mirror of
https://github.com/fleetdm/fleet
synced 2026-05-08 09:40:49 +00:00
44f9a0882f
The timeout is hardcoded to 2x vulns job periodicity (default one hour). See http://github.com/fleetdm/fleet/blob/main/docs/Contributing/Vulnerability-processing.md#false-positive-cleanup for contributor docs on this.
80 lines
7 KiB
Markdown
80 lines
7 KiB
Markdown
# Vulnerability processing
|
|
|
|
Vulnerability processing in Fleet detects vulnerabilities (CVEs) for the software installed on your hosts.
|
|
|
|
To see what software is covered, check out the [Coverage section](#coverage).
|
|
|
|
[Learn more](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Vulnerability-processing.md) about how it works for different platforms.
|
|
|
|
<div purpose="embedded-content">
|
|
<iframe src="https://www.youtube.com/embed/amJFecMWyvI" allowfullscreen></iframe>
|
|
</div>
|
|
|
|
## Coverage
|
|
|
|
Fleet detects vulnerabilities for these software types:
|
|
|
|
| Type | macOS | Windows | Linux |
|
|
| ------------------- | ------------------------------------------ | ------------------------------------------------ |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
| Apps | ✅ | ✅ | ❌ |
|
|
| Browser plugins | Chrome extensions, Firefox extensions | Chrome extensions, Firefox extensions | ❌ |
|
|
| Packages | Python, Homebrew | Python, Atom, Chocolatey | <p>For Ubuntu, Debian, RHEL (including CentOS), and Fedora: packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files.</p><p>For Amazon Linux, packages maintained by Amazon by checking [ALAS advisories](https://alas.aws.amazon.com/).</p> |
|
|
| IDE extensions | VS Code extensions | VS Code extensions | VS Code extensions |
|
|
|
|
Currently, only software names with all ASCII characters are supported. Vulnerabilities won't be detected for software with names featuring non-ASCII characters, such as Cyrillic, or software that has been renamed from its default name (e.g. "Chrome 2" instead of "Google Chrome"). For some software, Fleet uses [custom rules](https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/cpe_translations.json) to mitigate these issues on an app-by-app basis.
|
|
|
|
For Ubuntu Linux, kernel vulnerabilities with known variants (ie. `-generic`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
|
|
|
|
If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). When false positives are fixed, it may take two hous for the false positive to disappear after upgrading Fleet.
|
|
|
|
## Sources
|
|
|
|
Fleet combines multiple sources to get accurate and up-to-date CVE information:
|
|
- [National Vulnerability Database](https://nvd.nist.gov/developers/vulnerabilities) CVE feeds and CVSS scores from primary sources (available on Fleet Premium).
|
|
- [VulnCheck](https://vulncheck.com/) Enriched NVD CPE data
|
|
- [Mac Office release notes](https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac) Office for Mac vulnerabilities
|
|
- [Microsoft MSRC Security Bulletins](https://msrc.microsoft.com/update-guide) for Windows OS vulnerabilities
|
|
- [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json) for Linux software
|
|
|
|
## Advanced configuration
|
|
|
|
Fleet runs vulnerability downloading and processing via internal scheduled cron job. This internal mechanism is very useful
|
|
for frictionless deployments and is well suited for most use cases. However, in larger deployments,
|
|
where there can be dozens of Fleet server replicas sitting behind a load balancer, it is desirable to manage vulnerability processing externally.
|
|
|
|
The reasons for this are as follows:
|
|
|
|
- lower resource requirements across the entire Fleet server deployment (as vulnerability processing requires considerably more resources than just running Fleet server alone)
|
|
- more control over scheduling constraints (only process during windows of low utilization, etc.)
|
|
|
|
It is possible to limit vulnerability processing to a single [dedicated host](https://fleetdm.com/docs/deploying/configuration#current-instance-checks), by setting
|
|
`disable_schedule` to `true` but still run one Fleet server as `false`, but the drawback here is still having to dedicate resources
|
|
for this single host 24/7. The Fleet binary has a command which handles the same vulnerability processing, but will exit (successfully with 0) on completion. Using this sub-command we can delegate vulnerability processing
|
|
to external systems such as:
|
|
|
|
- [ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduling_tasks.html)
|
|
- [K8S](https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/)
|
|
- [GCP](https://cloud.google.com/run/docs/triggering/using-scheduler#create_job)
|
|
- [Plain old cron](https://en.wikipedia.org/wiki/Cron)
|
|
|
|
To opt into this functionality, be sure to configure your Fleet server deployment with
|
|
|
|
```bash
|
|
FLEET_VULNERABILITIES_DISABLE_SCHEDULE=true
|
|
```
|
|
|
|
which will **disable** the internal scheduling mechanism for vulnerability processing.
|
|
|
|
And then externally run with the same environment variables/configuration files passed to the server
|
|
command.
|
|
|
|
```text
|
|
fleet vuln_processing
|
|
```
|
|
|
|
<meta name="category" value="guides">
|
|
<meta name="authorGitHubUsername" value="noahtalerman">
|
|
<meta name="authorFullName" value="Noah Talerman">
|
|
<meta name="publishedOn" value="2024-07-12">
|
|
<meta name="articleTitle" value="Vulnerability processing">
|
|
<meta name="description" value="Find out how Fleet detects vulnerabilities and what software it covers.">
|