Cluster nodes vulnerability report.

[Isaac S.]

Hello Wazuh Team

There's a way to generate a report of the vulnerabilities detected from the cluster's nodes ?

All the nodes are under the id 000

Wazuh version 4.14.1

Isaac S.

[carlos...@wazuh.com]

Hello,

Yes, this is possible. Every node in the cluster reports its own packages as agent 000, so they all share that ID. However, each vulnerability document in the `wazuh-states-vulnerabilities-*` index also includes the fields `wazuh.cluster.node` and `agent.name` (the node's hostname).

You can try getting the report and analyzing the data in them to check what works best for you to differentiate each node's vulnerabilities, some options are:

1. Getting a PDF from the dashboard
- Go to Vulnerability Detection > Inventory (or Dashboard).
- Add the filter `agent.id: 000`.
- For a single node, also add `wazuh.cluster.node: <node_name>` (or `agent.name: <node_hostname>`).
- Click "Generate report" in the top right. You'll find the PDF under Dashboard management > Reporting.

2. Exporting a CSV from Discover (better for full lists)
- Open Discover and select the `wazuh-states-vulnerabilities-*` index pattern.
- Search for `agent.id:000`.
- Add the columns you need, for example: `wazuh.cluster.node`, `agent.name`, `package.name`, `package.version`, `vulnerability.id`, `vulnerability.severity`, `vulnerability.score.base`.
- Save the search, then use Reporting > Download CSV. You can also schedule the report to run regularly from there.

3. Running it from the Indexer API (for automation)
Run this from DevTools, or with curl against the indexer on port 9200:

GET wazuh-states-vulnerabilities-*/_search
{
  "size": 1000,
  "query": { "term": { "agent.id": "000" } },
  "aggs": {
    "by_node": {
      "terms": { "field": "wazuh.cluster.node" },
      "aggs": {
        "by_severity": { "terms": { "field": "vulnerability.severity" } }
      }
    }
  }
}

The `by_node` aggregation gives you a quick count per node and per severity. If you need more than 10,000 documents, page through them with `search_after`.

If some of your nodes don't show up in the results, please share the Vulnerability Detection and indexer sections of `ossec.conf` from one of the missing nodes, and we can take a look.

Regards,

Carlos

[Isaac S.]

Hello Carlos

This is the Vulnerability Detection and indexer configuration from one of workers nodes that doesn't show vulnerability information.

<ossec_config>

  <indexer>
    <enabled>yes</enabled>
    <hosts>
        <host>https://10.59.240.10:9200</host>
        <host>https://10.59.240.11:9200</host>
        <host>https://10.59.240.12:9200</host>
        <host>https://10.59.240.13:9200</host>
    </hosts>
    <ssl>
      <certificate_authorities>
        <ca>/etc/filebeat/certs/root-ca.pem</ca>
      </certificate_authorities>
      <certificate>/etc/filebeat/certs/filebeat.pem</certificate>
      <key>/etc/filebeat/certs/filebeat-key.pem</key>
    </ssl>
  </indexer>

</ossec_config>

  <vulnerability-detection>
    <enabled>yes</enabled>
    <index-status>yes</index-status>
    <feed-update-interval>60m</feed-update-interval>
  </vulnerability-detection>

In the worker node there are these logs in ossec.log file

2026/09/24 13:03:08 wazuh-modulesd:vulnerability-scanner: ERROR: Error processing delayed event: Invalid agent-info response format.
2026/09/24 13:03:08 wazuh-modulesd:vulnerability-scanner: ERROR: Error processing delayed event: Invalid agent-info response format.
2026/09/24 13:03:08 wazuh-modulesd:vulnerability-scanner: ERROR: Error processing delayed event: Invalid agent-info response format.
2026/09/24 13:03:08 wazuh-modulesd:vulnerability-scanner: ERROR: Error processing delayed event: Invalid agent-info response format.

Isaac S.