Browse documentation
Working through findings
The Vulnerabilities page is built around one question: what should I do next? It groups findings by the fix that clears them, rather than listing CVEs for you to sort out yourself.
Views
The left rail holds saved views:
| View | Shows |
|---|---|
| Open findings | Everything outstanding. |
| Known exploited | Findings in the CISA KEV catalogue — attacks seen in the wild. Start here. |
| Fix version known | Findings where the advisory named a fixed version. |
| No fix recorded | Findings where it didn't — see below. |
| Suppressed | Opens the suppression rules behind the count, where you can review or remove them. |
| Resolved 30d | A count only, not listed. |
Grouping: by fix, by CVE, by host
The default grouping is by fix — findings gathered under the upgrade that clears them. That's the shape that turns a long list into a short number of actions: one package upgrade may close dozens of findings across many machines.
Switch to by CVE when you're investigating a specific vulnerability, or by host when you're working through one machine.
Selecting anything opens a detail pane beside the list.
What a finding tells you
Alongside severity and the affected package:
- KEV — whether it's in the CISA known-exploited catalogue, whether it's associated with ransomware, and how far past its due date it is.
- EPSS — the probability it'll be exploited, with its percentile against everything else.
- Fixed version — the version that clears it, where the advisory said.
Between them, KEV and EPSS answer "is anyone actually attacking this?", which severity alone doesn't.
"No fix recorded" does not mean "no fix exists"
It means the advisory didn't state one. Most findings are in this position, because most advisories don't name a fixed version.
Treat it as "look it up", not "nothing can be done". Reading it as unfixable would leave most of your estate untouched.
Notes & tips
- Work Known exploited first, then by fix. Severity ranks theoretical danger; KEV ranks what's actually happening.
- Suppression happens per host, on a server's or device's own Vulnerabilities tab. Review or remove the rules from the Suppressed count here — see Viewing vulnerabilities by package § Reviewing and removing suppressions.