Reading the Dashboard¶
SaaS How to read the dashboard and decide what to do first.
Time: ~5 minutes
Read one line first¶
Start here: 4 updates close 17 CVEs attacked in the wild
That is the whole triage, most days. Four updates is the work. Seventeen is what they close.
One package update usually closes several vulnerabilities, so the number of things to install is always smaller than the number of findings. Work from the updates, not from the CVE count.
Three bands, in order¶
| Band | What is in it | When |
|---|---|---|
| ACT NOW | Confirmed as attacked in the wild, and it affects you | Today |
| PLAN THIS MONTH | Serious, not seen being attacked | This month |
| BACKGROUND | The rest | Next time you touch the machine |
Inside them are five tiles: Actively exploited, Early warning, Critical, High and Medium. The big number on each tile is updates to install; the smaller one is the CVEs they close.
Early warning holds what reached you before anyone confirmed it was being attacked: a public exploit exists, no attack has been seen, and the patch window is weeks rather than days.
Click a tile to filter the list below it.
Work top down
Most small organisations have nothing in ACT NOW most weeks. When something lands there, it is genuinely the thing to do first, because someone is already using it against other people.
Two banners worth clearing¶
N software not analysed: reported by an agent but not yet checked. Nothing is known about it yet, and it is not counted as clean.
N products awaiting a verified identity: SentriKat could not match these to a published software identity. Click Review to confirm them by hand, or Auto-Detect CPE to try automatically.
Both are normal on day one and should be near zero after that.
Filtering by where the software is¶
The Source filter splits the list: All, Servers, Clients, Containers, Dependencies.
Useful when the person fixing servers is not the person fixing laptops.
What you can do to a row¶
| Action | Use it when |
|---|---|
| Snooze | Not now. It comes back |
| Mark as fixed | You installed the update. The next scan checks you |
| Risk exception | You accept the risk, with a reason and an end date |
| Assign | Someone else is doing it |
| Share | Someone without an account needs to see it |
Snooze and Mark as fixed are different at audit time. Snooze means "not now"; Mark as fixed means "done", and the next scan will disagree if it is not.
Patching from the list¶
Remediation Actions, below the list, groups findings by the update that closes them: one row per update, the CVEs it closes, and the machines that need it. That is the list to work from when you are actually patching.