Skip to main content
Get a list of agents.
External DocumentationTo learn more, visit the Wazuh Server documentation.

​
Basic Parameters

ParameterDescription
Agent IDsA comma-separated list, without any whitespace before or after the commas, of agents IDs to return.
DistinctSelect to look for distinct values.
FieldsA comma-separated list, without any whitespace before or after the commas, of fields to return.

Note: Use ’.’ for nested fields, for example: field1 , field2.nestedField1, field3
LimitMaximum number of elements to return.
NameFilter by the name of the agent.
OffsetThe offset of the first element to return.
PrettySelect to show results in human-readable format.
QueryA query to filter the results by.

For example: status=active
Return All PagesAutomatically fetch all resources, page by page.
Search TextA string used to filter elements containing the specified text.

Note: To obtain a complementary search, use - at the beginning.
SortA comma-separated list, without any whitespace before or after the commas, of fields to sort by. Use +/- at the beginning to list in ascending or descending order. Use . for nested fields.
StatusA comma-separated list, without any whitespace before or after the commas, of statuses to filter the agents by.

Options:
- active
- pending
- never_connected
- disconnected
Wait For CompleteSelect to disable timeout response.

​
Advanced Parameters

ParameterDescription
Agent Register IPFilter by the IP used when registering the agent.
GroupFilter by the group of the agent.
Group Config StatusFilter by the agent’s group configure status.
IPFilter by the IP used by the agent to communicate with the manager.

Note: If it’s not available, it will have the same value as Register IP.
ManagerFilter by manager hostname to which the agents are connected to.
Node NameFilter by the node name.
OS NameFilter by the OS (Operating System) name of the agent.
OS PlatformFilter by the OS (Operating System) platform of the agent.
OS VersionFilter by the OS (Operating System) version of the agent.
Older ThanFilter agents based on the time elapsed since their last keep-alive signal. You can specify the time using seconds (s), minutes (m), hours (h), or days (d).

For example: 7d, 10s, or simply 10 (which defaults to seconds).
VersionFilter by agents version using one of the following formats: X.Y.Z, vX.Y.Z, wazuh X.Y.Z or wazuh vX.Y.Z.

For example: 4.4.0

​
Example Output

{
	"data": {
		"affected_items": [
			{
				"os": {
					"arch": "x86_64",
					"codename": "Focal Fossa",
					"major": "20",
					"minor": "04",
					"name": "Ubuntu",
					"platform": "ubuntu",
					"uname": "Linux |ac7cb188d538 |5.8.0-45-generic |#51~20.04.1-Ubuntu SMP Tue Feb 23 13:46:31 UTC 2021 |x86_64",
					"version": "20.04.2 LTS"
				},
				"lastKeepAlive": "2021-05-26T12:40:40Z",
				"id": "001",
				"dateAdd": "2021-05-26T12:40:08.000Z",
				"configSum": "ab73af41699f13fdd81903b5f23d8d00",
				"manager": "wazuh-worker2",
				"group": [
					"default"
				],
				"registerIP": "any",
				"ip": "172.25.0.6",
				"name": "ac7cb188d538",
				"status": "active",
				"mergedSum": "9a016508cea1e997ab8569f5cfab30f5",
				"version": "Wazuh v4.3.0",
				"node_name": "worker2",
				"group_config_status": "synced",
				"status_code": 0
			},
			{
				"os": {
					"arch": "x86_64",
					"codename": "Focal Fossa",
					"major": "20",
					"minor": "04",
					"name": "Ubuntu",
					"platform": "ubuntu",
					"uname": "Linux |ac7cb188d538 |5.8.0-45-generic |#51~20.04.1-Ubuntu SMP Tue Feb 23 13:46:31 UTC 2021 |x86_64",
					"version": "20.04.2 LTS"
				},
				"lastKeepAlive": "2021-05-26T12:40:40Z",
				"id": "002",
				"dateAdd": "2021-05-26T12:40:10.000Z",
				"configSum": "ab73af41699f13fdd81903b5f23d8d00",
				"manager": "wazuh-worker2",
				"group": [
					"default"
				],
				"registerIP": "any",
				"ip": "172.25.0.11",
				"name": "91642a418627",
				"status": "active",
				"mergedSum": "9a016508cea1e997ab8569f5cfab30f5",
				"version": "Wazuh v4.3.0",
				"node_name": "worker2",
				"group_config_status": "synced",
				"status_code": 0
			},
			{
				"os": {
					"arch": "x86_64",
					"codename": "Focal Fossa",
					"major": "20",
					"minor": "04",
					"name": "Ubuntu",
					"platform": "ubuntu",
					"uname": "Linux |ac7cb188d538 |5.8.0-45-generic |#51~20.04.1-Ubuntu SMP Tue Feb 23 13:46:31 UTC 2021 |x86_64",
					"version": "20.04.2 LTS"
				},
				"lastKeepAlive": "2021-05-26T12:40:40Z",
				"id": "003",
				"dateAdd": "2021-05-26T12:40:10.000Z",
				"configSum": "ab73af41699f13fdd81903b5f23d8d00",
				"manager": "wazuh-worker2",
				"group": [
					"default"
				],
				"registerIP": "any",
				"ip": "172.25.0.10",
				"name": "a442e15bc84e",
				"status": "active",
				"mergedSum": "9a016508cea1e997ab8569f5cfab30f5",
				"version": "Wazuh v4.3.0",
				"node_name": "worker1",
				"group_config_status": "not synced",
				"status_code": 0
			}
		],
		"total_affected_items": 3,
		"total_failed_items": 0,
		"failed_items": []
	},
	"message": "All selected agents information was returned",
	"error": 0
}

​
Workflow Library Example

List Agents with Wazuh Server and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I