agents/name/:agent_name is case sensitive

[skiingyac]

Agent name is basically the hostname. Let's say the name is BoB.

This works: GET /agents/name/BoB
This doesn't: GET /agents/name/bob
This works: /agents?pretty&q=name=BoB
This works: /agents?pretty&q=name=bob

Is there a good reason why /agents/name/:agent_name case-sensitive is case sensitive while /agents?q=name=:agent_name is not? I believe they both should be insensitive (rather than both case sensitive).

[AdriiiPRodri]

Hi @skiingyac,

This is because the 'q' parameter is used to search, which is less restrictive than the /agents/:agent_name endpoint. This endpoint is strict since you are trying to access an agent and this requires that you know exactly its name.

This behavior makes that we can have two or more agents with the same name but that are recognized by capital letters. In this last case, the 'q' parameter should show all the agents regardless the capital letters or not, because it is a filter over a list of agents.

I hope that this answer solves your doubt, in any case, if you have any other doubts, please do not hesitate to ask.

Regards

[skiingyac]

This approach is bad for other systems calling the API, which I believe is what the API is for. Using q= is vulnerable to partial matches. For example, if both foo and foobar exist, q=foo returns both and so requires extra processing in the requestor to filter out partial matches. I guess unfortunately this is the approach I'll have to take but it is particularly bad for short names that could return many partial matches and just cause a lot of overhead. The agents/name/:agent_name API can't be used because it returns NO matches since the most requestors would be treating the hostname case-insensitive and so don't know the precise capitalization. I was very surprised by this since I've not come across another API where username or hostname are case sensitive and so assumed it had to have been an oversight.

[AdriiiPRodri]

Hi @skiingyac,

We have created issue #468 to add this functionality to the Wazuh API. This issue will be closed, in order to better track the development of this functionality.

Best regards,
Adri