Actions15
- Active Response Actions
- Agent Actions
- Decoder Actions
- Indexer Actions
- Rule Actions
- Security Event Actions
- Vulnerability Actions
Indexer → Run Command
AI-generatedSummary
Run a Wazuh Active Response command through the Wazuh Manager API. Choose a command and optionally target agents, pass command arguments or alert data, and set whether the API should wait for completion.
Inputs
- Command (required) — Active Response command name.
- Agents — Comma-separated agent IDs. Leave blank to run the command on all agents.
- Arguments — Comma-separated arguments passed to the command.
- Alert Data — JSON object sent as alert.data in the request; defaults to {}.
- Wait for Complete — Whether to disable the Wazuh API timeout response; defaults to false.
Output shape
A single response object for each input item.
Returns the Wazuh Manager API response body. Empty Arguments and Alert Data are omitted from the request payload. Requires Wazuh Manager API credentials.