Retrieve recent OSSEC security alerts with optional filtering.

Args: limit: Maximum number of alerts to return (default: 50, max: 500). level_min: Minimum alert severity level (0-16). Level 0 = ignored, 3 = successful events, 5 = user errors, 7 = bad words, 10 = multiple failures, 12 = high importance, 15 = severe. level_max: Maximum alert severity level (0-16). group: Filter by rule group (e.g., 'syslog', 'sshd', 'authentication_failed'). search: Free-text search across alert content. time_range: Time range filter. Examples: '1h' (last hour), '24h' (last day), '7d' (last week), '30m' (last 30 minutes).

Returns: JSON array of alert objects containing timestamp, rule info, agent details, etc.

Get a summary of OSSEC alerts over a time period.

Provides counts grouped by severity level, rule group, and top triggered rules.

Args: time_range: Time range to summarize. Examples: '1h', '24h', '7d'. Default: '24h'.

Returns: JSON summary with alert counts by level, group, and top rules.

Search OSSEC alerts using a free-text query.

Searches across all alert fields including rule descriptions, source IPs, agent names, log content, and more.

Args: query: Search string to match across alert content. limit: Maximum number of matching alerts to return (default: 50). time_range: Optional time range filter (e.g., '1h', '24h', '7d').

Returns: JSON array of matching alert objects.

List all OSSEC agents managed by this server.

Retrieves the full list of agents including their ID, name, IP address, and status information.

Args: status: Optional filter by agent status. Valid values: 'active', 'disconnected', 'never_connected', 'pending'. If not specified, returns all agents.

Returns: JSON array of agent objects with id, name, ip, and status.

Get detailed information about a specific OSSEC agent.

Retrieves comprehensive details including agent name, IP, OS info, last keep-alive time, group membership, and current status.

Args: agent_id: The agent ID (e.g., '001', '002'). Use '000' for the manager.

Returns: JSON object with detailed agent information.

Add a new agent to the OSSEC manager.

Registers a new agent with the specified name and IP address. The agent will need to be authenticated and configured to connect.

Args: name: Unique name for the new agent (e.g., 'webserver-01'). ip: IP address of the agent (e.g., '10.0.0.10'). Use 'any' for dynamic IPs.

Returns: JSON object with the result including the new agent's ID and key.

Remove an agent from the OSSEC manager.

Permanently removes the agent registration. The agent will no longer be able to connect to the manager.

Args: agent_id: The agent ID to remove (e.g., '001').

Returns: JSON object indicating success or failure.

Restart a specific OSSEC agent.

Sends a restart command to the agent, causing it to reload its configuration and reconnect.

Args: agent_id: The agent ID to restart (e.g., '001').

Returns: JSON object indicating success or failure.

Search and retrieve OSSEC detection rules.

OSSEC rules define what events trigger alerts. Each rule has an ID, severity level, group classification, and matching criteria.

Args: rule_id: Filter by specific rule ID (e.g., '5710' for SSH brute force). level_min: Minimum rule level (0-16). level_max: Maximum rule level (0-16). group: Filter by rule group (e.g., 'sshd', 'web', 'syslog', 'authentication_failed'). search: Free-text search in rule descriptions. filename: Filter by rule file name (e.g., 'sshd_rules.xml').

Returns: JSON array of rule objects with id, level, description, groups, and match criteria.

Get the full details of a specific OSSEC rule by its ID.

Returns the complete rule definition including all matching criteria, parent rules, frequency settings, and associated group.

Args: rule_id: The rule ID to look up (e.g., '5710').

Returns: JSON object with the complete rule definition.

List all OSSEC rule files.

Returns the file names of all rule XML files, which can be used to inspect or filter rules by file.

Returns: JSON array of rule file information including filename and path.

Search and retrieve OSSEC log decoders.

Decoders are used to parse and normalize log data before it is evaluated against rules. They extract fields like source IP, username, program name, etc.

Args: search: Free-text search in decoder names. filename: Filter by decoder file name (e.g., 'local_decoder.xml').

Returns: JSON array of decoder objects with name, parent, fields extracted, etc.

Get File Integrity Monitoring (FIM) results for an agent.

Syscheck monitors files and directories for changes. It detects modifications to file content, permissions, ownership, and attributes.

Args: agent_id: Agent ID to query (default: '000' for the manager). file: Optional specific file path to check (e.g., '/etc/passwd').

Returns: JSON object with syscheck results including changed files and their details.

Trigger a File Integrity Monitoring scan on an agent.

Initiates a new syscheck scan that will check all monitored files and directories for changes since the last scan.

Args: agent_id: Agent ID to scan (default: '000' for the manager).

Returns: JSON object indicating whether the scan was triggered successfully.

Clear the syscheck database for an agent.

Removes all stored file integrity data. The next scan will create a new baseline.

Args: agent_id: Agent ID whose database to clear (default: '000' for the manager).

Returns: JSON object indicating success or failure.

Get rootcheck results for an agent.

Rootcheck performs system auditing, checking for rootkits, trojans, hidden processes, suspicious files, and system anomalies.

Args: agent_id: Agent ID to query (default: '000' for the manager).

Returns: JSON object with rootcheck findings.

Trigger a rootcheck scan on an agent.

Initiates a new rootcheck scan that will check for rootkits, trojans, and other security issues.

Args: agent_id: Agent ID to scan (default: '000' for the manager).

Returns: JSON object indicating whether the scan was triggered successfully.

Get the current status of all OSSEC services.

Checks whether each OSSEC daemon is running or stopped, including: ossec-analysisd, ossec-remoted, ossec-syscheckd, ossec-logcollector, ossec-maild, ossec-execd, and ossec-monitord.

Returns: JSON object with service status, running count, and overall state.

Restart all OSSEC services.

Stops and restarts all OSSEC daemons. Use this after making configuration changes to apply them.

Returns: JSON object indicating success or failure with service output.

Get OSSEC internal logs (ossec.log).

Retrieves the latest entries from OSSEC's own log file, useful for troubleshooting and monitoring OSSEC's operation.

Args: lines: Number of log lines to retrieve (default: 100). category: Optional filter by log category (e.g., 'ossec-analysisd', 'ossec-remoted', 'error', 'warning').

Returns: JSON array of log lines.

Get OSSEC processing statistics.

Retrieves statistics about events analyzed, alerts generated, firewall events, and other metrics.

Args: date: Optional date filter (YYYY-MM-DD format). Default: current day.

Returns: JSON object with statistical data.

Read the OSSEC configuration (ossec.conf).

Retrieves the parsed configuration. Can return the full config or a specific section.

Args: section: Optional configuration section to retrieve. Common sections: 'global', 'alerts', 'syscheck', 'rootcheck', 'localfile', 'remote', 'rules', 'command', 'active-response', 'syslog_output'. If not specified, returns the full configuration.

Returns: JSON object with the parsed configuration.

Get the raw OSSEC configuration file content.

Returns the complete ossec.conf file as plain text, preserving all XML formatting and comments.

Returns: The raw content of ossec.conf.

Test a log line against OSSEC rules and decoders.

Runs a log line through OSSEC's analysis engine to see how it would be decoded, which rules it matches, and what alert level it would generate. Extremely useful for debugging rules and decoders.

Args: log_line: The log line to test (e.g., a syslog line, auth.log entry, etc.). verbose: If True, include verbose rule matching details.

Returns: JSON object with decoding results, matched rules, and alert info.

Example log lines to test: - 'Mar 12 10:00:00 server sshd[1234]: Failed password for root from 10.0.0.1 port 22' - 'Mar 12 10:00:00 server sudo: user1 : TTY=pts/0 ; PWD=/home ; COMMAND=/bin/su -'

Get configured active response rules.

Active responses are automated actions OSSEC can take when specific alerts trigger, such as blocking an IP, restarting a service, or running a custom script.

Returns: JSON array of active response configurations including command, location, rules_id, and timeout.

Execute an active response command on an agent.

Triggers a configured active response action on a specific agent. Common commands include firewall-drop, host-deny, disable-account, etc.

⚠️ WARNING: This performs real actions on the agent! Ensure you understand the command's effect before executing.

Args: agent_id: Target agent ID (e.g., '001'). Use '000' for the manager. command: Active response command name (e.g., 'firewall-drop', 'host-deny', 'restart-ossec', 'disable-account'). arguments: Optional space-separated arguments (e.g., IP to block: '10.0.0.5').

Returns: JSON object indicating success or failure.