Get Policy Checks

Return the policy monitoring alerts for a given policy.

External Documentation

To learn more, visit the Wazuh Server documentation.

Basic Parameters

Parameter	Description
Agent ID	The agent ID.
Command	The command to filter by.
Description	The description of the policy to filter by.
Distinct	Select to look for distinct values.
Fields	A comma-separated list, without any whitespace before or after the commas, of fields to return. Note: Use ’.’ for nested fields, for example: field1 , field2.nestedField1, field3
Limit	Maximum number of elements to return.
Offset	The offset of the first element to return.
Policy ID	The policy ID to filter by.
Pretty	Select to show results in human-readable format.
Query	A query to filter the results by. For example: status=active
Return All Pages	Automatically fetch all resources, page by page.
Search Text	A string used to filter elements containing the specified text. Note: To obtain a complementary search, use - at the beginning.
Sort	A comma-separated list, without any whitespace before or after the commas, of fields to sort by. Use +/- at the beginning to list in ascending or descending order. Use . for nested fields.
Title	The title to filter by.
Wait For Complete	Select to disable timeout response.

Advanced Parameters

Parameter	Description
Condition	Filter by condition.
Directory	Filter by directory.
File	Filter by full path.
Process	Filter by process name.
Rationale	The rationale to filter by.
Reason	Filter by reason.
References	Filter by references.
Registry	Filter by registry.
Remediation	Filter by remediation.
Result	Filter by result.

Example Output

{
	"data": {
		"affected_items": [
			{
				"description": "The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A cramfs image can be used without having to first decompress the image.",
				"id": 19000,
				"reason": "Invalid path or wrong permissions to run command 'modprobe -n -v cramfs'",
				"command": "modprobe -n -v cramfs,lsmod",
				"rationale": "Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.",
				"condition": "all",
				"title": "Ensure mounting of cramfs filesystems is disabled.",
				"result": "not applicable",
				"policy_id": "cis_ubuntu20-04",
				"remediation": "1) Edit or create a file in the /etc/modprobe.d/ directory ending in .conf and add the following line: install cramfs /bin/true. 2) Run the following command to unload the cramfs module: # rmmod cramfs",
				"compliance": [
					{
						"value": "1.1.1.1",
						"key": "cis"
					},
					{
						"value": "5.1",
						"key": "cis_csc"
					},
					{
						"value": "2.2.5",
						"key": "pci_dss"
					},
					{
						"value": "CC6.3",
						"key": "tsc"
					}
				],
				"rules": [
					{
						"type": "command",
						"rule": "c:modprobe -n -v cramfs -> r:^install /bin/true"
					},
					{
						"type": "numeric",
						"rule": "not c:lsmod -> r:cramfs"
					}
				]
			}
		],
		"total_affected_items": 191,
		"total_failed_items": 0,
		"failed_items": []
	},
	"message": "All selected SCA/policy information was returned",
	"error": 0
}

Workflow Library Example

Get Policy Checks with Wazuh Server and Send Results Via Email

Preview this Workflow on desktop