API to get top MITRE tactics of an agent

[ashutoshkumarmishra560]

Hi,

I am using Wazuh 4.4.5. I am trying to find the REST API to fetch the top MITRE tactic of a particular agent. I can see the details on the dashboard of Wazuh but unable to find the REST API to fetch the same.
Can you please point me to the right documentation for the same.

I can get the SCA violations but need the same for MITRE tactic for an agent.

Thanks

[MiguelazoDS]

Hi @ashutoshkumarmishra560,

I think you're referring to this. https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.mitre_controller.get_tactics

Let us know if that helped. Regards!

[ashutoshkumarmishra560]

Thanks for taking out time and responding to the same. But I need the response for a particular agent. As shown in the screenshot
when

I view my agent in Wazuh Dashboard I get MITRE tactics related details such as Defense evasion, Privilege escalation etc but how to get the same data and details from REST API is something that I am struggling with.

[MiguelazoDS]

Mmm yeah, the information is already indexed it is not something you can get from a database that is the most common information using the API, the way I'm thinking you can get that information for all agents is using the CLI by making a request directly to the wazuh-indexer.

Because as you can see, the dashboard information is just the filtered information

that you can get with these filters

https://opensearch.org/docs/2.6/dashboards/run-queries/#working-in-the-curl-and-console-formats

[Dwordcito]

Closed for inactivity, please if you want to continue with the question, please reopen the discussion.

Thanks for being part of the community.

[winhigh]

@MiguelazoDS I have a question where i was using ossec previously but i use wazuh but i used to scrape ossec processed logs using scraping tools like prometheus but im unable to achieve the same using wazuh since wazuh refuses to connect or needs auth to it - can you suggest any ideas to scrape logs from wazuh-ossec or mananger