"Shadow IT includes hardware, software, and services running outside IT and security teams' visibility or approval," Wazuh writes — and frames the problem as one of sight, not solely of policy.
Network discovery scans vs. endpoint telemetry
Many organizations rely on network discovery scans to measure asset coverage, but those scans measure reachability, not monitoring coverage. The source material explains that network scans only identify endpoints that respond during the scan window; powered-off devices, isolated network segments, and software that does not expose listening ports can remain invisible. Network discovery can infer services from exposed ports, but it cannot reliably identify software that does not listen for inbound connections — for example, browser extensions, locally installed utilities, or remote-access tools that initiate outbound connections to a broker.
Wazuh agent: continuous system inventory and monitoring coverage
Wazuh is presented as a free and open source security platform that unifies SIEM and XDR capabilities across endpoints and cloud workloads. Central to its approach is an agent that collects continuous system inventory from each monitored endpoint. The agent reports hardware details, operating system information, installed packages, network interfaces, listening ports, running processes, services, users, groups, and browser extensions; on Windows endpoints it also reports installed updates.
The inventory capability is enabled by default, runs an initial scan when the agent starts, and rescans on a configurable interval that defaults to one hour. Agent enrollment status provides a measure of coverage among endpoints registered with the Wazuh server: an agent may be in one of four states — never connected, pending, active, or disconnected. Agents that enrolled but never connected signal incomplete deployments; an agent moves to disconnected when no keep-alive message arrives within the configured window, which defaults to 15 minutes. These states let security teams measure monitoring coverage instead of assuming it.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVisibility into browser extensions, services, and unapproved applications
Beginning with Wazuh 4.14.0, inventory collection includes browser extensions, endpoint services, users, and groups. The browser-extension model is unified across Windows, macOS, and Linux, allowing teams to identify extensions with broad permissions across the estate from a single query. Services inventory normalizes Windows services alongside Linux systemd units, helping surface unapproved software configured to start automatically.
Inventory data is intended to be actionable: teams can configure custom Wazuh rules to detect selected unauthorized applications and use an Active Response script to remove them from monitored endpoints. The source points to two demonstration posts — "Threat hunting using inventory data collected by Wazuh," which shows queries, custom rules, and CDB lists, and "Managing shadow IT with Wazuh," which covers the detection rules and the active-response uninstallation script.
Agentless monitoring and syslog for network devices
For devices that cannot run an agent — printers, switches, IP cameras, and other network appliances — Wazuh supports agentless monitoring over SSH for routers, firewalls, switches, and Linux or BSD systems. Where neither an agent nor SSH is available, the Wazuh server can accept syslog directly from network appliances and other equipment. These methods extend visibility beyond agent-capable endpoints, but the source is explicit about their limits: SSH and syslog monitoring provide only the information exposed by the configured commands, files, and device logs.
What this means for security teams, procurement leaders, and end users
- Security teams and technologists: Use inventory collected at the endpoint to compare what is installed and running against network-scan results; query indexed inventory centrally during investigations rather than collecting data on demand; and correlate inventory with vulnerability content from the Wazuh Cyber Threat Intelligence platform for centralized analysis.
- Procurement and IT operations leaders: Treat agent enrollment state as a concrete metric of monitoring coverage — agents that never connect or that show as disconnected point to deployment or retention gaps that procurement and operations must address.
- End users and device owners: Recognize that software installed outside an approved baseline — including browser extensions and remote tools that make outbound connections — can be visible to centralized inventory and, where configured, removable through active response.
Shadow IT, the source argues, is first and foremost a visibility problem. Network scanning will always answer a different question than endpoint telemetry. By collecting continuous inventory from agents, ingesting SSH and syslog where agents cannot run, indexing that data centrally, and correlating it with vulnerability and policy data, organizations gain the factual baseline they need to find unmanaged endpoints, identify unauthorized software, and initiate remediation where configured. For organizations wrestling with blind spots, the practical choice described here is to measure what is monitored rather than to assume monitoring is complete.
