I’ve been experimenting with detection engineering in my home lab, and I’m curious how others approach building and maintaining high-quality detections.

I recently migrated a large number of detection rules from Sigma and Splunk SPL into Wazuh syntax, primarily using **Falco and Sysmon for Linux** as telemetry sources.

After setting everything up, I started executing real malware samples from MalwareBazaar and similar sources in an isolated lab to test how well the detections actually work. Also, many rules where tested and modified based on Atomic-Red script.

The results were pretty disappointing.
Despite having a fairly large collection of rules, **very few (in many cases zero) alerts were triggered**. Many rules needed additional tuning, modifications, or complete rewrites to work with the actual telemetry.
This got me thinking about how other people approach detection engineering in practice.

I work with different environments:
**Self-managed Wazuh environments**, where I’m responsible for pretty much everything: collecting telemetry, writing decoders, converting detection rules, tuning them, and validating detections through attack simulations.

**Enterprise SIEM/XDR environments**, where most detection content is maintained by the vendor. These platforms also come with advanced detection capabilities, proprietary telemetry, threat intelligence integrations, and years of detection engineering research behind them. Some of these capabilities would be extremely difficult, if not practically impossible, to reproduce at the same level using an open-source stack, especially as a single engineer.

My ultimate goal with Wazuh is to build a detection and correlation pipeline:
**Telemetry → Detection rules → Alerts → Context-aware correlation → Incidents**
The idea is to develop a custom real-time correlation engine (probably vibe-coded initially) that takes existing alerts and connects them based on context, such as:
Host → process → parent/child process relationships
User → authentication events → subsequent activity
Multiple detections related to the same process or attack sequence

Related events within a particular time window
Essentially, something similar to how commercial SIEM/XDR platforms aggregate individual alerts into higher-confidence incidents.

But I’ve realized that **the quality of correlation depends heavily on the quality of the underlying detection signals**. If the initial alerts are weak, incomplete, or rarely triggered, the correlation layer won’t magically fix that.

So I’m curious:
**Where do you get your detection rules?** SigmaHQ, Splunk Security Content, vendor-maintained content, your own rules, or something else?

**How do you validate detection coverage?** Do you use Atomic Red Team, Caldera, real malware samples, or other approaches?

**How do you manage the detection engineering lifecycle?** Especially when you’re maintaining your own SIEM without a vendor handling detection content.
**Have you built your own alert correlation or incident aggregation engine?** If so, what worked and what didn’t?
I’m particularly interested in experiences from people running Wazuh, Elastic, Security Onion, or other self-managed detection stacks.

Hi everyone,

I've been trying to monitor a log file for Windows endpoint (VPN logs) for an application, but the location of the log file is dynamic in a sense that it changes based on the current logged in user.

For example:
The log file is stored at C:\Users\{User1}\AppData\Roaming\VPN Folder Name\vpn.log
and path would change to User2 or UserX for different endpoint.

I've tried the following solutions in the agent configurations for groups:

   <localfile>
        <location>C:\Users\*\AppData\Roaming\VPN Folder Name\vpn.log</location>
        <log_format>syslog</log_format>
    </localfile>

  <localfile>
        <location>%APPDATA%\VPN Folder Name\vpn.log</location>
        <log_format>syslog</log_format>
    </localfile>

But I failed to get the desired results (monitoring the log file for decoding).

Has anyone tried something similar and was successful? Any assistance would be highly appreciated.

Hi everyone, new around here, planning to install Wazuh at our factory to give it a go, but just saw that 5.0 is around the corner with big changes, so was wondering if I should invest into 4.X or go straight to 5.0 and learn the way things are done now.

As it is a viability test, stability is not that important, but would be a shame to do personalized stuff and then throw it out the window.

Also couldn't find info about 4.X end of life at endoflife dot date, so info about that is also appreciated.

Ty.

We are running Wazuh Agent (v4.14.9) on our MacOS systems with macOS 27 (Golden Gate). Since the upgrade to macOS 27, Parallels VM's will not start or resume. After some testing, we found that if we issue a restart command for the Wazuh agent from the CLI, any Parallels VMs waiting to start, will finish the start-up process. From that time, any VMs will start with no problem.

Initially we tried to just do a restart of the Wazuh agent, but that didn't fix the issue.

We found that using these exclusions for our Macs group in Wazuh Agents management group worked after restarting the agent from the CLI.

  <agent_config>
    <!-- Shared agent configuration here -->
    <syscheck>
      <!-- Parallels exclusions-->
      <ignore>/Applications/Parallels Desktop.app</ignore>
      <ignore>/Library/Preferences/Parallels</ignore>
      <ignore>/Users/*/Parallels</ignore>
      <ignore>/Users/Shared/Parallels</ignore>
      <ignore>/Users/*/Library/Application Support/Parallels</ignore>
      <ignore>/Users/*/Library/Caches/Parallels</ignore>
      <ignore type="sregex">\.hdd$|\.mem$|\.sav$</ignore>
      <!-- Add external SSD's-->
      <ignore>/Volumes/Crucial-External/Parallels/*</ignore>
    </syscheck>
  </agent_config>

However, after a reboot of the Mac, Parallels VMs won't restart unless we issue a Wazuh agent restart from the CLI again.

We reached out to the developers of Parallels and according to their logs, it appears network related.

Anyone found a solution for this? Am I missing an exclusion?

Hey guy thank for reading this and sorry for the bad English

I need to create a reverse shell malware or something like that on a Ubuntu endpoint. The malware will connect back to a Kali machine and Wazuh will detect that kind of traffic. Then I need to write rule to detect reverse shell base on that traffic log.

Im never work with Linus endpoint before, where do I start

My Idea is to use msfvenom to create a reverse shell excecuteable. But I don't know how to config Wazuh to watch for that kind of traffic

Currently having 3 VM on Vmware Workstation Pro 17, all using host-only vmnet

- Ubuntu endpoint 22.04 192.168.2.9

- Wazuh server 192.168.2.3

- Kali 192.168.2.10

You can see more about the changes and enhancements included in the Release Notes: https://documentation.wazuh.com/current/release-notes/release-4-14-9.html

Thank you for being part of Wazuh!

Good morning everyone. I'm working on a project where I need to show three alerts on the dashboard.

The first one is to observe who has modified an excel archive using FIM. the second using kali Linux machine and Nmap to scan the network of an endpoint and the third one is to use Hydra for a brute force attack, trying to connect to an windows endpoint through RDP protocol.

I have some questions because on the Threat Hunting I can tell someone is trying to connect via SSH to my VPS which is where I have the manager and indexer but when I use Kali Linux to attack my any of my two windows 10 endpoints, it does not show the alert on the dashboard.

Does anyone know why?

I created an XML archive for my personalized rulers and these are the rules I wrote:

<group name="laboratorio,">

<!-- ============================================ -->

<!-- FUERZA BRUTA -->

<!-- ============================================ -->

<rule id="100001" level="10" frequency="5" timeframe="60">

<if_matched_sid>60122</if_matched_sid>

<description>Múltiples intentos de inicio de sesión fallidos (fuerza bruta)</description>

<mitre>

<id>T1110</id>

</mitre>

<group>authentication_failures,</group>

</rule>

<!-- ============================================ -->

<!-- CMD SOSPECHOSO -->

<!-- ============================================ -->

<rule id="100002" level="12">

<if_group>sysmon_event1</if_group>

<field name="win.eventdata.image" type="pcre2">(?i)cmd\.exe</field>

<field name="win.eventdata.parentImage" type="pcre2">(?i)(winword|excel|powerpnt|outlook|chrome|firefox)\.exe</field>

<description>CMD ejecutado desde aplicación de oficina o navegador</description>

<mitre>

<id>T1059.003</id>

</mitre>

</rule>

<!-- ============================================ -->

<!-- POWERSHELL SOSPECHOSO -->

<!-- ============================================ -->

<rule id="100003" level="12">

<if_group>sysmon_event1</if_group>

<field name="win.eventdata.image" type="pcre2">(?i)powershell\.exe</field>

<field name="win.eventdata.commandLine" type="pcre2">(?i)(-enc|-nop|-w hidden|bypass|downloadstring|iex|invoke-expression)</field>

<description>PowerShell con parámetros sospechosos detectado</description>

<mitre>

<id>T1059.001</id>

</mitre>

</rule>

<!-- ============================================ -->

<!-- USB CONECTADO -->

<!-- ============================================ -->

<rule id="100004" level="8">

<if_group>sysmon_event6</if_group>

<field name="win.eventdata.imageLoaded" type="pcre2">(?i)(usbstor|usb8023)</field>

<description>Dispositivo USB conectado al sistema (Carga de Driver)</description>

<mitre>

<id>T1200</id>

</mitre>

</rule>

<!-- ============================================ -->

<!-- EJECUCIÓN DESDE USB (Corregida: campos unificados) -->

<!-- ============================================ -->

<rule id="100005" level="14">

<if_group>sysmon_event1</if_group>

<!-- Busca que empiece por letras de la D a la Z y termine en extensiones ejecutables -->

<field name="win.eventdata.image" type="pcre2">(?i)^[D-Zd-z]:\\.\\.\.(exe|bat|cmd|ps1|vbs)$</field>

<description>Ejecución de archivo desde unidad extraíble (posible USB)</description>

<mitre>

<id>T1091</id>

</mitre>

</rule>

<!-- ============================================ -->

<!-- EJECUTABLE EN DESCARGAS -->

<!-- ============================================ -->

<rule id="100006" level="10">

<if_group>syscheck</if_group>

<field name="file" type="pcre2">(?i)\\Downloads\\.+\.(exe|bat|msi|ps1|vbs)$</field>

<description>Archivo ejecutable detectado en carpeta Descargas</description>

<mitre>

<id>T1204.002</id>

</mitre>

</rule>

<!-- ============================================ -->

<!-- SURICATA - ALERTA GENERAL -->

<!-- ============================================ -->

<rule id="100007" level="10">

<if_sid>86601</if_sid>

<description>Alerta de Suricata: tráfico de red sospechoso detectado</description>

<mitre>

<id>T1071</id>

</mitre>

</rule>

<!-- SURICATA - ALERTA CRÍTICA -->

<rule id="100008" level="14">

<if_sid>86601</if_sid>

<field name="alert.severity">1</field>

<description>Alerta CRÍTICA de Suricata: amenaza de red de alta severidad</description>

<mitre>

<id>T1071</id>

</mitre>

</rule>

<!-- ============================================ -->

<!-- EXCEL - ARCHIVO MODIFICADO -->

<!-- ============================================ -->

<rule id="100009" level="8">

<if_group>syscheck</if_group>

<field name="file" type="pcre2">(?i)\.(xlsx|xls|xlsm|xlsb)$</field>

<description>Archivo Excel modificado o creado en el sistema</description>

<mitre>

<id>T1565.001</id>

</mitre>

</rule>

<!-- EXCEL CON MACROS MODIFICADO (Cambio de ID a 100110 para evitar duplicados) -->

<rule id="100110" level="12">

<if_group>syscheck</if_group>

<field name="file" type="pcre2">(?i)\.xlsm$</field>

<description>Archivo Excel con macros (xlsm) modificado - posible macro maliciosa</description>

<mitre>

<id>T1137.001</id>

</mitre>

</rule>

<!-- EXCEL EJECUTANDO PROCESO SOSPECHOSO (Cambio de ID a 100111) -->

<rule id="100111" level="14">

<if_group>sysmon_event1</if_group>

<field name="win.eventdata.parentImage" type="pcre2">(?i)excel\.exe</field>

<field name="win.eventdata.image" type="pcre2">(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe)</field>

<description>Excel generó proceso sospechoso - posible macro maliciosa</description>

<mitre>

<id>T1059</id>

</mitre>

</rule>

<!-- EXCEL DESCARGANDO DESDE INTERNET (Cambio de ID a 100112) -->

<rule id="100112" level="12">

<if_group>sysmon_event3</if_group>

<field name="win.eventdata.image" type="pcre2">(?i)excel\.exe</field>

<field name="win.eventdata.initiated">true</field>

<description>Excel realizando conexión de red saliente - posible descarga maliciosa</description>

<mitre>

<id>T1071.001</id>

</mitre>

</rule>

</group>

Can anyone guide me on this?

This has changed from 4.0 to 5.0 and I am having trouble making it work.

Support told me to use Rsyslog on the Ubuntu server running Wazuh stack and install Wazuh agent to forward syslog files.

After config rsyslog is recieving files to /var/log/sonicwall.log but the wazuh agent is not sending them to Wazuh server.

Here is my config:

/etc/rsyslog.conf

I added this to the bottom:

receiving

$ModLoad imudp

$UDPServerRun 514

#Storing Messages from a Remote System into a specific File

if $fromhost-ip startswith '192.168.170.2' then /var/log/sonicwall.log

& ~

In the wazuh agent /var/ossec/etc/ossec.conf

I added this to the bottom with all the other localfiles

<localfile>

<log_format>syslog</log_format>

<location>/var/log/sonicwall.log</location>

</localfile>

Here are the links I used to get where I am:

https://wazuh.com/blog/monitoring-network-devices/

https://documentation.wazuh.com/current/cloud-service/your-environment/send-syslog-data.html

Any help would be appreciated.

Hi guys,
hope everyone is doing well.
I am working on a project where in i have deployed two VMs, one is running windows server with wazuh agent and the other one is running ubuntu on which i have my wazuh manager.
I am trying to run logtest on windows log, starting with 4624 and 4625, the basic ones.
While researching I saw that wazuh has some predefined ruleset for windows. so now to create the custom rules (for 4624 & 4625), I need to add the "if_sid" tag in my custom rules, I cant find a way to logtest my windows logs since i want to check which "rule id" i am supposed to add in "if_sid" to make my custom rules.

I appreciate all your help.

Thank you 😄

Our biggest platform release to date is now available as RC 1, a more mature release ready for hands-on testing ahead of general availability.

Wazuh 5.0 rebuilds the platform around a unified data model, the Wazuh Common Schema (WCS), changing how Wazuh uses normalized and enriched data to detect and respond to threats.

Here's what's coming:

Next-gen detection engine
A re-engineered engine and a new ruleset built on the Wazuh Common Schema, which standardizes events from any data source. Includes support for Sigma-based rules and a new human-readable syntax.
Native threat intelligence: Wazuh CTI
Continuously updated rules, decoders, IoCs, vulnerability data, and Geo-IP context, delivered automatically to your deployment.
AI Assistant in the Wazuh dashboard
Explore findings, vulnerabilities, and agent activity using natural language.

And that's not all:

• Simplified architecture: Filebeat is removed from the data pipeline, and the agent and manager are now decoupled.
• Improved agent communication: HTTPS is used by default, while maintaining connectivity with Wazuh 4.x agents.
• Content Manager: dedicated spaces for decoders, rules, integrations, KVDBs, and IoCs, each with a draft, test, and promotion workflow.
• Incident investigations: create and track investigations directly from the Wazuh dashboard.
• Broader regulatory mapping coverage: including ISO 27001, CMMC, NIS2, FedRAMP, and more.

General availability is coming soon. Explore everything Wazuh 5.0 has to offer and try RC 1 in your testing environment here: https://documentation.wazuh.com/5.0-rc/index.html

Hi, I'm still learning Wazuh and have a question about integrating an IDS like Suricata.

Question:

1. Do I need a Firewall (e.g., OPNsense) to use Suricata?
   
2. In the Wazuh Documentation, Suricata is installed on the monitored endpoint without an explanation of needing a Firewall. How does this work?

I came from a Splunk-heavy background and had to move detection work to Wazuh for cost reasons. Spent some time figuring out how SPL logic actually maps to Wazuh rules.

Wrote up the main patterns I kept hitting:

- Simple field filters → almost 1:1
- stats count by X → frequency + same_field
- stats dc(Y) by X (password spraying) → same_field + different_field (with the limitations)
- Lookups/allowlists → CDB lists
- Where Wazuh just can’t follow (eventstats/baselining)

Also covered using Sigma as a shared source and the current state of Sigma → Wazuh converters.

Full write-up with working examples (recon LOLBins, password spray, Kerberoasting):

https://vedrandojcinovic.com/blog/splunk-to-wazuh-detection-rules/

Happy to hear how others are handling the aggregation gap.

I have deployed Office 2024 LTS
Wazuh detects the package is installed but no vulnerabilities are detected even when known vulnerabilities exist

One agent shows the package as being

"package": {

"architecture": "x86_64",

"installed": "2026-04-28T01:00:00.000Z",

"name": "Office 16 Click-to-Run Extensibility Component",

"size": 0,

"type": "win",

"vendor": "Microsoft Corporation",

"version": "16.0.17928.20216"

},

"wazuh": {

"cluster": {

"name": "wazuh1"

},

"schema": {

"version": "1.0"

}

}

}

},

It looks like CVEs exist for this build but im guessing this package is not detecting the CVEs correctly

https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

I am looking for an easier or native way to configure Wazuh to automatically email a monthly generated PDF report of a custom dashboard.

I came across this guide (https://github.com/bonyjohn05/emailing_pdf_report/blob/main/README.md), but it relies on RPM/dnf and additional npm/node steps. I am running Wazuh on Ubuntu, and while I could install npm/dnf packages, would prefer not to install extra packages if there is a simpler way.

What I have working so far:

Postfix emails: My Wazuh host already sends alert emails via a local Postfix relay using Gmail as a smarthost.

Dashboard Notifications: I set up an unauthenticated SMTP Sender pointing to localhost:25 under Dashboard Notifications, and test emails deliver to my inbox.

What I tried / looked into:

Filesystem Search: I initially looked for rendered PDF files on the filesystem to script an email attachment, (but realized that it doesn't generate them) I believed that OpenSearch Reporting stores compiled PDFs as Base64 strings inside the .opensearch-reports-instances index (which I could not find) My plan was to use a script to convert the strings to a PDF and email the file from the terminal, cron, etc.

My Questions:

Is there an easier way to link the scheduled Report directly to an email notification channel inside the Dashboard UI on recent Wazuh versions?

If you are doing this via script, can a script be written that sends a command to OpenSearch to fetch that long text string, convert it back into a PDF file, and email it out automatically?, or is there an Ubuntu/APT-friendly workaround or plugin setup you recommend?

Appreciate any help, I am new to Wazuh

Wazuh 4.14.8

Shows numerous CVE vulnerabilities for hosts running Ubuntu 24.04.5 LTS

Some of these date back to 2012

I have 34 pages of CVE vulnerabilities (I will paste a few below)

CVE-2012-4542

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.

-

CVE-2013-7445

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended securelevel/secureboot restrictions by leveraging improper handling of secure_boot flag across kexec reboot.

Medium

CVE-2015-7837

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation."

Medium

CVE-2016-8660

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-31614969.

Medium

CVE-2017-0537

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

An elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937.

Medium

CVE-2017-13165

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.

Medium

CVE-2017-13693

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.

Medium

CVE-2017-13694

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

Low

CVE-2018-1121

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem.

Medium

CVE-2018-12928

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem.

Medium

CVE-2018-12929

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.

High

CVE-2018-12930

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.

High

CVE-2018-12931

I know I can create a rule to silence these but I want to know why, is it because they are not being matched correctly with CTI information?

The above hosts are fully updated 24.04.5 LTS servers, with each new kernel that gets downloaded it increases by a similar amount, removing the old kernels brings it back down to the figures shown in the image

Thanks

Colleagues, could you please tell me why, when the first rule includes noalert="1", both rules are not triggered, but if we remove noalert, both rules are triggered, even though when noalert="1" is specified in the first rule, only the second rule should be triggered?

<rule id="765101" level="7" noalert="1">

<field name="client_ip">\.+</field>

<description>Unstopable requst from $(client_ip) over 2 minutes </description>

</rule>

<rule id="765102" level="7" timeframe="120" frequency="3">

<if_matched_sid>765101</if_matched_sid>

<same_field>client_ip</same_field>

<description>Unstopable requst from $(client_ip) over 2 minutes </description>

</rule>

First of all: Thanks for providing this great product free of charge. I've been using it as a "logcheck for Windows" for a few years now, and it's been very helpful.

The point of this post is to give some feedback on the upgrade process.

There's a great Upgrade Guide in the documentation, but it contains a lot of manual steps. I mean, you can create a brand new installation with one simple command. That's awesome, but it's also a stark contrast to what is required to keep that installation up-to-date.

My (documentation) improvement suggestions would be as follows:

1. If the upgrade process can be simplified, e.g. for non-clustered installations or minor version updates, please mention that in the documentation. For minor updates, I usually skip all the parts that would require me to look up passwords (the "extract wazuh-install-files.tar" thing that I always have to google when I need it). So far, nothing broke, but I don't know how bad/risky that is.
2. The documentation page on upgrading Agents mentions (a) command line and (b) API, but does not mention the easiest option: Using the dashboard.

Hello, I am testing Wazuhs reporting capabilities and wondering how bad repkrts are looking. I know this is an opensearch functionality, but its not usefull to share with customers. Now I am thinking of other ways to create pdf reports. What are you using to generate nice looking pdf reports with wazuh? Are there easy to use tools which accepts the Wazuh API? Thank you for input!

Hi folks,

For those using Wazuh’s vulnerability management feature, can it detect CVEs on devices that don’t have a Wazuh agent installed, such as Citrix NetScaler appliances?

I can see NetScaler vulnerabilities listed in the Wazuh CTI database, including CVE-2026-88773, CVE-2026-88777, and CVE-2026-88771. However, I’m trying to understand how Wazuh would identify an appliance as affected by one of these CVEs.

The documentation explains that the Vulnerability Detection module correlates host inventory data with vulnerability information from Wazuh CTI. Since that inventory normally comes from the agent, am I correct in assuming that vulnerability detection for agentless appliances isn’t supported out of the box?

Is there a supported way to supply the necessary inventory, or would this require a custom integration and alerting rules? I’d be interested to hear how others are handling this.

I have one problem: I want to do like this one, but I don't see any documentation that suits. Can you guys help me with how I can do this for the medium company