Documentation
CVE Feed Operations
Monitor the vulnerability feeds DeviceQuest downloads CVEs from, and set their schedules, priorities and API tokens.
Overview
DeviceQuest keeps its vulnerability database current by downloading advisories from public CVE feeds on a schedule. It merges the records from every feed into one CVE entry and matches new and changed CVEs against the software found on your assets. Use CVE Feed Operations (Admin → CVE Feeds) to check that each feed is healthy, turn feeds on or off, change how often and in which order they are used, store API tokens, start a sync by hand, and read each feed’s run history.
DeviceQuest ships with four feed sources:
| Source | Code | Endpoint | Default priority | API token |
|---|---|---|---|---|
| NVD 2.0 | nvd | https://services.nvd.nist.gov/rest/json/cves/2.0 | 100 | Optional. An NVD API key raises the request rate limit. |
| Microsoft Security Update Guide | msrc | https://api.msrc.microsoft.com/cvrf/v3.0 | 90 | Not needed. |
| GitHub Advisory | ghsa | https://api.github.com/advisories | 50 | Optional. A GitHub token raises the rate limit. |
| OSV.dev | osv | https://osv-vulnerabilities.storage.googleapis.com | 25 | Not needed. |
Each source starts disabled. Switch on Feed enabled to start syncing; an enabled source syncs every 24 hours by default.
Screen tour
- Feed console: a one-line summary of all feeds, for example All sources healthy or 1 source needs attention, with a hint about what to do next.
- Counters: how many Sources you have and how many are Healthy, need Attention, are Syncing or are Disabled.
- Latest sync: the most recent successful sync across all feeds, in UTC. It shows No syncs yet before the first sync.
- All feed sources: the list of feeds, ordered by health and priority. When a feed has a problem, it moves to a separate Needs attention list above, and this list becomes All other sources.
- Health state of the feed, with the outcome of its latest run: Last run succeeded, Last run failed, Running now or No runs yet. See Statuses.
- The feed’s name and code, for example OSV.dev and
osv. Click anywhere on the state or the name to open the feed’s panel. - Facts about the feed: Last sync (UTC, or Never), Schedule (for example Every 24h), Priority, and Auth (Configured when an API token is stored, otherwise None).
- Sync now: starts a sync of this feed straight away. While it runs, the button shows Syncing….
A feed in the Needs attention list also shows how many syncs in a row have failed, for example 2 consecutive failures.
Check feed health
- Open Admin → CVE Feeds.
- Read the feed console. All sources healthy means every enabled feed synced in the last 24 hours.
- If the console shows that sources need attention, look at the Needs attention list. A feed is listed there when its last sync failed or when it has not synced for more than 24 hours.
- Click the feed to open its panel. Under Current status, the Why it failed section explains the last error. It names the likely cause, for example DNS resolution failed, Connection timed out, TLS or certificate failure, Provider rate limit reached or Provider rejected the request. It also shows the endpoint, the steps to check next and the Raw error.
- Fix the cause, for example add an API token or allow the endpoint through your proxy, then click Sync now to retry.
Configure a feed
Click a feed to open its panel. The Configuration tab holds the feed’s settings. Each change is saved as soon as you make it, and DeviceQuest shows a confirmation such as NVD 2.0 updated.
- The feed’s health state, name and code.
- Configuration and Run history: the two tabs of the panel.
- Current status: the health state and the time of the last sync. When the last sync failed, this section also shows the number of consecutive failures and Why it failed.
- Feed enabled: turns the feed on or off. An enabled feed syncs on its schedule and when you click Sync now. A disabled feed does neither.
- Priority: decides which feed wins when two feeds describe the same CVE differently. For each field, DeviceQuest uses the value from the feed with the highest priority that provides one. Lists such as references are combined from all feeds.
- Interval (seconds): how often the feed syncs. The minimum is 60 seconds. For example,
86400is once a day. - Endpoint: the address the feed downloads from. It is read-only.
- The authentication state: API key configured or No API key configured.
- New API token: type a token to store for this feed. The field hides what you type.
- Save: stores the token. The button is available once you type a token.
- Clear API key: removes the stored token, after you confirm.
- Sync now: starts a sync of this feed.
- Close button: closes the panel. You can also press Esc or click outside the panel.
To change a setting:
- To turn a feed on or off, click the Feed enabled switch. The switch shows Enabled or Disabled.
- To change Priority or Interval (seconds), type the new number and press Enter or move to another field. The value is saved when the field loses focus.
Store or clear an API token
API tokens let a feed make more requests per hour. NVD 2.0 uses an NVD API key, and GitHub Advisory uses a GitHub token. DeviceQuest encrypts the token before it stores it, and never shows it again. The feed uses it from its next sync.
To store a token:
- Click the feed to open its panel.
- Under Authentication, type the token in New API token.
- Click Save, or press Enter.
The panel shows API key saved and the authentication state changes to API key configured. On the feed list, Auth shows Configured. To replace a token, store a new one the same way.
To remove a token:
- Under Authentication, click Clear API key.
- At Clear this API key?, click Clear key, or click Cancel to keep it.
The feed then syncs without a token.
Tokens are encrypted with the control plane’s credential master key, set in DEVICEQUEST_CREDENTIAL_MASTER_KEY.
Sync a feed now
Feeds sync on their own schedule. Start a sync by hand when you have fixed a problem or need the newest advisories straight away.
- Click Sync now on the feed’s row, or open the feed and click Sync now at the bottom of the Configuration tab.
- The feed’s state changes to Sync in progress and the button shows Syncing…. The page checks the run every few seconds.
- When the sync finishes, DeviceQuest shows Sync completed for and the feed code, and the feed’s state and Last sync are updated.
Sync now is available only for enabled feeds. When a feed is disabled, the panel shows Enable this feed before running a sync.
After a sync, DeviceQuest matches the new and changed CVEs against the software on your assets. Matches appear in the vulnerability lists. The first full download of a feed is followed by a matching run across all assets.
Review run history
- Refresh: reloads the run history.
- Status: the outcome of the run: running, completed or failed.
- Fetched: how many advisories the run downloaded.
- Changed: how many CVEs were new or changed after merging.
- Error: the error message of a failed run, or None.
- Click the feed to open its panel.
- Click the Run history tab. It lists the 20 most recent runs, newest first, with the Started time in UTC.
- Click Refresh to load the latest runs. If the history can’t be loaded, click Retry.
Fields
| Field | Description | Rules |
|---|---|---|
| Feed enabled | Allows scheduled and manual synchronisation. | On or off. Saved immediately. |
| Priority | Which feed’s values win when feeds disagree about a CVE. Higher wins. | Whole number, 0 or more. Saved when the field loses focus. |
| Interval (seconds) | Time between scheduled syncs. | Whole number, 60 or more. Saved when the field loses focus. |
| Endpoint | The address the feed downloads from. | Read-only. |
| New API token | A token the feed sends to its provider. | Stored encrypted and never shown again. |
Statuses
Feed health:
| Status | Meaning | Next possible status |
|---|---|---|
| Disabled | The starting state of every source: the feed does not sync until you switch on Feed enabled. | Sync in progress, Healthy, Attention needed |
| Healthy | The feed is enabled and synced successfully in the last 24 hours. | Sync in progress, Attention needed, Disabled |
| Sync in progress | A sync is running. | Healthy, Attention needed |
| Attention needed | The last sync failed, or the feed has not synced for more than 24 hours. | Sync in progress, Disabled |
| Not synced yet | The feed is enabled but has not completed a sync. | Sync in progress, Disabled |
| Disabled | The feed is turned off and does not sync. | Not synced yet, Healthy, Attention needed (when you enable it again) |
Sync runs:
| Status | Meaning | Next possible status |
|---|---|---|
| running | The run is downloading and merging advisories. | completed, failed |
| completed | The run finished. Fetched and Changed show what it did. | (final) |
| failed | The run stopped with an error, shown in Error. | (final) |
Every change you make on this page is recorded in the audit log: feed settings updated, token stored, token cleared and sync started.
Keyboard shortcuts
| Key | Action |
|---|---|
| Esc | Close the feed panel. |
| ← → ↑ ↓ | On the panel tabs, switch between Configuration and Run history. |
| Home / End | On the panel tabs, go to Configuration / Run history. |
| Enter | In Priority or Interval (seconds), save the value. In New API token, save the token. |