How to drop an ip in list ? (wazuh_blocked_ips)

[hregis]

Hello @talsoft

Thank you for your work, it works well.

However, the IPs are not removed from the list (wazuh_blocked_ips) after the time defined in "timeout".
Is there anything else that needs to be added to make it work the same way as "firewall-drop"?

Thank you

[talsoft]

Hi @hregis , thank you for your message. The delete IP should be execute in the timeout of the active response. Do you see any error in the integration log file? Has the API KEY in Cloudflare the permissions to delete? or only PUT?

You should see in the integration logs into Wazuh the error o logs like

wazuh-cloudflare/active-response/bin/cloudflare-block-ip.py

Lines 164 to 165 in 59127d9

	elif msg.command == DELETE_COMMAND:

[hregis]

@talsoft thank you for your response.

i have only "virustotal" logs in "integrations.log" !
Is there a setting to enable logs in "integrations.log"?
API KEY in Cloudflare use "edit" mode... i don't have "delete" mode...

My Wazuh version of manager and agent : 4.14.5-1

[hregis]

@talsoft for all others i have

<timeout>28800</timeout>

for "cloudflare-block" i try

<timeout>60</timeout>

and in "active-responses.log" i have ("command":"delete") every 60 seconds :

2026/05/25 21:57:12 active-response/bin/cloudflare-block-ip.py: Ended
2026/05/25 21:58:12 active-response/bin/cloudflare-block-ip.py: Started
2026/05/25 21:58:12 active-response/bin/cloudflare-block-ip.py: {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete",

but the ip is not deleted in "wazuh_blocked_ips" list of cloudflare

and i change with :

<timeout>28800</timeout>

But since then I no longer have any "delete" requests in the logs.

Additional question: if an IP address is no longer referenced in "iptables" but is still in "wazuh_blocked_ips" list of cloudflare
will that IP address no longer be removed from that list?

thank you for your help

[hregis]

@talsoft
Shouldn't we have a "command" similar to "firewall-drop" to remove IP addresses from the "wazuh_blocked_ips" list of cloudflare without including those referenced in iptables?

Sorry, I'm having trouble understanding how it works! 😄

[hregis]

@talsoft
one final question!
Will an IP address that is already referenced in iptables be added to the Cloudflare list?
And how does it react if the IP address is referenced in the manager's "ossec.conf" whitelist?

Sorry for all these questions but how Wazuh works seems unclear to me sometimes! 😄

[talsoft]

@talsoft for all others i have

<timeout>28800</timeout>

for "cloudflare-block" i try

<timeout>60</timeout>

and in "active-responses.log" i have ("command":"delete") every 60 seconds :

2026/05/25 21:57:12 active-response/bin/cloudflare-block-ip.py: Ended
2026/05/25 21:58:12 active-response/bin/cloudflare-block-ip.py: Started
2026/05/25 21:58:12 active-response/bin/cloudflare-block-ip.py: {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete",

but the ip is not deleted in "wazuh_blocked_ips" list of cloudflare

and i change with :

<timeout>28800</timeout>

But since then I no longer have any "delete" requests in the logs.

Additional question: if an IP address is no longer referenced in "iptables" but is still in "wazuh_blocked_ips" list of cloudflare will that IP address no longer be removed from that list?

thank you for your help

Thank you for your follow. The scrip only add and delete IPs to Cloudflare, It doesn't add any IP address in Iptables in the agent. Because, I created the script only for blocking IP address in the Cloudflare.
What is the wazuh manager version? I know Wazuh had changed the active response scripts (JSON format) format in older wazuh version, like in wazuh/wazuh#7210 .
Maybe, is the version deployed is before that change, the script doesn't work, because your wazuh manager wait for old format in the active response.

[talsoft]

@talsoft Shouldn't we have a "command" similar to "firewall-drop" to remove IP addresses from the "wazuh_blocked_ips" list of cloudflare without including those referenced in iptables?

Sorry, I'm having trouble understanding how it works! 😄

mm, maybe but the stateful active response reverts or stops its action after a specified period of time, with timeout. I remember the action is executed by wazuh manager with the timeout finish, for the operation Delete. I will review the code, if it is a issue.

[talsoft]

@talsoft one final question! Will an IP address that is already referenced in iptables be added to the Cloudflare list? And how does it react if the IP address is referenced in the manager's "ossec.conf" whitelist?

Sorry for all these questions but how Wazuh works seems unclear to me sometimes! 😄

mm, great question. According with the documentation, and the theory, the Whitelist has priority with Ban ip . But if that IP address is added in Cloudflare, the request never is received by wazuh. mmmm Interesting situation. Maybe, we need to read the whitelist of the manager before send the ip to blacklist in the Cloudflare.