Renaming Windows Device is not reflected Wazuh

[Leon Scott]

Hello guru's

I have renamed a device via the Windows 10 control panel interface.

This is mainly so I can easily identify the said machine and user as I have a few though not as many as most of you.

The Wazuh manager is not recognizing the new name and updating the appropriate historic records.  This is not trivial. Agent is configured to use the machine name.

Device was renamed prior and with restart to installation of upgrade from Windows 10 version 10.0.19045.2486 to version 10.0.19045.2586.

You will note in your vulnerability module that the final numbers are not reflected, which I believe is causing issues with Windows 11 devices, but not proven.

Thanks for putting up with me.

Regards

Leon.

[Adedamola Okelola]

Hello Leon,
Thank you for using Wazuh!

I absolutely understand your concern after renaming the endpoint and it's registered as a new agent on the Wazuh manager. 

Have in mind that, when you rename an agent, Wazuh manager does not update the agent details but instead registers it as a new addition to the agent pool.

Wazuh does not have specific functionality that allows users to rename an already registered agent, however, you can use the workaround below.

To rename an agent you can make use of the insert API endpoint. For example:

1. Get the current agent's values with an API call from Wazuh -> API console (I'm using the agent id 002 as an example, replace it with the id of the agent you want to rename, and take note of these values):

 GET /agents?agents_list=002&select=name,id,registerIP

Also, take note of the groups to which the agent belongs.

2. On the agent side, bring down the agent service to prevent it to re-register automatically with a new ID, you can do this from the GUI in the Manage menu → Stop. On Linux, agents it is systemctl stop wazuh-agent.

3. Delete the current agent (replace the id of the agent with yours):

DELETE /agents?agent_list=022&status=all&older_than=0d&purge=true

4. Insert the agent again with the same id and the new name, also you will need to provide a key which is a pseudo-random seed (it must have at least 64 characters, you can find generators online for this).
POST /agents/insert { "name": "new-name", "ip": "any", "id": "002", "key": "6ac03f4c18eac5132cb7b3f26d3a9b466ffc0cb2f8f00194dj7230b6ee33f0e9"

You will get an output with a hash/key, you need to copy this so you set it in your agent.

5. Now on the agent, open your Wazuh agent GUI (on Windows) then paste the obtained key in the field Authentication key, click on the save button and then restart the agent service (Manage menu → Start).
On Linux you can insert the key with the command:

/var/ossec/bin/manage_agents -i key
(replacing key with the obtained key) then restart the agent service with systemctl start wazuh-agent.

6. You should see the agent name with the old id in your manager, then to have the agent re-added to the previous groups you can do it from the API console in this way:
PUT /agents/022/group/GROUP_NAME

Let me know if this is useful.
Regards.

[Leon Scott]

Adedamola

Thankyou for your reply, apologies on late response.  I deleted the agent on the endpoint.  Reinstalled it, and then deleted the obsolete agent from the manager.

I am assuming someone in Wazuh is looking at a better solution.  However, if I remember correctly, changing the name of a PC in Microsoft Defender for Endpoint also causes headaches with obsolete devices populating the system.

Job done.  Thanks

Leon.