Wazuh api PUT rules file

[Maxim Parpaley]

Hello,

I'm using Wazuh version 4.3.10 and I use Postman to upload a file rule.

When i upload file rule from my computer , it work normal.

I use wazuh dashboard and F12 in tab network i get a request save file rule.

I see in header request with content-type: application/json

I use the same with Postman as web

but it not work and has response like that.

How can i solve this situation?

Best Regards,

[Matias Braida]

Hello Maxim,
First of all, thanks for using Wazuh.
Let me check some documentation and I will be back with an answer as soon as possible.
Regards

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/ba1b4976-771b-40a4-b168-a588a8c1aff4n%40googlegroups.com.

--

Matias S. Braida Software Engineer

[Matias Braida]

Hello Maxim,

Please follow this documentation to create/update a rule file using the manager API.
Link: https://documentation.wazuh.com/4.3/user-manual/api/reference.html#operation/api.controllers.rule_controller.put_file

I think the error that is happening to you is that header "Content-Type" has the wrong value. Please set it to "application/octet-stream" and try again.

I also have tested locally with postman. I attached the screens of the request.









Hope this helps.
Regards

[taimur ahmed]

I am having the same sort of issue but I want to send a custom rules file to the manager instead of writing a rule in an existing file. Please guide me how to solve it

[Matias Braida]

Hello Taimur,

First of all, thanks for using Wazuh.

I see the Postman screenshots you sent. I reproduced it on my local machine and it works. I attached my screenshot to show you.
I think that the problem you are having is that in the request URL, the text "{{rule_filename}}" needs to be a Postman variable. If you don't have defined a Postman variable with the name "rule_filename", then the request will fail.

I attached a screenshot of where you need to define variables in Postman. (image variables.png)
You could also take a look at this Postman documentation link about defining variables: https://learning.postman.com/docs/sending-requests/variables

But if you don't want to define a variable, you could directly write the rule filename in the request URL. I also attached an image using your specific values. (image request.png)

When you create the rule correctly, you will find the new file in the directory "/var/ossec/etc/rules".

Please tell me if this helps.
Regards