Browse documentation
How vulnerability scanning works
JOATOS's vulnerability scanning is inventory-driven: it matches the software your hosts report against known CVEs. You don't run intrusive network scans — findings come from the inventory you already collect.
Where the data comes from
- CVE data is kept in a local mirror of the NVD (NIST National Vulnerability Database), backfilled and synced daily.
- OS packages on Linux hosts are additionally checked against OSV (distro-native advisories), which understands distribution backports — where a fix ships in a distro's package revision without an upstream version bump.
- Your inventory comes from what you already collect: the endpoint agent, SSH on Linux servers, and SNMP firmware on network devices.
How matching works
For each installed product and version, JOATOS:
- Resolves the package to a CPE (the standard vendor/product identifier).
- Looks up CVEs whose affected version ranges include your installed version.
- For Debian/Ubuntu packages, checks the matching OSV advisory so distro backports are handled correctly.
Each match becomes a finding tied to a specific host, with a confidence rating (High / Medium / Low) reflecting how precisely the version matched.
Findings resolve themselves
A finding auto-resolves when correlation runs after the underlying inventory has changed — when the software is updated past the affected version, or removed from the host. You don't have to close findings manually as you patch.
Findings follow your inventory. Whenever a host's package list changes — an agent reports new inventory, a scheduled package scan runs, or someone selects Rescan on the host's Vulnerabilities tab — that host's findings are re-checked straight away. A daily correlation also re-checks every host, picking up newly published vulnerabilities.
Running a scan
Correlation runs automatically — for a host as soon as its package inventory changes, and once a day across every host. You can also run it on demand:
- Rescan on a host's Vulnerabilities tab re-collects that host's packages and re-checks its findings, then tells you whether they changed. For hosts with an agent, the scan is queued and the findings update when it completes.
- Scan now at the top of the Vulnerabilities page (administrators only) re-correlates every host, and also refreshes vulnerability data for software that hasn't been seen before.
If a full correlation is already running, Scan now waits for it to finish, so it can take longer than usual.
A product that has never appeared in your estate before gets its first matches at the next daily correlation or Scan now.
The Vulnerabilities page shows when findings were last correlated, as Findings checked.
Notes & tips
- Because findings are inventory-driven, accurate, current inventory is the key to accurate findings — keep agents healthy and scans running.
- Firmware findings for network devices come from what the device reports over SNMP.