Investigate steps to separate agent from manager #7
Assignees
Labels
level/task
Task issue
module/agent
spike
Spike
type/change
Change performed in a resource or Wazuh Cloud environment
Comments
vikman90
added
level/task
This was referenced Jun 12, 2024
Analyzing wazuh repositoryAnalyzing the root directory of the
Root directory
Architecture
Packages
Ruleset
Src
Tests/integration
Tools
Wodles
SummaryAfter the analysis above, where you can see the detail of the directories. We conclude knowing that the following are the components to be migrated:
|
Component diagramsThe following are two component diagrams, paying attention to which parts of the wazuh repository would be on the manager side and which on the agent side. ManagerFor illustrative purposes, the agent communication API and the new Engine are added, but the old wazuh modules that should be kept are mentioned. C4Component
Boundary(manager, "Manager", "") {
Component(agent_comms_api, "Agent-comms-API", "", "")
Component(engine, "Engine", "", "")
Boundary(modules, "Modules", "") {
Component(content_manager, "Content Manager", "", "")
Component(indexer_connector, "Indexer Connector", "", "")
Component(keystore, "Keystore", "", "")
Component(router, "Router", "", "")
Component(agent_upgrade_manager, "Agent Upgrade Manager", "", "")
Component(vulnerability_scanner, "Vulnerability Scanner", "", "")
}
}
AgentIn the same way the new agent is added in an illistrative way but the important thing is all the modules that need to be migrated. C4Component
title Agent components
Boundary(agent, "Agent", "") {
Component(logrotate, "Log rotate", "?", "Rotates the log")
Component(client, "Client", "", "HTTP 2.0 manager's client")
Component(commander, "Commander", "", "Runs commands from manager")
Component(storage, "Queue", "", "Persistent message queue")
Component(config_parser, "Config Parser", "", "Modules config parser")
}
Boundary(ExecutorModules, "Executors modules to be migrated", "") {
Component(executor, "Executor", "", "")
Boundary(executors, "Executors", "") {
Component(ar, "AR", "", "")
Component(agent_upgrade, "Agent Upgrade", "", "")
Component(command, "Command", "", "")
}
}
Boundary(CollectorModules, "Collectors modules to be migrated", "") {
Component(logcollector, "Logcollector", "", "")
Component(fim, "FIM (+Rootcheck)", "", "")
Component(aws, "AWS", "", "")
Component(syscollector, "Syscollector", "", "")
Component(sca, "SCA", "", "")
Component(azure, "Azure", "", "")
Component(gcp, "GCP", "", "")
Component(ms_graph, "MS Graph", "", "")
Component(o365, "O365", "", "")
Component(github, "Github", "", "")
Component(docker, "Docker", "", "")
Component(osquery_monitor, "Osquery Monitor", "", "")
}
Boundary(Submodules, "Submodules to be migrated", "") {
Component(dbsync, "DBsync", "", "")
Component(data_provider, "Data Provider", "", "")
}
Rel(client, storage, "Reads")
Rel(client, commander, "Queries")
Rel(logcollector, storage, "")
Rel(fim, storage, "")
Rel(aws, storage, "")
Rel(syscollector, storage, "")
Rel(azure, storage, "")
Rel(gcp, storage, "")
Rel(ms_graph, storage, "")
Rel(o365, storage, "")
Rel(github, storage, "")
Rel(docker, storage, "")
Rel(osquery_monitor, storage, "")
Rel(sca, storage, "")
Rel(executor, ar, "")
Rel(executor, agent_upgrade, "")
Rel(executor, command, "")
Rel(commander, executor, "")
Rel(syscollector, dbsync, "")
Rel(data_provider,syscollector, "")
Rel(fim, dbsync, "")
Rel(executor, logcollector, "")
Rel(executor, fim, "")
Rel(executor, aws, "")
Rel(executor, syscollector, "")
Rel(executor, azure, "")
Rel(executor, gcp, "")
Rel(executor, ms_graph, "")
Rel(executor, o365, "")
Rel(executor, github, "")
Rel(executor, docker, "")
Rel(executor, osquery_monitor, "")
Rel(executor, sca, "")
Rel(config_parser, commander, "Queries")
|
Agent 000 conceptManagerMost of the agent
QAThere are a couple of references in the APIThere are a few references in function and/or comments that need to be checked, most of them to avoid running some operations on the manager:
Additionally, there are many API tests that use this ID and they need to be verified. FrameworkThere are some references in function and/or comments that need to be checked, most of them to avoid running some operations on the manager:
Additionally, there are many Framework tests that use this ID and they need to be verified. |
Initial deletion listdelete.txt |
|
Requested changes applied! cc @vikman90 |
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Parent issue:
Description
The goal of this spike is to investigate the necessary steps to separate the Wazuh agent from the manager, enabling them to function as independent products. A significant portion of this task is already being addressed in #1. Once the scaffolding for the new agent repository is completed (#6), the primary focus will be on listing the elements from the Wazuh repository that need to be migrated to the new agent repository.
Functional requirements
Implementation restrictions
Plan
Analyze Wazuh repository:
Component migration:
Diagram development:
Evaluate "Agent 000" Concept:
Documentation and Reporting:
By following this plan, we aim to clearly outline the steps required to separate the Wazuh agent from the manager, ensuring both function as independent and efficient products.
The text was updated successfully, but these errors were encountered: