Wazuh Agent blocking or stopping service from the manager

[Khem Bhatta]

Dear all members,

Is there any way we can stop the wazuh agent service or block the particular host from re-authing from the manager itself ? I know the feature of removing the wazuh agent and restarting the wazuh agent from the manager but I couldn't find stopping service or blocking service. I also did find the blocking particular IP in case of active response but in case of the agent itself being removed completely from the dashboard and not allowing it to auth again what can we do? 

[Alejandro Ruiz Gonzalez]

Hello Khembhatta,

Thanks for using Wazuh!

What is your requirement here? Could you give me more details about it?

From the Wazuh manager, there are a huge number of actions we can perform in our agents, we can delete, restart, upgrade, add to a group and many more. You can check the complete list here:

https://documentation.wazuh.com/current/user-manual/api/reference.html#tag/Agents

But, there is no way to stop the services from an agent remotely.

As you commented, we have an active-response script that we can use to block particular IPs. 

In your last question, you commented that an agent has been completely removed from the dashboard, which probably means that you have removed. If that is the case, you can register this agent again by following:

https://documentation.wazuh.com/current/installation-guide/wazuh-agent/index.html

Let me know if that information was useful to you.