Vulnerability monitoring and NIS2: what Wazuh and Zabbix cover

What NIS2 requires on the technical side

The directive requires companies in scope to apply risk management measures. They include:

• incident handling;
• business continuity: backups and disaster recovery;
• security in acquiring, developing and maintaining systems, including vulnerability handling;
• assessing whether the measures work;
• access control and asset management;
• multi-factor authentication.

Significant incidents are reported in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the notification.

To meet these deadlines you need to learn about the incident in time and have data on what happened. This is where tools help.

What Wazuh does

Wazuh is an open-source security platform. An agent runs on each machine and sends data to a central server.

• Vulnerability detection. The agent lists installed software and the server compares it with databases of known vulnerabilities (CVE). You get a list per machine with a severity rating.
• Configuration checks. The SCA module compares system settings with recommendations such as the CIS Benchmarks.
• File integrity monitoring. Records when and how important files changed.
• Log analysis. Collects events from servers and raises an alert on suspicious activity.
• Active response. On certain events it can block an address or stop a process.

What Zabbix does

Zabbix does not look for vulnerabilities. It monitors whether systems work and how: availability, load, disks, services, network devices.

For NIS2 this matters in a different way. The history in Zabbix shows exactly when a problem started, which services were affected and how long recovery took. This is the data you need for an incident report.

What covers what

Internal scanning is not enough

Wazuh sees systems from the inside. An attacker sees them from the outside: which ports are open, which services answer and with which versions. So add external scanning to internal monitoring, at least after every network change and periodically.

What a working process looks like

1. Inventory. You know which machines exist and who is responsible for each.
2. Detection. Wazuh checks software automatically and external scanning shows what is visible from the internet.
3. Priority. What is severe and reachable from outside is fixed first. Not every vulnerability is urgent.
4. Fix. Updates in an agreed window, with a backup first.
5. Verification. The next scan confirms the vulnerability is closed.
6. Report. A monthly report: what was found, what was closed, what remains and why.

The report is also the evidence during an inspection that the measures do not exist only on paper.

What we can achieve for you