Central tracking of resolved vulnerabilities

Vulnerabilities can go away for several reasons. The software can be patched, the CVE can be withdrawn, it might have been flagged as a false positive. So far, this information would be spread throughout ShadowTrackr indexes.

This week's update is a major overhaul of the cves_assets index. It now tracks what happened to all your vulnerabilities. There are three new fields available: resolved, resolved_at and resolved_reason. it might take a few days for all states to settle in their new values.

You can easily get an overview of recent resolved cves with this query:

index=cves_assets resolved=true resolved_at>-7d

There is a report available for this in our Report Library

Along with this change we cleaned up the false positives registration. It now only contains the things you explicitly marked as false positives. The automaticly flagged false positives are gone from the GUI. For larger organizations this only generated a lot of noise and was not useful.

New vulnerabilities matching algorithm

The ShadowTrackr internal CVE database has been updated and augmented with new information. This allows us to better track and help you prioritise your risks from vulnerabilities. Check out our new Vulnerability management documentation to learn more.

A big part of the update is the ShadowTrackr CVSS Score. It is a CVSS v4 score, but unlike like the MITRE and NVD score we keep the threat group value (Exploit maturity) included in the final score. If a PoC exists or active attacks are known, the score will be higher. If not, it will be lower. We track a lot of sources for exploit status to keep the score accurate.

If you want, you can query our internal cves index for specific fields in the CVSS v4 vectorstring, or you can check our logs of changes to a CVE (when was an exploit found, when did CISA include it in the KEV, etc.). These options are also avaible for your cves_assets index.

The algorithm matching your software against vulnerabilities has also improved. It can find more complex matches and has less false positives. You might notice a different number of CVEs found in this weeks reports.

Branded PDF reports

The option to customize all pdf reports that ShadowTrackr sends is now available by default for all multi-tenant accounts. Look under Group settings in the left hand menu, and you'll find Branding

You can set your own logo instead of the ShadowTrackr logo, and even change the default ShadowTrackr color in the pdf to match your brand. This is especially useful for MSSPs.