Skip to content

Conversation

@juliancnn
Copy link
Member

@juliancnn juliancnn commented Dec 23, 2025

Closes #33519

Description

Introduces changes to the Wazuh engine to fetch policies from the indexer connector. It includes updates to the codebase for handling policy retrieval, hash checking, and existence verification.

Proposed Changes

  • WIC dded new methods in the IWIndexerConnector interface for policy management.
  • WIC Implemented the getPolicy, getPolicyHash, and existsPolicy methods in the WIndexerConnector class, to query on wazuh-indexer.
  • WIC: Introduced the PolicyResources structure to encapsulate policy-related data.
  • IndexerConnectorAsyncImp: Added search and Point In Time features
  • .devContainer: Modified Docker and development container configurations for testing and integration

Results and Evidence

No new test or final user feature added, but is posibble check adding this code and debugging:

                if (indexerConnector->existsPolicy("free"))
                {
                    LOG_INFO("Indexer Connector initialized. 'free' policy exists.");
                }
                LOG_INFO("Policy 'free' hash {}", indexerConnector->getPolicyHash("free"));
                auto t = indexerConnector->getPolicy("free");

                // Print sizes of retrieved resources
                LOG_INFO("Policy 'free' resources - KVDBs: {}, Decoders: {}, Integration Decoders: {}",
                         t.kvdbs.size(), t.decoders.size(), t.integration.size());

                LOG_INFO("Policy 'test2' exists: {}", indexerConnector->existsPolicy("test2") ? "true" : "false");

Logs:

2025/12/26 19:58:13 wazuh-analysisd[207690] main.cpp:425 at main(): INFO: Indexer Connector initialized. 'free' policy exists.
2025/12/26 19:58:13 wazuh-analysisd[207690] main.cpp:427 at main(): INFO: Policy 'free' hash dff016b30b6320b6abbe600b10e0f941a59845af76427b1a3b3ad1283f98c705
2025/12/26 19:58:13 IndexerConnector[207690] indexerConnectorAsyncImpl.hpp:619 at operator()(): DEBUG: PIT created successfully. PIT ID: m_q4QQQ9LmRlY29kZXJzX2RldmVsb3BtZW50XzAuMC4xLWRlY29kZXJzX2RldmVsb3BtZW50XzAuMC4xLXBvbGljeRZQc09hMURNclI5bUZQNE1nVFgtdXRnABZxa0dwZEQ5LVFfNnFOY2haTjJlZ013AAAAAAAAACB8FlM4RUo5UHdaVDZDZTRNTmxmYjZSblE-LmRlY29kZXJzX2RldmVsb3BtZW50XzAuMC4xLWRlY29kZXJzX2RldmVsb3BtZW50XzAuMC4xLWRlY29kZXIWaFUtUEx4a0dTZGUwZ0w2SnpkcVM0QQAWcWtHcGREOS1RXzZxTmNoWk4yZWdNdwAAAAAAAAAgeRZTOEVKOVB3WlQ2Q2U0TU5sZmI2Um5ROy5kZWNvZGVyc19kZXZlbG9wbWVudF8wLjAuMS1kZWNvZGVyc19kZXZlbG9wbWVudF8wLjAuMS1rdmRiFjhCaWNvaWtZU01DMlgzaEo4dHNQV2cAFnFrR3BkRDktUV82cU5jaFpOMmVnTXcAAAAAAAAAIHsWUzhFSjlQd1pUNkNlNE1ObGZiNlJuUUIuZGVjb2RlcnNfZGV2ZWxvcG1lbnRfMC4wLjEtZGVjb2RlcnNfZGV2ZWxvcG1lbnRfMC4wLjEtaW50ZWdyYXRpb24WY0ltOXYwN2dRNjZCX3FYdXRVekd3UQAWcWtHcGREOS1RXzZxTmNoWk4yZWdNdwAAAAAAAAAgehZTOEVKOVB3WlQ2Q2U0TU5sZmI2Um5RBBZjSW05djA3Z1E2NkJfcVh1dFV6R3dRAAAWOEJpY29pa1lTTUMyWDNoSjh0c1BXZwAAFlBzT2ExRE1yUjltRlA0TWdUWC11dGcAABZoVS1QTHhrR1NkZTBnTDZKemRxUzRBAAA=, Creation time: 1766779093154
2025/12/26 19:58:13 wazuh-analysisd[207690] windexerconnector.cpp:274 at getPolicy(): DEBUG: [indexer-connector] Total hits to retrieve: 396
2025/12/26 19:58:13 wazuh-analysisd[207690] windexerconnector.cpp:297 at getPolicy(): DEBUG: [indexer-connector] Retrieved 100 / 396 hits so far
2025/12/26 19:58:13 wazuh-analysisd[207690] windexerconnector.cpp:297 at getPolicy(): DEBUG: [indexer-connector] Retrieved 200 / 396 hits so far
2025/12/26 19:58:13 wazuh-analysisd[207690] windexerconnector.cpp:297 at getPolicy(): DEBUG: [indexer-connector] Retrieved 300 / 396 hits so far
2025/12/26 19:58:13 wazuh-analysisd[207690] windexerconnector.cpp:297 at getPolicy(): DEBUG: [indexer-connector] Retrieved 396 / 396 hits so far
2025/12/26 19:58:13 IndexerConnector[207690] indexerConnectorAsyncImpl.hpp:672 at operator()(): DEBUG: PIT successfully deleted. Response: {"pits":[{"successful":true,"pit_id":"m_q4QQQ9LmRlY29kZXJzX2RldmVsb3BtZW50XzAuMC4xLWRlY29kZXJzX2RldmVsb3BtZW50XzAuMC4xLXBvbGljeRZQc09hMURNclI5bUZQNE1nVFgtdXRnABZxa0dwZEQ5LVFfNnFOY2haTjJlZ013AAAAAAAAACB8FlM4RUo5UHdaVDZDZTRNTmxmYjZSblE-LmRlY29kZXJzX2RldmVsb3BtZW50XzAuMC4xLWRlY29kZXJzX2RldmVsb3BtZW50XzAuMC4xLWRlY29kZXIWaFUtUEx4a0dTZGUwZ0w2SnpkcVM0QQAWcWtHcGREOS1RXzZxTmNoWk4yZWdNdwAAAAAAAAAgeRZTOEVKOVB3WlQ2Q2U0TU5sZmI2Um5ROy5kZWNvZGVyc19kZXZlbG9wbWVudF8wLjAuMS1kZWNvZGVyc19kZXZlbG9wbWVudF8wLjAuMS1rdmRiFjhCaWNvaWtZU01DMlgzaEo4dHNQV2cAFnFrR3BkRDktUV82cU5jaFpOMmVnTXcAAAAAAAAAIHsWUzhFSjlQd1pUNkNlNE1ObGZiNlJuUUIuZGVjb2RlcnNfZGV2ZWxvcG1lbnRfMC4wLjEtZGVjb2RlcnNfZGV2ZWxvcG1lbnRfMC4wLjEtaW50ZWdyYXRpb24WY0ltOXYwN2dRNjZCX3FYdXRVekd3UQAWcWtHcGREOS1RXzZxTmNoWk4yZWdNdwAAAAAAAAAgehZTOEVKOVB3WlQ2Q2U0TU5sZmI2Um5RBBZjSW05djA3Z1E2NkJfcVh1dFV6R3dRAAAWOEJpY29pa1lTTUMyWDNoSjh0c1BXZwAAFlBzT2ExRE1yUjltRlA0TWdUWC11dGcAABZoVS1QTHhrR1NkZTBnTDZKemRxUzRBAAA="}]}
2025/12/26 19:58:13 wazuh-analysisd[207690] main.cpp:431 at main(): INFO: Policy 'free' resources - KVDBs: 30, Decoders: 284, Integration Decoders: 81
2025/12/26 19:58:13 wazuh-analysisd[207690] main.cpp:434 at main(): INFO: Policy 'test2' exists: false

Manual tests with their corresponding evidence

  • Compilation without warnings on every supported platform
    • Linux
    • Windows
    • MAC OS X
  • Log syntax and correct language review
  • Memory tests for Linux

    • Coverity
    • Valgrind (memcheck and descriptor leaks check)
    • AddressSanitizer
  • Memory tests for Windows

    • Coverity
    • UMDH
  • Memory tests for macOS

    • Leaks
    • AddressSanitizer
  • Decoder/Rule tests (Wazuh v4.x)

    • Added unit testing files ".ini"
    • runtests.py executed without errors
  • Engine (Wazuh v5.x and above)

    • Test run in parallel
    • ASAN for test (utest/ctest)
    • TSAN for test and wazuh-engine.
  • Wazuh server API/Framework

    • Run API Integration Tests

Artifacts Affected

Configuration Changes

Tests Introduced

Review Checklist

  • Code changes reviewed
  • Relevant evidence provided
  • Tests cover the new functionality
  • Configuration changes documented
  • Developer documentation reflects the changes
  • Meets requirements and/or definition of done
  • No unresolved dependencies with other issues
  • ...

@juliancnn juliancnn self-assigned this Dec 23, 2025
@juliancnn juliancnn force-pushed the enhancement/33519-fetch-snap-facade-indexer-connector branch from 6e14db3 to 91dada8 Compare December 26, 2025 14:24
@juliancnn juliancnn force-pushed the enhancement/33519-fetch-snap-facade-indexer-connector branch from 91dada8 to cae98c3 Compare December 26, 2025 14:25
@juliancnn juliancnn force-pushed the enhancement/33519-fetch-snap-facade-indexer-connector branch from 236d7b4 to d6af822 Compare December 26, 2025 19:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Indexer Connector – Fetch data from wazuh-indexer

2 participants