Vulnerability & Patch Management
Relevant source files
The following files were used as context for generating this wiki page:
- articles/patch-management-and-vulnerability-reporting-for-linux-desktops.md
- articles/linux-vulnerability-detection-with-oval-and-fleet.md
- articles/vulnerability-processing.md
- articles/automated-patch-management.md
- ee/vulnerability-dashboard/api/models/Vulnerability.js
- ee/vulnerability-dashboard/api/helpers/get-vulnerabilities.js
- ee/vulnerability-dashboard/api/controllers/get-priority-vulnerabilities.js
Vulnerability and Patch Management in Fleet is a integrated system designed to identify security risks within software inventories and orchestrate remediations across multi-platform environments (macOS, Windows, and Linux). The system operates as a closed-loop process where vulnerability reporting reacts to detected known security issues, and patch management proactively maintains consistent software versions to reduce the attack surface.
This module combines real-time software inventorying with vulnerability data from multiple external sources, such as the National Vulnerability Database (NVD) and Open Vulnerability and Assessment Language (OVAL) definitions. By correlating installed packages with Common Vulnerabilities and Exposures (CVE) catalogs, Fleet provides actionable insights through severity scoring and exploit probability metrics.
Sources: articles/patch-management-and-vulnerability-reporting-for-linux-desktops.md, articles/vulnerability-processing.md
Vulnerability Detection Pipeline
The detection pipeline automates the discovery of CVEs by comparing host software inventory against structured vulnerability data. For Linux distributions, this often involves parsing OVAL definitions—XML-based community standards that define vulnerable system states in a structured manner.
OVAL-Based Detection Logic
OVAL definitions are mapped to specific Operating System (OS) versions. Fleet determines the OS version of each host, downloads the corresponding OVAL definitions, and parses them into a lightweight JSON format for efficient analysis.
The pipeline evaluates software tests (package name and version assertions) against the host's inventory. If the logic tree for a definition evaluates to true, the host is marked as susceptible to the associated vulnerabilities.
Sources: articles/linux-vulnerability-detection-with-oval-and-fleet.md:25-45, articles/linux-vulnerability-detection-with-oval-and-fleet.md:85-110
Data Sources and Prioritization
Fleet enriches basic CVE information with advanced metrics to help security teams prioritize remediation efforts. This includes CVSS scores for severity, EPSS for exploit probability, and CISA KEV for identifying vulnerabilities known to be exploited in the wild.
| Source | Platform Support | Purpose |
|---|---|---|
| NVD | macOS, Windows, Linux | Primary CVE feeds and baseline CPE data. |
| VulnCheck | All | Enriched CPE data for more accurate matching. |
| OVAL | Ubuntu, RHEL, CentOS, Fedora | Distribution-specific package vulnerability definitions. |
| ALAS (Amazon) | Amazon Linux | Security advisories via goval-dictionary. |
| MSRC | Windows | Microsoft-specific OS vulnerabilities. |
Sources: articles/vulnerability-processing.md:75-85, ee/vulnerability-dashboard/api/models/Vulnerability.js:40-65
Automated Patch Management
Automated patch management in Fleet is a rule-driven workflow that moves patches through discovery, prioritization, testing, and verification. It utilizes a combination of Mobile Device Management (MDM) for OS-level updates and an agent-based layer for third-party application management.
The Remediation Lifecycle
The system ensures that successful installation is followed by verification to confirm the device has reached the expected state.
- Discovery: Agent collects inventory (software, OS version, patch status).
- Prioritization: Risk classification based on KEV and NIST guidance.
- Deployment: MDM policies control deferrals (Windows/macOS) while orchestration layers handle Linux.
- Verification: Continuous reconciliation comparing actual state against approved GitOps configuration.
Sources: articles/automated-patch-management.md:15-55, articles/automated-patch-management.md:120-135
Vulnerability Dashboard Logic
The vulnerability dashboard tracks "Priority CVEs" and patch progress. Priority vulnerabilities are identified either by presence in the main database or via a priorityCveIds array in the Platform configuration.
Patch Progress Calculation
The system calculates remediation efficacy by comparing the number of resolved installs against the total number of unique affected hosts.
Implementation Details
Vulnerability Data Model
Vulnerability records are stored with metadata relevant to both identification and prioritization.
// From ee/vulnerability-dashboard/api/models/Vulnerability.js
attributes: {
cveId: { type: 'string', required: true },
probabilityOfExploit: { type: 'number', required: true }, // EPSS
severity: { type: 'number', required: true }, // CVSS
hasKnownExploit: { type: 'boolean', required: true }, // CISA KEV
isPriority: { type: 'boolean', defaultsTo: false },
cveDescription: { type: 'string' }
}
Sources: ee/vulnerability-dashboard/api/models/Vulnerability.js:25-85
Sorting and Filtering
Vulnerabilities can be filtered by severity (0.0 to 10.0) and sorted by various criteria including detection date (createdAt), publication date (publishedAt), or resolution date (resolvedAt).
Sources: ee/vulnerability-dashboard/api/helpers/get-vulnerabilities.js:15-55
Summary
The Vulnerability & Patch Management system in Fleet provides a unified interface for handling security risks across heterogeneous fleets. By combining automated detection via OVAL and NVD with a structured remediation lifecycle, it allows organizations to move from reactive scanning to proactive risk management. The use of GitOps for patch configuration and automated verification loops ensures that security policies remain enforced and auditable.
Sources: articles/automated-patch-management.md, articles/patch-management-and-vulnerability-reporting-for-linux-desktops.md