Vulnerabilities and exposure
The software watchlist
Track a product so the next KEV or CVE against it alerts you: alert cadence, sources, severity filter, and the split between site software and device software.
Updated · 2 min read
The inventory watches what your scans observed. The watchlist watches what you tell it to: the CMS a scan cannot see the version of, the browser and operating system on your staff's laptops, the VPN appliance at the office.
Where
- Web: Security, Watchlist.
- iOS: the Vulnerabilities module, More, Watchlist; "Monitor" on any advisory page adds its product.
- API/MCP:
GET/POST /api/vulnapps/apps,PATCH/DELETE /api/vulnapps/apps/:id,GET /api/vulnapps/apps/search,/catalog,/catalog/categories; toolslist_tracked_software,search_software_catalog,get_software_catalog,get_software_catalog_categories,track_software,update_tracked_software,untrack_software.
Adding a product
Search the catalog by name or category (the catalog is one row into a searchable picker in the app). Each tracked product has:
| Setting | Values | Default |
|---|---|---|
Alert cadence (alert_pref) |
realtime, daily, weekly |
daily |
| Sources | kev, cve, or both |
both |
| Severity filter | all, or a minimum severity | all |
| Active | On or paused | on |
Adding from an advisory page adds the product, not the one CVE, because the next one is the one you want to hear about. The watch is baselined at creation, so only advisories published after it alert (see watch-forward).
Site software and device software
A watchlist that follows Chrome, Windows and Office puts advisories for them beside findings about your own servers. The ledger separates them: Watching for your sites (products a scan could see, with whether one has) and Watching for your devices (products no scan of a domain could ever observe, where the advice is "update them"). Each product is a row you can open for its advisories, the newest date and a KEV marker. Nothing is hidden by default; you chose to watch it.
What alerts
A tracked product raises an alert when a new KEV or CVE entry names it, subject to the cadence and filter. The alert's verdict is derived the same way as for observed software: confirmed if a scan saw a vulnerable version, unconfirmed if no scan has ever observed it. Device software is always unconfirmed by construction, and the row says so rather than apologising.
Common questions
Why track something the scan already found? The scan may stop seeing it (a version string removed, a host retired) and the inventory reconciles. A watch persists until you remove it.
Can I track a product that is not in the catalog? track_software accepts a free-text app_name and vendor; matching then relies on the name, so use the vendor's exact product name.
Keep reading
Related articles
- KEV and CVE alerts with verdictsHow the CISA KEV and NVD feeds are ingested, why only new entries alert (watch-forward), the four exposure verdicts, the advisory page, and the global feed.Vulnerabilities and exposure ·Updated
- Software inventory and vendorsWhat your scans proved the site runs, split into versioned software that can be checked and software only seen; confidence, detector and last-seen; and vendors.Vulnerabilities and exposure ·Updated
- Findings, carry-forward and dismissalsWhat a finding shows, why a finding from a heavier scan survives a lighter one, and the four reasons a finding, a software reading or an alert can be silenced.Vulnerabilities and exposure ·Updated