Threat watches
Track an emerging threat across every customer, with curated watches and your own "tell me if anyone runs X below Y" rules.
Updated
On this page
A threat watch answers "are any of my customers affected by X?" the day an advisory drops, without waiting for vulnerability databases to catch up. Watches appear as cards under Threats we're tracking on Vulnerabilities.
Curated watches
RevoSecure curates watches for emerging threats that matter to MSPs (PHP2Shell, for example). They're read-only to workspaces and evaluated against every customer automatically. Each has a plain-language summary, the CVEs, severity and remediation that says exactly what to install and restart.
Create your own
Vulnerabilities → Threat watches → New watch: "tell me if anyone runs X below version Y".
-
Title, Severity and Product (shown on matches), and the CVEs if there are any.
-
Fixed in: one fixed release per release line, for example
7.4.1, 7.2.6. Optionally the First affected version; older versions are then not affected. -
Where to look (at least one):
Field Matches Windows programs The installed program name, case-insensitive, with wildcards ( FortiClient*)Runtimes Agent-detected runtimes: php,node,python,java,openssl,nginx,apache,tomcat…Web servers The product as fingerprinted from headers: PHP, nginx, Apache HTTP Server, Microsoft IIS, WordPress… Container images The image name, with wildcards ( bitnami/wordpress)Linux packages The (source) package name in any distribution, with wildcards ( openssh) -
What it is and What to do: the plain-language summary and remediation your team sees on matches.
-
Create and check. Every system is checked straight away, and again whenever new inventory arrives.
Wildcards are * and ?, matched against the whole name.
How fixed versions work
Fixed versions are per release line. With Fixed in 7.2.4, 7.0.12:
- 7.2.3 is affected (7.2 is fixed in 7.2.4); 7.2.5 isn't.
- A line below the lowest fixed line with no fix of its own is affected (6.4.x, if 7.2.4 and 7.0.12 are the fixes).
- A line above the highest fixed line isn't.
Reading a watch card
| Card says | Meaning |
|---|---|
| Not affected (checked N systems) | Every system that could run it was evaluated against the current rules |
| N systems at M customers affected | Select the card for the systems and what to install on each |
| Checking… | New or changed inventory, or an edited watch, hasn't been evaluated yet |
| Not conclusive | Some systems run the product without a readable version |
Distribution packages are judged with the distribution's own fix data, because Ubuntu and Debian back-port fixes without changing the upstream version. When that data isn't available, the match is possibly affected. See Vulnerability management.
When a watch matches
- One finding per watch and customer, for example PHP2Shell: 3 affected systems, which resolves when the last affected system is fixed.
- A notification to your team, by email too, one per watch and customer.
- The
threat_watch.matchedwebhook (see Webhooks).