vulnerability-detection

This section covers the configuration for the Vulnerability detection module.

Options

Options	Allowed values
enabled	`yes`, `no`
feed-update-interval	Positive number + Time unit suffix
index-status	`yes`, `no`
offline-url	`file://</ABSOLUTE_PATH_TO/OFFLINE_CONTENT>`, `http[s]://<CONTENT_URL>`

enabled

Enables the vulnerability detection module.

Default	`yes`
Allowed values	`yes`, `no`

feed-update-interval

Time interval for periodic feed updates.

Default	`60m`
Allowed values	A positive number containing a time unit suffix character. For example `2h` for 2 hours. The minimum allowed is `60m`; lower values are automatically reset to `60m`.

index-status

Enables indexing of vulnerability inventory data.

Default	`yes`
Allowed values	`yes`, `no`

offline-url

File path or URL for offline content access.

Default	Empty
Allowed values	`file://</ABSOLUTE_PATH_TO/OFFLINE_CONTENT>`, `http[s]://<CONTENT_URL>`

Where:

file://</ABSOLUTE_PATH_TO/OFFLINE_CONTENT>: File path pointing to offline content. For example, file:///path/to/the/cves.file.zip
http[s]://<CONTENT_URL>: URL starting with either http:// or https://, pointing to local network content or online content accessible via the internet.

interval

Deprecated since version 4.8.0: In earlier versions, this option set the time between vulnerability scans. The module now analyzes the inventory data that Syscollector sends, so the Syscollector interval sets how often inventory is checked. The Wazuh manager ignores it and logs an invalid element warning.

run_on_start

Deprecated since version 4.8.0: In earlier versions, this option ran feed updates and vulnerability scans when the service started. There is no replacement: the module analyzes inventory data as the agents send it. The Wazuh manager ignores it and logs an invalid element warning.

retry_interval

Deprecated since version 4.8.0: In earlier versions, this option set the time to wait before retrying agents that failed a scan. There is no replacement. The Wazuh manager ignores it and logs an invalid element warning.

provider

Deprecated since version 4.8.0: In earlier versions, this block configured the vulnerability feed providers. Vulnerability data now comes from the Wazuh Cyber Threat Intelligence (CTI) platform and is updated every feed-update-interval. To use offline content, set offline-url. The Wazuh manager ignores it and logs an invalid element warning.

Example of configuration

<vulnerability-detection>
   <enabled>yes</enabled>
   <index-status>yes</index-status>
   <feed-update-interval>60m</feed-update-interval>
   <offline-url>file:///path/to/the/cves.file.zip</offline-url> <!-- Optional -->
</vulnerability-detection>

Note

Supported compression formats include zip, xz, and gzip. The module also accepts raw JSON content in plain text files.