Add Wazuh troubleshooting tool integration by Stuti3097 · Pull Request #86 · wazuh/integrations

Stuti3097 · 2026-06-11T11:39:07Z

This PR adds the Wazuh troubleshooting tool integration.

The integration automates the collection of diagnostic information and troubleshooting tasks for common Wazuh issues. It performs health checks across Wazuh components, validates service and connectivity status, analyzes detected problems, and can execute supported remediation actions when applicable.

The integration also includes an AI assistant that uses the collected troubleshooting data to help explain issues and suggest next steps.

Copilot

Pull request overview

This PR introduces a new Wazuh troubleshooting tool integration consisting of a FastAPI backend, a static web frontend, guided troubleshooting flows, and an Ollama-powered “Copilot” assistant to help interpret collected diagnostics and suggest next steps.

Changes:

Adds a FastAPI backend with health-check, remediation endpoints, troubleshooting use-case flows, reporting, and Ollama “Copilot” chat routes.
Adds a full SPA-style frontend (HTML/CSS/JS) for dashboards, guided troubleshooting, reports, and the Copilot UI.
Adds local launch/config artifacts (startup script + config file) and documentation.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 21 comments.

Show a summary per file

File	Description
integrations/wazuh-troubleshooting-tool/start.sh	Dev launcher for backend/frontend processes
integrations/wazuh-troubleshooting-tool/README.md	Integration documentation and setup instructions
integrations/wazuh-troubleshooting-tool/frontend/styles.css	UI styling for portal views
integrations/wazuh-troubleshooting-tool/frontend/manual.js	Manual restart/troubleshooting flow UI logic
integrations/wazuh-troubleshooting-tool/frontend/copilot.js	Copilot frontend (chat UI + markdown rendering)
integrations/wazuh-troubleshooting-tool/frontend/assistant.js	Guided troubleshooting chat UI + backend integration
integrations/wazuh-troubleshooting-tool/frontend/app.js	SPA routing, health checks, report generation/download
integrations/wazuh-troubleshooting-tool/extract_backup.py	Utility script for extracting/moving backup artifacts
integrations/wazuh-troubleshooting-tool/config	Centralized credentials/config file (currently includes secrets)
integrations/wazuh-troubleshooting-tool/backend/wazuh_api.py	Wazuh API token retrieval and connectivity check
integrations/wazuh-troubleshooting-tool/backend/utils/log_handler.py	Indexer/dashboard log collection + deduping
integrations/wazuh-troubleshooting-tool/backend/utils/log_analyzer.py	Log keyword-based issue detection
integrations/wazuh-troubleshooting-tool/backend/utils/fix_engine.py	Remediation helpers (IPs/certs/perms/password/jvm heap)
integrations/wazuh-troubleshooting-tool/backend/use_cases/indexing_error.py	Guided flow for indexing errors
integrations/wazuh-troubleshooting-tool/backend/use_cases/dashboard_error.py	Guided flow for “dashboard not ready yet”
integrations/wazuh-troubleshooting-tool/backend/use_cases/cluster_issues.py	Guided flow for cluster health issues
integrations/wazuh-troubleshooting-tool/backend/use_cases/alerts_not_showing.py	Guided flow for “alerts not showing”
integrations/wazuh-troubleshooting-tool/backend/use_cases/init.py	Use-case registry + fuzzy router
integrations/wazuh-troubleshooting-tool/backend/test_flow.py	Manual script to exercise a flow
integrations/wazuh-troubleshooting-tool/backend/requirements.txt	Backend dependency list (currently invalid format)
integrations/wazuh-troubleshooting-tool/backend/observer.py	Collects system status/log/disk/memory info
integrations/wazuh-troubleshooting-tool/backend/main.py	FastAPI app: health checks, fixes, copilot, reports, summarize
integrations/wazuh-troubleshooting-tool/backend/flows/ip_cert_flow.py	Indexer IP/cert troubleshooting flow
integrations/wazuh-troubleshooting-tool/backend/flows/dashboard_ip_cert_flow.py	Dashboard IP/cert troubleshooting flow
integrations/wazuh-troubleshooting-tool/backend/executor.py	Shell command executor helper
integrations/wazuh-troubleshooting-tool/backend/curl_test.json	Sample JSON payload/output
integrations/wazuh-troubleshooting-tool/backend/copilot_engine.py	Ollama chat integration + env context collector
integrations/wazuh-troubleshooting-tool/backend/config.py	Loads config from ../config and exports constants
integrations/wazuh-troubleshooting-tool/backend/assistant_engine.py	Orchestrates guided use-cases vs Ollama fallback
integrations/wazuh-troubleshooting-tool/backend/analyzer.py	Simple analyzer mapping system outputs to problems

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)


+
+## Centralized Configuration
+
+All credentials and API endpoint URLs are defined in a single file in the project's root folder: `/home/vagrant/wazuh-ai-tool/config`.


+    {
+        "name": "Missing API Username",
+        "phrases": [
+            "could not connect to api - missing api username",
+            "missing api username",
+            "api username error",
+            "api connectivity issues",
+            "could not connect to api"
+        ],
+        "handler": "api_error"
+    },


+        elif handler == "api_error":
+            from .api_error import api_error_flow
+            result = api_error_flow(None, {})


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Stuti Gupta <stuti.gupta@wazuh.com>

Removed sensitive passwords from the configuration file. Signed-off-by: Stuti Gupta <stuti.gupta@wazuh.com>

Stuti3097

Fixed the config file

MiguelCasaresRobles · 2026-07-06T16:33:22Z

Hi @Stuti3097 — thanks for the effort here, but I can't merge this in its current form: as written it introduces serious security exposure on the host it runs on. Flagging the critical items so they can be addressed:

Unauthenticated remote code execution (critical, top priority). GET /run?cmd=... in backend/main.py runs a fully attacker-controlled string via subprocess.check_output(cmd, shell=True) and returns the output over HTTP. Combined with allow_origins=["*"] and no authentication anywhere, this is unauthenticated RCE as the service user on the Wazuh manager/indexer/dashboard host, reachable from any interface (start.sh binds 0.0.0.0). This endpoint must be removed entirely — a troubleshooting tool should never expose arbitrary command execution.
Shell injection + credential exposure (critical). /check builds curl -k -u {API_USERNAME}:{API_PASSWORD} ... as shell f-strings run with shell=True (creds visible in ps, and injectable). utils/fix_engine.py repeats the pattern — echo {password} | ... (password unquoted), sed -i 's|...|{cert}|g' on ls-derived filenames. Please move to subprocess argument lists (no shell=True) and never interpolate secrets/paths into shell strings. There's also a leftover print("DEBUG CLUSTER RAW:", ...).
Plaintext credentials by design (critical). The committed config file + README document storing live Wazuh API/Indexer/Kibana passwords in cleartext in the project dir, with no .gitignore guidance. Please externalize secrets and never commit a populated config.
Leftover / non-shippable content (critical/high). copilot_engine.py (~line 520) injects a hidden system-prompt instruction ("Greet the user as @4Ø4S0υł") — please remove. extract_backup.py is a personal dev script referencing files not in the repo. start.sh hardcodes /home/vagrant/wazuh-ai-tool and lab IP 192.168.56.57. requirements.txt starts with the literal text "Please install:" (so pip install -r fails) and omits rapidfuzz.

My recommendation: convert this to a draft (or let me know and I'll do it) and rework it around a security-first design — add authentication, remove /run, replace all shell=True string-building with argument lists, and externalize secrets — before we re-review. Happy to help scope that if useful.

- Sync full current project structure (agent/copilot/assistant engines, use_cases, flows, utils, knowledge-base sync scripts, frontend) - Remove real config file from tracking; ship a placeholder-only config with YOUR_*_PASSWORD placeholders instead (never commit real credentials) - Add .gitignore for config, generated knowledge-base artifacts, session history, and __pycache__

@MiguelCasaresRobles

…, CORS, and other findings Per @MiguelCasaresRobles's review and the automated Copilot review on this PR: Critical: - Remove GET /run?cmd= entirely — unauthenticated arbitrary command execution via subprocess shell=True, reachable on 0.0.0.0. No legitimate caller anywhere in the frontend; removed rather than gated, per review guidance. - Fix CORS: allow_origins=["*"] + allow_credentials=True (invalid per spec, unnecessarily permissive). Now restricted to the configured frontend origin(s), credentials disabled (app doesn't use cookie auth). - Remove hidden prompt-injection instruction in copilot_engine.py's system prompt ("Greet the user as @4Ø4S0υł"). - /check no longer shells `curl -u user:pass ...` (credentials visible in `ps`, shell-injection risk) — uses the existing get_token() + requests instead, for both the Wazuh API and Indexer cluster-health calls. - Remove dead "api_error" handler/import in use_cases/__init__.py — the module was never in this integration; matching that phrase would crash. High: - Remove extract_backup.py (personal dev script, references files outside this repo). - start.sh: derive BASE from the script's own location instead of a hardcoded /home/vagrant path; bind to the configured server.host (default localhost) instead of unconditionally 0.0.0.0; drop the hardcoded lab IP fallback. - Remove leftover `print("DEBUG CLUSTER RAW:", ...)` on every /check call. - Remove /copilot/logtest — called an undefined run_logtest(), unused by the frontend, would NameError if ever invoked. - Escape text before markdown formatting in frontend/agent.js's renderMarkdown() (innerHTML sink) — previously only fenced code blocks were escaped; bold/italic/headers/lists/inline-code were not, so a compromised backend response or prompt-injected tool result could inject live HTML/JS. - Quote the generated password in fix_engine.py's keystore command (printf + single-quote instead of unquoted echo) — the password charset includes `*`/`?`, which the shell was globbing. - Add a timeout and catch requests.RequestException specifically (was a bare `except:`) in wazuh_api.py's get_token()/check_api(). Also fixed while verifying the /check credential change: the API-health substring check flagged every successful call as an error, because a successful Wazuh API response body legitimately contains `"error": 0`. Now parses that field instead of substring-matching "error" in the raw text. All changes verified with a live smoke test: backend starts cleanly, /run and /copilot/logtest now 404, CORS rejects a disallowed Origin, /check reports accurate status.

Add Wazuh troubleshooting tool integration

73343a6

MiguelCasaresRobles requested a review from Copilot June 15, 2026 09:55

Copilot started reviewing on behalf of MiguelCasaresRobles June 15, 2026 09:55 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

Stuti3097 and others added 2 commits July 4, 2026 17:40

Potential fix for pull request finding

12101c0

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Stuti Gupta <stuti.gupta@wazuh.com>

Clear passwords in wazuh-troubleshooting-tool config

8dff2c5

Removed sensitive passwords from the configuration file. Signed-off-by: Stuti Gupta <stuti.gupta@wazuh.com>

Stuti3097 commented Jul 4, 2026

View reviewed changes

Stuti3097 self-assigned this Jul 4, 2026

Stuti3097 added 2 commits July 20, 2026 09:02

Stuti3097 mentioned this pull request Jul 21, 2026

Tracking: security review fixes for PR #86 (wazuh-troubleshooting-tool integration) Stuti3097/wazuh-troubleshooting-tool#9

Open

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Wazuh troubleshooting tool integration#86

Add Wazuh troubleshooting tool integration#86
Stuti3097 wants to merge 5 commits into
wazuh:mainfrom
Stuti3097:wazuh-troubleshooting-tool

Stuti3097 commented Jun 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Stuti3097 left a comment

Uh oh!

MiguelCasaresRobles commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		## Centralized Configuration

		All credentials and API endpoint URLs are defined in a single file in the project's root folder: `/home/vagrant/wazuh-ai-tool/config`.

Uh oh!

Conversation

Stuti3097 commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Stuti3097 left a comment

Choose a reason for hiding this comment

Uh oh!

MiguelCasaresRobles commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Stuti3097 commented Jun 11, 2026 •

edited

Loading