security/wazuh-agent: Fix active response duplicate key causing false aborts (#5104)

When multiple IPs trigger the same rule simultaneously, they were
sharing the same check_keys value (only rule ID), causing the manager
to abort all but the first execution.

Changed the key to include both rule_id and srcip to make it unique
per source IP, allowing multiple simultaneous blocks while still
preventing duplicate blocks of the same IP.

Fixes #4738
This commit is contained in:
mbedworth
2025-12-28 04:23:52 -05:00
committed by GitHub
parent 809f2ae9d8
commit d3cbedaa8e
@@ -121,7 +121,8 @@ def main(params):
},
"command": "check_keys",
"parameters":{
"keys": [event['parameters']['alert']['rule']['id']]
unique_key = "%s-%s" % (event['parameters']['alert']['rule']['id'], srcip)
"keys": [unique_key]
}
}))
sys.stdout.flush()