Vulnerabilities and assets
When a tracked scan finishes, its findings become vulnerabilities, and the systems it assessed become assets. Scans with Track results in Assets and Vulnerabilities turned off don't change anything on these pages (see Scans). [!NOTE] Your own honeypots aren't reported. When one of your scans reaches a sensor whose honeypots are on, nothing is reported for the honeypot ports configured on that sensor, at the addresses they listen on. The services there only imitate weak systems. Everything else about the sensor host is reported as usual: its own services, its other ports and its public address. Dashboard The Dashboard summarises your organisation, or your personal account: Open findings by severity: Critical, High, Medium and Low. Click a tile to open those vulnerabilities. Vulnerable assets, Known exploited (KEV), New this week (and how many were reopened), and Fixed this week. Open vulnerabilities over time: open findings at the end of each day, by severity, over 7, 30 or 90 days. Top vulnerabilities, Most vulnerable assets, Recent scans and your sensors' online and offline counts. Accepted risks and false positives don't count as open anywhere on the dashboard. Vulnerabilities Vulnerabilities lists everything your scans have found, worst first. Each row is one vulnerability, with: how many places it's open; how many are accepted or marked false positive; its CVSS score and the type of fix (Update, Mitigate, Workaround, No fix, No fix yet). The page also shows: severity tiles, a Known exploited count (CISA KEV), and Vulnerable assets; Last 30 days: new or reopened findings compared with fixed findings; Top fixes: the fewest actions with the biggest effect, with how many findings and assets each one fixes. To narrow the list: Open or Accepted & false positives; minimum severity: All, Medium+, High+ or Critical; search by name, family or CVE. Vulnerability detail Click a vulnerability to see: its severity, CVSS score and vector, CVEs, and whether it's known to be exploited; How to fix and the affected versions; a summary, insight, impact and references; Where it was found: each asset and port with the evidence, when it was first seen, and its status (Open, Accepted risk or False positive); Decisions: the accepted risks and false positives recorded for it. Triage: accepted risk and false positive People who manage findings can record a decision. That means org owners and admins, people with the Vulnerability manager role, and personal account holders. Decision Effect Expiry Accept risk The findings stay visible but stop counting as open. Required, up to one year (default 90 days). The findings reopen automatically after that date. Mark as false positive The findings stay visible but stop counting as open. None. Undo at any time. You can apply a decision: to one asset, from the Where it was found list; to selected assets; to selected vulnerabilities in the list; to every asset at once, with Accept the risk on every asset or Mark false positive on every asset. This also covers assets where the vulnerability is found later. A reason is required and is recorded in the audit log. To reverse a decision, select it under Decisions and choose Undo. The findings then count as open again. When findings close A finding is marked fixed when a later tracked scan could have seen it again and didn't. Orbital only closes a finding when that scan: succeeded; recorded the finding's severity; for network scans, covered the finding's port; for web scans, wasn't limited to specific tags or template severities. After a discovery stage, only ports found open count. WordPress findings close only when the scan saw the affected plugin, theme or core at a version that's no longer affected. TLS/SSL findings close only on ports the scan saw open. If a fixed finding appears again, it's counted as reopened. Assets Assets lists hosts, cloud accounts and Active Directory domains your scans have assessed, most at risk first. Each row shows the asset's open…
OrbitalCyber documentation