Vulnerability Asset Matching
The core question in vulnerability asset matching is: after a new high-risk CVE appears, how can you quickly produce a prioritized list of which enterprise assets are affected, which are exposed to the internet, and what the response order should be?
Flocks builds a vulnerability asset matching Agent: it first obtains vulnerability intelligence, then performs concurrent multi-source asset matching, cross-checks exposure, and finally outputs a prioritized list of affected assets. This flow provides directly usable response input for incident response.
Scenario Overview
The most time-consuming part of vulnerability response is usually not patching, but locating affected assets:
- A CVE only states "component X version Y is affected"; this must be mapped to which enterprise machines run the related component.
- HIDS software inventories, NDR traffic fingerprints, asset scanning platforms, and CMDB component versions are scattered across multiple systems.
- Priority must also consider whether the asset is externally exposed and whether it belongs to core business.
Manual matching usually takes a long time and is easy to miss. After automation, an initial list can be produced quickly after obtaining the CVE number.
Inputs and Outputs
Typical Inputs
- CVE / CNVD number, most common
- Vulnerability name + affected component description, semi-structured and enriched by the Agent
- Optional: intelligence source URL, such as a ThreatBook or security media article
- Optional: time window, defaulting to all assets, or only assets recently launched
Typical Outputs
- Vulnerability intelligence summary: affected component, version range, patch status, exploit maturity
- Affected asset list: tags for each asset, including component version / network location / exposure / business criticality
- Response priority: incident response list sorted by risk score
- Exposure focus: externally exposed assets pulled out separately for priority handling
Prerequisites
| Dependency | Requirement |
|---|---|
| Model | Reasoning model preferred: component version matching and exposure judgment both require multi-step inference |
| Vulnerability intelligence source | Any one of CVE / CNVD / ThreatBook / security media is usable; ThreatBook intelligence platform API is recommended. See Threat Intelligence and IOC Triage |
| Asset sources | At least two of CMDB (component versions), HIDS (software inventory / processes), NDR (traffic fingerprints), and asset scanning platform |
| Exposure data | Used for internet exposure checks. See Internet Asset Discovery |
| Channels | At least one of WeCom / DingTalk / Feishu is connected for notifying the incident response group. See Messaging & Alerting Integrations |
Steps (WebUI)
Step 1: Start a Session and Give Rex a Vulnerability Lead
Enter Session Management -> + New Session:
"CVE-2026-xxxx just dropped. Check which assets in our enterprise are affected and output a prioritized list."
Once Rex recognizes a vulnerability asset matching request, it delegates the task to the corresponding sub-agent or executes it via a defined Workflow.
Step 2: Enrich Vulnerability Intelligence
The sub-agent first enriches CVE intelligence:
- Pulls basic information from CVE / CNVD: affected component, versions, CVSS
- Pulls "exploit maturity" from ThreatBook / security media: whether POC exists and whether in-the-wild exploitation is observed
- Pulls patch information: whether the official patch has been released and what workarounds exist
It produces a standardized intelligence summary and persists it to Workspace, such as vulns/CVE-2026-xxxx/intel.json.
Step 3: Multi-source Asset Matching (Concurrent)
The sub-agent queries each asset source concurrently and matches affected components:
| Source | Matching logic |
|---|---|
| CMDB | Exact field matching on component name + version range |
| HIDS software inventory | Process / service / package name + version |
| HIDS process view | Runtime process characteristics, suitable for side components not recorded in CMDB |
| NDR | Traffic fingerprint / HTTP Banner, suitable for identifying externally reachable versions |
| Asset scanning platform | Port + service + version |
Results from different sources are deduplicated and merged, primarily using IP / hostname as the key, yielding a candidate affected asset list.
Step 4: Cross-check Exposure
For each candidate asset, perform another "external exposure check":
- Does the internal IP have a public NAT mapping?
- Does the corresponding service appear in internet asset discovery results?
- Is it a DMZ asset?
The result determines priority: externally exposed + core business > externally exposed + ordinary asset > internal + core business > others.
Step 5: Output the Affected Asset List
The final output is a sorted table, persisted to Workspace and pushed through channels:
- One asset per row: IP / hostname / component + version / network location / exposure / business criticality / recommended priority
- Summary at the top: total affected count, externally exposed count, core business count, and recommended handling time
Step 6: Optional: Hand Off to Vulnerability Verification
For assets in the list that are "externally exposed + core business", Rex can directly delegate to the Vulnerability Verification sub-agent to construct Payloads and verify whether the vulnerability is truly exploitable, further compressing response priority.
Real Case Walkthrough: A New CVE Emergency in Minutes
| Stage | Agent action | Output / notes |
|---|---|---|
| T+0:00 | A newly disclosed CVE-2026-xxxx appears in a security media group and is sent into the session | Natural-language lead |
| T+0:20 | Agent pulls basic information from the CVE database and exploit maturity from ThreatBook | Intelligence summary |
| T+1:00 | Concurrently queries CMDB + HIDS software inventory + NDR | First candidates: 37 assets matched |
| T+2:00 | Cross-checks exposure | 4 are externally exposed, 2 are core business |
| T+2:30 | Outputs the priority list | 4 high-priority assets + 33 medium/low-priority assets |
| T+2:35 | Pushes WeCom summary + Workspace report link | Incident response group starts work from the list |
| T+10 | Humans take over response; Agent continues to be called for vulnerability verification | The two scenarios hand off cleanly |
Output Example (List Summary)
# CVE-2026-xxxx Affected Asset List
Vulnerability: CVE-2026-xxxx (deserialization RCE in a Web framework, CVSS 9.8)
Exploit maturity: public POC available; ThreatBook marks "in-the-wild exploitation"
Official patch: 1.2.4 released; workaround: temporarily disable XX endpoint
## High Priority (Externally Exposed / Core Business, Handle Within 2h)
| IP | Hostname | Component version | Exposure | Business | Owner |
| --- | --- | --- | --- | --- | --- |
| 1.2.3.4 | web-prod-01 | v1.2.1 | Public 443 | Official site | Zhang San |
| 1.2.3.5 | web-prod-02 | v1.2.1 | Public 443 | Official site | Zhang San |
| 10.10.x.x | api-core-01 | v1.2.0 | Internal | Core API | Li Si |
| 10.10.x.y | api-core-02 | v1.2.0 | Internal | Core API | Li Si |
## Medium / Low Priority (Internal Only / Non-core, Handle Within 24h)
...33 assets total. See Workspace vulns/CVE-2026-xxxx/assets.json for details.Continuous Operation and Scheduled Tasks
| Task form | Description |
|---|---|
| Daily Vulnerability Subscription | Pull newly added high-risk CVEs from the previous day every morning, automatically run asset matching, and push only when there are hits |
| Monitoring list rescan | During high-priority vulnerability remediation, rescan every hour and watch the fixed / unfixed trend |
| Long-tail cleanup | Weekly summary of all unfinished vulnerabilities, generating cleanup reports for each business-line Owner |
| New asset scan | When CMDB adds an asset, trigger a review of whether it hits known vulnerabilities |
Boundaries and FAQ
| Question | Handling |
|---|---|
| Inaccurate CMDB version fields | Cross-check multiple sources: HIDS software inventory + NDR fingerprints as fallback |
| Some component versions are commit hashes and cannot be compared directly | Let the Agent use the "version comparison rules" in a Skill as fallback; mark undecidable items as "manual confirmation required" |
| Public exposure data is stale | Periodically trigger Internet Asset Discovery to stay current |
| The list is too long and nobody reads it | Channel notification only pushes the top N high-priority items; the full list is downloaded from Workspace |
| Want the Agent to patch automatically | Not recommended. Flocks focuses on accurately generating response lists; patch execution should be completed through operations processes |
Related Resources: Scenario Overview · Vulnerability Verification · Threat Intelligence and IOC Triage · Internet Asset Discovery · Internal IP Asset Profiling · Task Center