vulnerability-detection
The <vulnerability-detection> section configures the Wazuh Vulnerability Scanner module. The module correlates agent inventory data with its local vulnerability database and indexes detected vulnerabilities into the Wazuh indexer.
Options
enabled
Enable or disable the Wazuh Vulnerability Scanner module.
Default value |
yes |
Allowed values |
yes, no |
feed-update-interval
Specifies how often the Wazuh manager updates its local vulnerability database.
Before each update, the manager checks the vulnerability content synchronization status in the Wazuh indexer. If synchronization is already in progress, the Wazuh manager postpones the update for one minute and retries it. The update begins only when the content status is idle.
Default value |
60m |
Allowed values |
Positive time value with optional suffix - s, m, h, d. The value must be parseable; there is no enforced minimum. |
pageSize
Specifies the number of vulnerability records retrieved in each page during a feed update.
Default value |
100 |
Allowed values |
Integer between 1 and 10000 |
numSlices
Specifies the number of parallel slices used during the initial vulnerability content synchronization. Set to 1 for sequential mode. A higher value can raise memory usage without proportional time savings. Benchmark before you raise it above 2.
Default value |
2 |
Allowed values |
Integer between 1 and 32 |
Sample configuration
<vulnerability-detection>
<enabled>yes</enabled>
<feed-update-interval>60m</feed-update-interval>
<pageSize>100</pageSize>
<numSlices>2</numSlices>
</vulnerability-detection>
Dependencies
The <indexer> section must be configured before the Wazuh Vulnerability Scanner can synchronize vulnerability content and index detection results. Detection results are indexed into wazuh-states-vulnerabilities.