From d2dba3386df970582a990caf11967c0199bca2e6 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Wed, 14 Aug 2024 19:55:25 +0200 Subject: [PATCH] Added "Sources" section to vulnerability processing page. (#21243) # Docs for #19857 --- docs/Using Fleet/Vulnerability-Processing.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/docs/Using Fleet/Vulnerability-Processing.md b/docs/Using Fleet/Vulnerability-Processing.md index 2e675e5735..10d88debed 100644 --- a/docs/Using Fleet/Vulnerability-Processing.md +++ b/docs/Using Fleet/Vulnerability-Processing.md @@ -20,14 +20,23 @@ Fleet detects vulnerabilities for these software types: | ------------------- | ------------------------------------------ | ------------------------------------------------ | ---------------- | | Apps | ✅ | ✅ | ❌ | | Browser plugins | Chrome extensions, Firefox extensions | Chrome extensions, Firefox extensions | ❌ | -| Packages | Python, Homebrew | Python, Atom, Chocolatey | Packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files. Supported distributions: | +| Packages | Python, Homebrew | Python, Atom, Chocolatey | Packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files. Supported distributions: | | IDE extensions | VS Code extensions | VS Code extensions | VS Code extensions | As of right now, only app names with all ASCII characters are supported. Apps with names featuring non-ASCII characters, such as Cyrillic, will not generate matches. For Ubuntu Linux, kernel vulnerabilities with known variants (ie. `-generic`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD. -### Advanced configuration +## Sources + +Fleet combines multiple sources to get accurate and up-to-date CVE information: +- [National Vulnerability Database](https://nvd.nist.gov/developers/vulnerabilities) CVE feeds +- [VulnCheck](https://vulncheck.com/) CVE feeds +- [Mac Office release notes](https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac) for Office for Mac +- [Microsoft MSRC Security Bulletins](https://msrc.microsoft.com/update-guide) for Windows OS vulnerabilities +- [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json) for Linux software + +## Advanced configuration Fleet runs vulnerability downloading and processing via internal scheduled cron job. This internal mechanism is very useful for frictionless deployments and is well suited for most use cases. However, in larger deployments,