vulncheck
4364d2f8e6
Agents that re-enroll on a fresh Wazuh 5 server get ids from 001 again. The asset sync matched by agent id first, so the new 001 inherited the old 001's asset, findings and history. The id now stops matching when the agent's name is a different host than the asset's (case and FQDN vs short name tolerated) and its dateAdd is later than the registration stored on the asset (new column wazuh_registered_at, migration 066), or later than its last keepalive on rows synced before 066. Either condition alone keeps the asset, so a rename by another source and a migrated identity stay put. The old asset is unlinked with an audit entry, and the agent goes through the hostname stage. The vulnerability sync applies the same rule and skips such an agent until the next asset sync.
28 lines
749 B
Python
28 lines
749 B
Python
"""Add assets.wazuh_registered_at
|
||
|
||
Revision ID: 066
|
||
Revises: 065
|
||
Create Date: 2026-11-01 10:00:00.000000
|
||
|
||
The Wazuh agent's `dateAdd`. Agents that re-enroll on a fresh Wazuh server
|
||
get ids from 001 again; without the registration date the asset sync cannot
|
||
tell the new 001 from the old one (asset_lifecycle.unlink_reused_wazuh_id).
|
||
Filled by the next Wazuh sync. Idempotent (IF NOT EXISTS), same shape as
|
||
053–065.
|
||
"""
|
||
from alembic import op
|
||
|
||
|
||
revision = "066"
|
||
down_revision = "065"
|
||
branch_labels = None
|
||
depends_on = None
|
||
|
||
|
||
def upgrade() -> None:
|
||
op.execute("ALTER TABLE assets ADD COLUMN IF NOT EXISTS wazuh_registered_at TIMESTAMP;")
|
||
|
||
|
||
def downgrade() -> None:
|
||
op.execute("ALTER TABLE assets DROP COLUMN IF EXISTS wazuh_registered_at;")
|