Compliance
Kwetsbaarheidskoppelingen beoordelen
Review vulnerability mapping · Review vulnerability scan
Choose the task you want to carry out. Each procedure includes its prerequisites, steps and safeguards.
Voor wie
Beheerders, medewerkers en IT-teams die ITLedger gebruiken voor dienstverlening, assets, compliance en rapportages.
Taken
Kies je taak. De volledige werkwijze, voorwaarden en aandachtspunten staan hieronder in het Engels.
Review vulnerability mapping
Review vulnerability mapping.
Who can do this: Tenant administrator
Before you start
- Use an account with access to the stated page and permission for the chosen action.
Safeguards
- A suggested or reused CPE is only a draft until it is reviewed and saved.
- AI recommendation, NVD search, and scanning are not peer actions; mapping review comes first, scanning second.
- Incorrect manual overrides can produce misleading CVE coverage.
- A row with alternatives should still have only one canonical selected CPE at a time.
- Entity-type filtering helps focus the review; leaving everything in one queue can hide gaps in important asset classes.
- NVD-based search results help discovery, but an admin still needs to verify the final mapping is semantically correct.
- Go to Configuration → Vulnerability Registry.
- Open the Pending Review queue and optionally filter by entity type.
- Inspect the observed product/version, recommended CPE, alternatives, confidence, and verification evidence.
- Use suggested candidates, NVD search, or a manual override to choose one canonical mapping.
- Mark the mapping confirmed once it has been reviewed.
- Use auto-map for the next batch of unresolved items when needed.
- Refresh the page and verify mapping status, scan status, and coverage.
Expected outcome: The user has reviewed the result of review vulnerability mapping in the application.
Review vulnerability scan
Review vulnerability scan.
Who can do this: Tenant administrator
Before you start
- Use an account with access to the stated page and permission for the chosen action.
Safeguards
- A suggested or reused CPE is only a draft until it is reviewed and saved.
- AI recommendation, NVD search, and scanning are not peer actions; mapping review comes first, scanning second.
- Incorrect manual overrides can produce misleading CVE coverage.
- A scan should only run for confirmed mappings; invalid scan results should send the row back to review.
- Entity-type filtering helps focus the review; leaving everything in one queue can hide gaps in important asset classes.
- An empty scan is bounded by the confirmed mappings, scanned assets and scan time; it does not establish universal safety.
- Go to Configuration → Vulnerability Registry.
- Move to the Confirmed view and run scans only for confirmed entries.
- Refresh the page and verify mapping status, scan status, and coverage.
Expected outcome: The user has reviewed the result of review vulnerability scan in the application.
Aanbevolen werkwijze
- Wijs eigenaren toe voor bewijs en herstelwerk.
- Controleer verouderde informatie vóór gebruik bij een audit.
Gerelateerde handleidingen
Lees verder in Compliance
Bewijs, NIS2, risico’s, gegevensprofielen en kwetsbaarheden.