Overview
Vulnerability Detection shows the known software vulnerabilities (CVEs) on your Macs, Windows devices, and Linux devices, and helps you fix them. It's the first tab of the Security page in the Swif console. It replaces the Device CVE Report, which used to be under Reports.
With Vulnerability Detection, you can:
see how many vulnerabilities your fleet has, by severity
find the packages, CVEs, and operating systems that put your fleet most at risk
see which devices each vulnerability affects
get step-by-step remediation guidance from Swif IQ
Important: Turn on a Device CVE Report Policy for each platform. Vulnerability data comes from the Swif Security agent, which the Device CVE Report Policies install. Devices appear in Vulnerability Detection only after their platform's policy is configured and the agent is connected. If the Security page shows CVE Reporting Is Partially Configured, some platforms still need a policy.
Supported platforms
Platform | Architectures | Versions |
macOS | x86_64, arm64 | macOS 12 or later |
Windows | x86_64 | Windows 10 and 11 |
Linux | x86_64 (ARM isn't supported) | Ubuntu, Debian, Fedora, Arch, NixOS |
Open Vulnerability Detection
In the Swif console, select Security in the sidebar.
Open the Vulnerability Detection tab.
The Security page also has tabs for Security Configuration Assessment, File Integrity Monitoring, Threat Detection, and Agents. See Introducing the New Swif Security Page.
Set up vulnerability detection
You turn on vulnerability collection with three Device CVE Report Policies, one for each platform. Each policy installs the Swif Security agent on its devices.
Policy | Platform | Device ownership | Setting |
Apple Device CVE Report Policy | macOS 12 or later | Company-owned and BYOD | Enable Wazuh |
Windows Device CVE Report Policy | Windows 10 or later | Company-owned | Swif Windows Device CVE Report |
Linux Device CVE Report Policy | Linux (not ARM) | Company-owned and BYOD | Enable Wazuh Agent |
Configure the policies
In the Swif console, select Security in the sidebar.
Select Configure Policies. It's in the banner at the top of the page when one or more platforms aren't set up yet.
In Configure Device CVE Report Policies, check each policy's status:
Not Configured: select Configure Policy to set it up.
Configured: select Edit Policy to change it.
Either button opens the policy in the standard policy wizard, with the policy already selected.
On Basic configurations, keep or change the Policy Name and Policy Description. Under Settings, make sure the policy's setting is on:
Apple: Enable Wazuh
Windows: Swif Windows Device CVE Report
Linux: Enable Wazuh Agent
[Screenshot: Linux Device CVE Report Policy, Basic configurations]
Select Continue.
On Select devices and Select device groups, choose the devices to scan. Assigning device groups means new devices that join the group are covered automatically.
On Review, check the settings and save the policy.
Repeat for each platform in your fleet.
Once the agent is installed and connected, Vulnerability Detection starts collecting data automatically. Check agent status on the Agents tab.
Turn off vulnerability collection
To stop collecting data from Macs or Linux devices, turn off Enable Wazuh or Enable Wazuh Agent in that platform's policy. On Macs, this uninstalls the agent.
Accounts the agent creates on devices
On Macs and Linux devices, the Swif Security agent creates a local service account named wazuh, plus a group with the same name. It doesn't create one on Windows. This account comes from the standard Wazuh agent installer.
Question | Answer |
Is it the Swif Admin account? | No. It's a separate account, used only by the Swif Security agent. The Swif Admin account is different. See Swif Admin User Behavior on Managed Devices. |
What's it for? | The part of the agent that talks to Swif runs as this account, instead of with administrator (root) rights. If that part were ever compromised, an attacker wouldn't get administrator access to the device. This is a common security practice called privilege separation. |
Does it have admin privileges? | No. It's a limited service account. |
Can anyone log in with it? | No. It has no password and no login shell. On macOS, it's hidden from the login screen. |
Is it removed? | Yes. Uninstalling the agent removes the |
Wazuh's documentation confirms this:
wazuh-agentd reference: the agent component that communicates with the server runs as user
wazuh.Uninstalling the Wazuh agent: uninstalling removes the
wazuhuser and group.
What you'll see
Overview
The Overview view summarizes vulnerabilities across your fleet:
Card | What it shows |
Total Vulnerabilities | All vulnerabilities found across your devices |
Affected Devices | How many devices have at least one vulnerability |
Unique CVEs | How many different CVEs were found |
Critical / High / Medium / Low Severity | The number of vulnerabilities at each severity |
Vulnerability trend | Vulnerabilities by severity over time. Choose the time range, such as Last 30 days. |
Top affected packages | The packages with the most vulnerabilities, such as Chrome |
Top affected OS | The operating systems with the most vulnerabilities |
To see individual vulnerability events, switch to Events.
Filters
Narrow the data by:
severity
operating system
time range, such as the last 24 hours
device group
Vulnerability details
Select a vulnerability to see:
which devices it affects
the vulnerable package or OS version
Swif IQ's remediation guidance
Fix vulnerabilities with Swif IQ
For each vulnerability, Swif IQ gives an assessment with context and recommended steps. These can include:
Update guidance, such as updating to a specific macOS or Windows build
Temporary mitigations if you can't update right away, such as firewall restrictions
Monitoring suggestions for unusual behavior
A remediation plan for every affected device type
To install updates across your fleet, use your software update policies. For example, the Apple Software Update Policy for Macs.
Prioritize what to fix
Start with Critical and High. Filter by severity, and fix these first.
Fix the top packages. Updating one widely installed package can close many vulnerabilities at once.
Update outdated operating systems. Check the most vulnerable operating systems, and update those devices.
Track progress. Watch the severity trends go down as you patch.
Troubleshooting
A device doesn't appear in Vulnerability Detection
Check that the Device CVE Report Policy for the device's platform is Configured, and assigned to the device.
Check that the device runs a supported platform and version. Linux devices on ARM aren't supported.
On the Agents tab, check that the Swif Security agent is installed and Active.
The banner says CVE Reporting Is Partially Configured
At least one platform's Device CVE Report Policy isn't set up. Select Configure Policies, and configure each policy marked Not Configured.
A local account named wazuh appeared on a Mac or Linux device
This is expected. The Swif Security agent creates a limited wazuh service account so that it doesn't run with administrator rights. It isn't the Swif Admin account, has no admin privileges, and can't be used to log in. See Accounts the agent creates on devices above.
The Swif Security agent shows Disconnected
The device is offline, or the agent can't reach Swif. Bring the device online, and wait for the status to change to Active.
I can't upgrade an outdated Swif Security agent
Upgrades work only while the device is online and the agent is Active. Swif doesn't queue upgrade requests for offline devices.
Bring the device online.
Wait for the agent status to change from Disconnected to Active.
On the Agents > Upgrade page, select Refresh.
Select the device, and run the upgrade again.
The message "Upgrade unavailable. Agent is disconnected." means the device must reconnect first.
A vulnerability still shows after I installed the update
The data updates after the agent's next scan. Check again later. If the vulnerability remains, confirm that the update installed on the device.