Set up

Findings

Fill the Findings view with the vulnerabilities on your hosts and network. Use Wazuh and Greenbone: the board reads both itself, with nothing to build.

Use Wazuh and Greenbone

Connect these two and the Findings view fills itself, every 5 minutes:

Wazuh, for the vulnerable packages on every host with a Wazuh agent: the board reads its indexer and makes one finding per host and package. Set it up: Connections › Wazuh.
Greenbone (OpenVAS), for what a network scan finds: open services, outdated software, TLS problems. The last finished report of every task becomes findings. Set it up: Connections › Greenbone.

Both are free and self-hosted. Run Wazuh's agents on your hosts and a Greenbone scan task on a schedule (weekly, say), add the two connections, restart the board, and that's all. What people decide about a finding (in progress, accepted risk, false positive, closed) is kept in the board's database.

Advanced: other scanners

Only read on if you also want findings from a scanner the board can't read itself, such as Trivy. Then you write a job yourself that converts that scanner's output to one findings.json in the format below, and serve the file from any web server the board can reach. The board reads it every 5 minutes and keeps the last good copy. Findings the file has from Wazuh or Greenbone give way to the board's own, under the same keys, so decisions stay on them.

Connect it

connections:
  findings:
    url: https://findings.example.com/findings.json
    token_file: /secrets/findings_token
    # ca_file: /secrets/findings_ca.crt    # a self-signed certificate

Serve the file with any web server the board can reach, protected with a bearer token: the board sends Authorization: Bearer <token_file's content>. Deciding findings needs oidc.groups.security.

The document

{
  "schema": 1,
  "generated_at": "2026-10-26T21:05:18Z",
  "sources": {
    "wazuh":     { "ok": true,  "as_of": "2026-10-26T21:05:18Z" },
    "greenbone": { "ok": false, "as_of": "2026-10-25T01:13:20Z", "error": "report older than 8 days" }
  },
  "findings": [ … ]
}

Field	Meaning
`schema`	`1`. Any other number is refused and the last good copy stays, marked stale.
`generated_at`	When the build ran (RFC 3339).
`sources`	One entry per scanner the build read: `ok`, `as_of`, and `error` when it failed. Shown as a strip at the top of the view.
`findings`	The findings, below.

A finding

One finding is one thing to fix: a vulnerable package on a host, an image with vulnerabilities, an open port, a TLS problem. Group CVEs into the finding that fixes them, not one finding per CVE.

{
  "key": "1d09a07ede2203ac78344e7c5d04816d25e992b1",
  "asset": "web01",
  "asset_type": "host",
  "component": "openssl",
  "identifier": "package:openssl",
  "title": "openssl 3.0.2-0ubuntu1.15",
  "severity": "critical",
  "cvss": 9.8,
  "epss": 0.42,
  "kev": true,
  "kev_cves": ["CVE-2024-0001"],
  "cves": ["CVE-2024-0001", "CVE-2024-0002"],
  "fix_available": true,
  "fixed": "3.0.2-0ubuntu1.16",
  "installed": "3.0.2-0ubuntu1.15",
  "internet_facing": true,
  "deadline": "2026-10-29",
  "first_seen": "2026-10-26",
  "last_seen": "2026-10-26",
  "present": true,
  "verified": false,
  "seen_by": ["wazuh"],
  "owner": "ops"
}

Required fields

Field	Meaning
`key`	Stable id: the same finding has the same key in every build, or the decisions made about it are lost. A hash of asset and identifier works.
`asset`	The host, image or address it is on.
`asset_type`	`host`, `image`, or a word of your own.
`identifier`	What is wrong on the asset, e.g. `package:openssl`, `port:23/tcp`.
`title`	One line, shown on the board.
`severity`	`critical`, `high`, `medium` or `low`.
`deadline`	The last day to fix it, `YYYY-MM-DD`. Past it, the finding is overdue and the board raises `SecurityFindingOverdue` in Alertmanager.
`first_seen`, `last_seen`	`YYYY-MM-DD`.
`present`	The latest scan still sees it. `false` keeps it on the board as gone.
`verified`	For a finding no longer present: a successful scan confirmed it is gone. Only then can someone close it.
`seen_by`	The `sources` that report it.

Optional fields

Field	Meaning
`component`	The package or service.
`cvss`, `epss`	Numbers; EPSS from 0 to 1.
`kev`, `kev_cves`	On CISA's Known Exploited Vulnerabilities list, and which CVEs. Shown as actively exploited, sorted first.
`cves`, `counts`	All its CVEs, and the CVEs per severity.
`fix_available`, `fixed`, `installed`	Whether a fixed version exists, which, and the version installed.
`internet_facing`	The asset can be reached from the internet; shown as a tag.
`owner`, `note`, `evidence`	Who should fix it, anything to add, and where the build found it.
`hosts`, `packages`	For an image: where it runs, and its vulnerable packages.

Other fields are ignored, so a build can carry more for its own use.