Vulnerability Management

Scope

How to review vulnerabilities, set remediation policies, accept risk, and assess exploitability.

Viewing Vulnerabilities

Dashboard (the relevant workflow > Vulnerabilities):

• Overview tab: Stats grid (total CVEs, affected endpoints, severity breakdown, CISA KEV count), top 10 CVEs by endpoint count, aging buckets, and a 30-day detection trend. If the overview load fails, the page shows an inline retryable error banner instead of a blank shell.
• KB Mappings tab: KB-to-CVE cross-reference table showing which Windows KB patches fix which CVEs. Searchable by KB number or CVE ID. Shows severity, CVSS, affected endpoint count, and data source (CVE advisory vs. patch DB). Results cover only the organizations your role reaches, and only the endpoints it covers: a CVE appears only if it affects one of those endpoints, and the affected-endpoint count counts only those endpoints. With an organization filter, advisory-backed mappings, patch-backed mappings and counts all cover that one organization. Filtering on an organization outside your role returns “Organization not found”. Pagination uses server-provided totals for accurate page navigation
• Remediation tab: Urgency breakdown (critical/high/medium/low bands), patch availability stats, patch approval status. “Deploy Auto-Remediation” button per organization (requires security.manage)
• Data Sources tab: Sync source status, last sync times, per-source sync buttons
• Remediation Policy tab: Auto-remediation severity gates, batch limits, change control settings, and an org-level scheduled matching interval override

Note: Sync, match, and bridge operations run in the background. The dashboard shows “started” confirmations — check the Data Sources tab for progress.

Filtering:

• By severity: critical, high, medium, low
• By CISA KEV status
• By whether endpoints are affected
• By search (CVE ID or title)

Export and bulk actions:

• Export CSV downloads the current filtered vulnerability inventory for the active account.
• Bulk acceptance requires a reason and can include an optional expiry datetime. The action updates the affected EndpointVulnerability records and synchronizes linked alerts/incidents through lifecycle sync.

Triggering Manual Operations

Vulnerability feeds are managed by Cadres. The feeds (NVD, CISA KEV, USN, RHSA, MSRC, Apple) are shared by every customer. Cadres enables, disables and syncs them, and they sync automatically every day. In Relay you can see each feed and its last sync on the Data Sources tab, read-only. The same data is at:

Run endpoint matching now (Run Matching on the Overview tab or Run Endpoint Matching on the Data Sources tab; needs security.manage):

Link CVEs to patches now (Link CVEs to Patches; needs security.manage): Returns 202 and runs in the background, with the same scope as matching. Links CVEs to available patches and computes urgency scores.

Trigger auto-remediation:

Export vulnerability inventory: Exports the filtered vulnerability inventory for the organizations your role reaches; affected-endpoint counts cover only your endpoints. CSV is the default response format.

Bulk accept risk: Accepts risk for all affected endpoint-vulnerability records that match the selected CVEs. Requires security.manage.

a. Checking Operation Status

Risk Acceptance

Accept risk for a vulnerability:

Key behaviors:

• Accepted vulns remain visible in dashboards but are excluded from remediation
• Acceptance survives re-matching – the matcher does NOT re-open accepted vulns
• Lifecycle sync resolves linked alerts when risk is accepted
• In the endpoint-detail UI, the risk acceptance form includes an optional expiry date picker. If no date is set, the acceptance is permanent until manually revoked.

Revoke risk acceptance:

Exploitability Assessment

View assessments for an endpoint:

Trigger fingerprint-based assessment: Uses the endpoint’s fingerprint baseline to auto-detect:

• Network reachability of vulnerable services
• Whether affected process is running
• Firewall rules as compensating controls

Manual override:

Score interpretation: | Score Range | Meaning | |-------------|---------| | 0.8 - 1.0 | Highly exploitable – immediate action needed | | 0.5 - 0.8 | Moderately exploitable – standard remediation | | 0.2 - 0.5 | Low exploitability – schedule remediation | | 0.0 - 0.2 | Minimal risk – compensating controls effective |

Remediation Summary

Returns:

• Urgency breakdown: count at each tier (0-25, 26-50, 51-75, 76-100)
• Patch availability: vulns with matched patches vs without
• CISA KEV count with/without patches

The Overview tab also shows:

• Aging buckets for active vulnerabilities: 0-7, 8-30, 31-90, and 90+ days
• A 30-day detection trend chart based on detected_at

Common Vulnerability Scenarios

Scenario: New critical CVE in CISA KEV

1. CISA KEV sync runs daily, marks CVE as KEV + exploit_available
2. Vuln matching detects affected endpoints on the next due scheduler tick (default every 6 hours, with optional org-level cadence overrides)
3. Exploitability assessment runs automatically
4. Vuln-patch bridge matches to available patches
5. If remediation policy qualifies it: auto-approve patches, create deployment
6. If no patch available + emergency_mitigation_allowed: config-only mitigation applied

Scenario: Investigating a specific endpoint

3. Check urgency_score and matched_patch_kb on each endpoint-vulnerability

Scenario: False positive vulnerability

1. Verify the version detection is correct (check installed_version vs fixed_version)
2. If it’s a genuine false positive from product name collision: accept risk with explanation
3. The vendor enforcement (_vendor_matches()) should prevent most false positives