Working by patch

A team does not schedule a CVE. It schedules a patch: one patch closes several vulnerabilities on several servers, and the machine gets one window rather than a window per vulnerability. That is why By patch is the default mode of the vulnerability register and not a secondary view.

What the row holds

Column	What it holds
Patch	The patch name, with the origin of that name beneath it
Vulnerabilities	How many CVEs the patch closes
CVE	The identifiers themselves, two and then “+N”
Severity	The worst level in the group, with its highest CVSS
Servers	How many servers are known to be exposed
Systems	Which systems those servers belong to
Type	The class labels of the vulnerabilities in the group
Product	The affected products
Open	How many of the vulnerabilities are still open
Published	The latest publication date in the group

Clicking a row expands it: the vulnerabilities the patch closes, and the servers it has to be applied to.

How a row lands in a group

Grouping may never drop a row, and that rule decides everything else.

• A vulnerability with a recorded patch goes under it. If the feed named several patches for the same vulnerability — different builds of one product — it appears under each of them.
• A vulnerability with no patch but a KB number is grouped by the KB, and the row says so: “From KB / patch”. That is weaker evidence than a patch the feed named, and a row that did not state the difference would be overstating what is known.
• A vulnerability with neither lands in an explicitly named No patch row.

Server names are folded on the first DNS label, so the same machine written once as a short name and once as an FQDN is counted once. A server name the feed gave that the inventory has never heard of is counted separately as Not in inventory and is never dropped — “we do not know what this is” is a finding, not a rounding error.

From the row to a maintenance window

A patch row carries a schedule button, for administrators. It opens the scheduling wizard with that patch's server list already loaded, up to fifty servers — the exact number is written on the button itself. A row with no known servers cannot be scheduled, and the button says that too.

Export

The Excel export of this mode produces two sheets: the patch table, and a second sheet with one row per patch and server — system name, host name, severity and the vulnerabilities. The team doing the work works from the second one. That sheet has a row limit, and if rows did not fit it says how many.