
Component(indexer_connector, "Indexer Connector", "", "")
Component(keystore, "Keystore", "", "")
Component(router, "Router", "", "")
Component(agent_upgrade_manager, "Agent Upgrade Manager", "", "")
Component(vulnerability_scanner, "Vulnerability Scanner", "", "")
}
}
In the same way the new agent is added in an illistrative way but the important thing is all the modules that need to be migrated.
C4Component
title Agent components
Boundary(agent, "Agent", "") {
Component(logrotate, "Log rotate", "?", "Rotates the log")
Component(client, "Client", "", "HTTP 2.0 manager's client")
Component(commander, "Commander", "", "Runs commands from manager")
Component(storage, "Queue", "", "Persistent message queue")
Component(config_parser, "Config Parser", "", "Modules config parser")
}
Boundary(ExecutorModules, "Executors modules to be migrated", "") {
Component(executor, "Executor", "", "")
Boundary(executors, "Executors", "") {
Component(ar, "AR", "", "")
Component(agent_upgrade, "Agent Upgrade", "", "")
Component(command, "Command", "", "")
}
}
Boundary(CollectorModules, "Collectors modules to be migrated", "") {
Component(logcollector, "Logcollector", "", "")
Component(fim, "FIM (+Rootcheck)", "", "")
Component(aws, "AWS", "", "")
Component(syscollector, "Syscollector", "", "")
Component(sca, "SCA", "", "")
Component(azure, "Azure", "", "")
Component(gcp, "GCP", "", "")
Component(ms_graph, "MS Graph", "", "")
Component(o365, "O365", "", "")
Component(github, "Github", "", "")
Component(docker, "Docker", "", "")
Component(osquery_monitor, "Osquery Monitor", "", "")
}
Boundary(Submodules, "Submodules to be migrated", "") {
Component(dbsync, "DBsync", "", "")
Component(data_provider, "Data Provider", "", "")
}
Rel(client, storage, "Reads")
Rel(client, commander, "Queries")
Rel(logcollector, storage, "")
Rel(fim, storage, "")
Rel(aws, storage, "")
Rel(syscollector, storage, "")
Rel(azure, storage, "")
Rel(gcp, storage, "")
Rel(ms_graph, storage, "")
Rel(o365, storage, "")
Rel(github, storage, "")
Rel(docker, storage, "")
Rel(osquery_monitor, storage, "")
Rel(sca, storage, "")
Rel(executor, ar, "")
Rel(executor, agent_upgrade, "")
Rel(executor, command, "")
Rel(commander, executor, "")
Rel(syscollector, dbsync, "")
Rel(data_provider,syscollector, "")
Rel(fim, dbsync, "")
Rel(executor, logcollector, "")
Rel(executor, fim, "")
Rel(executor, aws, "")
Rel(executor, syscollector, "")
Rel(executor, azure, "")
Rel(executor, gcp, "")
Rel(executor, ms_graph, "")
Rel(executor, o365, "")
Rel(executor, github, "")
Rel(executor, docker, "")
Rel(executor, osquery_monitor, "")
Rel(executor, sca, "")
Rel(config_parser, commander, "Queries")
Most of the agent 000
concept is removed with the deprecation of wazuh-analysisd
and wazuh-remoted
. Only a few references remain in the following files:
./src/wazuh_modules/vulnerability_scanner.
agent 000
concept is quite separate from the rest of the code. The module behavior only identifies the agent 000
to verify whether or not to perform a new scan or a clean-up or to correctly define the node name. This behavior depends on the information collected by syscollector../src/wazuh_modules/agent_upgrade/manager
./src/shared_modules/indexer_connector/qa
./src/wazuh_modules/wm_syscollector.c
and /root/wazuh/src/src/shared/agent_messages_adapter.c
There are a couple of references in the wazuh-analysisd
tests, which will be deprecated.
There are a few references in function and/or comments that need to be checked, most of them to avoid running some operations on the manager:
./api/api/controllers/active_response_controller.py
run_command
../api/api/controllers/agent_controller.py
reconnect_agents
.get_agent_config
.delete_single_agent_multiple_groups
.delete_single_agent_single_group
.put_agent_single_group
.get_agent_key
.restart_agent
.put_upgrade_agents
.put_upgrade_custom_agents
.get_agent_upgrade
.get_component_stats
.get_agent_no_group
../api/api/controllers/ciscat_controller.py
get_agents_ciscat_results
(ciscat
will be deprecated)../api/api/controllers/sca_controller.py
get_sca_agent
.get_sca_checks
../api/api/spec/spec.yaml
Additionally, there are many API tests that use this ID and they need to be verified.
There are some references in function and/or comments that need to be checked, most of them to avoid running some operations on the manager:
./framework/scripts/agent_groups.py
show_groups
../framework/wazuh/active_response.py
run_command
../framework/wazuh/agent.py
get_agents_summary_status
.get_agents_summary_os
.reconnect_agents
.restart_agents
.restart_agents_by_node
.delete_agents
.assign_agents_to_group
.remove_agent_from_group
.remove_agent_from_groups
.remove_agents_from_group
.get_outdated_agents
.upgrade_agents
.get_upgrade_result
.get_agents_sync_group
.get_full_overview
../framework/wazuh/manager.py
get_config
../framework/wazuh/stats.py
get_daemons_stats_agents
../framework/wazuh/core/agent.py
get_key
.unset_single_group_agent
.get_agents_info
../framework/wazuh/core/configuration.py
get_active_configuration
../framework/wazuh/core/exception.py
1703
needs to be removed../framework/wazuh/core/manager.py
get_wazuh_active_logging_format
../framework/wazuh/core/stats.py
get_daemons_stats_from_socket
../framework/wazuh/core/wazuh_queue.py
send_msg_to_agent
../framework/wazuh/core/wdb.py
__query_input_validation
../framework/wazuh/core/cluster/master.py
get_health
.Additionally, there are many Framework tests that use this ID and they need to be verified.
Changes applied: https://github.com/wazuh/wazuh-agent/pull/23
@vikman90 please, review.
Requested changes applied!
cc @vikman90
Parent issue:
Description
The goal of this spike is to investigate the necessary steps to separate the Wazuh agent from the manager, enabling them to function as independent products. A significant portion of this task is already being addressed in https://github.com/wazuh/wazuh-agent/issues/1. Once the scaffolding for the new agent repository is completed (https://github.com/wazuh/wazuh-agent/issues/6), the primary focus will be on listing the elements from the Wazuh repository that need to be migrated to the new agent repository.
Functional requirements
Implementation restrictions
Plan
Analyze Wazuh repository:
Component migration:
Diagram development:
Evaluate "Agent 000" Concept:
Documentation and Reporting:
By following this plan, we aim to clearly outline the steps required to separate the Wazuh agent from the manager, ensuring both function as independent and efficient products.