Use cases

The following use cases show practical applications of visualizing system inventory data for security operations on the Wazuh dashboard.

Use case 1: Resource monitoring

Monitor memory usage across all endpoints to assess system performance and find devices with low available memory.

  1. Click the menu icon, then navigate to Security operations > IT Hygiene.

  2. Select the System tab and then Hardware.

  3. Click + Add filter and configure it as follows:

    • Field: host.memory.free

    • Operator: exists

    Use case 1: Resource monitoring

Use case 2: Vulnerability management

Identify endpoints with critical vulnerabilities in your environment and use the system inventory to locate every endpoint running the affected software.

  1. Click the menu icon, then navigate to Threat intelligence > Vulnerability Detection.

  2. Switch to the Inventory tab.

  3. Click + Add filter and configure it as follows:

    • Field: vulnerability.severity

    • Operator: is

    • Value: Critical

    The filtered view lists the vulnerable packages and the endpoints where they are installed.

    Use case 2: Vulnerability management

  4. Note the name of an affected package. Click the menu icon, then navigate to Security operations > IT Hygiene.

  5. Select the Software tab and then Packages.

  6. Click + Add filter and configure it as follows:

    • Field: package.name

    • Operator: is

    • Value: openssl. The name of the affected package.

    IT Hygiene - Vulnerable package

  7. Update or uninstall the vulnerable software packages.

Use case 3: Detecting new software installations

Identify new software installed across your fleet to catch potential unauthorized or shadow-IT applications shortly after they appear.

  1. Click the menu icon, then navigate to Threat intelligence > Threat Hunting.

  2. Switch to the Findings tab.

  3. Click + Add filter and configure it as follows:

    • Field: wazuh.rule.title

    • Operator: is

    • Value: Wazuh IT Hygiene - Item created

  4. Add a second filter:

    • Field: event.action

    • Operator: is

    • Value: package-installed

    Detecting new software installations

    The filtered view lists every package installation across your fleet as it is detected, including the endpoint, the package name, and the installation time.

  5. To see the full installation history of a specific package, note its name and pivot to Security operations > IT Hygiene > Software > Packages, then filter on package.name.

    Package installation history across endpoints

Use case 4: Auditing privileged account hygiene

Review user accounts for unexpected privileged group membership.

  1. Click the menu icon, then navigate to Security operations > IT Hygiene.

  2. Select the Identity tab and then Groups.

  3. Click + Add filter and configure it as follows:

    • Field: group.name

    • Operator: is

    • Value: A group name associated with administrative access in your environment. In this case Administrators

    The filtered view shows every account which is a member of the Administrators group.

    Privileged group membership

Use case 5: Reviewing open ports and attack surface

Find endpoints with unexpected listening services to reduce your attack surface.

  1. Click the menu icon, then navigate to Security operations > IT Hygiene.

  2. Select the Network tab and then Listeners.

  3. Click + Add filter and configure it as follows:

    • Field: source.ip

    • Operator: is

    • Value: 0.0.0.0

    The filtered view shows every listening socket bound to all network interfaces, rather than only localhost, across your fleet. Sockets bound this way are reachable from other machines on the network and deserve closer review.

    Listening services bound to all interfaces