Vulnerability Management

Get quick answers to common Vulnerability Management questions in ServiceOps, covering setup, scanning, CVE investigation, remediation, and reporting.

Common questions about Vulnerability Management in ServiceOps, for IT Admins and Technicians.

Which operating systems does Vulnerability Management support?

A: Vulnerability Management currently supports Windows endpoints only.

Does Vulnerability Management require a specific ServiceOps version?

A: Yes. Vulnerability Management requires ServiceOps v8.7.5 or later. The module does not work on v8.7.4 or any earlier version. Ask your administrator to confirm the installed version before configuring the module.

What license do I need to use Vulnerability Management?

A: You need an active Vulnerability license applied on your ServiceOps instance. Contact your administrator to confirm the license is active.

What agent version do I need on my endpoints?

A: Endpoints on the Vulnerabilities + Patch plan require the Motadata agent upgraded to v8.7.5. Endpoints on the Vulnerabilities + Patch + Asset + CMDB plan do not require the agent to be upgraded to v8.7.5.

Do SaaS customers need to sync the vulnerability repository?

A: No. On SaaS, Motadata manages the Vulnerability repository centrally. Repository sync is not required and the Vulnerability Audit page is not shown. All other steps, including adding endpoints and running scans, are the same as On-Prem.

What URL needs to be whitelisted for On-Prem repository sync?

A: For On-Prem deployments, whitelist https://vulncatalog.serviceops.ai on your network or proxy server. Without this, the Vulnerability repository sync silently fails and no scan returns data.

How does vulnerability scanning work in ServiceOps?

A: The Motadata agent on each enrolled Windows endpoint collects the OS and software inventory and sends it to the ServiceOps server. The server compares this inventory against the local CVE database, which syncs from the Motadata Central Vulnerability Repository on a daily schedule or on demand. Every match between installed OS or software and a known CVE creates a vulnerability record. Scans run automatically on four triggers: a database update, a new endpoint enrolled, new discovery data arriving, or an endpoint configuration change.

How long should I wait before scanning a newly added endpoint?

A: Wait at least 10-15 minutes after adding a new endpoint before clicking Initiate Scan. Running the scan too early returns no results because the agent has not yet sent its OS and software inventory to the server.

What roles do I need to view and manage vulnerability data?

A: To view vulnerability data, your role needs View Vulnerability enabled under Admin > Users > Roles. To modify vulnerability records, you need View + Manage Vulnerability. To manage endpoints, you need View + Manage Endpoint. For reports, View Vulnerability Reports must be enabled before Manage Vulnerability Reports can be activated. The out-of-the-box Vulnerability Manager and Vulnerability Specialist roles include the relevant permissions.

I upgraded from v8.7.4. Why do my existing endpoints show no vulnerability data?

A: Endpoints enrolled before the v8.7.5 upgrade do not trigger an automatic scan after the upgrade. Open the Endpoint List page and click Initiate Scan for each existing endpoint. If you hold separate Patch and Vulnerabilities licenses, also confirm the endpoint agent is upgraded to v8.7.5 before scanning.

What is the difference between the Vulnerabilities list and the Detected CVEs list?

A: The Vulnerabilities list groups findings by patch. Each row is a patch record (PCH-XX) that consolidates all CVEs a single patch resolves, along with the count of endpoints missing that patch. The Detected CVEs list is CVE-centric — each row is a single CVE with its own CVSS score, severity, exploit status, and affected endpoint count. Use the Vulnerabilities list to approve and deploy patches. Use the Detected CVEs list to investigate a specific CVE or assess exploit risk.

How do I remediate a vulnerability in ServiceOps?

A: Go to Vulnerability Management > Vulnerabilities, select one or more approved patch records, and click Take Action > Remediation. This redirects you to the Patch Deployment creation page where you configure and publish the deployment. The Remediation option is only available for patches with Approval Status = Approved. If a patch is not yet approved, select it and click Take Action > Approve first, then use Remediation to trigger deployment.

Why does patch data not appear immediately after a scan?

A: Vulnerability data and patch data populate at different times. Vulnerability scan results appear right after Initiate Scan completes. Patch results only appear after the scheduled Patch Cycle job runs. This is expected behavior. Wait for the Patch Cycle job to complete before expecting patch data to show up on the Vulnerabilities list.

Can I see vulnerabilities on a software asset record?

A: Yes. When the Vulnerability license is active and the associated endpoint is enrolled in scope, a Vulnerabilities tab appears on Software Asset records in Asset Management. The tab is read-only and shows the same CVE data as the Vulnerability Endpoints detail page. If you have the View Vulnerability permission, clicking a CVE ID takes you to the full CVE detail page.

Why do all KPI cards on the Vulnerability Dashboard show zero?

A: KPI cards show zero when no scans have run yet or no endpoints are enrolled. Confirm endpoints are enrolled in Admin > Discovery and Agents > Endpoint Management. Then go to Admin > Vulnerability Management > Vulnerability Settings and click Update Now to trigger the first database sync, followed by Initiate Scan on the Endpoint List page.

Can I export vulnerability data for compliance audits?

A: Yes. The Vulnerabilities list and Detected CVEs list both support export to CSV or Excel with optional password protection. For formal audit packages, use Reports > Vulnerability to run the out-of-the-box Endpoint Vulnerability Details Report or Critical Detected CVEs Report, or build a custom report with the columns and filters your audit requires. You can export reports in PDF or Excel format.