How a vulnerability is matched to a server

Clicking a row in the register opens the exposure panel: which servers are exposed to this vulnerability, grouped by system, each with its own match reason. The head of the panel states which of the two paths put them on the list.

The confirmed path

When the feed named the server names its own scan found, there is nothing to estimate. The list is the scan's list, and the panel reads “Source: SOC scan — the exact server list that was actually scanned, not an estimate.”

Names are resolved against the inventory on the lowercased first DNS label, so a short name in the inventory and an FQDN in the feed are the same machine. A name the feed gave that the inventory does not know stays on the list with blank fields: a source said it is exposed, and a join that missed is not a reason to hide it.

The estimated path

A vulnerability with no server list — a hand-entered record, or one ingested before the feed began sending names — is matched on three conditions, all of which must hold:

Condition	When the field is empty
The vulnerability's OS family matches the server's	Applies to every operating system
The version pattern matches the version recorded on the server	Applies to every version
The server's last update predates the patch date	—

The third condition uses the patch date, falling back to the publication date when no patch date was recorded. A server updated after that date drops off the list.

The estimated match reads the operating system and the last update date. It does not read which patches are actually installed, and the panel says so itself: “Estimated exposure — the match is computed from the operating system and the server's last update date, not from a KB actually installed. Verify before deciding.”

Per-server tracking

Every row in the panel carries two different marks:

• Scheduled — set automatically when a non-cancelled event exists for that vulnerability and that server. Such an event is created when scheduling from the register.
• Handled — a manual mark, server by server, recording who set it and when. Requires the vulnerabilities.mark_host permission.

The list exports to CSV and to Excel. In the Excel file each system gets its own sheet, because the list is handed to system owners rather than read as one flat list.