Wazuh: the agent id is not the agent name

Name and id are both on the alert

A Wazuh alert includes an agent object. The id is the number the manager assigned when that agent enrolled. The name is the label configured for it. People read the name because it looks like a hostname. The id is what stays put for that enrollment.

After a lab VM is rebuilt and enrolled again, the new agent often gets the same name and a new id. Alerts from the old id are the previous enrollment. Mixing them makes one timeline out of two hosts.

A gap in time is not proof of one agent

You cannot tell a rebuild from a rename by the name alone. Compare ids. If the id changes, start a new series in the note even when the name does not. If the id is stable and the name string changes, say the label changed and keep the id.

Do not fill a missing id by searching on the name and taking the newest agent. That picks an enrollment you did not read on the alert.

What to file

File agent.id and agent.name from the alert, and the timestamp. If you group several alerts, group by id. Mention the name as the label on that id. When an id has no agent anymore, say the enrollment is gone rather than borrowing a later id with the same name.

Worked case: lab-web-02 twice

Monday’s file alert is agent id 014, name lab-web-02. Friday’s file alert is agent id 027, name lab-web-02. The VM was rebuilt on Wednesday. A draft draws one week of changes for “lab-web-02.”

The note splits the week: id 014 through Wednesday, id 027 after enrollment. The file change on Friday is not a follow-up to Monday’s change. Same label, two enrollments, two series.

Monday alert: agent.id 014  agent.name lab-web-02
Friday alert: agent.id 027  agent.name lab-web-02
rebuild: Wednesday, new enrollment
write: two series
not: one host across the week