Threat Advisor
The Threat Advisor is the first page after sign-in. It answers three questions for the projects you can see: how much open risk there is, what needs action now, and which vulnerabilities matter most. Every figure is computed on the server from the findings register, so the page, its exports and the API always agree.
Risk figures
Section titled “Risk figures”| Figure | What it counts |
|---|---|
| Open findings | Open findings by severity, with a daily trend. |
| Mean time to resolve | Mean days from a finding first being seen to being marked fixed. Shown once at least five findings have been fixed. |
| New in 7 days, New in 30 days | Findings first seen in that window. |
| SLA breaches | Open findings past their SLA date. See Findings and triage. |
Needs Attention
Section titled “Needs Attention”Open findings past their SLA, then those due within 7 days, sorted by severity and SLA pressure. Each row opens the finding in the register.
Most At-Risk Assets
Section titled “Most At-Risk Assets”The assets with the most open exposure, weighted by severity. An asset scanned several times counts once.
Coverage by Capability
Section titled “Coverage by Capability”How recently each of the seven scan types ran, and which are enabled on this instance. A capability that has not run recently is a gap in your picture, not a clean result.
Advisories by Exploitability
Section titled “Advisories by Exploitability”Dependency advisories grouped by CVE across every scan and asset, so one vulnerability in ten services is one row with ten occurrences. Each row shows:
| Column | Source |
|---|---|
| Severity and CVSS score | The advisory. |
| Known Exploited | The CISA KEV catalogue. If the catalogue could not be read, the page says so and the status is unknown, never “not exploited”. |
| Fix available | The fixed version the advisory names. |
| Occurrences, scans and assets | Where the vulnerability appears in your estate. |
Rows are ordered by severity, then CVSS score, then occurrences. The register holds up to 300 advisories and states the total when there are more.
Each dependency finding also carries its EPSS exploit probability where one is published. See Dependencies and SBOM.
Export
Section titled “Export”Export the advisory register as CSV from the page, or as CSV or JSON with GET /api/threats/export?format=csv or format=json. Exporting needs the report export permission. GET /api/threats also returns a briefing of advisories first seen in the last 24 hours.
Advisories are ordinary findings. Triage them in Findings and triage, where their SLA follows the policy for their effective severity.