我有一个在Debian上运行的wazuh管理器，它接收来自mikrotik路由器的日志。当有人尝试登录路由器失败5次时，它向管理器发送警报，管理器将通过将尝试登录的IP添加到mikrotik路由器中的地址列表中，该路由器将阻止其所有流量，超时设置为一天。
我现在想做的是，找出如何立即解除封锁的IP谁被封锁，而不必等待一天，它自动解除封锁。我尝试做的是，手动创建一个JSON有效负载，并使用curl将其发送给管理器。我使用的命令可以工作，但是管理器没有将输出发送到正确的位置。
我也有一台运行在debian上的测试代理机。管理器正在向安装了wazuh代理的计算机发送命令。然而，我希望它把它发送到mikrotik路由器，这是一个无代理系统。我有可能这样做吗，或者它只工作没有安装了wazuh的代理？
我使用的命令是这样的：

curl -k -X PUT "https://192.168.31.179:55000/active-response" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command":"delete","alert":{"timestamp":"2023-06-15T10:09:29.676+0100","rule":{"level":15,"description":"Mikrotik: Suspeita ataque forcabruta","id":"100102","frequency":5,"firedtimes":1,"mail":true,"groups":["mikrotik"]},"agent":{"id":"000","name":"cmanuel2"},"manager":{"name":"cmanuel2"},"id":"1686820169.2649","previous_output":"system,error,critical mikrotik_logs: login failure for user admin from 192.168.31.1 via web\nsystem,error,critical mikrotik_logs: login failure for user admin from 192.168.31.1 via web\nsystem,error,critical mikrotik_logs: login failure for user admin from 192.168.31.1 via web\nsystem,error,critical mikrotik_logs: login failure for user admin from 192.168.31.1 via web","full_log":"system,error,critical mikrotik_logs: login failure for user admin from 192.168.31.1 via web","decoder":{"parent":"mikrotik","name":"mikrotik"},"data":{"srcip":"192.168.31.1","dstuser":"admin"},"location":"192.168.31.201"}}'

输出是这样的：

{
  "data": {
    "affected_items": [

    ],
    "total_affected_items": 0,
    "total_failed_items": 1,
    "failed_items": [
      {
        "error": {
          "code": 1707,
          "message": "Cannot send request, agent is not active",
          "remediation": "Please, check non-active agents connection and try again. Visit https://documentation.wazuh.com/4.4/user-manual/registering/index.html and https://documentation.wazuh.com/4.4/user-manual/agents/agent-connection.html to obtain more information on registering and connecting agents"
        },
        "id": [
          "001"
        ]
      }
    ]
  },
  "message": "AR command was not sent to any agent",
  "error": 1
}

我知道输出给我一个错误，因为测试代理机器被关闭，但它不应该尝试发送上面的命令摆在首位，它应该这样做的mikrotik路由器。