Showing Wazuh Manager IP in the dashboard / alerts.json

[Haekal]

comp-win10 is an agent, and wazuh-manager is the manager. However, only the agent is displaying agent.ip. Is there a way to include the Wazuh manager's IP in the dashboard or alerts.json?

[Md. Nazmur Sakib]

Hi Haekal,

Hope you are doing well. Thank you for using Wazuh.

If you look at the difference between the Agent log and the Wazuh Manager log.

Agent:

Manager:

Inside the agent block the IP address is missing for the manager log. So it is not possible to display the IP address of the manager in the dashboard.

I hope this answers your questions. Please let me know if you need any further information.

Regards

Md. Nazmur Sakib

[Haekal]

There isnt any option or config i can change to add that natively inside wazuh? Why would you want to purposely not show wazuh manager IP?

[Md. Nazmur Sakib]

Hi  Haekal

Please allow me some time to check and get back to you.

[Md. Nazmur Sakib]

Hi Haekal,

Hope you are doing well. Sorry for the late response.

I was doing some study on this topic. Based on my findings.

In the Agent IP the ip of the agent which is forwarding the log to manager is mapped but for manager is not actually an agent and logs are not coming from a different source like agent’s log. So the agent IP part is missing for the manager log.

That is all I can tell at this moment. If I can make any further progress on this topic, I will let you know.

Regards

Md. Nazmur Sakib

[Haekal]

Hello  Nazmur, thank you for your response.

May I know where in the script the mapping process is taking place?

Looking forward to your response.

[Md. Nazmur Sakib]

Hi Haekal,

You can find it in the 

/etc/filebeat/wazuh-template.json file.