[Bug] old version of wazuh responder script problems

Describe the bug
Hello good morning, I have issues with the script of wazuh responder, because it is old and i need to modify some code in the script, so i need to know what blocks i need to add in ossec.conf and what i need to modify in the script to it works

If I want to block an ip with netsh.exe what i need to change in the blocks in var/ossec/etc/ossec.conf or in my windows configuration

To Reproduce
Steps to reproduce the behavior:

1. run the wazuh responder on ip observable
2. error or failure when the responder runs in cortex
3. if I change the command from firewall-drop to netsh.exe if it runs failes??
4. this script works in windows scripts like netsh or not?

this is the old version of script in wazuh responder in github had issues like firewall-drop.sh or even when you run i have issues like Agent ID is missing when it runs the responder in cortex.

#!/usr/bin/env python3
from cortexutils.responder import Responder
import requests
import ipaddress

class Wazuh(Responder):
def init(self):
Responder.init(self)
self.wazuh_manager = self.get_param('config.wazuh_manager', None, 'https://localhost:55000')
self.wazuh_user = self.get_param('config.wazuh_user', None, 'Username missing!')
self.wazuh_password = self.get_param('config.wazuh_password', None, 'Password missing!')
self.wazuh_agent_id = self.get_param('data.case.customFields.wazuh_agent_id.string', None, "Agent ID Missing!")
self.wazuh_alert_id = self.get_param('data.case.customFields.wazuh_alert_id.string', None, "Alert ID Missing!")
self.wazuh_rule_id = self.get_param('data.case.customFields.wazuh_rule_id.string', None, "Rule ID Missing!")
self.observable = self.get_param('data.data', None, "Data is empty")
self.observable_type = self.get_param('data.dataType', None, "Data type is empty")

def run(self):
Responder.run(self)
auth = (self.wazuh_user, self.wazuh_password)
headers = {'Content-Type': 'application/json'}
# Check observable to ensure valid IP address
if self.observable_type == "ip":
try:
ipaddress.ip_address(self.observable)
except ValueError:
self.error({'message': "Not a valid IPv4/IPv6 address!"})
else:
self.error({'message': "Not a valid IPv4/IPv6 address!"})
payload = '{"command":"firewall-drop.sh", "arguments": ["-", "' + self.observable + '", "' + self.wazuh_alert_id + '", "' + self.wazuh_rule_id + '", "' + self.wazuh_agent_id + '", "var/log/test.log"], "custom": "True"}'
r = requests.put(self.wazuh_manager + '/active-response/' + self.wazuh_agent_id, headers=headers, data=payload, verify=False, auth=auth)
if r.status_code == 200:
self.report({'message': "Added DROP rule for " + self.observable })
else:
self.error(r.status_code)

def operations(self, raw):
return [self.build_operation('AddTagToCase', tag='Wazuh: Blocked IP')]

if name == 'main':
Wazuh().run()

Expected behavior

1. success when I run the script against one ip observable
2. sucees if I change the command from firewall-drop to netsh.exe

Complementary information

when I change the code with other new code like this below i got better results like success but in wazuh dont appears nothing maybe because i need to change the command firewall.drop to netsh in payload.

#!/usr/bin/env python3
from cortexutils.responder import Responder
import requests
import ipaddress
import json
import urllib3
from base64 import b64encode

Disable insecure https warnings (for self-signed SSL certificates)

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class Wazuh(Responder):
def init(self):
Responder.init(self)
self.wazuh_manager = self.get_param('config.wazuh_manager', None, 'https://localhost:55000')
self.wazuh_user = self.get_param('config.wazuh_user', None, 'Username missing!')
self.wazuh_password = self.get_param('config.wazuh_password', None, 'Password missing!')
self.wazuh_agent_id = self.get_param('data.case.customFields.wazuh-agent-id.string', None, "Agent ID Missing!")
self.wazuh_alert_id = self.get_param('data.case.customFields.wazuh-alert-id.string', None, "Alert ID Missing!")
self.wazuh_rule_id = self.get_param('data.case.customFields.wazuh-rule-id.string', None, "Rule ID Missing!")
self.observable = self.get_param('data.data', None, "Data is empty")
self.observable_type = self.get_param('data.dataType', None, "Data type is empty")

def run(self):
Responder.run(self)
auth = (self.wazuh_user, self.wazuh_password)
basic_auth = f"{self.wazuh_user}:{self.wazuh_password}".encode()
headers = {'Content-Type': 'application/json',
'Authorization': f'Basic {b64encode(basic_auth).decode()}'}

   # Check observable to ensure valid IP address
   if self.observable_type == "ip":
       try:
           ipaddress.ip_address(self.observable)
       except ValueError:
           self.error({'message': "Not a valid IPv4/IPv6 address!"})
   else: 
       self.error({'message': "Not a valid IPv4/IPv6 address!"})
   payload = '{"command":"firewall-drop", "arguments": ["-", "' +  self.observable + '", "' + self.wazuh_alert_id + '", "' + self.wazuh_rule_id + '", "' + self.wazuh_agent_id + '", "var/log/test.log"]}'
  
   response = requests.get(self.wazuh_manager + '/security/user/authenticate', headers=headers, verify=False)
   token = json.loads(response.content.decode())['data']['token']
   # New authorization header with the JWT token we got
   requests_headers = {'Content-Type': 'application/json',
                      'Authorization': f'Bearer {token}'}

   response = requests.put(f"{self.wazuh_manager}/active-response?agents_list={self.wazuh_agent_id}", headers=requests_headers, data=payload, verify=False)
   
   if response.status_code == 200:
       self.report({'message': "Added DROP rule for " + self.observable  })
   else:
       self.error(response.status_code)

def operations(self, raw):
return [self.build_operation('AddTagToCase', tag='Wazuh: Blocked IP')]

if name == 'main':
Wazuh().run()

Work environment

• Client OS: windows 10
• Server OS: ubuntu 22
• Browse type and version: firefox
• Cortex version: 3.1
• Cortex Analyzer/Responder name: Wazuh responder
• Cortex Analyzer/Responder version:

Possible solutions
change some code like firewall-drop instead firewall-drop.sh and other code because this cause issues when the script runs

Additional context

Review the Wazuh responder script shown in the issue alongside var/ossec/etc/ossec.conf, firewall-drop.sh, and the Windows netsh.exe command. Reproduce the Cortex failure with an IP observable and verify completion when the responder blocks the IP and Wazuh records the action.