| 1 | --- |
| 2 | title: Vulnerability overview |
| 3 | description: Review vulnerability posture across agents with EPSS scoring and package detail. |
| 4 | --- |
| 5 | |
| 6 | # Vulnerability overview |
| 7 | |
| 8 | **Menu:** Agents → Vulnerability Overview |
| 9 | |
| 10 | Vulnerability Overview provides near real-time vulnerability data (from **Wazuh Indexer**) enriched with **EPSS** scoring and package details, so you can prioritize remediation based on both severity and likely exploitation. |
| 11 | |
| 12 |  |
| 13 | |
| 14 | --- |
| 15 | |
| 16 | ## What you’re looking at |
| 17 | |
| 18 | ### Distribution |
| 19 | |
| 20 |  |
| 21 | |
| 22 | A quick breakdown of vulnerabilities by severity (Critical / High / Medium / Low). |
| 23 | |
| 24 | Use this for: |
| 25 | - “How bad is it right now?” |
| 26 | - tracking whether patching is reducing overall exposure |
| 27 | |
| 28 | ### Coverage + top packages by EPSS |
| 29 | |
| 30 |  |
| 31 | |
| 32 | This section highlights: |
| 33 | - how many **agents** are impacted |
| 34 | - how many **unique packages** are involved |
| 35 | - how many **customer codes** are represented |
| 36 | |
| 37 | And surfaces packages/vuln clusters ranked by **EPSS** (a good “what should we care about first?” view). |
| 38 | |
| 39 | ### Detailed table |
| 40 | |
| 41 |  |
| 42 | |
| 43 | The table is the working view where you can pivot by: |
| 44 | - CVE |
| 45 | - severity |
| 46 | - affected agent/hostname |
| 47 | - package / OS / architecture |
| 48 | - **CVSS** |
| 49 | - **EPSS score** and **EPSS percentile** |
| 50 | - timestamp (when observed) |
| 51 | |
| 52 | --- |
| 53 | |
| 54 | ## EPSS (Exploit Prediction Scoring System) — how to use it |
| 55 | |
| 56 | EPSS is a probability model maintained by FIRST that estimates the likelihood a CVE will be exploited “in the wild.” |
| 57 | |
| 58 | In CoPilot you’ll typically see: |
| 59 | - **EPSS**: a score between **0 and 1** (higher means more likely exploitation) |
| 60 | - **EPSS Pct**: percentile ranking (how that CVE compares to other CVEs) |
| 61 | |
| 62 | How to operationalize it: |
| 63 | - Use **CVSS** to understand *impact/severity* |
| 64 | - Use **EPSS** to understand *likelihood/urgency* |
| 65 | - Prioritize items that are **High CVSS + High EPSS** first |
| 66 | |
| 67 | Rule of thumb: |
| 68 | - A Medium CVSS with a very high EPSS can be more urgent than a High CVSS with very low EPSS. |
| 69 | |
| 70 | Reference: |
| 71 | - https://www.first.org/epss/ |
| 72 | |
| 73 | --- |
| 74 | |
| 75 | ## Common tasks |
| 76 | |
| 77 | ### Filter by tenant/customer |
| 78 | |
| 79 | Use filters to focus on one customer code at a time in multi-tenant environments. |
| 80 | |
| 81 |  |
| 82 | |
| 83 | ### Identify “top risk” items |
| 84 | |
| 85 | A practical triage flow: |
| 86 | 1) Review **Top Packages by EPSS** |
| 87 | 2) Open the package/CVE details |
| 88 | 3) Identify affected agents |
| 89 | 4) Create remediation tasks (patch/update/remove package) |
| 90 | 5) Validate closure by confirming the item disappears as inventory updates |
| 91 | |
| 92 | ### Pivot to reporting |
| 93 | |
| 94 | If you need a deliverable for a customer or internal patch window: |
| 95 | - use the reporting workflow described here: [Vulnerability report](/user/ui/report-vulnerability) |
| 96 | |
| 97 | --- |
| 98 | |
| 99 | ## Prerequisites |
| 100 | |
| 101 | - Wazuh inventory (syscollector) is flowing for endpoints |
| 102 | - Wazuh vulnerability detection is enabled and indexing results |
| 103 | |
| 104 | --- |
| 105 | |
| 106 | ## Gotchas |
| 107 | |
| 108 | - Stale inventory = stale posture. If an agent hasn’t checked in recently, its vulnerability list may be outdated. |
| 109 | - EPSS is a prioritization signal, not a guarantee—use it alongside your environment context (internet exposure, compensating controls, exploitability, asset criticality). |