Vulnerability Detection 4.14.1

[Max]

Hi,

I recently updated the Wazuh manager from version 4.13 to 4.14.1 and, according to the following documentation, Debian 10 still appears to be supported:

https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/how-it-works.html

However, I’m not seeing any data in the Inventory tab for my Debian 10 agent.

Could you please advise?

Thanks in advance.

[josue....@wazuh.com]

Hi,

Let me replicate this and I will get back to you as soon as possible.

I can confirm that Debian 10 is supported correct. 

Please share the ossec.log from the manager to check further.
cat /var/ossec/logs/ossec.log | grep -i -E "error|warn|vuln|index"

Also, you can try sudo /var/ossec/bin/wazuh-control restart to force the re-scan.

The Vulnerability Detection module creates alerts when new vulnerabilities are found or when existing ones are resolved as a result of package updates, removals, or system upgrades. Although these conditions are required for alerts to occur, they alone do not guarantee alert generation, as it also depends on the specific detection scenarios.

Alerts related to package changes are generated only when a vulnerability is added to or removed from the inventory as a result of installing or uninstalling a package.

For this to happen, the event must be captured during a scheduled Syscollector scan.

There are two situations where alerts may not be generated:
If package changes occur while the Wazuh agent is stopped, the changes will not trigger any alerts.
If the changes are detected only after the Wazuh agent has been restarted, no alert will be generated either.

You can install the older version of VLC and wait for the next scans and let me know if vulnerabilities are detected.
With this information, we can analyze what might be happening.

Thanks

[ArnaudG]

Hello, I"m working with MAx, then let me give you more details.

1/ It is not related to Alerts (as far as I understand), it is Inventory : we see nothing in the "Vulerability-Detection Inventory" for some of our Debian ( Specifically Debian 10 and Debian 9 machines), but can see Inventory items for other machines ( Windows / Ubuntu and Debian 11, 12 or 13).

2/ It was already the case when running v 4.13.1 but we have seen this https://github.com/wazuh/wazuh/issues/32507 then we decided to upgrade, but same result.