Appearance
Vulnerabilities
Wazuh detects vulnerable packages on every endpoint. Theseus does not show those findings raw: vuln-verify corroborates each one against vendor and NVD data first, and the console shows its verdicts.
How findings are verified
vuln-verify runs every 30 minutes. For each Wazuh finding it gives a verdict:
| Verdict | Meaning |
|---|---|
| Confirmed | The vulnerability is real on this host |
| Needs review | The evidence is not conclusive |
| Suppressed | Not applicable (for example, the vendor's fixed version is installed) |
It also tracks remediation:
- A finding gone from two consecutive snapshots is checked against the fixed version: remediation verified, or fix unverified when the version cannot be proven.
- A kernel fix waits as pending reboot until the running kernel has the fix.
- A finding that comes back within 30 days is reopened.
The console shows confirmed and reopened findings; findings under review or suppressed are not shown as open.
Vulnerabilities
Vulnerabilities → Vulnerabilities (/detection/vulnerabilities) has three tabs:
- Overview: counts and trends.
- Endpoint vulnerabilities: verified findings on your agents.
- External vulnerabilities: findings of the external scanner, read-only here.
Investigation
Vulnerabilities → Investigation answers: what is real, what is patchable, and what is being exploited. Findings are grouped in bands, most urgent first:
- Actively exploited (in CISA's Known Exploited Vulnerabilities list)
- Returned after a fix
- Critical, patchable
- High, patchable
- Awaiting reboot
- Medium and low, patchable
- Fix coming
- Awaiting vendor patch
- No patch information
Each finding suggests an action: Patch now, Reboot host, Rescan host, Investigate, Awaiting vendor or No action. Patch now starts a patch job; see Patching. Rescan host means the host already has the fix and only its report is old: Rescan now (on the Patching page, or the Agents page) clears it within about 5 minutes.
Disabled agents are left out of these pages until they are enabled again; the page header says how many.