fleet/docs/1-Using-Fleet/13-Vulnerability-Processing.md

Vulnerability Processing

• What to expect
• Setup

What to expect

Fleet checks for vulnerabilities against the National Vulnerability Database only at the moment. The way it works is by first translating the software from each host into a CPE (Common Platform Enumeration) representation of the name.

With this CPE, we search the full list of CVEs (Common Vulnerabilities and Exposures) from NVD to detect the CVEs that match the defined CPE. If any matches are found, they are exposed through the API for describing a host and through the frontend in the host details section.

These checks are performed in one Fleet instance. If your Fleet deployment uses multiple instances, only one will be doing this work.

In order to do all this, Fleet downloads the following files:

1. A preprocessed CPE database generated by FleetDM to speed up the translation process: https://github.com/fleetdm/nvd/releases
2. The historical data for all CVEs and how to match to a CPE: from https://nvd.nist.gov/vuln/data-feeds

The database generated in 1 is processed from the original official CPE dictionary https://nvd.nist.gov/products/cpe. It's updated once a day at most, depending on whether there's new data.

The whole process is both CPU intensive and Memory intensive. The goal is to make the processing as fast as possible. As an example, matching 200k CPEs against the CVE database will take around 10 seconds on an Apple Macbook Pro with 16 cores and it will take around 3Gbs of RAM while it's doing so. The CPU and memory usages are in burst once every hour in the instance that does the processing.

Vulnerability processing is currently in Beta.

Setup

Vulnerability checking is disabled by default. In order to enable it, you need to enable the software inventory feature by setting the following environment variable:

FLEET_BETA_SOFTWARE_INVENTORY=1

Or through the app config (see below).

---
apiVersion: v1
kind: config
spec:
  host_settings:
    enable_software_inventory: true

Fleet also needs a path where it will download the different data feeds. This can be done through the fleet server config yaml or through env vars:

echo '
... rest of your config here
vulnerabilities:
  databases_path: /some/path
' > /tmp/fleet.yml
fleet serve --config /tmp/fleet.yml

The path specified needs to exist and fleet needs to be able to read and write to and from it. This is the only mandatory configuration needed for vulnerability processing to work. However, there are other optional configuration options which can be found here in the Configuration documentation.

You'll need to restart the Fleet instances after changing these settings.