Metadata-Version: 2.4
Name: wazuh_findings_exporter
Version: 2.0
Summary: Simple script that exports Wazuh Vulnerabilities by Agent groups
Home-page: https://github.com/quirinziessler/wazuh_findings_exporter
Download-URL: https://github.com/quirinziessler/wazuh_findings_exporter
Author: Quirin Hardy Zießler
Author-email: quirin@ziessler.com
License: MIT
Keywords: Wazuh,exporter,DefectDojo,Wazuh API
Classifier: Intended Audience :: Developers
Classifier: Topic :: Software Development :: Build Tools
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Description-Content-Type: text/markdown
License-File: LICENSE.txt
Requires-Dist: urllib3
Requires-Dist: requests
Requires-Dist: opensearch-py
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: download-url
Dynamic: home-page
Dynamic: keywords
Dynamic: license
Dynamic: license-file
Dynamic: requires-dist
Dynamic: summary

# wazuh_findings_exporter

A simple python script which exports findings of a client group from wazuh and adds the agent-ip as well as hostname to every finding for better further processing.

The script may not be perfect, so feel free to provide PRs and help to improve it.
 
For Wazuh versions below 4.8 it enriches each finding with `agent_ip` and `agent_name`.  
For Wazuh 4.8+ it queries OpenSearch directly.

## Usage

```python
from wazuh_findings_exporter import Wazuh_Importer

WAZUH_URL = "https://wazuh.example.local"
WAZUH_USER = "wazuh-user"
WAZUH_PASS = "wazuh-pass"

# Optional for Wazuh 4.8+ (OpenSearch access)
OS_USER = "opensearch-user"
OS_PASS = "opensearch-pass"
OS_HOST = "opensearch.example.local"
OS_PORT = 9200

EXPORT_DIR = "output"

importer = Wazuh_Importer(
    BASE_URL=WAZUH_URL,
    USERNAME=WAZUH_USER,
    PASSWORD=WAZUH_PASS,
    OPENSEARCH_USERNAME=OS_USER,
    OPENSEARCH_PASSWORD=OS_PASS,
    OPENSEARCH_HOST=OS_HOST,
    OPENSEARCH_PORT=OS_PORT,
    output_mode="split",
    verify=False,
    timeout=30,
)

result = importer.get_findings(
    group="Clients_AAAA",
    filedestination=EXPORT_DIR,
    filename="wazuh.json",
)

print(f"Saved results: {result}")
```

## Parameters

`Wazuh_Importer(...)` parameters:

| Parameter | Type | Default | Description |
| --- | --- | --- | --- |
| `BASE_URL` | `str` | required | Base URL of the Wazuh API, e.g. `https://wazuh.example.local:55000`. |
| `USERNAME` | `str` | required | Wazuh API username. |
| `PASSWORD` | `str` | required | Wazuh API password. |
| `OPENSEARCH_USERNAME` | `str` | `""` | OpenSearch username (used for Wazuh 4.8+). |
| `OPENSEARCH_PASSWORD` | `str` | `""` | OpenSearch password (used for Wazuh 4.8+). |
| `OPENSEARCH_HOST` | `str` | `""` | OpenSearch host (Wazuh 4.8+). |
| `OPENSEARCH_PORT` | `int` | `9200` | OpenSearch port (Wazuh 4.8+). |
| `verify` | `bool` | `False` | Verify TLS certificates for API/OpenSearch calls. |
| `timeout` | `float` | `10` | Request timeout in seconds. |
| `elasticsearch_index` | `str` | `wazuh-states-vulnerabilities-*` | OpenSearch index pattern for vulnerabilities. |
| `output_mode` | `str` | `single` | `single` writes one file; `split` writes chunks of 100000 hits per file. |
| `logger` | `logging.Logger` | `None` | Custom logger instance. |
| `disable_insecure_request_warnings` | `bool` | `True` | Suppress insecure HTTPS warnings when `verify=False`. |

`get_findings(...)` parameters:

| Parameter | Type | Default | Description |
| --- | --- | --- | --- |
| `group` | `str` | required | Wazuh group name. |
| `filedestination` | `str` | required | Directory where the JSON output will be saved. Created if missing. |
| `filename` | `str` | `wazuh.json` | Output filename. |

## How It Works

- The importer authenticates to the Wazuh API and fetches the API version.
- Wazuh < 4.8 behavior: script calls `/vulnerability/{agent_id}` per agent, filters out findings with `condition == "Package unfixed"`, and adds `agent_ip` and `agent_name` to each finding.
- Wazuh >= 4.8 behavior: script queries OpenSearch using the configured credentials and streams results using OpenSearch scrolls.

## Output

- `output_mode="single"` returns a single `Path` to the JSON file.
- `output_mode="split"` returns a list of `Path` objects, one per chunk.
