Vulnerability Management
Relevant source files
The following files were used as context for generating this wiki page:
Vulnerability Management in Horizon is a core module designed to identify, track, and remediate security weaknesses within an organization's IT infrastructure. It integrates automated data collection from agents with external threat intelligence sources, such as the National Vulnerability Database (NVD), to provide a comprehensive security posture of all discovered assets.
The system correlates vulnerabilities specifically to affected assets by analyzing software installations and hardware configurations. Beyond simple CVE tracking, it encompasses penetration test finding management and Red Team activity tracking, mapping techniques to the MITRE ATT&CK framework.
Sources: README.md:57-61, IMPLEMENTATION_PLAN.md:464-469
System Architecture and Integration
The vulnerability management system operates as a multi-tier component involving backend synchronization, database persistence, and agent-led discovery.
Data Flow Overview
The lifecycle of a vulnerability record starts with external synchronization and ends with asset-specific remediation tracking.
The server acts as the central orchestrator, performing "Vulnerability-Asset Correlation" by matching software inventory reported by agents against synchronized CVE data.
Sources: IMPLEMENTATION_PLAN.md:464-474, README.md:57-58
Core Components and Database Schema
The vulnerability management system relies on a complex relational schema to track sources, assessments, and findings across different security engagement types.
Primary Data Entities
| Entity | Description | Derived Source |
|---|---|---|
| vulnerability_sources | Defines external origins like NVD or proprietary feeds. | IMPLEMENTATION_PLAN.md:465 |
| vulnerabilities | Central repository for CVEs and identified weaknesses. | IMPLEMENTATION_PLAN.md:465 |
| vulnerability_assessments | Links specific vulnerabilities to asset instances and status. | IMPLEMENTATION_PLAN.md:465 |
| penetration_test_findings | Tracks findings, evidence, and retesting workflows. | IMPLEMENTATION_PLAN.md:466-476 |
| red_team_findings | Maps techniques to MITRE ATT&CK and tracks IOCs. | IMPLEMENTATION_PLAN.md:467-483 |
Vulnerability-Asset Correlation Logic
Correlation is achieved through automated software mapping. When an agent reports a normalized software inventory, the system triggers a lookup against the vulnerabilities table.
Security Engagement Modules
Horizon extends standard vulnerability management to include structured security testing workflows.
Penetration Test Integration
The system tracks the full lifecycle of a penetration test engagement. Key features include:
- Engagement Tracking: Defining the scope and duration of assessments.
- Finding Management: Storing findings with associated evidence (e.g., screenshots, logs).
- Retesting Workflow: A structured process for verifying remediations.
Sources: IMPLEMENTATION_PLAN.md:475-479
Red Team Tracking
For advanced security operations, Horizon provides specialized tracking for Red Team engagements:
- MITRE ATT&CK Mapping: Findings are tagged with specific adversary techniques.
- IOC Tracking: Database entries for Indicators of Compromise discovered during exercises.
- Metric Analysis: Tracking "Dwell Time" and "Detection Metrics" to evaluate defensive response.
Sources: IMPLEMENTATION_PLAN.md:480-484
Error Handling and Validation
Operations within the vulnerability module utilize the project's standard error infrastructure.
| Error Type | Use Case in Vulnerability Management |
|---|---|
AppError::NotFound | Requested CVE or Finding ID does not exist. |
AppError::Validation | Invalid input during manual finding entry or NVD sync. |
AppError::Database | Connectivity issues during correlation lookups. |
Sources: crates/error/src/codes.rs:44, AGENTS.md:88-100
CLI Management
The Horizon CLI provides administrative commands that support the underlying infrastructure required for vulnerability tracking, such as database migrations.
# Ensure schema is up to date for vulnerability tables
horizon migrate --threads 4
Sources: crates/cli/src/main.rs:13-15, crates/cli/src/main.rs:105-110
Conclusion
Vulnerability Management in Horizon is an "Inference-First" system that bridges the gap between static asset inventory and active security posture. By combining automated CVE correlation with manual penetration testing and Red Team workflows, it provides a centralized registry for all infrastructure risks, enabling data-driven remediation guided by AI-powered pattern recognition.
Sources: README.md:27, IMPLEMENTATION_PLAN.md:32, IMPLEMENTATION_PLAN.md:508