Removing a decommissioned host from Wazuh.

Do you use Wazuh? I do, and I love it! It is one of my favorite tools. If you are not familiar with it well head over to their website and give it a look.

Let’s get down to business with the issue of removing a decommissioned host from the Wazuh dashboard. To do so you will need ssh access to your Wazuh server. In my case I run all of the services on one server, so I only need to ssh in to one place.

Once connected you will want to run the following.

sudo /var/ossec/bin/manage_agents

You will choose r to remove an agent. Then you will be presented with a list of available agents to remove.

You will select an agent by typing the id number above I selected 009 and confirmed my selection deleting agent 009.

You will now be taken back to the options and here I selected q to quit as I was only deleting one agent. Seen below.

Hope this helps you out!