Glossary

Terms are listed alphabetically. Where a term has its own documentation page, the term links to it.

A

Accepted risk

The triage status of a vulnerability match that an approved exception covers. When the exception is revoked or expires, the match returns to its previous status. In Compliance, a monitored control that needs attention and carries an evidence-backed sign-off also reads Accepted risk.

Asset

A device DeviceQuest tracks, such as a server, workstation, network device, virtual machine or cloud resource. Each asset is one record, built from the observations of every source that reports it.

Attestation

A sign-off that records a person’s decision that a compliance control is satisfied. It takes effect once evidence is linked to it.

B

Bootstrap credential

A one-time secret that a host agent enrolls with. It enrolls one agent and is then used up; after that, the agent connects with its own token.

Bridge host agent

A host agent that runs a schedule’s scans from inside its own network. Use one when the targets sit in a network the control plane cannot reach.

C

Canonical name

The standard title DeviceQuest uses for a piece of software, for example Mozilla Firefox ESR, whatever name each source reports. Detected names are mapped to canonical names, and curation decisions teach new aliases.

Confidence

How certain DeviceQuest is about an asset’s identity or about an observation, shown as a percentage. More sources and stronger identifiers raise it.

Curation

The review of software names that DeviceQuest could not map to a canonical name with enough confidence. An administrator approves the proposed canonical name, which then applies to future scans automatically, or rejects the match.

CVSS

The Common Vulnerability Scoring System, a 0–10 severity score for a CVE. DeviceQuest shows the CVSS v3 base score, with the CVSS v4 score when the feed provides one.

E

EPSS

The Exploit Prediction Scoring System: the probability that a CVE is exploited in the next 30 days. DeviceQuest combines it with CVSS and KEV into each CVE’s risk score.

Evidence

A file that proves a compliance control is met, such as a policy document or a configuration export. You upload it in the control record and link it to a sign-off.

Exception

A time-limited decision to accept the risk of one vulnerability on one asset, backed by a business case. One person requests it and a different person approves it; while it is approved, the match is Accepted risk.

F

Flow

An automation in which one or more triggers start one or more actions, such as sending a webhook, sending an email or opening a ticket.

H

Host agent

The DeviceQuest agent installed on a Linux or Windows host. It collects inventory locally, runs scans and connects outbound to the agent gateway.

K

KEV

The CISA Known Exploited Vulnerabilities catalogue, which lists CVEs known to be exploited in the wild. DeviceQuest marks these CVEs with a CISA KEV badge and weights them higher in the risk score.

M

Match

A link between a CVE and one of your assets, created when DeviceQuest finds vulnerable software, an operating system or a device model on the asset. You decide what happens to each match in triage.

O

Observation

A single fact that a source reports about an asset, such as an IP address, a hostname or an installed package, with its source, time and confidence. DeviceQuest builds each asset from its observations.

R

Remediation

A task to fix a vulnerability, such as patching a package or upgrading firmware. Each task belongs to a CVE and has a priority, an SLA, an assignee and a status.

S

Scan profile

A named set of scanner settings for one scan type, such as the ports to probe or a timeout. A schedule that uses the profile applies these settings to every scan it runs from the control plane.

Scan target

A saved address that schedules scan: an IP address, a CIDR range, a hostname or an FQDN, together with the scan type used for it.

Scope (API key)

A permission attached to an API key: read, write, admin or recognition:read. The API checks the scope against each request’s HTTP method.

SLA

The time allowed to resolve a remediation task, set by its priority and counted from the day the task is created. Tasks past their SLA are counted in Past SLA.

Statement of Applicability

An export that lists every control in a framework’s assessed scope, whether it applies, and why. Auditors ask for it in ISO 27001 audits, and it is useful for every framework.

Sweep

A scan type that finds the live hosts in an IP range and the services they expose. It then starts an authenticated follow-up scan of each host that has a usable credential.

T

Tenant

Your organisation’s own space in DeviceQuest. Assets, users, settings and API keys all belong to one tenant, and you only ever see your own tenant’s data.

Triage

Reviewing vulnerability matches and deciding what happens to each one: acknowledge, assign, dismiss or resolve it, open a remediation task or request an exception.

V

View

A saved asset filter with a name, so you can reopen it in one click. A view is Private to you or shared with your Team.

W

Webhook

An HTTP POST that DeviceQuest sends to your endpoint when a subscribed event happens. Every delivery is signed with the endpoint’s secret, so your receiver can check that it came from DeviceQuest.