Wazuh icon

Wazuh

Work with the Wazuh Server API and Wazuh Indexer API

Actions15

Vulnerability → Run Command

AI-generated

Summary

Sends a Wazuh Active Response command to the specified agents, or to all agents when the Agents field is empty. The request can include command arguments, alert data, and a wait-for-completion setting.

Inputs

  • Command (required) — Active Response command name, for example !firewall-drop.
  • Agents — Comma-separated agent IDs. Leave empty to target all agents.
  • Arguments — Comma-separated arguments passed to the command.
  • Alert Data — JSON object sent as alert.data; defaults to {}. Must be a JSON object.
  • Wait for Complete — Whether to set Wazuh's wait_for_complete request parameter; defaults to false.

Output shape

A single response body per input item.

Calls the Wazuh Manager API with a PUT request to /active-response. The response body is returned as the output JSON; API errors fail the item unless Continue On Fail is enabled, in which case an error field is returned.

Examples

Example 1: Run `!firewall-drop` on selected agents, passing an IP as an argument.

Set Command to !firewall-drop, Agents to 001,002, and Arguments to the target IP.

Example 2: Run a command on all agents with alert context.

Leave Agents empty and provide an Alert Data JSON object; it is sent as alert.data.

Links

Discussion