Skip to content

Commit 6f5d68c

Browse files
ayodekoayodeko
authored
Merge pull request #8763 from wazuh/enhancement/idr266-update-tools-reference
Update the Tools reference section
2 parents bb4bca2 + 4e49682 commit 6f5d68c

17 files changed

+318
-143
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ All notable changes to this project will be documented in this file.
2121
- **Post-release**: Added note about manual replication of `ossec.conf` between master and worker nodes. ([#8720](https://github.com/wazuh/wazuh-documentation/pull/8720))
2222
- **Post-release**: Added a table describing the possible environment statuses in the cloud service documentation. ([#8407](https://github.com/wazuh/wazuh-documentation/pull/8407))
2323
- **Post-release**: Added the Wazuh indexer API reference. ([#8756](https://github.com/wazuh/wazuh-documentation/pull/8756))
24+
- **Post-release**: Added examples of Wazuh tools to the user manual reference. ([#8763](https://github.com/wazuh/wazuh-documentation/pull/8763))
2425

2526
### Changed
2627

‎source/development/wazuh-logtest.rst‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@
22
33
.. meta::
44
:description: The Wazuh-Logtest solution is distributed by different components of the Wazuh environment: core logtest, wazuh RESTful API, and wazuh-logtest tool.
5-
6-
.. _dev-wazuh-logtest:
7-
85

96
Wazuh-Logtest
107
=============
@@ -23,18 +20,15 @@ The Wazuh-Logtest solution is distributed by different components of the Wazuh e
2320

2421
Wazuh-Logtest replacement for ossec-logtest tool.
2522

23+
Wazuh API and :doc:`wazuh-logtest tool </user-manual/reference/tools/wazuh-logtest>` connect to the wazuh-analysisd session manager, this acts as a sandbox with the rules engine, allowing to isolate different users with their own rules and decoders.
2624

27-
Wazuh API and :ref:`wazuh-logtest tool <wazuh-logtest>` connect to the wazuh-analysisd session manager, this acts as a
28-
sandbox with the rules engine, allowing to isolate different users with their own rules and decoders.
2925
The below show image illustrations how the user logs test flow through the Wazuh environment.
3026

3127
.. thumbnail:: ../images/development/logtest-flow.png
3228
:title: Wazuh Logtest
3329
:align: center
3430
:width: 100%
3531

36-
37-
3832
Sessions
3933
--------
4034

‎source/release-notes/release-3-7-0.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ The registries generated by the File Integrity Monitoring system are now stored
134134
Breaking changes
135135
^^^^^^^^^^^^^^^^
136136

137-
The old File Integrity Monitoring plain text databases are no longer in use. After the upgrading process, it's necessary to execute the :ref:`migration script <fim_migrate>` in order to preserve the previous FIM entries.
137+
The old File Integrity Monitoring plain text databases are no longer in use. After the upgrading process, it's necessary to execute the :doc:`migration script </user-manual/reference/tools/fim-migrate>` in order to preserve the previous FIM entries.
138138

139139
Distributed API requests in cluster mode
140140
----------------------------------------

‎source/user-manual/reference/daemons/wazuh-maild.rst‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,10 @@
33
.. meta::
44
:description: Learn about the wazuh-maild program that sends alerts via email in this section of the documentation.
55

6-
.. _wazuh-maild:
7-
86
wazuh-maild
97
=============
108

11-
The wazuh-maild program sends alerts via email. It is started by :ref:`wazuh-control`.
9+
The wazuh-maild program sends alerts via email. It is started by :doc:`../tools/wazuh-control`.
1210

1311
+-----------------+-------------------------------------------------------------------------------------------------+
1412
| **-c <config>** | Run using <config> as the configuration file. |

‎source/user-manual/reference/ossec-conf/rule-test.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ rule_test
1515
<rule_test>
1616
</rule_test>
1717
18-
Here is how to configure the Wazuh-Logtest solution. It allows to test rules and decoders from Wazuh API and :ref:`wazuh-logtest tool <wazuh-logtest>`
18+
Here is how to configure the Wazuh-Logtest solution. It allows to test rules and decoders from Wazuh API and :doc:`wazuh-logtest tool </user-manual/reference/tools/wazuh-logtest>`
1919

2020
Options
2121
-------

‎source/user-manual/reference/tools/agent-auth.rst‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@
77

88
Since Wazuh 4.0, by default, the agent registers automatically with the manager through enrollment. Configuration details can be found on :ref:`Enrollment section <reference_ossec_client>`.
99

10-
.. _agent-auth:
11-
1210
agent-auth
1311
==========
1412

@@ -72,3 +70,22 @@ The ``agent-auth`` program is the client application used along with :ref:`wazuh
7270
+----------------------------+------------------------------------------------------------------------------------------------------+
7371

7472
.. _`SSL ciphers`: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html
73+
74+
Example
75+
-------
76+
77+
Add agent with agent name ``Ubuntu24`` to Wazuh manager with IP address ``192.168.0.XX``:
78+
79+
.. code-block:: console
80+
81+
# /var/ossec/bin/agent-auth -A Ubuntu24 -m 192.168.0.XX
82+
83+
.. code-block:: none
84+
:class: output
85+
86+
2025/08/04 10:57:47 agent-auth: INFO: Started (pid: 111205).
87+
2025/08/04 10:57:47 agent-auth: INFO: Requesting a key from server: 192.168.0.XX
88+
2025/08/04 10:57:47 agent-auth: INFO: No authentication password provided
89+
2025/08/04 10:57:47 agent-auth: INFO: Using agent name as: Ubuntu24
90+
2025/08/04 10:57:47 agent-auth: INFO: Waiting for server reply
91+
2025/08/04 10:57:47 agent-auth: INFO: Valid key received

‎source/user-manual/reference/tools/agent-control.rst‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,17 @@
33
.. meta::
44
:description: Learn to query the manager for information about any agent or initiate a syscheck/rootcheck scan on an agent using the agent_control program.
55

6-
.. _agent_control:
7-
86
agent_control
97
=============
108

119
The agent_control program allows you to query the manager for information about any agent and also allows you to initiate a syscheck/rootcheck scan on an agent the next time it checks in.
1210

1311
With this tool, you can check the status of each available agent, which can be any of the following:
1412

15-
- Active: The agent is correctly connected to the manager.
16-
- Pending: The agent is waiting for a response from the manager.
17-
- Disconnected: The agent is not connected to the manager.
18-
- Never connected: The agent has never connected to the manager.
13+
- **Active**: The agent is correctly connected to the manager.
14+
- **Pending**: The agent is waiting for a response from the manager.
15+
- **Disconnected**: The agent is not connected to the manager.
16+
- **Never connected**: The agent has never connected to the manager.
1917

2018
agent_control options
2119
---------------------
@@ -59,8 +57,20 @@ agent_control options for Active Response
5957

6058
.. note::
6159

62-
The active-response identifier for use with the ``-f`` option is composed of the command name followed by the value indicated in the ``timeout`` option (active-response block). If ``timeout_allowed`` (command block) is set to no, or no timeout has been specified, the number next to the command name is 0.
60+
The active-response identifier for use with the ``-f`` option is composed of the command name followed by the value indicated in the ``timeout`` option (active-response block). If ``timeout_allowed`` (command block) is set to no, or no timeout has been specified, the number next to the command name is 0.
61+
62+
You can verify the identifier of an active response with the first column of ``/var/ossec/etc/shared/ar.conf``.
63+
64+
Example
65+
-------
66+
67+
Restart an agent:
68+
69+
.. code-block:: console
70+
71+
# /var/ossec/bin/agent_control -R -u 001
6372
64-
|
73+
.. code-block:: none
74+
:class: output
6575
66-
You can verify the identifier of an active response with the first column of ``/var/ossec/etc/shared/ar.conf``.
76+
Wazuh agent_control: Restarting agent: 001

‎source/user-manual/reference/tools/agent-upgrade.rst‎

Lines changed: 43 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
33
.. meta::
44
:description: List outdated agents and upgrade them using the agent_upgrade program. Learn more about it in this section of the Wazuh documentation.
5-
6-
.. _agent_upgrade:
75

86
agent_upgrade
97
==============
@@ -46,82 +44,77 @@ The agent_upgrade program allows you to list outdated agents and upgrade them.
4644
Examples
4745
----------
4846

49-
* List outdated agents:
47+
- List outdated agents:
5048

51-
.. code-block:: console
49+
.. code-block:: console
5250
53-
# /var/ossec/bin/agent_upgrade -l
51+
# /var/ossec/bin/agent_upgrade -l
5452
55-
.. code-block:: none
56-
:class: output
53+
.. code-block:: none
54+
:class: output
5755
58-
ID Name Version
59-
002 VM_Debian9 Wazuh v3.13.2
60-
003 VM_Debian8 Wazuh v3.13.2
61-
009 VM_WinServ2016 Wazuh v3.10.1
56+
ID Name Version
57+
002 VM_Debian9 Wazuh v4.2.0
58+
003 VM_Debian8 Wazuh v4.2.0
59+
004 VM_WinServ2016 Wazuh v4.1.0
6260
63-
Total outdated agents: 3
61+
Total outdated agents: 3
6462
63+
- Upgrade agent:
6564

66-
* Upgrade agent:
65+
.. code-block:: console
6766
68-
.. code-block:: console
67+
# /var/ossec/bin/agent_upgrade -a 002
6968
70-
# /var/ossec/bin/agent_upgrade -a 002
69+
.. code-block:: none
70+
:class: output
7171
72-
.. code-block:: none
73-
:class: output
72+
Upgrading...
7473
75-
Upgrading...
74+
Upgraded agents:
75+
Agent 002 upgraded: Wazuh v4.2.0 -> |WAZUH_CURRENT|
7676
77-
Upgraded agents:
78-
Agent 002 upgraded: Wazuh v3.13.2 -> |WAZUH_CURRENT|
77+
- Upgrade multiple agents:
7978

79+
.. code-block:: console
8080
81-
* Upgrade multiple agents:
81+
# /var/ossec/bin/agent_upgrade -a 003 004
8282
83-
.. code-block:: console
83+
.. code-block:: none
84+
:class: output
8485
85-
# /var/ossec/bin/agent_upgrade -a 001 002
86+
Upgrading...
8687
87-
.. code-block:: none
88-
:class: output
88+
Upgraded agents:
89+
Agent 003 upgraded: Wazuh v4.2.0 -> |WAZUH_CURRENT|
90+
Agent 004 upgraded: Wazuh v4.1.0 -> |WAZUH_CURRENT|
8991
90-
Upgrading...
92+
- Upgrade agent using a custom repository:
9193

92-
Upgraded agents:
93-
Agent 001 upgraded: Wazuh v4.2.0 -> |WAZUH_CURRENT|
94-
Agent 002 upgraded: Wazuh v4.0.0 -> |WAZUH_CURRENT|
94+
.. code-block:: console
9595
96+
# /var/ossec/bin/agent_upgrade -a 002 -v v|WAZUH_CURRENT| -r http://mycompany.wpkrepo.com/
9697
97-
* Upgrade agent using a custom repository:
98+
.. code-block:: none
99+
:class: output
98100
99-
.. code-block:: console
101+
Upgrading...
100102
101-
# /var/ossec/bin/agent_upgrade -a 002 -v v4.0.0 -r http://mycompany.wpkrepo.com/
103+
Upgraded agents:
104+
Agent 002 upgraded: Wazuh v4.2.0 -> |WAZUH_CURRENT|
102105
103-
.. code-block:: none
104-
:class: output
106+
- Install custom WPK file:
105107

106-
Upgrading...
108+
.. code-block:: console
107109
108-
Upgraded agents:
109-
Agent 002 upgraded: Wazuh v3.13.2 -> 4.0.0
110+
# /var/ossec/bin/agent_upgrade -a 002 -d -f /root/upgrade_openscap_debian.wpk -x install.sh
110111
112+
.. code-block:: none
113+
:class: output
111114
112-
* Install custom WPK file:
113-
114-
.. code-block:: console
115-
116-
# /var/ossec/bin/agent_upgrade -a 002 -d -f /root/upgrade_openscap_debian.wpk -x install.sh
117-
118-
.. code-block:: none
119-
:class: output
120-
121-
Upgrading...
122-
123-
Upgraded agents:
124-
Agent 002 upgraded: Wazuh v3.13.2 -> 4.0.0
115+
Upgrading...
125116
117+
Upgraded agents:
118+
Agent 002 upgraded: Wazuh v4.2.0 -> |WAZUH_CURRENT|
126119
127120
.. note:: When the agent finishes updating, it is automatically restarted to apply the new configuration.

‎source/user-manual/reference/tools/clear-stats.rst‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33
.. meta::
44
:description: The Wazuh clear_stats tool clears event stats. Learn more about this feature.
55

6-
.. _clear_stats:
7-
86
clear_stats
97
===========
108

@@ -19,3 +17,17 @@ The clear_stats program clears the events stats.
1917
+--------+------------------------------+
2018
| **-w** | Clear the weekly averages. |
2119
+--------+------------------------------+
20+
21+
Example
22+
-------
23+
24+
Clear daily averages:
25+
26+
.. code-block:: console
27+
28+
# /var/ossec/bin/clear_stats -d
29+
30+
.. code-block:: none
31+
:class: output
32+
33+
** Internal stats clear.

‎source/user-manual/reference/tools/cluster-control.rst‎

Lines changed: 20 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
33
.. meta::
44
:description: Manage the Wazuh cluster from any manager using the cluster_control program. Learn more about it in this section of the Wazuh documentation.
5-
6-
.. _cluster_control:
75

86
cluster_control
97
===============
@@ -14,26 +12,26 @@ in order to use this tool.
1412
cluster_control options
1513
-----------------------
1614

17-
+-----------------------------------------+---------------------------------------------------+
18-
| Option name | Option description |
19-
+=========================================+===================================================+
20-
| ``-h, --help`` | Display the help message. |
21-
+-----------------------------------------+---------------------------------------------------+
22-
| ``-i, --health [more] [-fs]`` | Display the cluster's healthcheck. |
23-
+-----------------------------------------+---------------------------------------------------+
24-
| ``-l, --list-nodes [-fn]`` | Display connected nodes in the cluster. |
25-
+-----------------------------------------+---------------------------------------------------+
26-
| ``-d, --debug`` | Show debug messages. |
27-
+-----------------------------------------+---------------------------------------------------+
28-
| ``-a, --list-agents [-fs] [-fn]`` | Display agents in the cluster. |
29-
+-----------------------------------------+---------------------------------------------------+
30-
| ``-fn, --filter-node [NODE_NAME]`` | Display information of specified node(s) only |
31-
+-----------------------------------------+---------------------------------------------------+
32-
| ``-fs, --filter-agent-status [STATUS]`` | Display agents with the specified status(es) only |
33-
+-----------------------------------------+---------------------------------------------------+
34-
35-
Examples of use
36-
---------------
15+
+---------------------------------------------+---------------------------------------------------+
16+
| Option name | Option description |
17+
+=============================================+===================================================+
18+
| ``-h``, ``--help`` | Display the help message. |
19+
+---------------------------------------------+---------------------------------------------------+
20+
| ``-i``, ``--health [more] [-fs]`` | Display the cluster's healthcheck. |
21+
+---------------------------------------------+---------------------------------------------------+
22+
| ``-l``, ``--list-nodes [-fn]`` | Display connected nodes in the cluster. |
23+
+---------------------------------------------+---------------------------------------------------+
24+
| ``-d``, ``--debug`` | Show debug messages. |
25+
+---------------------------------------------+---------------------------------------------------+
26+
| ``-a``, ``--list-agents [-fs] [-fn]`` | Display agents in the cluster. |
27+
+---------------------------------------------+---------------------------------------------------+
28+
| ``-fn``, ``--filter-node [NODE_NAME]`` | Display information of specified node(s) only |
29+
+---------------------------------------------+---------------------------------------------------+
30+
| ``-fs``, ``--filter-agent-status [STATUS]`` | Display agents with the specified status(es) only |
31+
+---------------------------------------------+---------------------------------------------------+
32+
33+
Examples
34+
--------
3735

3836
Get cluster's healthcheck
3937
^^^^^^^^^^^^^^^^^^^^^^^^^^^

0 commit comments

Comments
 (0)