Configuration

Vulnerability detection is enabled by default on the Wazuh manager. The Vulnerability Scanner module uses endpoint inventory from the Syscollector module and vulnerability intelligence synchronized through the Wazuh indexer to detect vulnerabilities on monitored endpoints.

You can configure vulnerability detection in the Wazuh manager configuration file at /etc/wazuh-manager/wazuh-manager.conf. The following block shows the default vulnerability detection configuration:

<vulnerability-detection>
  <enabled>yes</enabled>
  <feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>

Where:

<enabled> specifies whether vulnerability detection is enabled. The default value is yes. The allowed values are yes and no.
<feed-update-interval> specifies how often the Vulnerability Scanner module checks for vulnerability intelligence updates from the Wazuh indexer. The default value is 60m (one hour). The allowed value is a positive number that contains a suffix character indicating a time unit, such as s (seconds), m (minutes), h (hours), or d (days).

Note

Setting feed-update-interval below 60m is not supported and will be ignored. Increasing the interval increases the time between vulnerability intelligence updates available to the Vulnerability Scanner module.

Requirements

Vulnerability detection depends on the endpoint inventory collected by the Wazuh Syscollector module. The Syscollector module is enabled by default on the monitored endpoint and must collect operating system and package inventory data.

The Syscollector configuration is found in the Wazuh agent configuration file. The file is located at:

/var/ossec/etc/ossec.conf for Linux endpoints.
C:\Program Files (x86)\ossec-agent\ossec.conf for Windows endpoints.
/Library/Ossec/etc/ossec.conf for macOS endpoints.

The following block shows the default Syscollector configuration on a monitored endpoint. The <disabled>, <os>, and <packages> options are required for vulnerability detection. Detection timing depends on the configured Syscollector module scan interval. The default interval is 1h.

<wodle name="syscollector">
  <disabled>no</disabled>
  <interval>1h</interval>
  <scan_on_start>yes</scan_on_start>
  <hardware>yes</hardware>
  <os>yes</os>
  <network>yes</network>
  <packages>yes</packages>
  <ports all="yes">yes</ports>
  <processes>yes</processes>
  <users>yes</users>
  <groups>yes</groups>
  <services>yes</services>
  <browser_extensions>yes</browser_extensions>

  <!-- Database synchronization settings -->
  <synchronization>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <max_eps>75</max_eps>
    <integrity_interval>24h</integrity_interval>
  </synchronization>
</wodle>

For Windows endpoints, enable hotfix collection when you want Wazuh to use installed Microsoft updates to evaluate resolved vulnerabilities:

<wodle name="syscollector">
  <hotfixes>yes</hotfixes>
</wodle>

Wazuh indexer dependency

The Vulnerability Scanner module depends on the Wazuh indexer to obtain synchronized vulnerability intelligence.

If the Wazuh manager cannot connect to the Wazuh indexer, the Vulnerability Scanner module cannot retrieve vulnerability intelligence or index vulnerability data. As a result, vulnerability information might not be updated or available in the Wazuh dashboard.

You can validate the Wazuh indexer configuration in the <indexer> section of the Wazuh manager configuration file at /etc/wazuh-manager/wazuh-manager.conf. The default <indexer> configuration is:

<indexer>
  <hosts>
    <host>https://127.0.0.1:9200</host>
  </hosts>
  <ssl>
    <certificate_authorities>
      <ca>/etc/wazuh-manager/certs/indexer-ca.pem</ca>
    </certificate_authorities>
    <certificate>/etc/wazuh-manager/certs/indexer-connector.pem</certificate>
    <key>/etc/wazuh-manager/certs/indexer-connector-key.pem</key>
  </ssl>
</indexer>

Ensure that:

The <hosts> section contains the full URL of a Wazuh indexer node, including the scheme and port.
The Wazuh indexer CA and the Wazuh manager client certificate and key exist in /etc/wazuh-manager/certs/ as indexer-ca.pem, indexer-connector.pem, and indexer-connector-key.pem. If the Wazuh indexer runs on the same host, the Wazuh manager imports these files from /etc/wazuh-indexer/export/ when it is installed and before every start.
The Wazuh manager has valid Wazuh indexer credentials. The Wazuh manager stores this password in its keystore. Without these credentials, the Wazuh manager does not start.

You can check the certificates and the configuration files of the Wazuh manager with the following command. It prints check: no problem found on success, and exits 1 on any problem:

# /var/wazuh-manager/bin/wazuh-manager-resolve-credentials --check

Note

This check does not read the keystore, so it does not confirm that the Wazuh indexer password is present or correct. Every time the Wazuh manager starts, it reports the password state in the service journal:

# journalctl -u wazuh-manager | grep resolve-credentials | tail

the indexer password is in the keystore means a password is stored. MISSING WAZUH_INDEXER_MANAGER_PASSWORD means it is not, and the manager does not start.

The Wazuh manager never replaces an indexer password that is already in its keystore. After you change the wazuh-manager user password on the Wazuh indexer, update the keystore and restart the Wazuh manager:

# printf '%s' '<NEW_INDEXER_PASSWORD>' | /var/wazuh-manager/bin/wazuh-manager-keystore -f indexer -k password

# systemctl restart wazuh-manager

Verify the Wazuh indexer is reachable and operational by querying the cluster health API using a Wazuh indexer user. Enter the Wazuh indexer password when prompted:

# curl -k -u <WAZUH_INDEXER_USERNAME> -XGET https://<INDEXER_IP_ADDRESS>:9200/_cluster/health?pretty

Replace <INDEXER_IP_ADDRESS> with the address in the <host> entry of the <indexer> section.

A successful connection returns a result similar to the following:

{
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 99,
  "active_shards" : 99,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

Offline vulnerability feed

Wazuh 5.0 uses the Wazuh indexer as the source of vulnerability feed data for the Vulnerability Scanner module. To update the vulnerability content without Internet access, load a newer snapshot into the Wazuh indexer, as Updating the content offline describes.