Agent Deletion

[John Carry]

Hello Wazuh Team,

Is it possible can we delete the an agent entry in the agent tab? if yes please provide the reference or the method.

Regards,

John Carry

[Pacome Kemkeu]

Hello John !

To remove the agents, you have 2 alternatives:

1- Using the CLI, for this I leave you the following documentation:
https://documentation.wazuh.com/current/user-manual/agents/remove-agents/remove.html

2- Using the Wazuh’s API, performing the calls through the Wazuh dashboard app:

To do this, you need to go to Wazuh -> Tools -> API Console .
Then, run the API calls according to the documentation.

Below a few example on how to perform your request:

DELETE /agents?agents_list=100&status=all. You will need to replace 100 with the agent ID you want to remove. The status field is required. In my example, means that we delete the agent no matter the state.

You can also delete agents that have been disconnected for a certain period of time with the following call:
DELETE /agents?status=disconnected&older_than=30d&agents_list=all

The same can be done with never connected agents:
DELETE /agents?status=never_connected&older_than=1d&agents_list=all

Also, feel free to check our API reference, to learn more about the calls you can perform:
https://documentation.wazuh.com/current/user-manual/api/reference.html

I hope this helps you!

Regards,