Vulnerability detection

The Wazuh Vulnerability Scanner module detects vulnerabilities in operating systems and applications on monitored endpoints. The Wazuh agent uses the Syscollector module to collect endpoint inventory, including OS details, installed packages, and Windows hotfixes, and sends it to the Wazuh manager. The Wazuh Vulnerability Scanner module analyzes the inventory against vulnerability intelligence synchronized from Wazuh Cyber Threat Intelligence (CTI) via the Wazuh indexer to identify vulnerable packages.

The Wazuh Vulnerability Scanner module helps to meet the following PCI DSS requirements:

  • Requirement 6 - Develop and Maintain Secure Systems and Software: Actors with malicious intent can exploit security vulnerabilities to gain privileged access to systems. Vendor security patches fix these vulnerabilities, and system owners must install them. All system components must have all appropriate software patches to protect against the exploitation and compromise of account data by malicious individuals and malicious software.

The goal of this requirement is to verify that systems and software have the appropriate security patches installed to address discovered vulnerabilities and prevent compromise.

  • Requirement 11 - Test Security of Systems and Networks Regularly: Vulnerabilities are being discovered continually by malicious individuals and researchers, and being introduced by new software. System components, processes, and bespoke and custom software must be tested frequently to verify that security controls continue to reflect a changing environment.

This requirement aims to verify that systems and networks are regularly tested to confirm their security status. These tests include penetration testing and vulnerability scans. The Wazuh Vulnerability Scanner module supports this requirement by detecting vulnerabilities in operating systems and applications. Vulnerability detection helps organizations assess exposure and address security risks as they are discovered. You can find more details on configuring vulnerability scans in the vulnerability detection section of the documentation.

Use cases

Below are PCI DSS requirements that the Wazuh Vulnerability Scanner module can meet.

PCI DSS requirement 6.3

PCI DSS requirement 6.3 mandates that security vulnerabilities be identified and addressed. You can identify these security vulnerabilities by scheduling vulnerability scans with the Wazuh Vulnerability Scanner module. In this example, the goal is to identify vulnerable packages installed on a CentOS Stream 10 endpoint.

The Wazuh Vulnerability Scanner module works with the Syscollector module to detect vulnerable packages and software on a monitored endpoint. Vulnerability detection is enabled by default in the Wazuh manager configuration file at /var/wazuh-manager/etc/wazuh-manager.conf. The following block shows the default vulnerability detection configuration:

<vulnerability-detection>
  <enabled>yes</enabled>
  <feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>

The Syscollector configuration is enabled by default and is found in the Wazuh agent configuration file. The file is located at /var/ossec/etc/ossec.conf.

<wodle name="syscollector">
  <disabled>no</disabled>
  <interval>1h</interval>
  <scan_on_start>yes</scan_on_start>
  <hardware>yes</hardware>
  <os>yes</os>
  <network>yes</network>
  <packages>yes</packages>
  <ports all="yes">yes</ports>
  <processes>yes</processes>
  <users>yes</users>
  <groups>yes</groups>
  <services>yes</services>
  <browser_extensions>yes</browser_extensions>
  <!-- Database synchronization settings -->
  <synchronization>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <max_eps>75</max_eps>
    <integrity_interval>24h</integrity_interval>
  </synchronization>
</wodle>

Once the scan finishes, you can see the results on the Wazuh dashboard. They include details of vulnerable packages, for example, vulnerabilities in the Firefox application.

When you select any vulnerability, you see an overview of the detected issue and its status.

PCI DSS requirement 11.3

PCI DSS requirement 11.3 mandates that external and internal vulnerabilities be regularly identified, prioritized, and addressed. You can identify these vulnerabilities by performing vulnerability scans. The Wazuh Vulnerability Scanner module also supports prioritizing vulnerabilities by providing details on severity ratings and CVSS scores. You can use the Wazuh dashboard to filter for critical severity to prioritize remediation.