Skip to content
docs

Type at least two characters. Press Enter for full results.

    Vulnerabilities

    View as MarkdownOpen in ChatGPTOpen in Claude

    Outpost matches installed software against distribution security feeds and the National Vulnerability Database (NVD) to identify known vulnerabilities, or CVEs. Matching uses the inventory endpoints already report. Use the findings to decide what to fix and record risks you accept.

    Before you begin

    Section titled “Before you begin”
    • To see findings you need vuln:read. To suppress a finding you need alert:manage, because accepting a risk is the same kind of decision as silencing an alert.
    • On the MSP plan, open the client’s workspace first.

    How findings are made

    Section titled “How findings are made”
    • Linux distribution packages are matched against the distribution’s own security data from the Debian security tracker and OSV. Native package version rules recognize fixes backported by the distribution, even when the upstream version number stays the same.
    • Feed families include Debian, Ubuntu, AlmaLinux, Rocky Linux, Red Hat, SUSE, and Alpine. Verification requires coverage for the exact distribution and release. Red Hat and SUSE require an exact product/release match; a related distribution is not proof of coverage.
    • Other software is matched against NVD, including its applicability conditions. Add-ins and plug-ins are assessed as their own products, not assigned their host product’s CVEs.
    • A finding names the CVE, installed software and version, and the fixed version when the advisory provides one. Distribution findings use the distribution’s severity rating when assigned, otherwise NVD’s. The CVSS score comes from NVD.
    • A finding is open while the endpoint still reports the matching software, and resolved when it stops reporting it, for example after an upgrade or a removal.
    • The profile setting vuln.scan_enabled, on by default, decides whether an endpoint’s software is matched. Turning it off stops new findings for the endpoint and does not mark it clean.
    • A newly found vulnerability at or above vuln.alert_min_severity, which defaults to high, raises an alert. Findings below it are still recorded and listed. See the Vulnerability settings.

    Distribution package identity requires agent 0.3.0 or later. Older agents’ Linux package findings are not distro-verified. Outpost picks up a newly reported distribution release within about 15 minutes of the first endpoint reporting it, when feed coverage is available. Findings refresh on the next scan.

    If the page shows The vulnerability feed is not switched on, contact support. Existing findings stay listed.

    Review vulnerabilities

    Section titled “Review vulnerabilities”

    1. Go to Software > Vulnerabilities.

      The list has one row per CVE across the client’s endpoints. Each row shows whether attacks have been seen (Known exploited or No known exploit), the Severity, the CVE, its Score, how many Endpoints have it, the Software it matched through, and First seen and Last seen.

    2. Narrow the list by State (Open, Resolved, Accepted risk, or Any state), Exploited, Severity, CVSS score at least 4.0, 7.0, or 9.0, CVE, or Endpoint id.

    3. Select a CVE to open it. The page lists every endpoint it was found on, with the Software, the Installed version, the version it is Fixed in (or No distro fix available for a distribution finding without a fix, otherwise No fix published yet), the Match, the dates, and the State.

    A known-exploited CVE of medium severity is usually more urgent than a critical one that nobody has exploited. A CVSS score of 0 can mean NVD has not scored the CVE yet; a distribution severity rating can still be present.

    Match says how sure the finding is:

    MatchMeaning
    Distribution verifiedThe distribution security feed confirms the finding for this package and release.
    Upstream matchAn NVD match on a distribution package without distribution verification.
    Confirmed mappingA mapping states what this software is in the NVD.
    Name match, unconfirmedOutpost matched the installed software’s name and version. Check it before acting on it.

    Each finding shows its advisory source: Debian security tracker, OSV with the distribution, such as OSV (Ubuntu), or NVD. Older findings without source evidence show Source not reported.

    Two labels separate awareness findings from the critical and high totals:

    LabelMeaningCounted as
    Upstream match, not distro-verifiedNVD matches a distribution package, but the distribution feed has not confirmed it. A backported fix may apply.Unverified, excluded from critical and high totals.
    No distro fix availableThe distribution tracks this CVE for this release but has not shipped a fix. The finding stays listed for awareness.No distro fix, counted separately and excluded from critical and high totals.

    To fix a finding, upgrade or remove the software. See Deploy software and Patching. The finding resolves on the next match after the endpoint reports the change.

    Each endpoint’s own findings are on its Vulnerabilities tab.

    Accept a risk on one endpoint

    Section titled “Accept a risk on one endpoint”

    Suppressing records that you accept a finding on one endpoint. It applies per endpoint, because the same flaw on a test endpoint and on a domain controller are different decisions.

    1. Open the CVE from Software > Vulnerabilities.
    2. On the endpoint’s row, select Suppress. Only open findings can be suppressed.
    3. In Reason, say why the risk is accepted. The reason is required, up to 2,000 characters, and is what someone reviewing the decision later works from.
    4. Select Suppress.

    The finding moves to Accepted risk and stays on file with your reason and who accepted it.

    Verify

    Section titled “Verify”

    Open the CVE again. The endpoint’s row shows the state suppressed, the reason, and Accepted by followed by who accepted it. After an upgrade, the row shows resolved once the endpoint has reported its new inventory.

    If something goes wrong

    Section titled “If something goes wrong”
    SymptomCauseFix
    The page shows The vulnerability feed is not switched onThe feed is not enabled for your Outpost.Contact support.
    An endpoint never has findingsvuln.scan_enabled is off for it, or it reports no software inventory.Check Profiles > Effective config for the endpoint.
    Suppress is missing on a rowThe finding is not open.Only open findings can be suppressed.
    Suppressing is refusedYou lack alert:manage.Ask someone who holds it.
    A finding stays open after an upgradeThe endpoint has not reported its inventory since.Wait for the next inventory, or check the installed version on the endpoint.

    Next steps

    Section titled “Next steps”

    Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.