Wazuh vulnerability scans

[Stephen-Ridgway]

Hi!

Has anyone got Wazuh vulnerability scans working?

SR

[ThreeEyedRaven-99]

Hi SR!

For Wazuh Vulnerability Scan you can follow these steps:

1. Download NVD Database in SO and extract the NVD database in a directory.
2. Bind the NVD directory in /opt/so/saltstack/default/salt/wazuh/init.sls (for example: if your NVD Database directory is in /root/Downloads/NVD/feeds, you can do like this in init.sls file: - /root/Downloads/NVD/feeds:/mnt/feeds
3. In wazuh config file add vulnerability-detector section and then you can mention the path of the NVD feeds:

yes /mnt/feeds/nvd-feed.*json.gz$ 1h

4. restart wazuh: so-wazuh-restart

5. Once vulnerability scan finishes you will see the data in alert section in the Kibana - or you can search for data.vulnerability in discover section

Please excuse my poor English :)