Wazuh remote command from API doesn't work - wazuh

Question

I'm trying to execute remote command from Wazuh manager to the agent using API, below waht i'm trying to do:
curl -k -X PUT "https://192.168.1.76:55000/active-response?agents_list=001" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" -d '{"command": "customA", "custom":true}'
and then the response:
{"data": {"affected_items": ["001"], "total_affected_items": 1, "total_failed_items": 0, "failed_items": []}, "message": "AR command was sent to all agents", "error": 0}
The problem is simply that the command "customA" isn't triggered in the agent.
Here the body of the "/var/ossec/etc/ossec.conf" file in the MANAGER:
<command>
<name>customA</name>
<executable>launcher.cmd</executable>
<extra_args>custom_remove.py</extra_args>
</command>
<command>
<name>customB</name>
<executable>launcher.cmd</executable>
<extra_args>custom_remove.py</extra_args>
</command>
<command>
<name>forRemote</name>
<executable>custom_remove.exe</executable>
</command>
<active-response>
<disabled>no</disabled>
<command>customA</command>
<location>local</location>
<rules_id>255001</rules_id>
</active-response>
<active-response>
<disabled>no</disabled>
<command>customA</command>
<location>local</location>
<rules_id>999001</rules_id>
</active-response>
And this is the "local_internal_options.conf" file in the Windows AGENT 001:
windows.debug=2
rootcheck.sleep=0
syscheck.sleep=0
logcollector.remote_commands=1
wazuh_command.remote_commands=1
Eventually, I think that command and active response are correctly configured, because they will work correctly if i try to test them triggering a rule (for exampple rule 999001).
Moreover, i post the response of the api "GET /manager/configuration/analysis/command":
{
"data": {
"affected_items": [
{
"command": [
{
"name": "disable-account",
"executable": "disable-account",
"timeout_allowed": 1
},
{
"name": "restart-wazuh",
"executable": "restart-wazuh",
"timeout_allowed": 0
},
{
"name": "firewall-drop",
"executable": "firewall-drop",
"timeout_allowed": 1
},
{
"name": "host-deny",
"executable": "host-deny",
"timeout_allowed": 1
},
{
"name": "route-null",
"executable": "route-null",
"timeout_allowed": 1
},
{
"name": "win_route-null",
"executable": "route-null.exe",
"timeout_allowed": 1
},
{
"name": "netsh",
"executable": "netsh.exe",
"timeout_allowed": 1
},
{
"name": "customA",
"executable": "launcher.cmd",
"timeout_allowed": 0
},
{
"name": "customB",
"executable": "launcher.cmd",
"timeout_allowed": 0
},
{
"name": "forRemote",
"executable": "custom_remove.exe",
"timeout_allowed": 0
},
{
"name": "remove-threat",
"executable": "remove-threat.exe",
"timeout_allowed": 0
}
]
}
],
"total_affected_items": 1,
"total_failed_items": 0,
"failed_items": []
},
"message": "Active configuration was successfully read",
"error": 0
}
I hope that someone will help me. Thanks in advice!

Answer 1

please open C:\Program Files (x86)\ossec-agent\etc\shared\ar.conf file and verify that you have:
customA0 - launcher.cmd - 0
if you don't have it, create any file in /var/ossec/etc/shared/default/ for the manager to update the agent by sending a merged.mg, this resets the agent and updates it according to what you configured in ossec.conf from the manager.
The command should have customA0 instead of customA.
Example:
curl -k -X PUT "https://192.168.1.72:55000/active-response?agents_list=001" -H "Authorization: Bearer $(curl -u wazuh:wazuh -k -X GET "https://192.168 .1.xxx:55000/security/user/authenticate?raw=true)" -H "content-type: application/json" -d '{"command": "customA0", "custom":true}'
I hope this is useful.
Regards
Note: I attach an example that I did to test
manager
agent