SKNS
v2.0
v2.0latest
Skans Docs/Monitoring/Vulnerability management
Monitoring

Vulnerability management

Skans runs an offline, air-gap-capable vulnerability feed on the appliance itself. It syncs the public CVE List and MITRE ATT&CK into an on-box store, matches them against your live per-host inventory, and produces CVSS-scored, ATT&CK-tagged findings — the match runs entirely on the appliance, with no cloud scanner in the loop. This is how Skans supports the risk-assessment control (NIST RA-5) for an isolated enclave.

The credibility anchor: the match uses a strict version-range gate, not a name lookup. A host that is actually patched shows zero findings — proven in a live drill, a fully-patched host produced 0 hits — so a green result means green, not unscanned.

How the pipeline works #

A first-party worker, Skans.VulnFeed, owns the whole path:

  1. Sync — it pulls the CVE List from cve.org (cvelistV5, CVE Record Format 5.0) and MITRE ATT&CK Enterprise (STIX), and loads them into on-box reference indices.
  2. Match — it joins your live inventory against each CVE’s affected-version ranges. A broad product-and-version match finds candidate hits; a strict version-range check then gates every candidate, so software that has been patched past the affected range stays quiet.
  3. Write — each surviving hit becomes a finding carrying a severity / CVSS score, a fix target (the fixedIn version), a prioritized remediation summary, and the matching ATT&CK technique tags.

Everything lives in the appliance’s on-box search store (OpenSearch, reached locally). Nothing about this pipeline leaves the wire.

Index Holds Role
skans-cve Hundreds of thousands of CVEs (about 342k at last sync, ~298 MB) the CVE corpus — the storage long-pole
skans-attack 697 ATT&CK techniques (222 top-level; 13 of 14 tactics) technique reference for tagging
skans-inventory Live per-host software / firmware inventory the match source
skans-vulns Per-host findings (CVSS + fixedIn + report) the findings sink
skans-alerts-* Raised alerts the alert sink
Tip

CVE totals grow over time — the ~342k figure is a real measured on-box count at last sync, not a fixed ceiling. The parse-and-index path is source-agnostic, so the feed source can change without touching the matching engine.

Air-gap integrity: the signed feed bundle #

For an air-gapped site, the CVE + ATT&CK feed arrives as a PackSigner-signed .skb bundle (skans.feed.attack). SyncBundleSvc CMS-verifies it against the held pack anchor before any indexing — a tampered or unsigned bundle is refused, and nothing is ingested. This is the authenticated path for sites with no internet.

A direct-internet pull (for connected sites) records a SHA-256 provenance line for what it fetched, but the signed-bundle path is the answer for air-gapped enclaves.

What findings look like #

Each finding on a host is CVSS-scored and tells you the fix target — the version that clears it. Alerts are enriched with ATT&CK technique IDs (for example T1110, brute force) so a finding reads as adversary behavior, not just a number.

A Critical CVE match rule watches the findings index; when it fires, AlertSvc raises an on-box alert and dispatches it to your configured sinks (SMTP, webhook, SIEM-forward) alongside every other Skans alert — see Alerts & notifications.

Threat-intel fusion: KEV + EPSS #

Matched findings are enriched with two public threat-intelligence feeds, so triage can rank by real-world exploitation rather than CVSS alone:

  • CISA KEV — the Known Exploited Vulnerabilities catalog syncs into an on-box index (skans-kev); a finding whose CVE is in the catalog is stamped kev=true, so actively-exploited vulnerabilities sort to the top.
  • FIRST.org EPSS — each matched CVE carries its EPSS exploit-prediction score, an estimate of the probability the CVE will be exploited in the wild.

The ATT&CK technique tags on findings come from a CVE → CWE → ATT&CK join: the weakness class a CVE belongs to links it to the adversary techniques that exploit that class.

Where you see it in the console #

  • Security → Vulnerabilities — the CVE / CVSS matches across the enclave, or an honest 0 when nothing matches.
  • Each device’s Vulnerabilities tab — that host’s findings, with an Open remediation request action that routes the fix into the patch-approval flow.
  • ATT&CK tags on every finding — each hit carries its mapped technique IDs (for example T1110), so you can read a finding as adversary behavior.
Note

Findings are ATT&CK-tagged today, and the Vulnerabilities page and per-device tab ship now. The ATT&CK coverage matrix / navigator heatmap — a colored technique-coverage overlay over the ATT&CK index — is roadmap polish, not shipped yet.

The honest boundary #

Read this before you treat Skans as a remediation or IDS tool — it is neither, by design.

Warning

1. Remediation is a hand-off, not automation. Skans tells you what is vulnerable and what version fixes it. It does not pick a fix artifact or apply it for you — there is no CVE-to-exact-fix automation. Closing a finding means routing it through the approved-patch rings, where a human approves the patch. (SI-2 is an enabler here, not a certification.)

2. Firmware is flagged, not auto-patched. Skans flags stale device firmware; it cannot invent an update a vendor hasn’t shipped. Where a vetted image and a vendor path exist, an optional, hard-gated push re-hashes the image against its recorded SHA-256, defaults to HTTPS, and requires an explicit confirm. Firmware auto-patching is not a goal.

3. This is posture assessment, not detection. Vulnerability management here is known-CVE assessment matched to inventory (RA-5) — it is not a full IDS/EDR and not an active exploit scanner. Pair it with an IDS/EDR for complete Detect coverage.

For admins: run model #

The feed runs on a schedule, not on demand. The in-process periodic-jobs engine inside the always-on control-plane service runs the sync-and-scan (--sync --scan) weekly as one of its supervised jobs — there is no OS scheduled task and no separate scheduler service to maintain.

Note

--sync, --scan, and --ingest-file are real backend verbs, but they are the scheduled job’s plumbing — not an operator workflow. Drive vulnerability management from the console (the Vulnerabilities page and the per-device tab), not the CLI.

Compliance framing #

This capability supports NIST RA-5 (vulnerability monitoring, primary) and SI-2 (flaw remediation, via the patch hand-off), and feeds SI-4 / SI-5 posture. That is an enabler, never a certification — see NIST 800-171 / CMMC evidence for what Skans owns technically versus the organizational controls that remain yours.

Next #