Active Response - Manual Tigger scripts

[heinola]

In the prior SO version I have used I could issue a agent_control for lets say route-null to one or all my agents. Is there a function like this still in so2 ?

[dougburks]

agent_control is still there, it's just inside the Wazuh container. You should be able to execute it using docker exec similar to some of the examples at:
https://docs.securityonion.net/en/2.3/wazuh.html

[heinola]

Thank you all