Preview
This guide is a preview. Its content may change.
Configuring and Understanding SSVC (Priority)#
When You Need Help
SSVC is a way of classifying vulnerabilities into four levels (Immediate, Out-of-Cycle, Scheduled, and Defer) based on "when to fix them." FutureVuls makes this decision automatically, taking your own environment into account (CSIRT Plan).
The Four Inputs Used for the Decision#
| Input (as labeled on the settings screen) | Description | Who decides |
|---|---|---|
| Exploitation | Whether attacks have actually been observed | FutureVuls updates this automatically. Vulnerabilities newly added to KEV are reflected within about one hour |
| Automatable | How far it can be used in automated attacks | FutureVuls updates this automatically |
| Human Impact | How much an attack would affect your business | You decide |
| Exposure | Whether the system can be reached from outside | You decide |
FAQ#
A. Where do I configure this?
You set the default values for Human Impact and Exposure in Group Settings. Default values are already filled in when you enable SSVC. If you want to use different values for each system, set the values on a role and assign that role to the target servers. Values set on a role take precedence over the values in Group Settings.
B. When do changes to the settings take effect?
They are applied, including to existing tasks, at the next scan. If you want them applied right away, run "Manual Scan of All Servers" in Group Settings (up to 500 servers at a time).
C. How are due dates determined?
You can have due dates set automatically according to priority by using "SSVC Triggers & Actions" in Organization Settings or Group Settings. Automatic settings do not overwrite due dates set by a Special Alert Tag or entered manually. Other due dates are updated when no due date is set, when the new due date is earlier, or when the current due date has passed (SSVC due dates).
Troubleshooting#
If this page doesn't solve your problem, contact us through the support contact form with your current settings and the behavior you expect.