Expanding Your Use: Features by Challenge#

After You Get Started

Once your operations are up and running, use more of FutureVuls's features to make vulnerability management easier and more reliable. This page introduces useful features and how to use them for each "challenge you want to solve" that you answered in the Onboarding Preparation Sheet. Start with the sections that match your organization's challenges.

Who this is for
Administrators

Time required
About 5 minutes per challenge

What you'll learn
Which features you can use for each challenge, and what they do

You're done when
You have started using at least one feature that fits your organization's challenges

You don't need to use every feature before you finish the Go-Live Checklist. First complete the three ramp-up stages, then come back to this page.

Features marked "CSIRT Plan" are available with the CSIRT Plan.

Reduce the Effort of Addressing Vulnerabilities#

Hundreds of vulnerabilities are detected, and daily triage and assignment take too much time. In this case, automate triage and due-date setting so that people only make decisions on what has already been narrowed down automatically. When the same vulnerability is found on many servers, you can update them all at once instead of opening each one.

Feature	What it does	Manual
Auto Triage (CSIRT Plan)	Automatically assigns priorities to vulnerabilities that match conditions and removes those that don't need to be addressed from the list, reducing daily triage (configured in Setup 3)	Auto Triage
Automatic due dates	Automatically sets due dates on tasks based on priority (configured in Setup 4)	SSVC (Due Dates and Triggers & Actions)
Bulk task updates	Updates the assignees, due dates, and statuses of tasks related to the same vulnerability all at once	Tasks tab

Eliminate Missed Responses and Dependence on Individuals#

Some vulnerabilities remain without an assignee, assignees miss notifications, or handovers fall through when people change roles. In this case, automate assignment and notifications. Immediate detections and periodic reports can also be delivered to the chat tools you already use. Notifications of task updates and comments arrive by email. Tracking end-of-support software separately from vulnerabilities also makes it easier to plan updates.

Feature	What it does	Manual
Automatic assignee assignment	Automatically assigns the server's Default Assignee when a task is created (configured in Setup 4)	Group Settings
Slack and Teams notifications	Delivers notifications such as Immediate detections and periodic reports to the chat tools you already use. Notifications of task updates and comments arrive by email	Notification Feature, Slack App, Teams
EOL and Supply Chain Risk	Notifies you of software whose support has ended (or will end soon) as a risk separate from vulnerabilities	Supply Chain Risk

Meet Audit and Regulatory Requirements#

For audits and regulatory compliance, you need to explain which vulnerabilities you addressed, when, and how, as well as why you didn't address others. In this case, record your response decisions as statuses, and use activity records and exported lists as evidence. When you need to provide configuration information to business partners or regulators, you can export it as an SBOM.

Feature	What it does	Manual
Response records (statuses)	Keeps a record that includes the reasons you didn't address something, such as "Risk Accepted" or "Not Affected" (STEP 3)	Task Details
Audit Log (CSIRT Plan)	Keeps a record of who performed which operation and when	Audit Log
CSV Report	Exports all of a group's tasks and software using "CSV Report" on each list, for use in reports. You receive an email when generation is complete. If you only need the rows on the current page, you can also use "Export" on the list	Task CSV Report, Software CSV Report
SBOM export	Exports the configuration information you manage as an SBOM (CycloneDX or SPDX). You can also export it without vulnerability information (for example, for submissions under the CRA)	Exporting SBOMs

Report Status to Management#

You manage vulnerabilities separately by department or system, and compiling the company-wide status takes effort every time. In this case, aggregate multiple groups together and use screens that show the response status at a glance. When creating reports, export the underlying aggregated data as CSV.

Feature	What it does	Manual
Group Sets (CSIRT Plan)	Combines multiple groups so you can track response status company-wide or across departments	Group Sets
Dashboard (CSIRT Plan)	Shows the response status at a glance	Dashboard
CSV Report	Exports the underlying aggregated data for use in reports	Task CSV Report

Prevent Incidents#

You want to know right away whether your organization is affected by vulnerabilities that are making headlines. In this case, check the alert information that highlights high-profile vulnerabilities, tag the ones your organization should be especially wary of, and manage them with due dates.

Feature	What it does	Manual
Alert information	Uses icons in the list to flag vulnerabilities that are drawing widespread attention. Vulnerabilities newly added to the catalog of actively exploited vulnerabilities (KEV) are reflected in tasks within about 1 hour, without waiting for a scan, if they have already been detected. For servers registered via the scanner, paste, or SBOM, this is available on the CSIRT / PSIRT plans	Security Alerts and Advisories, Automatic Re-matching When Threat Information Changes
Public exploit code	Lets you check whether code that can be used in attacks has already been published	Exploit Information
Special Alert Tag	Tags vulnerabilities your organization should be especially wary of and manages them with due dates	Special Alert Tags
Reachability (beta)	For Go applications, shows whether a detected vulnerability can actually be reached from your code (CSIRT Plan)	Reachability Analysis (Beta)

Troubleshooting#

If something isn't working, see Troubleshooting (FAQ).

If you're not sure how to use a feature, contact us through the support contact form.