Unveiling ScanOrchestrator: Your VD Scan Orchestrator

Hey folks! Let's dive into something pretty cool: the ScanOrchestrator. Think of it as the conductor of a symphony, specifically the symphony of vulnerability detection (VD) scans. This article will break down what it is, how it works, and why it's so important in the world of security, especially when you're rocking Wazuh. So, grab a coffee (or your favorite beverage) and let's get started!

What is ScanOrchestrator?

So, ScanOrchestrator is the brain behind coordinating and executing all the different types of VD scans. It's the go-to layer that receives commands from ScanContext and then springs into action. These actions involve everything from checking against CVEs feed (that's Common Vulnerabilities and Exposures, the list of known security holes) to updating the vulnerability index and sending out alerts. The primary goal of ScanOrchestrator is to ensure that vulnerabilities are found, understood, and addressed quickly and efficiently. It's a critical component for keeping your systems safe, guys. The orchestrator deals with different types of scans: VDFirst, VDSync, and VDClean. Each of these has a specific role, but they all funnel through the orchestrator to get the job done. This means that everything is organized and follows the same process, which means that you can make sure everything is coordinated. ScanOrchestrator also works closely with IndexerConnectorSync to read and modify the current vulnerability index. This is where it keeps track of everything, comparing what it knows against the actual state of your systems. This helps to determine if the system is vulnerable, and what is vulnerable.

The Core Components

• CVEs Feed: This is where ScanOrchestrator gets its information about vulnerabilities. This might be from scanning packages, doing a full agent scan, or resolving known issues.
• IndexerConnectorSync: The orchestrator reads and modifies the vulnerability index. This is your system’s memory of vulnerabilities.
• Alert Dispatcher: When the orchestrator finds something, it sends out alerts to let you know about the issues, and these are based strictly on the differences it finds.

The Orchestration Flows: The Heart of the Matter

Alright, let’s talk about the specific tasks that ScanOrchestrator handles. These are the flows, or the step-by-step processes, for different types of scans. Each flow has a specific responsibility, and each one is designed to be self-contained and idempotent. This means they can be run multiple times without causing any problems.

Detailed Flow Breakdown

• FirstFullScan: This is the initial baseline scan. It runs after the first VD session for an agent, establishing a starting point.
• FullScan: This is a full rescan, triggered by an OS change or the removal of a hotfix. This makes sure everything is still secure.
• PackageUpdate: This handles the process of updating packages. It includes a delete and insert pair to keep things clean.
• PackageDelete: This flow handles the removal of a package. Simple, but important.
• PackageInsert: This deals with the addition of a new package to the system.
• HotfixInsert: This is a tail-step for VDSync, used to evaluate CVEs fixed by new knowledge bases, without needing a full scan. This is used for efficiency.
• CleanupAgentData: This flow deletes agent-specific data within the VD indices, keeping things tidy. This is important for removing old or unnecessary information. This helps keep the index clean and efficient. Keeping the data clean will ensure there is not confusion when the system searches for vulnerabilities.

Ordering Note: ScanContext makes sure these flows run in the right order for VDSync (updates → deletes → inserts → hotfix). The orchestrator is designed so each flow has its own role. This modular design helps everything run efficiently and correctly.

Responsibilities in Detail

The ScanOrchestrator has a specific set of responsibilities to ensure everything runs smoothly:

• Clear Structure: It has a clear and minimal public structure, with one method for each flow, making it easier to understand and use.
• Scanning and Analysis: Within each method, it scans for vulnerabilities in the OS or package being analyzed. This involves checking the system against known vulnerabilities.
• Previous State: Reads the previous state from the vulnerability index using IndexerConnectorSync. This is vital for understanding what's changed.
• Diff Computation: Calculates the differences (diffs) between the current state and the previous state. This identifies what CVEs have been added or removed.
• Index Updates: Applies index updates only based on the diffs to ensure only relevant information is changed.
• Alert Generation: Generates alerts for the diffs, informing users about affected and solved vulnerabilities. This ensures users are aware of the system state.
• Robust Logging and Error Handling: ScanOrchestrator also handles all the logging and error handling. This includes detailed logs and graceful error handling. This will ensure that all the system information is saved and that issues don't block the completion callback. This is especially important for things like inventory synchronization, it makes sure that the process can continue even if something goes wrong.

Delving into the DoD (Definition of Done)

Let’s look at the DoD (Definition of Done). This helps ensure that the ScanOrchestrator is implemented properly.

• Adapt the Class: The ScanOrchestrator class is adapted to expose the ScannerTypes. This will ensure it can perform all of the correct scans. This includes FirstFullScan, FullScan, PackageUpdates, PackageDelete, PackageInsert, HotfixInsert, and CleanupAgentData.
• Implementation/Adaptation: Existing internal classes are implemented or adapted as needed. This includes things like TPackageScanner, TEventInsertInventory, TEventDetailsBuilder, TEventPackageAlertDetailsBuilder, TEventSendReport, TEventDeleteInventory, TCVESolvedInventorySync, and TCVESolvedAlertDetailsBuilder.
• Diff-Based Updates and Alerts: All flows must produce diff-based index updates and alerts. This ensures that the system works efficiently.
• Detailed Logging: Robust logging is implemented around each step. This includes the start and end of each process, the sizes of the data, timings, and any errors. This helps when something goes wrong.
• Graceful Error Handling: Graceful error handling is implemented to ensure partial failures per item do not block the session completion callback. This is critical for keeping the system running. This means if something fails, it doesn't bring everything down.

Key Takeaways and Benefits

• Efficiency: The ScanOrchestrator streamlines the vulnerability scanning process. By automating and coordinating the various scan types, it makes sure you get the best and most accurate information.
• Accuracy: Using diff-based updates ensures that changes are accurate and only relevant issues are addressed.
• Alerting: Generating alerts for the diffs gives you real-time visibility into your system's vulnerabilities, helping you respond quickly.
• Error Handling: Robust error handling and logging mean that even if there are problems, they can be fixed. You won't have to worry about the whole system crashing.

Conclusion: Your Security Sidekick

So, there you have it, folks! The ScanOrchestrator is a critical part of your security setup, managing the complex process of vulnerability detection with efficiency and accuracy. By understanding how it works, you can appreciate the value of this crucial component in keeping your systems safe and secure. It ensures that your system is up-to-date. If you are using Wazuh, make sure you understand the role of the ScanOrchestrator. It is your security sidekick. Keep up the great work and stay safe out there, guys!