Attach agent information in communication to the server

[vikman90]

Parent Issue: #241

When the agent registers, it must send information about itself to the server:

• IP address
• Operating system
• Agent version

This information must also be attached to the metadata headers in stateful and stateless messages.

[TomasTurina]

Update

Working on new definition (new message structure). The structure of the registration request is still missing.

[TomasTurina]

Messages format

Registration request

• API: Server Management

Authentication:

• Endpoint: /security/user/authenticate

• Method: POST

• Headers:

  • Authorization: Basic base64(user:pass)
  • User_agent:
    • version: VERSION
    • type: Endpoint
    • arch: ARCH
    • platform: PLATFORM

Example: WazuhXDR/5.0.0 (Endpoint; x86_64; Linux)

• Body: empty

Registration

• Endpoint: /agents

• Method: POST

• Headers:

  • Authorization: Bearer token
  • User_agent:
    • version: VERSION
    • type: Endpoint
    • arch: ARCH
    • platform: PLATFORM

Example: WazuhXDR/5.0.0 (Endpoint; x86_64; Linux)

• Body: json
  • id: UUID
  • key: alphanumeric (32 characters)
  • type: Endpoint
  • version: VERSION
  • groups: [GROUPS]
  • hosts:
    • os:
      • name: OS
      • platform: PLATFORM
    • arch: ARCH
    • hostname: HOSTNAME
    • ip: IP (primary)

Example:

{
    "agent": {
        "groups": [],
        "host": {
            "architecture": "aarch64",
            "hostname": "tomas",
            "ip": "172.20.0.1",
            "os": {
                "name": "Ubuntu",
                "platform": "Linux"
            }
        },
        "id": "sldkfjoqwvnskdsoif",
        "key": "oiefsakjndwreoguiweo",
        "type": "Endpoint",
        "version": "5.0.0"
    }
}

Stateful/stateless requests

• API: Agent Comms

Authentication:

• Endpoint: /api/v1/authentication

• Method: POST

• Headers:

  • User_agent:
    • version: VERSION
    • type: Endpoint
    • arch: ARCH
    • platform: PLATFORM

Example: WazuhXDR/5.0.0 (Endpoint; x86_64; Linux)

• Body: json
  • uuid: UUID
  • key: alphanumeric (32 characters)

Example:

{ 
    "uuid": "UUID", 
    "key": "7b8276c3bf96aff5709346d368f04fed"
} 

Sateful/stateless

• Endpoint: /api/v1/events/stateful /api/v1/events/stateless

• Method: POST

• Headers:

  • Authorization: Bearer token
  • User_agent:
    • version: VERSION
    • type: Endpoint
    • arch: ARCH
    • platform: PLATFORM

Example: WazuhXDR/5.0.0 (Endpoint; x86_64; Linux)

• Body: json
  • id: UUID
  • type: Endpoint
  • version: VERSION
  • groups: [GROUPS]
  • hosts:
    • os:
      • name: OS
      • platform: PLATFORM
    • arch: ARCH
    • hostname: HOSTNAME
    • ip: IP (primary)

Example:

{
    "agent": {
        "groups": [],
        "host": {
            "architecture": "aarch64",
            "hostname": "tomas",
            "ip": "172.20.0.1",
            "os": {
                "name": "Ubuntu",
                "platform": "Linux"
            }
        },
        "id": "sldkfjoqwvnskdsoif",
        "type": "Endpoint",
        "version": "5.0.0"
    }
}

[Nicogp]

Work update

2024/11/05

• I added the changes to the AgentInfo class to obtain and return the necessary information for the queries.

2024/11/06

• I have been doing manual tests
• I have been trying to mock the server, so far without much success.
• I have been reviewing the changes

2024/11/07

• I created a mock of the server
• PR created and in review

2024/11/08

• I have made the changes requested in the review.
• I added more functionalities
  • Save received queries in a file and delete already sent responses to avoid duplication of events.
• I performed manual testing of this issue with the mock

[TomasTurina]

PR ready for review. Pending some tests.