Vulnerability triage

Overview

Vulnerability triage lists every match between a CVE and one of your assets. A match is created when DeviceQuest finds vulnerable software, an operating system or a device model on an asset during a scan or an import. Triage is where you decide what happens to each match: acknowledge it, assign it, dismiss it, resolve it, open a remediation task or request an exception.

Open it from Triage in the Risk group of the sidebar, from Triage on the Vulnerabilities page, or from View affected assets on a CVE.

You need vulnerabilities:read to view triage and vulnerabilities:write to act on matches. Override severity needs admin:manage.

Screen tour

Click to enlarge

Queue and Table views

Click Queue or Table, or press v, to switch views. DeviceQuest remembers your choice.

Queue shows one match at a time on a card with everything you need to decide: the CVE and severity, the reason it is next, the asset, the description, the CVSS score and the triage actions with their labels. Use Prev and Next, or k and j, to move through the queue. The counter shows your position, for example 1 / 115, and the queue moves on to the next page when you reach the end of one.

Table shows a page of matches in rows:

Click to enlarge

The other columns are CVE and First seen. Matches are listed newest first.

Exposure

The Exposure panel summarises the matches on the current page (This page · 50 of 115):

• Status: how many matches are Open, In progress, Resolved, Dismissed and Accepted risk.
• Severity: how many are Critical, High, Medium, Low and Informational. An administrator’s severity override counts instead of the feed severity.

Click a value to filter the page by it. Click it again to clear that filter.

Filter matches

Click Filters to open the filter panel:

Click to enlarge

Filters apply as you type. Active filters show as chips such as Status: open × above the queue; click × to remove one, or Clear all to remove them all.

To see the vulnerabilities on one asset, open the asset and click Vulnerabilities. To see the matches you have accepted through exceptions, set Status to Accepted risk.

Statuses

A match only becomes Accepted risk through an approved exception. When the exception is revoked or expires, the match goes back to the status it had before.

Act on a match

In Queue view the actions are labelled buttons. In Table view they are icons; hover an icon for its name.

• Acknowledge: moves an Open match to In progress and records you as the person who acknowledged it. Shown while the match is open and unacknowledged.
• Assign: opens Assign to. Enter a user’s email address or user ID and click Assign (or press Enter).
• Dismiss: opens Reason for dismissal. Describe why the finding is not actionable (3 to 1000 characters) and click Confirm dismissal.
• Resolve: asks Resolve CVE-…?. Click Confirm to mark the match Resolved.
• More (⋯): shows more actions. In Queue view they are labelled Override, Remediation and Exception:
  • Override severity (administrators only). See Override severity.
  • Create remediation: opens Create remediation with this CVE and asset filled in. Enter a Title, optionally a Description and Due date, choose a Priority, and click Create. The task appears on Remediations.
  • Request exception: opens Request exception for this match. See Request an exception.

A short message confirms each action, for example Acknowledged or Resolved. Every action is written to the audit log.

Click to enlarge

Override severity

Administrators can record a different severity for one match, for example when a critical CVE sits on an isolated test machine. The override shows next to the original scanner value and is used in the severity filter and the Exposure panel.

Click to enlarge

1. Click More, then Override severity.
2. Choose critical, high, medium, low or informational.
3. Click Save override.

To remove an override, open the dialog again and click Clear override — revert to scanner value. Each override is recorded in the audit log.

Bulk actions

In Table view, select one or more matches to show the bulk bar with N selected:

• Acknowledge: asks Acknowledge N matches?; click Confirm.
• Resolve: asks Resolve N matches?; click Confirm.
• Copy: copies the selected matches as CSV (cve_id,asset_id,severity,status,created_at).
• ×: clears the selection.

DeviceQuest reports how many matches were updated, for example 5 acknowledged, or 4 succeeded, 1 failed.

Actions palette

Click Commands, or press ⌘K (Ctrl+K), to open the actions palette. It offers Filter: Open matches, Filter: Critical severity, Switch to Queue view, Switch to Table view, Clear all filters and Show keyboard shortcuts.

Keyboard shortcuts

Press ? or click Shortcuts to show the list. Press ? or Esc to close it. Shortcuts are ignored while you type in a field.

The action keys (a, r, d, s, e, m) act on the card shown in Queue view.

Related pages

• Vulnerabilities
• CVE details
• Remediations
• Exceptions