Vulnerability Management

[rmsteffen]

EDIT: someone already asked this, feel free to delete - sorry I'll be more careful next post :-/

I'm really trying to decide between Wazuh, SecurityOnion and UTMStack. I REALLY like what I'm seeing in UTMstack, but I know that OpenVAS has some limitations in terms of "business" detections (the free feed has a lot of detections dropped that are considered enterprise) -- additionally network scanning doesn't really give a complete view of vulnerabilities.

Has UTMStack considered adding vulnerability detection in a similar way as Wazuh does using CVE databases like NVD along with software inventory to figure out vulnerabilities for devices? I think there are similar implementations for OSquery. Obviously there would still be configuration-based vulnerabilities but software inventory based scanning + openvas network scan would be probably "good enough" for most SMBs.