| 1 | --- |
| 2 | title: Vulnerability reports (Wazuh) |
| 3 | description: Generate CSV reports from the Wazuh Vulnerability Detection module data in the Wazuh Indexer. |
| 4 | --- |
| 5 | |
| 6 | # Vulnerability reports (Wazuh) |
| 7 | |
| 8 | **Menu:** Report Creation → Vulnerability Reports |
| 9 | |
| 10 | Vulnerability reports pull data from the **Wazuh Vulnerability Detection** module. |
| 11 | |
| 12 | Wazuh’s model (simplified): |
| 13 | - agents collect software inventory via **Syscollector** |
| 14 | - the manager correlates inventory with CTI feeds and flags CVEs |
| 15 | - results are indexed and queryable (inventory + alerts) |
| 16 | |
| 17 |  |
| 18 | |
| 19 | --- |
| 20 | |
| 21 | ## What you can generate |
| 22 | |
| 23 | - A vulnerability report for a specific **customer/tenant** |
| 24 | - Filtered views by severity, agent, package, CVE, etc. (depending on UI/options) |
| 25 | |
| 26 | --- |
| 27 | |
| 28 | ## Step 1 — Filter what you want to report on |
| 29 | |
| 30 |  |
| 31 | |
| 32 | Common operator filters: |
| 33 | - Customer |
| 34 | - Severity (Critical/High/Medium/Low) |
| 35 | - Agent/host |
| 36 | - Specific CVE (`CVE-…`) |
| 37 | |
| 38 | --- |
| 39 | |
| 40 | ## Step 2 — Generate and download |
| 41 | |
| 42 |  |
| 43 | |
| 44 | When you generate a report, CoPilot produces a **CSV** and stores it for download. |
| 45 | |
| 46 | Operator tips: |
| 47 | - Use “Critical + High” first for remediation prioritization. |
| 48 | - If you’re generating very large reports, prefer background generation if available. |
| 49 | |
| 50 | --- |
| 51 | |
| 52 | ## Common gotchas |
| 53 | |
| 54 | ### “The report is empty” |
| 55 | Common causes: |
| 56 | - the Wazuh vulnerability module isn’t enabled or isn’t indexing status |
| 57 | - the customer has no Syscollector inventory data |
| 58 | - filters are too narrow |
| 59 | |
| 60 | ### “Why do vulnerabilities exist even if we patched?” |
| 61 | Wazuh correlates inventory versions + hotfix data (Windows) against CVE ranges. Inventory and patch state need to be current. |