Vulnerability detection

Vulnerability detection helps you identify known security flaws in operating systems and software installed on monitored endpoints. These flaws can expose systems to unauthorized access, remote code execution, data exposure, or service disruption.

Vulnerability detection is implemented on the Wazuh manager by the Vulnerability Scanner module. This server-side module analyzes endpoint inventory and matches it against vulnerability intelligence to detect Common Vulnerabilities and Exposures (CVEs).

The Wazuh agent uses the Syscollector module to collect endpoint inventory, including operating system details, installed packages, and Windows hotfixes.

In Wazuh 5.0, the Wazuh indexer synchronizes Wazuh Cyber Threat Intelligence (CTI) content and provides the vulnerability feed used by the Vulnerability Scanner module. Vulnerability detection is driven by endpoint inventory updates. It runs after Wazuh receives updated inventory from the Syscollector module, rather than as a manual, on-demand scan.