Skip to content
All answers
Workflow

How do I track only the CVEs that affect my stack?

Declare the technologies you actually run, then filter every incoming CVE against that list before a human ever sees it. This inverts the default workflow: instead of reading a global feed and asking "do we run this?", you receive only the disclosures that touch your declared inventory, which is typically a very small fraction of daily volume.

The accuracy of this depends entirely on the inventory being honest. A stack list that omits the forgotten appliance in the DMZ produces a clean, comfortable feed that misses the thing most likely to be exploited.

Version boundaries matter as much as product names. Most advisories affect specific ranges, and a match on product alone generates the false alarms that make people stop reading alerts.

The payoff is proportional to how noisy your current process is. Teams triaging a global feed by hand usually find the filtered volume drops by more than an order of magnitude.