External scanner

The scanner runs Nuclei scans of your internet-facing hosts and sends its findings to Wazuh. It needs the scanner module. In a two-server install it runs on the core.

Vulnerabilities → Scanner (/admin/network-scanning). Only administrators can start scans and manage schedules; other roles can view results.

Scope

Only scan targets you are authorised to scan.

• Private, loopback, link-local, CGNAT, cloud metadata and other reserved addresses are always refused, including host names that resolve to them.
• NUCLEI_TARGET_ALLOWLIST (CIDRs and host suffixes, comma-separated) restricts scans further: when it is set, only matching targets are scanned. When it is empty, any public target is allowed. Set it on the server or ask your provider; there is no editor in the console.

Run a scan

1. Launch scan: targets one per line or comma-separated, and a severity threshold.
2. The scan goes queued, running, then completed or failed.
3. Findings list severity, finding, host, template and what matched, with an exposure rating (critical to minimal). AI analysis explains a finding (needs an LLM endpoint).

Schedules

New schedule: name, targets, severity, frequency (daily, weekly, monthly), time, start and end dates, e-mail recipients for the report, enabled. Reports by e-mail need SMTP.

Findings also appear under Vulnerabilities → External vulnerabilities, and in Wazuh as alerts.