Configuration

Vulnerability detection is enabled by default on the Wazuh manager. The Vulnerability Scanner module uses endpoint inventory from the Syscollector module and CVE content synchronized through the Wazuh indexer to detect vulnerable packages and software on monitored endpoints.

You can configure vulnerability detection in the Wazuh manager configuration file at /var/wazuh-manager/etc/wazuh-manager.conf. The following block shows the default vulnerability detection configuration:

<vulnerability-detection>
  <enabled>yes</enabled>
  <feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>

Where:

  • <enabled> specifies whether vulnerability detection is enabled. The default value is yes. The allowed values are yes and no.

  • <feed-update-interval> specifies how often the Vulnerability Scanner module checks for vulnerability feed updates from the Wazuh indexer. The default value is 60m (one hour). The allowed value is a positive number that contains a suffix character indicating a time unit, such as s (seconds), m (minutes), h (hours), or d (days).

Note

Setting feed-update-interval below 60m is not supported and will be ignored. Increasing the interval reduces network and indexer load at the cost of slower CVE feed refresh.

Requirements

Vulnerability detection depends on the endpoint inventory collected by the Wazuh Syscollector module. The Syscollector module is enabled by default on the monitored endpoint and must collect operating system and package inventory data.

The Syscollector configuration is found in the Wazuh agent configuration file. The file is located at:

  • /var/ossec/etc/ossec.conf for Linux endpoints.

  • C:\Program Files (x86)\ossec-agent\ossec.conf for Windows endpoints.

  • /Library/Ossec/ossec.conf for macOS endpoints.

The following block shows the default Syscollector configuration on a monitored endpoint. The <disabled>, <os>, and <packages> options are required for vulnerability detection. Detection timing depends on the configured Syscollector module scan interval. The default interval is 1h.

<wodle name="syscollector">
  <disabled>no</disabled>
  <interval>1h</interval>
  <scan_on_start>yes</scan_on_start>
  <hardware>yes</hardware>
  <os>yes</os>
  <network>yes</network>
  <packages>yes</packages>
  <ports all="yes">yes</ports>
  <processes>yes</processes>
  <users>yes</users>
  <groups>yes</groups>
  <services>yes</services>
  <browser_extensions>yes</browser_extensions>

  <!-- Database synchronization settings -->
  <synchronization>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <max_eps>75</max_eps>
    <integrity_interval>24h</integrity_interval>
  </synchronization>
</wodle>

For Windows endpoints, enable hotfix collection when you want Wazuh to use installed Microsoft updates to evaluate resolved vulnerabilities:

<wodle name="syscollector">
  <hotfixes>yes</hotfixes>
</wodle>

Wazuh indexer dependency

The Vulnerability Scanner module depends on the Wazuh indexer for CTI content synchronization and vulnerability data indexing. The Wazuh manager must be able to connect to the Wazuh indexer.

If the Wazuh manager cannot connect to the Wazuh indexer, Wazuh cannot synchronize CVE data, update the vulnerability inventory, or show vulnerability data in the Wazuh dashboard.

You can validate the Wazuh indexer configuration in the <indexer> section of the Wazuh manager configuration file at /var/wazuh-manager/etc/wazuh-manager.conf. The default <indexer> configuration is:

<indexer>
  <hosts>
    <host>https://127.0.0.1:9200</host>
  </hosts>
  <ssl>
    <certificate_authorities>
      <ca>etc/certs/root-ca.pem</ca>
    </certificate_authorities>
    <certificate>etc/certs/manager.pem</certificate>
    <key>etc/certs/manager-key.pem</key>
  </ssl>
</indexer>

Ensure that:

  • The <hosts> section contains the IP address or hostname of the Wazuh indexer node.

  • The certificate paths match the files available on the Wazuh manager.

  • The Wazuh manager has valid Wazuh indexer credentials in its keystore.

Verify the Wazuh indexer status in the Wazuh manager by sending a GET request to the /_cluster/health endpoint. Enter the Wazuh indexer password when prompted:

# curl -k -u <WAZUH_INDEXER_USERNAME> -XGET https://<INDEXER_IP_ADDRESS>:9200/_cluster/health?pretty

A successful connection returns a result similar to the following:

{
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 99,
  "active_shards" : 99,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

Unsupported offline feed

Offline vulnerability feed loading is not supported in Wazuh 5.0.

The <offline-url> option used in earlier versions was removed because the vulnerability feed content format changed. Wazuh 5.0 uses the Wazuh indexer as the source of vulnerability feed data for the Vulnerability Scanner module.