# wazuh-vulnerability-detection

Companion files for the lesson [Wazuh Vulnerability Detection Setup](https://maheshtata.com/wazuh/wazuh-vulnerability-detection/).

Tested against the Wazuh 5.0 beta5 documentation (September 2026). Wazuh 5.0 is
still in beta, so treat every value as subject to change at GA.

| File | What it is | Where it goes |
| --- | --- | --- |
| `wazuh-manager.conf.fragment.xml` | The `<vulnerability-detection>` and `<indexer>` sections | merge into `/var/wazuh-manager/etc/wazuh-manager.conf` |
| `agent.conf` | Syscollector inventory settings for an agent group | `/var/wazuh-manager/etc/shared/<GROUP_NAME>/agent.conf` |

Both files are fragments. The manager configuration rejects unknown elements at
startup, so merge the sections into the existing file rather than replacing it.

## Order of operations

1. Merge the manager fragment, then `systemctl restart wazuh-manager`.
2. Verify the indexer connection before expecting any data:
   ```
   curl --cacert /var/wazuh-manager/etc/certs/root-ca.pem \
        --cert /var/wazuh-manager/etc/certs/indexer-connector.pem \
        --key /var/wazuh-manager/etc/certs/indexer-connector-key.pem \
        https://127.0.0.1:9200/_cluster/health
   ```
3. Create the agent group, place `agent.conf`, validate it with
   `verify-agent-conf`, and add agents to the group.
4. Wait for the first Syscollector scan and the first feed synchronisation.

## Notes

- `feed-update-interval` below `60m` is not supported and is ignored.
- Offline vulnerability feeds are not supported in Wazuh 5.0; `offline-url`
  was removed.
- The first inventory scan after enrolment builds the inventory and generates
  no findings. That is expected.
- Results are indexed into `wazuh-states-vulnerabilities`.