Tester: Wazuh's vuln-detector misses some products (MS365, mRemoteNG,
…). Chosen approach (safe option): surface the GAP, make NO automatic
CVE assignment → zero false positives.
Backend
- GET /api/v1/assets/{id}/coverage-gap: fetches syscollector packages,
cross-references against the asset's open-vuln package_name blob
(token match, len>=3 to avoid substring noise). Returns packages
WITHOUT any finding, each annotated with its endoflife.date status
when known (EOL / EOL SOON / out-of-active-support) — a hint only,
never a CVE claim. Pure local data, no NVD, no rate-limit risk.
Frontend
- Amber check-circle action per Wazuh-linked asset opens a modal
listing the gap packages (name / version / EOL hint), with a clear
"investigate manually — no automatic CVE claim" disclaimer.
Operator workflow: spot a high-value uncovered package (e.g. an EOL
mRemoteNG), investigate in NVD/vendor advisories, mark accordingly.
Deliberately conservative — keeps data quality intact.
vulncheck
af94797c3b