Choose the Wazuh state index for an inventory question

Bottom line: Choose the data category before entering an inventory query. Trace an unexpected result through the documented collection and indexing path instead of substituting a familiar alerts population.

Source fact: documented behavior

The Wazuh global queries guide describes endpoint data collected periodically by modules such as Syscollector and centralized in dedicated global state indices.

The Inventory Harvester validates data against Wazuh Common Schemas and batches it for delivery to the indexer.

Its index table assigns installed packages to wazuh-states-inventory-packages-*, open ports to wazuh-states-inventory-ports-* and detected vulnerabilities to wazuh-states-vulnerabilities-*.

What the source does not establish

This article selects a documented state-data population and its processing path. It does not prove that an endpoint is currently reachable, prescribe an exact freshness interval or equate a missing inventory record with an absent package or vulnerability.

Applicability questions

• Is the question about packages, ports, vulnerabilities or another documented category?
• Which global state index represents that category?
• What endpoint and observation time can anchor the comparison?
• What collector, harvester or indexing evidence is available?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends recording the selected state index and tracing a known endpoint observation through the inventory path before relying on the query.

1. Write a concrete inventory question and choose its category from the applicable documentation. For a proposed package question, identify a harmless known installed package on an approved test endpoint; for a port question, choose a separately authorized known observation. Keep those case definitions distinct instead of assuming that an alert mentioning a package or port supplies the same inventory population.
2. Record the actual selected index pattern, endpoint identity and available collection times. Compare the resulting state record with the approved source observation. If the record is absent or unexpected, investigate the collector-to-manager-to-indexer path with the relevant operators. Avoid relabeling the query as a live remote command or assigning a universal update delay that the deployment has not measured.
3. Inspect available harvester and indexing diagnostics for the bounded case, preserving errors and retries for their responsible owner. Use the consumer’s documented query workflow to distinguish an index-selection mistake from a missing record. Keep broader endpoint compromise, software approval and vulnerability remediation decisions outside this inventory-path acceptance unless their separate evidence is supplied.

Verification and evidence

Proposed verification: compare the known package case with the package-state population, then review a separate category control so the index choice is explicit. Retain the endpoint observation, query scope and actual returned record together. If timing is relevant, measure the actual observed collection-to-query interval rather than copying a presumed service guarantee.

Repeat the bounded trace after an authorized harmless change only when the endpoint owner approves that exercise. Preserve unresolved collection or indexing gaps instead of filling them with synthetic production records. No inventory collection, endpoint query or harvester test was performed for this article; the proposed checks do not establish completeness across all monitored systems.

Official references

• Wazuh global queries — Wazuh; official product documentation.

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.