NCSC NL vulnerabilities report

This week's update is actually a big update on a lot of scanner node modules. This is a quality improvement, but not one that will stand out particularly if you are using the GUI. You'll just have better quality results.

What does stand out to end users is the new $ncsc_vulnerabilities_report. Since we track all advisories from the Dutch NCSC now, we can provide reports on the CVE numbers in those reports that are relevant for the software we have detected on your assets. Will the most pressure to resolve these CVEs is on government and public organizations, it is a good idea for everyone to prioritise these. These vulnerabilities have been picked out of the bulk for a good reason.

Single Sign-On (SSO) now available

Short post today, but one with impact. ShadowTrackr now supports Single Sign-On from Microsoft Azure AD/Entra ID, Okta and any generic OIDC (like Keycloak).

The option is available for enterprise accounts and up under Settings->Security.

Central tracking of resolved vulnerabilities

Vulnerabilities can go away for several reasons. The software can be patched, the CVE can be withdrawn, it might have been flagged as a false positive. So far, this information would be spread throughout ShadowTrackr indexes.

This week's update is a major overhaul of the cves_assets index. It now tracks what happened to all your vulnerabilities. There are three new fields available: resolved, resolved_at and resolved_reason. it might take a few days for all states to settle in their new values.

You can easily get an overview of recent resolved cves with this query:

index=cves_assets resolved=true resolved_at>-7d

There is a report available for this in our Report Library

Along with this change we cleaned up the false positives registration. It now only contains the things you explicitly marked as false positives. The automaticly flagged false positives are gone from the GUI. For larger organizations this only generated a lot of noise and was not useful.