Vulnerability report and kernels

[German DiCasas]

Hi team,

There are any form to exclude from the report of vulnerabilities, Inventory, the CVE related to not active kernel? 

I mean, we have on servers the rule of store the N-1 of the kernels and there are a lot of servers. So, there are any way to exclude the not active kernel over each agent? (only on vulnerability report) or if exist a field for that.

thanks

German

[Christian Borla]

  Hi German,
 
  There isn't a built-in setting in Vulnerability Detection/Inventory that automatically excludes CVEs tied to inactive (non-running) kernel packages, and this is specific to 4.x
  (Vulnerability Detection module). The scanner works purely off the package inventory that Syscollector reports, and it has no awareness of which kernel is actually loaded (uname -r).
 
  The workaround the team suggested there is to stop Syscollector from reporting the non-running kernel packages in the first place, using its built-in package-exclusion mechanism
  (/var/ossec/queue/syscollector/norm_config.json), driven by a wodle command script that keeps that file's exclusion list in sync with uname -r on each agent. Full example (Debian/Ubuntu,
  adapt the pattern for other distros) here: https://github.com/wazuh/wazuh/issues/27477#issuecomment-2578922700

  A couple of things to know before rolling this out at scale:
  - It's an unofficial, undocumented workaround (not a supported feature) — you own and maintain the script.
  - Even the author noted the exclusion doesn't always apply deterministically on the first run after a kernel change; a second agent restart may be needed for it to take effect.
  - It fully removes the excluded kernel packages from the package inventory too, not just from vulnerabilities — so if you rely on inventory for other purposes, keep that in mind.

  Given your N-1 retention policy across many servers, this is still the most direct path to a clean report today.
 
  Regards