First Scan¶
SaaS Understand what happens after your agent scans, and how to interpret the results.
Time: ~3 minutes
How Scanning Works¶
When an agent scans an endpoint, it:
- Collects a list of installed software (name, version, vendor)
- Uploads the inventory to SentriKat
- SentriKat matches each product against the exploited-vulnerability catalogue, the European database, and the public CVE records
- Results appear on your dashboard as matched vulnerabilities
The matching uses CPE (Common Platform Enumeration) identifiers. The shared knowledge base resolves the pairs it already knows; what stays ambiguous is not guessed, it waits for you on the CPE Review page.
Check Your Results¶
After your agent's first scan:
- Go to Products in the left sidebar
- You should see a list of software detected on your endpoint
- Each product shows:
- Name and version
- Vendor
- Status: whether any exploited vulnerabilities match
Understanding Matches¶
The dashboard is the list: it is where SentriKat shows what it found.
| Column | Meaning |
|---|---|
| CVE ID | The unique vulnerability identifier (e.g., CVE-2024-1234) |
| Severity | CVSS score from the best available of the three databases |
| Product | Which of your installed products is affected |
| Status | Affected, Likely Resolved, or Resolved |
| Due Date | the remediation deadline (if this is a exploited vulnerability) |
| Ransomware | Whether this CVE is known to be used in ransomware campaigns |
Status Meanings¶
- Affected , Your installed version is vulnerable
- Likely Resolved : A patch exists and your version might include it, but couldn't be confirmed automatically
- Resolved , Your version includes the fix
What If Nothing Shows Up?¶
If no vulnerabilities appear, that's actually good news. It means none of your installed software matches a known exploited vulnerability. SentriKat only tracks actively exploited CVEs, not the full 200,000+ published catalogue.
You'll still see your products listed under Products. If products don't appear either:
- Make sure the agent scan completed (check Agent Activity, or Inventory → Endpoints, for the last-seen timestamp)
- Wait 2–3 minutes for the matching pipeline to finish
- Try a one-off scan: on Windows
powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -RunOnce; on Linux/macOSsudo bash ./sentrikat-agent-linux.sh --run-once
Scheduling¶
By default, agents scan every 4 hours. You can adjust the schedule:
# Windows: set the interval (in minutes) when installing the .ps1 script
powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -Install -IntervalMinutes 120
On Linux/macOS, adjust the cadence by editing the agent's systemd timer or launchd plist and reloading it.