Update VD POC #7215
Update VD POC #7215
Conversation
There was a problem hiding this comment.
The related #7183 issue requires steps to install vulnerable packages in order to trigger alerts. We're not installing a vulnerable Firefox version but using one installed by default. We're not patching or uninstalling Firefox to show solved vulnerabilities either. Are we ok with this approach? Aren't we going to explain in the "Test the configuration" sub-section that installing Firefox 116 or similar is required to see the alerts?
| @@ -20,9 +20,10 @@ Infrastructure | |||
| +===============+============================================================================================================================================+ | |||
| | Ubuntu 22.04 | The vulnerability detection module checks for vulnerabilities in the operating system and installed applications in this Linux endpoint. | | |||
There was a problem hiding this comment.
What's the purpose of having this Endpoint? We're not later showing any vulnerabilities for this endpoint.
| Test the configuration | ||
| ---------------------- | ||
|
|
||
| You don’t have to perform any action. Wazuh detects the vulnerable packages installed in the Ubuntu endpoint automatically. The time it takes to detect vulnerabilities depends on the Syscollector :doc:`interval </user-manual/reference/ossec-conf/wodle-syscollector>` configured in the ``ossec.conf`` file. |
There was a problem hiding this comment.
Same comment as above. We're saying vulnerable packages get automatically detected but don't show a results visualization below.
|
|
||
| You don’t have to perform any action. Wazuh detects the vulnerable packages installed in the Ubuntu endpoint automatically. The time it takes to detect vulnerabilities depends on the Syscollector :doc:`interval </user-manual/reference/ossec-conf/wodle-syscollector>` configured in the ``ossec.conf`` file. | ||
|
|
||
| #. Install ``vim`` in the Debian endpoint with ``sudo apt install vim -y``. |
There was a problem hiding this comment.
| #. Install ``vim`` in the Debian endpoint with ``sudo apt install vim -y``. | |
| #. Install ``vim`` in the Debian endpoint with ``sudo apt install vim -y`` to install a vulnerable package. Wait until the syscollector runs a new scan. |
There was a problem hiding this comment.
Is this going to work? Is the default version vulnerable?
| You don’t have to perform any action. Wazuh detects the vulnerable packages installed in the Ubuntu endpoint automatically. The time it takes to detect vulnerabilities depends on the Syscollector :doc:`interval </user-manual/reference/ossec-conf/wodle-syscollector>` configured in the ``ossec.conf`` file. | ||
|
|
||
| #. Install ``vim`` in the Debian endpoint with ``sudo apt install vim -y``. | ||
|
|
|
|
||
| #. Install ``vim`` in the Debian endpoint with ``sudo apt install vim -y``. | ||
|
|
||
| #. Wait until the syscollector runs a new scan. |
There was a problem hiding this comment.
| #. Wait until the syscollector runs a new scan. |
|
|
||
| #. Wait until the syscollector runs a new scan. | ||
|
|
||
| #. Delete the package with ``sudo apt purge vim -y``. |
There was a problem hiding this comment.
| #. Delete the package with ``sudo apt purge vim -y``. | |
| #. Delete the package with ``sudo apt purge vim -y`` to fix the vulnerability. |
| Visualize the alerts | ||
| -------------------- | ||
|
|
||
| You can visualize the alert data in the Wazuh dashboard. To do this, go to the Vulnerability Detection module, select Events, and click on any vulnerability to expand the document. | ||
| You can visualize detected vulnerabilities data in the Wazuh dashboard. Go to **Vulnerability Detection** and select **Events** to see a list of all vulnerable packages detected after the first scan. |
There was a problem hiding this comment.
We could add a step to filter specific Vim alerts to quickly find them. This will save scrolling down allowing to display the Events tab at top in the screenshots.
Objective
This PR aims to enhance the precision and usability of the Proof of Concept (POC) documentation for our Vulnerability Detection system. By expanding the documentation to include more detailed sections and illustrative examples, we intend to provide clearer guidance and better support for users engaging with our vulnerability detection tools.
Description