Wazuh's Vulnerability Detection panel automatically detects the CVEs affecting the software installed on your agents, cross-referencing it against the NVD, Debian, Red Hat, and other databases. It's enabled by default and requires no extra configuration to start showing results.
How do you use Wazuh's Vulnerability Detection panel?
Wazuh's Vulnerability Detection panel cross-references the software installed on your systems against CVE databases to detect known vulnerabilities. It comes enabled by default, but it can be customized on both the server and the agents.
Why is vulnerability detection mandatory under the regulations?
ISO 27001 - Control A.8.8
Management of technical vulnerabilities: Organizations must identify the technical vulnerabilities in their information systems, assess their exposure, and take appropriate measures. It's not optional, it's an explicit control in Annex A.
Important: Running a vulnerability scanner once a year isn't enough. The standard requires a continuous, documented process.
ENS - Measures op.exp.6 and op.exp.3
op.exp.6 (Protection against malicious code): Active protection against exploitable vulnerabilities.
op.exp.3 (Security management): Requires keeping an up-to-date inventory of installed software and its versions, precisely so it can be cross-referenced against vulnerability databases. In the ENS medium category, this control is mandatory.
How do you configure the server (Manager)?
Vulnerability detection comes enabled by default. In the manager's /var/ossec/etc/ossec.conf you can customize:
<vulnerability-detector>
<enabled>yes</enabled>
<interval>5m</interval>
<min_full_scan_interval>6h</min_full_scan_interval>
<run_on_start>yes</run_on_start>
</vulnerability-detector>Parameters:
interval: How often to check for new packagesmin_full_scan_interval: Minimum interval between full scansrun_on_start: Run a scan when the service starts
How do you configure the agents?
On the agents, the software inventory module is enabled by default. It sends the list of installed packages to the manager, which cross-references them against the CVE databases.
You can customize which packages to scan or exclude specific directories from the analysis by editing the agent's ossec.conf.
How do you remediate a real CVE? CVE-2025-15467 (OpenSSL)
In the video we automatically detect a critical OpenSSL vulnerability. The panel shows:
- CVE ID: CVE-2025-15467
- Severity: Critical
- Affected package: openssl
- Vulnerable version: the one installed on the system
- Fix: Update to a patched version
Fix: Update OpenSSL
apt update && apt upgrade -y openssl libssl3t64 openssl-provider-legacyAfter the update, Wazuh will verify on the next scan that the vulnerability no longer applies and mark it as resolved.
What information does the panel provide?
The Vulnerability Detection panel shows:
- Total vulnerabilities per agent and severity
- CVE ID linked to the national vulnerability database
- CVSS Score: Severity rating
- Affected package and version
- Detection date
- Status: Active, resolved, or ignored
Compliance summary
| Regulation | Control | Requirement |
| ISO 27001 | A.8.8 | Continuous management of technical vulnerabilities |
| ENS | op.exp.6 | Protection against malicious code |
| ENS | op.exp.3 | Up-to-date software inventory |
How quickly does Wazuh confirm a fix?
Continuous scanning is what separates real compliance from a checkbox exercise. With the default configuration, Wazuh re-evaluates new packages every 5 minutes and runs a full inventory comparison at least every 6 hours, so a newly disclosed critical CVE typically appears in the dashboard within hours of the feed being updated rather than waiting for a quarterly audit. In practice that closes the exposure window from weeks to a single day.
Equally important is the resolution loop: once you patch a package, the very next scan re-checks the installed version against the CVE database and flips the finding to resolved, automatically producing the documented evidence that ISO 27001 A.8.8 and ENS op.exp.3 auditors ask for. There is no manual spreadsheet to maintain, which is where most vulnerability-management programs fail.
Frequently Asked Questions
How does Wazuh's Vulnerability Detection panel work?
Wazuh's software inventory module collects the full list of installed packages and their versions from each agent and sends it to the manager. The manager cross-references that inventory against CVE databases such as the NVD, Debian, Red Hat, and Canonical feeds, and reports any matching known vulnerability with its CVE ID and CVSS score. The module is enabled by default, so it starts showing results without extra configuration.
Is vulnerability detection enabled by default in Wazuh?
Yes. Both the vulnerability-detector module on the manager and the software inventory module on the agents are enabled out of the box. You only need to edit ossec.conf if you want to customize the scan interval, the minimum full-scan interval, or exclude specific packages or directories from analysis.
How does Wazuh help meet ISO 27001 and ENS compliance?
ISO 27001 control A.8.8 requires a continuous, documented process for managing technical vulnerabilities, not a once-a-year scan. The Spanish ENS framework requires op.exp.6 (protection against malicious code) and op.exp.3 (an up-to-date software inventory), which is mandatory in the ENS medium category. Wazuh's continuous scanning and software inventory satisfy all three controls automatically and leave an audit trail.
How often does Wazuh scan for new vulnerabilities?
By default the vulnerability-detector checks for new packages every 5 minutes (the interval parameter) and runs a full scan no more often than every 6 hours (min_full_scan_interval), with run_on_start set to yes so a scan happens when the service starts. These values are configurable in the manager's ossec.conf.
What information does the Vulnerability Detection panel show?
For each agent it shows the total number of vulnerabilities by severity, the CVE ID linked to the national vulnerability database, the CVSS score, the affected package and version, the detection date, and the status (active, resolved, or ignored). Once you patch a package, Wazuh marks the CVE as resolved on the next scan.
Next steps
Our managed Wazuh service covers more panels like Configuration Assessment, Malware Detection, and Threat Hunting. Discover our Wazuh service.