Aggregated CIS Report of all Wazuh Agents

[Jerome Nelson Jayaprakash]

Hello Community,

I need to export CIS Benchmark report of all the agents in my Wazuh server which runs on v4.3.10. I have tried some python script, but no luck. Please help me with a script to get the CIS report.

Thanks,

Jerome

[Kasim Mustapha]

Hello Jerome,

I'm sorry for not getting back to you sooner.

You can export the events but the dashboards are built-in. Alternatively, you could create a similar dashboard in the visualization and export those.

The filter for the cis benchmark is --> rule.groups:sca

I hope this helps. Let me know if you have further questions.

Regards,

Kasim Mustapha

[Jerome Nelson Jayaprakash]

Hi Kasim,

Thanks for the reply.

I have created a dashboard and added the filter to it, however, it ain't work well for me. Please refer to the attachment and correct if am wrong.

And my actual requirement is to get the consolidated report of the pass, fail and score of all the agents.

Thanks,

Jerome

[Kasim Mustapha]

Hello Jerome,

Apologies for not getting back to you sooner.

I created a sample visualization to display the results for all agents in a pie chart with the following configurations;

The result is as follows;

You export this as a report.

I hope this helps. Let me know if you have further questions.

[Jerome Nelson Jayaprakash]

Hi Kasim,

Thanks for the email with the samples.

I have tried the same but I am having trouble with the configuration.

I couldn't the slice size option in the data metrics. It is not listed in the ADD METRIC section. Am I missing anything?

I have attached the sample SS. Please refer to that and provide your input.

Thanks,

Jerome

[Kasim Mustapha]

Hello Jerome,

Sorry for the late response.

You are not adding other metrics.

You are slicing the buckets.

This is what the bucket configuration would look like.

I hope this answers your questions. 

Let me know if you have further concerns.

[Jerome Nelson Jayaprakash]

Hi Kasim,

I have configured the visualization and have attached the SS.

But our requirement is that we need to see the consolidated report of all the agents with passed, failed and scores of each on a whole.

I have attached the CSV sheet which I exported from Wazuh with the Python script. I used to export the report and share it with my manager on a daily basis. And now I lost the script when my system crashed and couldn't rebuild a new one. 

Could u pls help me with getting such report?

Thanks,

Jerome

[Vinicius Lehmann]

Hello, 

I had the same need and ended up creating a python script that makes requests to Wazuh's API and returns the result in an excel spreadsheet.

[Jerome Nelson Jayaprakash]

Hi Vinicius,

Thanks for the script. It works very well as expected. 

I am able to pull the CIS report of all the agents. I can now extract the summary report from the result.