Skip to main content
Run an Active Response command on all agents or a list of them.
External DocumentationTo learn more, visit the Wazuh Server documentation.

​
Basic Parameters

ParameterDescription
Agent IDsA comma-separated list, without any whitespace before or after the commas, of agent IDs. All agents are selected by default.
ArgumentsA comma-separated list, without any whitespace before or after the commas, of command arguments.
CommandThe command running in the agent.

Note: If this value starts with !, then it refers to a script name instead of a command name.
PrettySelect to show results in human-readable format.
Wait For CompleteSelect to disable timeout response.

​
Advanced Parameters

ParameterDescription
Alert DataAlert data depending on the active response command executed.

​
Example Output

{
	"data": {
		"affected_items": [
			"001",
			"002"
		],
		"total_affected_items": 2,
		"total_failed_items": 0,
		"failed_items": []
	},
	"message": "AR command was sent to all agents",
	"error": 0
}

​
Workflow Library Example

Run Command with Wazuh Server and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I