When the CVE List Is Updated
Security Monitor finds CVEs by comparing the software on your endpoints with the NIST CVE database. The CVE list isn’t real-time. A CVE disappears when CapaOne has checked the endpoint’s new software inventory, not at the moment you update the software.
When CapaOne checks an endpoint for CVEs
Section titled “When CapaOne checks an endpoint for CVEs”CapaOne checks an endpoint for CVEs each time the CapaOne Agent sends a new software inventory. The agent sends one:
- About once a day.
- When CapaOne has installed, updated, or uninstalled an application on the endpoint.
- When you request a software scan. See Remove a CVE sooner.
Once a day, CapaOne also downloads the latest CVE data and checks all endpoints again. Newly published CVEs appear after this check.
What to expect after you update software
Section titled “What to expect after you update software”How soon a CVE disappears depends on how the software was updated:
| How the software was updated | When the CVE disappears |
|---|---|
| With CapaOne, for example as a Repository App or a Company App | Usually within a few minutes after the installation completes. |
| Outside CapaOne, for example by the application’s own updater | After the endpoint’s next daily software scan, usually by the next day. |
If several applications are queued for the endpoint, the scan runs after the last one completes. An offline endpoint is scanned when it’s online again.
The views under Windows → Security don’t all update at the same time:
- The endpoint’s Software and Detected CVEs views update first. Their Collected on timestamp shows when the endpoint was last checked for CVEs.
- The Affected Endpoints, Affected Software, and Detected CVEs tabs follow within 15 minutes. Their Generated on timestamp shows when they were last updated.
- Overall Exposure and the CVEs by Severity (30 days) chart on the Vulnerabilities tab are calculated once a day. A CVE you fix today is counted as Eliminated after the next daily check.
Remove a CVE sooner
Section titled “Remove a CVE sooner”If the software was updated outside CapaOne, request a new software inventory instead of waiting for the daily scan:
- Go to Windows → Endpoints → List and click the endpoint’s name.
- Open the actions menu (⋮) in the endpoint header and select Request → Scan software.
CapaOne checks the endpoint for CVEs when the scan completes.
To scan several endpoints, select them in the endpoint list and select Scan software in the actions menu. Only online endpoints are scanned. See Windows Endpoint List.
Use Scan software, not Scan security. Scan security doesn’t collect a new software inventory, so it doesn’t pick up the new version.
If the CVE is still listed
Section titled “If the CVE is still listed”If the CVE is still listed after a software scan:
- Check the application’s version on the endpoint’s Inventory → Software tab. If the old version is listed, the update didn’t install.
- Look for other installations of the application, such as an older version installed for a single user. Each installation is checked on its own.
- Open the CVE and read its details. The vulnerability might also affect the new version.