<!--
  Manager-side vulnerability detection fragment.

  Merge these sections into the existing <wazuh_config> root of:
    /var/wazuh-manager/etc/wazuh-manager.conf

  This is a fragment, not a complete manager configuration. The file already
  contains global, logging, remote, auth, indexer, agent-upgrade, task-manager,
  wdb and cluster sections. Unknown elements cause a startup error, so merge
  rather than replace.

  Apply with:
    systemctl restart wazuh-manager

  Lesson: https://maheshtata.com/wazuh/wazuh-vulnerability-detection/
-->

<wazuh_config>

  <vulnerability-detection>
    <!-- Enabled by default. -->
    <enabled>yes</enabled>

    <!-- How often the manager updates its local vulnerability database.
         60m is the default AND the floor: lower values are not supported
         and are ignored. -->
    <feed-update-interval>60m</feed-update-interval>

    <!-- Records fetched per page during a feed update. Range 1 to 10000. -->
    <pageSize>100</pageSize>

    <!-- Parallel slices for the initial content synchronisation.
         Range 1 to 32; 1 is sequential. Benchmark before going above 2:
         more slices can raise memory use without saving proportional time. -->
    <numSlices>2</numSlices>
  </vulnerability-detection>

  <!-- The scanner depends on this section. Without a working indexer
       connection it can neither obtain vulnerability intelligence nor index
       results into wazuh-states-vulnerabilities. -->
  <indexer>
    <hosts>
      <host>https://127.0.0.1:9200</host>
    </hosts>
    <ssl>
      <certificate_authorities>
        <ca>etc/certs/root-ca.pem</ca>
      </certificate_authorities>
      <certificate>etc/certs/indexer-connector.pem</certificate>
      <key>etc/certs/indexer-connector-key.pem</key>
    </ssl>
  </indexer>

</wazuh_config>
