Vulnerabilities Detected for Non-Existing Agents

[Rebits]

Wazuh version	Component	Install type	Install method	Platform
4.8.0-rc1	Vulnerability Detection	Manager	Packages	ALAS 2023

Description

In the Demo environment it has been detected that there are present in the index vulnerabilities for non-existing agents

The full list of existing agents is the following:

However, upon removing the default wazuh.cluster.name filter, vulnerabilities were detected for a non-existing Ubuntu agent with wazuh.cluster.name value set to 2:

The exact registration time of this old agent cannot be provided due to the previous use of a Demo instance. However, it has been more than 1 day since registration.

Steps to Reproduce

No steps to reproduce can be provided for now due this agent was already present in the environment.

More information will be attached as soon as possible.

Expected Behavior

No vulnerabilities should be detected for non-existing agents.

[davidjiglesias]

@Rebits

This is not an issue, the Demo environment has 2 different clusters, and the Ubuntu agent belongs to the second one, and so when you remove the filter the Vulnerability detection dashboard searches over all states indexes: