Remove Agents

Delete all agents or a list of them based on optional criteria.

External Documentation

To learn more, visit the Wazuh Server documentation.

Basic Parameters

Parameter	Description
Agent IDs	A comma-separated list, without any whitespace before or after the commas, of agents IDs to delete. Use all to delete all agents.
Pretty	Select to show results in human-readable format.
Purge	Select to permanently delete an agent from the key store.
Query	A query to filter the results by. For example: status=active
Status	A comma-separated list, without any whitespace before or after the commas, of statuses to filter the agents by. Options: - all - active - pending - never_connected - disconnected
Wait For Complete	Select to disable timeout response.

Advanced Parameters

Parameter	Description
Agent Register IP	Filter by the IP used when registering the agent.
Group	Filter by the group of the agent.
IP	Filter by the IP used by the agent to communicate with the manager. Note: If it’s not available, it will have the same value as Register IP.
Manager	Filter by manager hostname to which the agents are connected to.
Node Name	Filter by the node name.
OS Name	Filter by the operating system name of the agent.
OS Platform	Filter by the operating system platform of the agent.
OS Version	Filter by the operating system version of the agent.
Older Than	Filter agents based on the time elapsed since their last keep-alive signal. You can specify the time using seconds (s), minutes (m), hours (h), or days (d). For example: 7d, 10s, or simply 10 (which defaults to seconds).
Version	Filter by agents version using one of the following formats: X.Y.Z, vX.Y.Z, wazuh X.Y.Z or wazuh vX.Y.Z. For example: 4.4.0

Example Output

{
	"data": {
		"affected_items": [
			"001",
			"002",
			"003"
		],
		"total_affected_items": 3,
		"total_failed_items": 0,
		"failed_items": []
	},
	"message": "All selected agents were deleted",
	"error": 0
}

Workflow Library Example

Remove Agents with Wazuh Server and Send Results Via Email

Preview this Workflow on desktop