The Wazuh Vulnerability Detector module correlates the software inventory collected from agents with public CVE databases (NVD, Canonical, Debian, Red Hat, ALAS, Microsoft) to surface vulnerable packages across your fleet.
1. Enable in ossec.conf on the manager
<vulnerability-detection>
<enabled>yes</enabled>
<index-status>yes</index-status>
<feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>
<indexer>
<enabled>yes</enabled>
<hosts>
<host>https://127.0.0.1:9200</host>
</hosts>
</indexer>2. Enable syscollector on agents
<wodle name="syscollector">
<disabled>no</disabled>
<interval>1h</interval>
<packages>yes</packages>
<os>yes</os>
<hotfixes>yes</hotfixes>
</wodle>3. Restart the manager
systemctl restart wazuh-manager4. View findings
In the Wazuh dashboard open Vulnerability Detection -> Inventory. Findings are enriched with CVSS score, CVE ID, patched version and severity.
Note: Feed downloads need outbound HTTPS to feed.wazuh.com, nvd.nist.gov and the vendor feeds. Air-gapped installs need the offline feed package.
We integrate Wazuh vulnerability data into ticketing (Jira/ServiceNow) so patching becomes measurable, reach out via contact.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see: