Sheet SYN-08 · Network Operations Manual
Vulnerability Management
Matching the fleet against known-exploited and published vulnerabilities, severity rules, and the exposure view.
Scope
Synapse checks the devices in the fleet against published and known-exploited vulnerabilities. This guide covers matching, the vulnerabilities view, and vulnerability policies.
Matching
Synapse matches fleet devices against the CISA Known Exploited Vulnerabilities catalog and against NVD data, using CPE 2.3 identifiers. The platform refreshes the known-exploited catalog on its maintenance cycle. Nobody has to update it by hand.
The vulnerabilities view
The view has two tabs:
- Device matches. Every match between a device and a vulnerability, with filters for serial and status. Each row shows the vendor, product, and vulnerability name. Known-exploited entries carry a badge. Handle those first: attackers already use them.
- Catalog. The full known-exploited catalog with text search. Use it to look up an advisory whether or not it matches your fleet.
Vulnerability policies
The vulnerability policy type works like Wi-Fi standardization. Its rules decide what fails a device, including a minimum severity. It uses the same organization, label, and site scopes and gives the same pass, fail, or not-applicable results. Vulnerability results appear on the compliance dashboard with the same evidence as other policies.
Effect on scores
Vulnerability results feed one of the four health score dimensions. Ongoing exposure lowers site scores and rollups.