Run an OpenSearch query DSL request against a Wazuh 5 index pattern.

Returns the raw JSON response, including aggregations, preceded by a diagnostics block when the result needs interpretation (zero hits, a truncated total, or an aggregation that covers only part of the result set).

Common patterns:

• wazuh-events-v5-* all events

• wazuh-findings-v5-* all detection findings

• wazuh-events-v5-* one of: access-management, applications, cloud-services, network-activity, other, security, system-activity, unclassified

These are datastreams. Always query the wildcard pattern, never a backing index such as .ds-wazuh-events-v5-network-activity-000001.

The time field is @timestamp. There is no timestamp field in Wazuh 5. Set "track_total_hits": true whenever you need an exact count; without it OpenSearch stops counting at 10000.

A "size" larger than WAZUH_SEARCH_MAX_SIZE (default 100) is lowered to that limit before the query is sent, and the diagnostics block says so. Use "size": 0 with aggregations to count without pulling documents.

Args: index: Index or datastream pattern, e.g. "wazuh-events-v5-network-activity*". body: OpenSearch query DSL as a JSON string.

List the fields of a Wazuh 5 index and how many documents actually fill them.

Use this before writing any aggregation. The Wazuh 5 engine schema defines 2351 fields, and a mapped field is not necessarily a populated one: agent.id and wazuh.agent.id are both mapped as keyword, but only wazuh.agent.id ever carries a value. Aggregating on the wrong one returns zero buckets and HTTP 200 — no error at all. With only_populated=true this tool reports the document count per field, which makes that distinction visible.

Namespace sizes in the engine schema: wazuh=492, threat=444, process=391, file=144, tls=77, host=57, observer=53, dll=46, user=46, client=35, destination=35, server=35.

Args: index: Index or datastream pattern, e.g. "wazuh-events-v5-network-activity*". prefix: Restrict to a field namespace, e.g. "wazuh." or "source.". Strongly recommended — an unfiltered listing over 2351 fields is capped. only_populated: When true (default), issue a second pass with exists aggregations and return only fields holding a value in at least one document.

Run a raw log line through the Wazuh 5 decoder chain and return the result.

Calls the Content Manager plugin on the indexer. The response shows which decoders matched and what the normalised WCS document looks like, which is the way to find out why a field is empty in the index.

Args: event: The raw log line to decode. location: Log source path, e.g. "/var/ossec/logs/opnsense_syslog.log". queue: Queue id of the originating source. Defaults to 49. space: One of test, custom, standard — logtest supports no others. Custom decoders live in "custom"; "standard" carries only the shipped ruleset. A valid name does not guarantee the environment is provisioned — use the tester_sessions tool to see which ones exist and are enabled. trace_level: One of NONE, ASSET_ONLY, ALL. Defaults to ASSET_ONLY, which is the level that reveals the matched decoder chain. NONE returns the normalised event only; ALL adds per-asset trace detail. integration: Integration name for the detection phase. Without it the plugin normalises the event and reports detection as "skipped".

Issue a GET against the Wazuh manager API and return the response unchanged.

A deliberately thin passthrough. The manager API is the volatile half of Wazuh 5 and breaks further at GA (/var/ossec moves to /var/wazuh-manager, clustering becomes the default, agent id 000 disappears), so this tool adds no interpretation on top of it.

Non-2xx responses are returned as they are, status code included. In Wazuh 5 several 4.x endpoints are gone and their 404 is the correct answer, not a failure to hide:

• /rules 404, the Engine has no RULE content type any more

• /manager/logs 404

• /manager/stats/remoted 404 Verified working: /agents, /syscollector/{agent_id}/... Changed response schemas: /cluster/healthcheck (no enabled field), /cluster/nodes (no node_type field).

The security root is restricted to /security/users/me and /security/users/me/policies — enough to tell RBAC filtering apart from an empty deployment when /agents returns less than expected, without enumerating the deployment's accounts, roles and policies through a tool meant for agent and event data.

Args: path: Manager API path, e.g. "/agents". params: Optional query parameters.

List or fetch OpenSearch Security Analytics detectors.

Detection in Wazuh 5 lives in the indexer, not in the Engine. These detectors are what produces the documents in wazuh-findings-v5-*.

The plugin exposes no list-all endpoint, so list is implemented as POST /_plugins/_security_analytics/detectors/_search with match_all. Detector documents are nested under the detector path, which matters if you search them by name.

Args: action: "list" for all detectors, "get" for a single one by id. detector_id: Required when action is "get". size: Maximum number of detectors to return for "list". Defaults to 50.

List the Wazuh 5 engine test sessions — the environments logtest can use.

logtest answers a call naming an environment that does not exist with HTTP 200 and "The '' environment does not exist" buried in the body. This tool is how to find out which environments there actually are, and whether they are enabled.

Calls POST /_internal/tester/table/get on the engine's internal HTTP API. That server runs inside the manager container on its own port, so it needs WAZUH_ENGINE_URL — the indexer and manager URLs do not reach it.

Read-only by design. The engine also exposes session/post, session/delete and session/reload; none of them are wired up here. Sessions are recreated on every policy import through the Content Manager API, so a hand-made session disappears at the next import — a create tool would only invite a workaround that does not hold.

Args: action: Only "list" is supported.

Summarise wazuh-findings-v5-* by severity, agent, rule title and category.

A frozen query for the breakdown every report starts with, so that producing it needs no valid OpenSearch query DSL. search still covers everything else; this tool only removes the need to hand-write the one aggregation that recurs.

Severity is wazuh.rule.level, a keyword holding a string — critical, high, medium, low, informational — not a Wazuh 4.x numeric level. The whole scale is printed in canonical order with an explicit 0 for the levels that did not occur, because a terms aggregation returns only the values it found: a missing critical bucket cannot distinguish "none occurred" from "never populated". Any value outside the scale is listed as well and marked UNKNOWN. Before aggregating, the tool probes whether wazuh.rule.level is populated at all and says so instead of printing a table of zeros.

Output is a compact set of tables, not raw JSON. The request that produced them is in the footer if you want to re-run or extend it via search.

Args: hours: Size of the time window ending now, in hours. Default 24. top_agents: How many agents to list, by finding count. Default 10. top_titles: How many rule titles to list. Default 10.

Measure what share of the documents actually carries a value per field.

The normalisation-quality measurement, callable without query DSL. For each mapped field it reports the document count and coverage inside a time window and across the whole datastream, because those are different questions:

event.action, wazuh-events-v5-network-activity*
  whole datastream (10,238,381 docs)     8.1%
  last 24 hours       (348,247 docs)    71.0%
  last 12 hours                        100.0%

A decoder fix had landed hours earlier. All three numbers are correct. The window describes the pipeline as it runs now, the datastream describes the stored history — quote the one you mean. When they differ by more than 20 percentage points the diagnostics block says so explicitly, because that gap is the signature of a change in normalisation inside the datastream.

Fields with 0% coverage are listed, never filtered: mapped-but-never- populated is the agent.id trap and the most important result this measurement produces.

Coverage is three-valued — populated, not populated, not measurable. An exists aggregation returns 0 for a field the mapping declares "index": false no matter what the documents hold, so the mapping is read first and such fields are reported as not measurable, with dashes, never as 0%. Verified: event.original in wazuh-events-v5-network-activity* is index:false and doc_values:false, matches 0 of 10,243,389 documents, and carries the complete raw log line in _source of every document sampled. For those fields the tool samples _source and reports in how many of the sampled documents the key is present — evidence rather than a coverage figure.

Cost scales with the field count — the schema has 2351 fields — so the listing is capped at WAZUH_SCHEMA_FIELD_LIMIT (default 200) and the cap is reported. Pass a prefix to measure a namespace instead of a truncation.

Args: index: Index or datastream pattern, e.g. "wazuh-events-v5-network-activity*". prefix: Restrict to a field namespace, e.g. "source." or "wazuh.". hours: Size of the time window ending now, in hours. Default 24. min_docs: Hide fields below this document count in the window. Default 0, which hides nothing. Any higher value removes the 0% fields — the ones worth looking at — so the output says how many it dropped.