POC data persistence UX - agent commands

[asteriscos]

Description

We will implement a new commands feature in Wauzh which will allow sending commands to agent in a generic way. The initial design of the commands feature is described in the Data persistence issue, where this issue is tracked.

These commands will be stored in a Wazuh index, following a defined schema. Also, these commands will be updated over time with feedback from the agent, related to the failure or success during the execution of the command.

We must create a new plugin with the proof of concept of a UI that allows the user to manage the agent commands. The user must be able to see the list, and filter (eg. by finished, pending, failed state).

We might allow the user to create new commands. But these commands won't be written to the index. As only the command API will be able to write to the commands index.

Plan

• Create a new plugin with a basic layout to manager agent commands
• Mock data in an index and mock endpoints in the imposter so the UI has a minimum functionality
  • The mocks must be compliant with WCS (Wazuh common schema)
• The queries and data manipulation should only be possible with an internal user for security reasons.
  • To achieve this evaluate the possibility to use an index that starts with . [dot] so it's not listed with other indexes
• Determine basic RBAC roles and permissions to limit the interaction with the plugin

[Machi3mfl]

Update 2024/05/08

• Add commands index pattern

• Create commands overview page

• Adjust mocked data, and modify the script to add more readable data POC data persistence UX - agent commands #214 (comment)
• Create the command detail flyout POC data persistence UX - agent commands #214 (comment)
• Use the JSON and Table document detail to use in the command detail flyout (⏳ In progress)

[Machi3mfl]

Update 2024/06/08

Screen.Recording.2024-08-06.at.16.26.54.mov

Note

Added more readable data and adjusted command table columns. Also, the command detail flyout was added

[lucianogorza]

Data analysis

Analyzing the fields established in the commands index, we suggest adding some fields that are listed in the Process ECS:

• entity_id: To uniquely identify the process.
• name: To provide the user with a quick way to identify it. Example: ssh.
• start and end: To know when the process started and ended.
• command_line: So the user can see the exact command executed.