Actions15
- Active Response Actions
- Agent Actions
- Decoder Actions
- Indexer Actions
- Rule Actions
- Security Event Actions
- Vulnerability Actions
Agent → Run Command
AI-generatedSummary
Sends a Wazuh Active Response command to the specified agents, or to all agents when the Agents field is empty. Passes optional command arguments and alert data to the Wazuh Manager API.
Inputs
- Command (required) — Active Response command name, such as !firewall-drop.
- Agents — Comma-separated agent IDs; leave empty to target all agents.
- Arguments — Optional comma-separated arguments passed to the command.
- Alert Data — JSON object sent as alert.data; defaults to {} and is omitted from the request when empty.
- Wait for Complete — Defaults to false; passed to the API as wait_for_complete to control its timeout response.
Output shape
A single Wazuh Manager API response body per input item.
The request uses PUT /active-response. Non-empty arguments are sent as an array and non-empty alert data as alert.data. Invalid Alert Data JSON or a non-object value raises an error; with Continue On Fail, the item instead contains an error field.