Skip to content

CPE Review

SentriKat matches your software against vulnerability data through CPE identifiers (the naming standard the public catalogues use for products). Getting this mapping right is the difference between a trustworthy dashboard and alert noise, so SentriKat treats it with a simple, strict philosophy:

A wrong CPE is worse than no CPE.

CPE Review CPE Review

How assignment works

  1. Exact matches first. Software reported by agents or imports is matched against the local software identity catalogue (tens of thousands of vendor:product pairs, synced automatically). Exact dictionary matches win over everything else.
  2. A strict plausibility gate for everything fuzzy. Near-matches must pass checks on BOTH the vendor and the product name; generic words (client, agent, runtime, setup, redistributable…) and substring tricks don't get through. Installers and sub-components never inherit the parent product's CPE.
  3. Below the bar → NO CPE, and a review entry. Instead of guessing, SentriKat queues the software on the CPE Review page for a human decision. Deterministic, reproducible. No AI in the matching engine.

The same rules re-validate existing assignments: a weekly self-audit flags entries that diverge from the software identity catalogue and can self-heal wrong ones.

The CPE Review page

Products → CPE Review lists software that didn't clear the bar, grouped by proposed identity:

  • Assign: confirm a proposed CPE (it becomes a learned mapping; matching re-runs immediately for that product)
  • Dismiss: mark the software as not-matchable (e.g. an internal tool); per-row or for a whole group at once
  • Learned mappings are remembered and, if you opted in, shared with the SentriKat knowledge base so every install benefits

What this means for your dashboard

  • Matches shown by default are version-verified where the data allows it; unverifiable legacy matches are hidden behind an explicit filter instead of padding your counts
  • Actively exploited entries are always surfaced, in the ACT NOW band on the dashboard
  • The N products awaiting a verified identity banner on the dashboard counts what is waiting here: worth working through on day one, near zero in steady state

FAQ

Why does some software show "no CPE"? Because nothing cleared the plausibility bar, by design. Assign it in CPE Review if you know the right identity, or dismiss it if it's not a publicly tracked product.

Do I have to maintain mappings by hand? No. Exact dictionary matching + the review queue for edge cases is the whole workflow; there are no mapping files to maintain.