Vulnerability Management

The agent collects the software installed on each host — operating-system packages and application dependencies. The platform automatically matches that inventory against its CVE database, so vulnerable software surfaces without you running a separate scan.

Findings by severity

Each finding links an installed package to a known CVE and carries the CVE's severity (for example Critical, High, Medium or Low). Use severity to prioritise — Critical and High findings on exposed hosts first.

Fleet view — the Vulnerabilities page

The Vulnerabilities page shows findings across your whole fleet. Use it to:

• See which CVEs affect your environment and how widespread each one is.

• Sort and filter by severity to focus on what matters most.

• Pivot from a finding to the affected hosts.

Per-endpoint view — the Vulnerabilities tab

Open a host under XDR → Endpoints and select the Vulnerabilities tab to see only that host's findings. Filters let you narrow the list — for example by severity — so you can assess a single machine quickly.

Workflow

1. Review the fleet Vulnerabilities page and filter to the highest severities.

2. Identify the affected hosts and confirm the vulnerable package on each host's Vulnerabilities tab.

3. Remediate — patch or upgrade the affected software.

4. As the agent reports the updated inventory, resolved findings drop off on the next scan.