Vulnerability Detection List not updating

[exe]

Hello There,

we are using Wazuh on docker on a single node stack.

We recently updated our Servers and the number of Vulnerabilities didnt decrease.

Please let me know what infos you need to help me resolve  this issue.

Thanks in advance!

[Pablo Moliz Arias]

To investigate this issue, the following information is required. You can obtain it as described below:

1. Wazuh versions (Manager, Indexer, Dashboard) and Docker image tags

   • Check the Docker image tags or run wazuh-manager -v inside the manager container.

2. Vulnerability Detection status

   • Review the <vulnerability-detection> section in ossec.conf on the Wazuh Manager to confirm it is enabled.

3. Syscollector status

   • Verify that <wodle name="syscollector"> is enabled in the agent configuration.

4. Relevant logs

   • Check Wazuh Manager logs for vulnerability-related messages, for example in /var/ossec/logs/ossec.log or by running docker logs wazuh-manager.

5. Inventory update

   • Confirm that agents reported updated package inventory after the server updates.

If you share me more this details, I can try to help you to identify why the vulnerability count did not change.

Below are links to the official Wazuh documentation that explain these components in detail:

• Wazuh Docker deployment
• Upgrading Wazuh on Docker
• Vulnerability Detection overview
• How Vulnerability Detection works
• Vulnerability Detection configuration

[exe]

Hello Pablo,

thanks for the Answer, here are the infos:

1.)
NAMES                           IMAGE                          STATUS
watchtower                      nickfedor/watchtower:latest    Up 2 days (healthy)
portainer_agent                 portainer/agent:lts            Up 2 days
single-node-wazuh.manager-1     wazuh/wazuh-manager:4.13.0     Up 2 days
single-node-wazuh.dashboard-1   wazuh/wazuh-dashboard:4.13.0   Up 2 days
single-node-wazuh.indexer-1     wazuh/wazuh-indexer:4.13.0     Up 7 hours

2.)
<vulnerability-detection>
   <enabled>yes</enabled>
   <index-status>yes</index-status>
   <feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>

3.)
<wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports all="yes">yes</ports>
    <processes>yes</processes>

4.) I couldn't find any vulnerability-related logs
5.) Still no update sadly

[Pablo Moliz Arias]

Thank you for the detailed configuration and status

The problem is that he Indexer restarted 7 hours ago, but the Manager did not. When the Indexer goes down, the Manager (specifically the filebeat service inside it) often stops sending data or gets stuck waiting for the connection to come back. Even if the Indexer comes back up, the Manager's shipping pipeline might be "stalled."

Step 1: 

We need to re-establish the connection chain. Since you are on Docker, please run these commands on your host machine:

1. Restart the Manager to reconnect to the Indexer:

   docker restart single-node-wazuh.manager-1

2. Wait 2 minutes, then check the Filebeat logs inside the manager to ensure it is talking to the indexer:

   docker exec single-node-wazuh.manager-1 cat /var/log/filebeat/filebeat | grep -i "error" | tail -n 10

Step 2

If the restart didn't solve it after a few minutes, your Vulnerability Database inside the container might be stale.

Let's force Wazuh to delete its internal database and re-download the vulnerability definitions from scratch.

Run these commands on your Docker Host:

1. Enter the Manager container as root:

   docker exec -u 0 -it single-node-wazuh.manager-1 bash

2. Stop the Wazuh service (inside the container):

   /var/ossec/bin/wazuh-control stop

3. Check if the database file exists:

   ls -l /var/ossec/queue/vulnerabilities/cve.db

           If the file exists, delete it (if it does not exist, just proceed to the start command):

           rm -f /var/ossec/queue/vulnerabilities/cve.db

       4. Start the Wazuh service:

            

           /var/ossec/bin/wazuh-control start

       5. Exit the container:

           

           exit

Using these commands:

• The Manager will realize the DB is missing.

• It will start downloading the OVAL/NVD feeds.

• Once downloaded, it will re-scan your inventory.

A common confusion is where you look in the Dashboard. 

Do NOT look at: Modules > Security Events. (This shows a history. The old vulnerability alerts will remain there forever as a historical record). 

DO look at: Modules > Vulnerability Detection > Inventory. 

Or check the specific agent: Agents > Select Agent > Vulnerability Inventory.