POC data persistence UX - endpoint inventory

[asteriscos]

Description

We want to create a new plugin which will be in charge of:

• dashboards and reports related to the endpoint
• actions related to endpoints provided by the API
• notifications related to the endpoints

dashboard and events view will use the endpoints inventory data directly from the indexer. We expect the information to be similar to the one we currently have in Endpoints summary / agent-name / Inventory.

Coordinate with wazuh-indexer to define an early design and field mappings for the inventory index or indices.

Plan

• Analysis
  • Design the index and mappings along with the indexer team
  • Explore different information dashboard designs:
    • Segregate information tabs per data type (Network interfaces, Network ports, etc.)
    • Include a menu within the view to select different views without going for the global menu
    • Propose other tests / designs based on the available information
• PoC
  • Mock data in an inventory index that complies with WCS (Wazuh common schema)
  • Create a new plugin that includes a dashboard and discover views in the main plugin
  • The dashboard must be configured as a saved object so it can be referenced in the reporting plugin

[lucianogorza]

Analysis

Here are the sections currently listed in the inventory of the device where an agent is installed:

Data related to hardware and operating system

Network interfaces

Network ports

Network settings

Packages

Processes

Analyzing the established index for persisting the inventory stateful-inventory and comparing it with the data currently displayed, the following questions arise:

• How is the relationship with the agent established?
• In which fields will the information for networks, packages, and processes be persisted?
• Can there be multiple documents in the index for the same agent?

[lucianogorza]

Update 12/08/2024

Generate data through a Python script.

Index pattern inventory-system-*

Index pattern inventory-networks-*

[lucianogorza]

Update 13/08/2024

Add Networks, Processes and Packages tabs to agent view (replace Inventory tab)

To generate index data:

1. Run data generator script:

wazuh-dashboard-plugins/scripts/wazuh-fleet-generator$ python3 dataInjectScript.py

2. Create index patterns manually (create with the same name and id):

• fleet-agents-* (Includes agent and host data)
• inventory-networks-*