Browse documentation
Viewing vulnerabilities by package
The Vulnerabilities page is your org-wide view of open findings, correlated from reported software inventory against the NVD mirror. This article covers reading and filtering it.
The summary
At the top, four cards show open-finding counts by severity — Critical, High, Medium, Low — and a line summarises open findings · distinct CVEs · hosts affected. Panels highlight the most widespread CVEs and the most exposed hosts. Select a severity card to filter to it.
Grouped vs Flat
Findings are listed in collapsible groups — By fix (default), By CVE or By host; see Working through findings. Each group's header shows the worst severity, the number of hosts and findings, and how old the oldest finding is.
Groups start collapsed, so the list reads as a short set of actions. Select a group to open it and see each CVE, its CVSS score, the affected host and the installed version. Expand all and Collapse all open or close every group shown.
Filtering
- Search across CVE ID, product name, and hostname.
- Filter by severity.
- Filter by type — a device type (Switch, Router, Firewall…) or a server type (Physical, Virtual, Hypervisor, Workstation, Laptop…).
- Filter by site.
- Filter by group — matches hosts that are in the group themselves; a group on a site doesn't include that site's hosts.
Filters narrow the findings before they're grouped, so they apply to all three groupings and to Create tasks. They're remembered while you move around the app; the filters active button clears them all.
- CVE IDs link out to the full entry on the NVD website; hosts link to their detail page.
Acting on findings
- Scan now (top of the left rail, administrators only) re-correlates every host's inventory immediately. Otherwise every host is re-checked once a day, and a host is also re-checked whenever its inventory changes — Findings checked below it shows when the last full correlation ran. See How vulnerability scanning works.
- Create tasks for all turns the currently filtered findings into remediation tasks in one action (priorities and due dates are set from severity).
- Individual findings can be turned into a single task — see Investigating a CVE.
Accepting a finding
How you accept a finding depends on the host, and it happens on the host's own Vulnerabilities tab:
- Servers and devices — Suppress hides that CVE for that product on that host. It's durable: the finding stays hidden through future scans. You'll be asked for a reason, which is required — it's what lets someone judge the suppression later.
- Endpoints — Dismiss removes the finding once. It's not a rule, so it can come back on a later scan.
Reviewing and removing suppressions
Select the Suppressed count in the left rail to open the suppression rules. Each rule shows the CVE, the product, the host, the reason, and who created it and when. Remove a rule to return its findings to the open list — you'll be asked to confirm.
Anyone who can view the page can read the rules; removing one needs write access to Vulnerabilities. Suppressing a product or a whole CVE across every host isn't available from the interface.
Notes & tips
- Severity here uses Critical / High / Medium / Low (with None/Unknown for unscored CVEs).
- Start with the Grouped view and the Critical card to triage the highest-impact software first.