I’m mapping a home-lab learning path focused on network defense and vulnerability management: pfSense + Suricata inline, Wazuh for telemetry, and weekly OpenVAS scans against a Windows Server 2019 and Ubuntu LTS, aiming to remediate CVSS >=7 in 7 days with change control. For folks who’ve hired junior defenders, does this setup and cadence reflect what you expect, or should I emphasize asset inventory accuracy and patch SLAs (e.g., 15/30/60 days) more?
Looks solid; what’s stood out when I’ve hired is candidates who track “exposure age” and auto-ticket highs, and who snapshot/rollback before patching. I’d run Suricata alert-only for a week to baseline so the IPS doesn’t eat your Netflix, and tag assets by criticality so the 7‑day SLA applies where it matters. Quick reference: https://www.cisecurity.org/controls/vulnerability-management.
I kept getting “still vulnerable” after Patch Tuesday until I started flagging a ‘pending reboot’ state in Wazuh and blocking ticket closure until a rescan passed; it killed a lot of reopen noise… If you keep Suricata inline, whitelist your scanner’s IP so the auth checks don’t get tripped.
@jordan_lake92 nailed the auth part — on my team we pull the CISA KEV list into Wazuh/OpenVAS, tag those findings, and make KEV a 24h target while keeping your 7‑day SLO for the rest. After each change, kick a targeted rescan on the affected host to close the loop.
One thing that helped in my lab: take a VM snapshot before each change window and run a short daily delta scan (top ports/new services) while keeping the full OpenVAS run weekly; it caught drift without burning cycles. For prioritization I layer in EPSS to bubble likely-to-be-exploited items first: Exploit Prediction Scoring System (EPSS) — saved me from the ‘works on my VM’ gremlins once.
Looks solid for a junior-defender baseline; the one thing I’d add is “proof‑of‑fix” via Wazuh syscollector — query package/KB versions post‑remediation and only auto‑close when those values match. To sharpen prioritization, map OpenVAS CVEs to Suricata alerts so vulns you see in traffic jump the queue, not just by CVSS. Small caveat: keep GVM/NVT feeds syncing daily before scans and allow time‑bound exceptions so you’re not playing whack‑a‑mole.