External DocumentationTo learn more, visit the Wazuh Server documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Agent ID | The agent ID. |
| Command | The command to filter by. |
| Description | The description of the policy to filter by. |
| Distinct | Select to look for distinct values. |
| Fields | A comma-separated list, without any whitespace before or after the commas, of fields to return. Note: Use ’.’ for nested fields, for example: field1 , field2.nestedField1, field3 |
| Limit | Maximum number of elements to return. |
| Offset | The offset of the first element to return. |
| Policy ID | The policy ID to filter by. |
| Pretty | Select to show results in human-readable format. |
| Query | A query to filter the results by. For example: status=active |
| Return All Pages | Automatically fetch all resources, page by page. |
| Search Text | A string used to filter elements containing the specified text. Note: To obtain a complementary search, use - at the beginning. |
| Sort | A comma-separated list, without any whitespace before or after the commas, of fields to sort by. Use +/- at the beginning to list in ascending or descending order. Use . for nested fields. |
| Title | The title to filter by. |
| Wait For Complete | Select to disable timeout response. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Condition | Filter by condition. |
| Directory | Filter by directory. |
| File | Filter by full path. |
| Process | Filter by process name. |
| Rationale | The rationale to filter by. |
| Reason | Filter by reason. |
| References | Filter by references. |
| Registry | Filter by registry. |
| Remediation | Filter by remediation. |
| Result | Filter by result. |
Example Output
{
"data": {
"affected_items": [
{
"description": "The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A cramfs image can be used without having to first decompress the image.",
"id": 19000,
"reason": "Invalid path or wrong permissions to run command 'modprobe -n -v cramfs'",
"command": "modprobe -n -v cramfs,lsmod",
"rationale": "Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.",
"condition": "all",
"title": "Ensure mounting of cramfs filesystems is disabled.",
"result": "not applicable",
"policy_id": "cis_ubuntu20-04",
"remediation": "1) Edit or create a file in the /etc/modprobe.d/ directory ending in .conf and add the following line: install cramfs /bin/true. 2) Run the following command to unload the cramfs module: # rmmod cramfs",
"compliance": [
{
"value": "1.1.1.1",
"key": "cis"
},
{
"value": "5.1",
"key": "cis_csc"
},
{
"value": "2.2.5",
"key": "pci_dss"
},
{
"value": "CC6.3",
"key": "tsc"
}
],
"rules": [
{
"type": "command",
"rule": "c:modprobe -n -v cramfs -> r:^install /bin/true"
},
{
"type": "numeric",
"rule": "not c:lsmod -> r:cramfs"
}
]
}
],
"total_affected_items": 191,
"total_failed_items": 0,
"failed_items": []
},
"message": "All selected SCA/policy information was returned",
"error": 0
}