THE FIELD GUIDE / SECURITY & RESPONSE
CVE exposure & automatic containment
Monitor exploitation between CVE publication and an effective fix, with policy-authorized quarantine or process termination.
Establish applicability
Correlate published CVEs and trusted vendor or distribution advisories with installed packages, versions, services and relevant configuration. Account for distribution backports and native version semantics. Distinguish confirmed applicability, uncertain applicability and unaffected endpoints; a vulnerable-package match or CVSS score alone does not establish exploitation.
Follow the exposure window
Record the CVE publication date, first applicability assessment, detected exploitation, patch installation and effective-fix verification. Start active CVE-specific monitoring when applicability is established, even when a patch is not yet available. Review retained telemetry back to publication where available, with explicit gaps for late enrollment, ingestion delays and offline periods.
Detect exploitation with evidence
Correlate CVE-specific indicators and behavior with available execution/eBPF, process, file, integrity, service, application-log and network observations. Each detection retains the affected CVE, supporting events, rule provenance and version, freshness and confidence. Deterministic detection continues with AI paused or unavailable; optional AI enrichment honors both global and per-server controls. AI assertions alone are insufficient to trigger containment.
Choose monitor-only or automatic response
Administrators configure response policies per server, CVE or applicable policy group. Choose monitor-only operation or explicitly enable automatic quarantine, process termination, or both. Set evidence and confidence thresholds, permitted action scope and exclusions. Confirmed exploitation that meets the enabled policy can trigger containment without approving every incident.
Contain the identified artifact or process
Bounded typed executors recheck host identity, process start time and file identity immediately before acting. Least-privilege helpers, duplicate suppression and recovery records handle repeated events and races. Preserve evidence before action when feasible without delaying urgent containment. Record attempted and completed actions separately, and alert on failure or uncertain outcomes.
Verify that the fix is effective
Keep the exposure window open until the fixed package/version is verified and any required service restart or reboot activates the fix. Failed installs, partial updates, stale inventory and still-running vulnerable code leave it open. Rollback or reintroduction of an affected version reopens exposure.
Inspect fleet coverage and action history
Server and fleet views bring together affected CVEs, exposure duration, coverage gaps, patch availability, expected and actual installation times, effective-fix status, detection evidence, policy settings and containment history. Prompt alerts and auditable records retain actor/policy, CVE and rule version, timestamps and outcomes. Review supported detectors, platforms and coverage for each endpoint.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗