Forced vulnerability baseline scan

[Nepolean]

Dear team,

Is there a way I can forcefully run the baseline scan for vulnerability detector in wazuh. I have vulnerability scan enabled and I already got the alerts when the baseline scan did it's job for the first time. The thing is, I need these alerts to be generated again. How can I do that?

Thanks

Nepolean 

[Miguel Angel Cazajous]

Hello Nepolean,

Yes, you can force a baseline scan only by changing the attribute last_full_scan in the vuln_metadata table from the agent database (/var/ossec/queue/db/<agent_id>.db)

- Stop your manager

- Execute sqlite3 /var/ossec/queue/db/<agent_id>.db 'update vuln_metadata set last_full_scan = 0'

- Start your manager again

The module will run a Baseline scan, after checking that field is 0 since it represents an epoch value. Let us know if that worked. Regards!

[Nepolean]

Thanks Miguel. Can I do it for all the agents in one go?

[Miguel Angel Cazajous]

Yes, with some bash script, it wouldn't be hard to do it.

I'm thinking maybe with the help of this API request, you can get your agents https://documentation.wazuh.com/current/user-manual/agents/listing/listing.html and parse the ID which is the name for the databases.

With agent_control -l and some greps you could achieve the same, but a JSON response would be easier to parse.

Once you have the IDs you can pass those arguments to a bash function that executes that query.

function force_bs {
    sqlite3 /var/ossec/queue/db/$1.db 'update vuln_metadata set last_full_scan = 0'
}

To parse the JSON response, JQ it's a great tool https://www.baeldung.com/linux/jq-command-json.

[Nepolean]

Thank Miguel, I tried the command you have given to force the vulnerability baseline scan. But it is not triggering any scan as I am not getting any alerts. In the command we are changing the value for last full scan, right? We need to run the baseline scan. Is that a problem?

Thanks

Nepolean

[Miguel Angel Cazajous]

Hi Nepolean,

You're right, to report again the vulnerabilities you should clean the inventory, otherwise, it won't report the already reported vulnerabilities.

So the only additional step is: sqlite3 /var/ossec/queue/db/000.db 'delete from vuln_cves'

Change the agent ID to the correct one.

First scan run



After this trick

[Nepolean]

Thanks Miguel.. That worked.

I did not understand the 2 screenshots, though.

Thanks

Jayakrishnan

[Miguel Angel Cazajous]

Hi Nepolean,

Glad to know it worked!, the screenshots were just to show that after that trick the 152 alerts from the first scan triggered again. Have a good day!