disable CVE events in security events

[Mefisto Evil]

is there a way to disable all CVE events in security events list ? i have a lot of them

and i want to see them if i go to particula agent->vulnerabities in dashboard
 buit not in list of all events

examples of events:

CVE-2023-24861 affects Windows Server 20xx

CVE-2023-24908 affects Windows Server 20xx

[Manuel Jose Cano Rojo]

Hi Mefisto,

It is possible, let me lead you in the process. To suppress an alert, you can create a custom rule with level = 0, which means the alert will be ignored when a specific rule or group of rules is triggered. This kind of rule is usually stored in /var/ossec/etc/local_rules.xml. You can also use the WUI  where you can navigate to Management -> Rules and there you can set a filter to Custom rules, and select the file local_rules.xml. An example of this rule could look as follows:

<group name="cve-ignore,"> <rule id="100002" level="0"> <if_group>vulnerability-detector</if_group> <field name="vulnerability.cve">CVE-0000-0000, CVE-0000-0001, CVE...</field> <description>Ignoring alert $(vulnerability.cve). Vulnerability was published $(vulnerability.published). Reference $(vulnerability.reference)</description> <location>agent_name</location> <options>no_full_log</options> </rule> </group>
Note the <field> tag, must contain the CVE you are aiming to silence. The location tag is set in order to provide a specific agent to silence, if you want to apply this alert to every agent, you can just not add the <location> tag.

Let me know if you need any further help.

Regards,
Manuel.

[Mefisto Evil]

Hi manuel thank you for anwer
so i should type every CVE in <field> tag? i have a lot of them.. there is no way to do this without typing all CVE one by one?

вторник, 18 апреля 2023 г. в 15:28:12 UTC+5, Manuel Jose Cano Rojo:

[Manuel Jose Cano Rojo]

Hi Mefisto,

You have to do it this way, there is no other way to perform this operation at the moment.

Regards,

Manuel.

[Kamil Tańcula]

Hi,

I have some problem to trace the problem of disabling CVE .
Example.
I want to disable CVE number CVE-2023-37920 for agent linux-wazuh-20. 

I created such an entry in local_rules.xml.

<group name="cve-ignore,">

   <rule id="190001" level="0">

      <if_group>vulnerability-detector</if_group>

      <field name="vulnerability.cve">CVE-2023-37920</field>

      <description>Ignoring alert $(vulnerability.cve). Vulnerability was published $(vulnerability.published). Reference $(vulnerability.reference)</description>

      <location>linux-wazuh-20</location>

    <options>no_full_log</options>

  </rule>

</group>

Restart wazuh-manager and wazuh-agent and the entry for this CVE is still there.
What am I doing wrong ?