view bulk installed packages

[Athan Espinoza]

Hi, I have a question. Is there any handle or additional tool to access packages in an automated and massive way?

Let me explain... in order to see if there is any tool installed on many computers without having to check them one by one (which is laborious).

I tried a tool that added a module to Wazuh called "Wazuh-Inventory-Automation" but it didn't seem to work, "I'm not sure if it's because it doesn't work in the current version of Wazuh or if I need to learn more."

Regards.

[Mauricio Ruben Santillan]

Hello Athan,

Wazuh API provides an endpoint to get packages data from agents:

GET /syscollector/<AGENT_ID_HERE>/packages

And you can also set some filters to this query. There's related information here: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_packages_info

The only problem here, is that this endpoint will run per agent since, as you can see, the agent_ID is part of the endpoint itself.

The possible workaround you can apply then, is to create a script. This script will need to get a list of your agents (GET /agents), and based on that agents list output, run the endpoint explained here to each agent of the output.

I hope this helps. Let me know!