Skip to content

CPE Review

SentriKat matches your software against vulnerability data through CPE identifiers (the naming standard NVD uses for products). Getting this mapping right is the difference between a trustworthy dashboard and alert noise — so SentriKat treats it with a simple, strict philosophy:

A wrong CPE is worse than no CPE.

How assignment works

  1. Exact matches first. Software reported by agents or imports is matched against the local NVD CPE dictionary (tens of thousands of vendor:product pairs, synced automatically). Exact dictionary matches win over everything else.
  2. A strict plausibility gate for everything fuzzy. Near-matches must pass checks on BOTH the vendor and the product name; generic words (client, agent, runtime, setup, redistributable…) and substring tricks don't get through. Installers and sub-components never inherit the parent product's CPE.
  3. Below the bar → NO CPE, and a review entry. Instead of guessing, SentriKat queues the software on the CPE Review page for a human decision. Deterministic, reproducible — no AI in the matching engine.

The same rules re-validate existing assignments: a weekly self-audit flags entries that diverge from the NVD dictionary and can self-heal wrong ones.

The CPE Review page

Products → CPE Review lists software that didn't clear the bar, grouped by proposed identity:

  • Assign — confirm a proposed CPE (it becomes a learned mapping; matching re-runs immediately for that product)
  • Dismiss — mark the software as not-matchable (e.g. an internal tool); per-row or for a whole group at once
  • Learned mappings are remembered and, if you opted in, shared with the SentriKat knowledge base so every install benefits

What this means for your dashboard

  • Matches shown by default are version-verified where the data allows it; unverifiable legacy matches are hidden behind an explicit filter instead of padding your counts
  • 0-day / actively-exploited entries are always surfaced, flagged distinctly on the dashboard
  • The "Needs Verify" card counts matches waiting for verification — worth a look on day one, near-zero in steady state

FAQ

Why does some software show "no CPE"? Because nothing cleared the plausibility bar — by design. Assign it in CPE Review if you know the right identity, or dismiss it if it's not a publicly tracked product.

Do I have to maintain mappings by hand? No. Exact dictionary matching + the review queue for edge cases is the whole workflow; there are no mapping files to maintain.