quox wazuh
quox wazuh
Section titled “quox wazuh”Wazuh security monitoring. Bare quox wazuh runs status. Verbs: status, agents, alerts, incidents, hooks, triage, coverage, vulns, fim, sca, rootcheck, report, deploy-history, deploy, deploy-bulk, remove, active-response, indexer
| Command | What it does |
|---|---|
quox wazuh status | Manager health (daemons) and agent counts by state |
quox wazuh agents [options] | Enrolled Wazuh agents |
quox wazuh alerts [options] | Recent alerts, newest first |
quox wazuh triage [options] | Alerts grouped by rule: count, top hosts, MITRE, highest level first |
quox wazuh coverage | Which fleet hosts Wazuh does not cover: missing agents, disconnected agents, no vulnerability inventory |
quox wazuh vulns [options] | Vulnerabilities on monitored hosts, highest score first |
quox wazuh fim [options] | File integrity (syscheck): recently changed files (reads the wazuh_fim tool) |
quox wazuh sca [options] | Security configuration assessment: policies with pass/fail; --policy lists its failed checks (reads the wazuh_sca tool) |
quox wazuh rootcheck [options] | Rootcheck findings (reads the wazuh_rootcheck tool) |
quox wazuh deploy-history [options] | Wazuh agent deploy results |
quox wazuh deploy [options] <host> | Install the Wazuh agent on a host (held for human approval) |
quox wazuh deploy-bulk [options] <hosts...> | Install the Wazuh agent on several hosts: one governed call and one approval per host |
quox wazuh remove <agentId> | Remove an agent from the Wazuh manager (held for human approval) |
quox wazuh active-response [options] <agentId...> | Run an active response on one or more agents (held for human approval) |
quox wazuh indexer | The Wazuh indexer credential behind alerts and vulns |
quox wazuh report | Signed, offline-verifiable Wazuh security posture report: generate, list, show, verify |
quox wazuh hooks | The per-org signed hook Wazuh integratord posts alerts to (list, create, rotate, delete; org admin) |
quox wazuh incidents [options] | Wazuh alerts that became Quox incidents (one per rule and agent; repeats counted, not re-alerted) |
quox wazuh connect [options] | Connect this organisation to its Wazuh: stores the API (and optional indexer) credential in the vault, then runs status. Admin only. Passwords are prompted, never flags. |