FutureVuls Basic Terms
This page briefly explains terms you will often see when you start using FutureVuls, in the order you use FutureVuls: from contract to registration, decision, and response.
For detailed specifications and procedures, see the manual pages linked in the "Details" column.
Management Units and Permissions
| Term |
Meaning |
Details |
| Organization |
A container for managing your company in FutureVuls, and the unit of billing. In most cases, you create one organization per company. |
How to Divide Organizations |
| Group |
A container for organizing servers and assets. All vulnerability information and server/product information belong to a group, and we recommend dividing groups to correspond with each system in your organization. |
How to Divide Groups |
| Group Set |
A feature that bundles multiple groups so that you can manage vulnerabilities and tasks across them. It is available on the CSIRT plan. |
Group Sets |
| Role |
A feature for grouping servers within a group. Every server belongs to a role, and you can configure SSVC Decision Points and Task Priority Rule Sets per role. |
Roles |
| Group Admin |
A permission that allows you to view and change the settings and basic screens of a group. You need this permission to view the group settings or change the "Important CVE" conditions, for example. |
User Permission Management |
Registering Servers and Products
| Term |
Meaning |
Details |
| Local Scan |
The standard method in which the scanner is installed on a server to scan that server itself. We recommend it when you can place the scanner on the server. |
Local Scan |
| Remote Scan |
A method in which a server with the scanner installed logs in via SSH to other servers on the same network and scans them. You do not need to install the scanner on each target server. |
Remote Scan |
| Paste Scan |
A method in which you run commands on a server to collect configuration information and copy and paste the output into the FutureVuls screen to register it. It is suited to environments where deploying the scanner is difficult, such as closed networks. |
Paste Scan |
| Pseudo-server |
A non-physical, empty server used to manage software and other assets in FutureVuls. To manage network devices and similar assets, you create a pseudo-server and then register CPEs. A pseudo-server is billed as one server. |
Pseudo-server |
| SBOM Import |
A method in which you import an SBOM file and manage vulnerabilities in the software it lists. |
SBOM Management, Importing SBOM Files |
| Amazon Inspector Integration |
A method that imports scan results from Amazon Inspector, a vulnerability management service from AWS, into FutureVuls for management. It covers EC2 instances, AWS Lambda, and Amazon ECR. |
Inspector Integration |
| Manual Scan |
An operation in the FutureVuls screen that matches uploaded configuration information against the latest vulnerability data. It does not synchronize (upload) configuration information. |
When Scans Run |
| Scheduled Automatic Scan |
A process that automatically re-matches uploaded configuration information against the latest vulnerability data once a day. It detects newly published vulnerabilities even if nothing on the server has changed. Eligible servers depend on your plan and the server. |
Periodic Automatic Scans |
In environments where internet access goes through a proxy server, you need to configure the proxy for the scanner. For the procedure, see "Proxy Configuration."
| Term |
Meaning |
Details |
| CPE |
A globally common identifier (Common Platform Enumeration) for identifying software and products. For software outside OS package management, such as middleware and network device firmware, you register CPEs to detect vulnerabilities. |
CPE Scan |
| PURL |
An identifier (Package URL) for identifying packages. It is mainly used for OSS libraries and is used for EOL detection, license detection, and vulnerability detection. |
Distinguishing Between CPE and PURL |
| KB |
A Windows update, identified by a number called a KBID. FutureVuls detects Windows vulnerabilities based on which KBs are applied, and if any are missed, you can register KBIDs manually from the screen. |
Manual KBID Registration |
| SBOM |
A list of the components (such as libraries) that make up a piece of software. In FutureVuls, you can import SBOM files to detect vulnerabilities and export scan results in SBOM format. |
SBOM Management |
| Lockfile |
A file, such as package-lock.json, that records the dependent libraries an application uses and their versions. You can manage library vulnerabilities by pasting the contents of a lockfile into the screen or by specifying a lockfile for the scanner. |
Application Scan |
External Vulnerability Metrics
| Term |
Meaning |
Details |
| CVE |
A globally common identification number assigned to a published vulnerability. FutureVuls generally displays the CVE ID; for vulnerabilities without a CVE ID, it displays the ID issued by the information source. |
CVE ID |
| CVSS |
A common metric for evaluating the severity of vulnerabilities. FutureVuls displays CVSS v2 / v3 / v4 scores. "Severity" is based on the CVSS v3 score, and for vulnerabilities that only have a CVSS v4 score, the CVSS v4 score is used. Note that CVSS represents severity, not actual risk. |
CVEs, CVSS Issues |
| Security Alert |
A warning about especially dangerous vulnerabilities published by CISA KEV, VulnCheck KEV, ENISA KEV, JPCERT/CC-Alerts, or CISA-Alerts. You can check whether a vulnerability has security alerts in the vulnerability list and vulnerability details. |
Security Alerts and Advisories |
| KEV |
KEV (Known Exploited Vulnerabilities) is information on extremely high-risk vulnerabilities that have been confirmed to be exploited in attacks. FutureVuls imports CISA KEV, VulnCheck KEV, and ENISA KEV and displays them as security alerts. |
KEV Information |
| EPSS |
A metric that represents the probability that a vulnerability will be exploited within the next 30 days. |
EPSS in Vulnerability Details, EPSS |
| SSVC |
A framework for deciding the response priority of vulnerabilities based on actual risk. In FutureVuls, it is available on the CSIRT plan and the PSIRT plan, and an SSVC Priority is automatically derived for each task (server × vulnerability). Even for the same vulnerability, the Priority can differ depending on the Exposure / Human Impact settings of the group or role that the server belongs to. |
SSVC Implementation in FutureVuls, What is SSVC |
| Exposure / Human Impact |
Two of the Decision Points used to derive SSVC Priority, which you set to match your environment. Exposure represents the target system's level of exposure to the internet, and Human Impact represents the business impact if it is attacked; you set them in the group settings or on roles. |
Configuring SSVC Decision Points |
| SSVC Priority |
The four levels of response priority derived by SSVC. Immediate means respond as quickly as possible, Out-of-Cycle means respond faster than usual, Scheduled means respond during regular maintenance, and Defer means do not respond at this time. |
Response Priority |
Prioritization in FutureVuls
| Term |
Meaning |
Details |
| Vulnerability Priority / Task Priority |
Four priority levels, HIGH / MEDIUM / LOW / NONE, that you can set on vulnerabilities and tasks. When a task is newly created, its task priority inherits the priority of the related vulnerability. |
Vulnerability Priority and Task Priority |
| Important CVE |
One of the tabs in the vulnerability list. Vulnerabilities with open tasks that match conditions you set in advance are sorted into it. You can set the conditions using SSVC Priority, vulnerability priority, and vulnerability characteristics such as CVSS scores and security alerts; changing them requires the Group Admin permission. |
Criteria for Important CVE |
| Auto Triage |
A CSIRT plan feature that automatically sets vulnerability priorities, task statuses, and more based on rules. It includes SSVC-based triage, Special Alert Tags, Automatic Vulnerability Priority, Automatic Ignore Settings, and Task Priority Rule Sets. Automatic Ignore applies only to tasks with the status NEW and does not apply to tasks with the priority HIGH. |
Auto Triage, Automatic Ignore Settings |
| Special Alert Tag |
A feature that forcibly sets the priority of specified vulnerabilities. Special Alert Tags are managed per organization, and you can also set a due date. |
Special Alert Tags |
| Triggers & Actions |
A feature that defines actions to run when the SSVC Priority differs from the previous one. Depending on the Priority, it can automatically update the task's status, priority, and due date. |
Triggers & Actions |
Tasks and Response
| Term |
Meaning |
Details |
| Task |
A ticket for managing a detected vulnerability, where "1 task = 1 server × 1 vulnerability." Tasks are created automatically when a scan detects a vulnerability, and you cannot create them manually. When the vulnerability is no longer detected, the task automatically changes to PATCH_APPLIED, and you cannot set this status manually. |
About Tasks |
| Task Status |
A value that represents the response status of a task. Unfinished tasks have statuses such as NEW / INVESTIGATING / ONGOING / DEFER, and completed tasks have statuses such as PATCH_APPLIED. |
Task Status |
| Open / Ongoing / Deferred / Resolved Tabs |
Tabs in the task list. Open shows tasks with NEW, Ongoing shows tasks with INVESTIGATING or ONGOING, and Deferred shows tasks with DEFER, in each case only tasks that are not ignored. Resolved shows tasks with PATCH_APPLIED, ALT_RESOLVED, NOT_AFFECTED, WORKAROUND, or RISK_ACCEPTED, as well as tasks that are set to be ignored. |
Sub-tabs |
| Default Assignee |
The user who is automatically set as the primary assignee of newly created tasks. You can set it per server, and the default assignee is notified by email when a new task is registered. |
Servers / Products, Notification Feature |
| Due Date |
The deadline by which a task should be completed. You can set it manually, or it can be set automatically by a Special Alert Tag or SSVC Triggers & Actions; you can find unresolved tasks past their due date in the "Expired" tab of the task list. |
Update Task, Sub-tabs |
| Ignore |
A feature that keeps tasks you have decided not to address from appearing in the Open tab and other tabs of the task list. In addition to ignoring a task permanently, you can ignore it conditionally, such as until a patch is released or until a specified date. |
Task Ignore Settings |
| Patch |
An update provided to fix vulnerabilities in software. When you apply a patch and the vulnerability is no longer detected in the next scan, the task automatically changes to PATCH_APPLIED. |
Task Status |
Dates and Times on the Screen
| Term |
Meaning |
Details |
| Last Configuration Sync |
The latest date and time the scanner synchronized the server's configuration information with FutureVuls. It applies only to servers of type "Scanner." |
Servers / Products |
| Last Detection Time |
The latest date and time when registered configuration information was successfully matched against vulnerability information. Scheduled automatic scans and manual scans also update it, as does automatic re-matching on eligible servers, for example when a detected vulnerability is added to KEV. It can therefore be more recent than the Last Configuration Sync. |
Servers / Products, Automatic Re-matching When Threat Information Changes |
| Out of sync |
A warning shown in the server details when a server registered with a scanner has not synchronized its configuration information for 24 hours or more. Check whether the scanner or the server has stopped. |
Check That Scans Haven't Stopped |