Skip to main content
CSIRT Italia, ACN’s national CSIRT, publishes a few vulnerability bulletins every day. NIS 2 asks you to receive and analyse them (measure I-2.2.4). CSIRT bulletins does that work for you: every morning it checks each new bulletin against the hardware and software inventories you keep in V-CISO, so you see first the bulletins that concern your systems, with what to do. There is no agent to install. What you need: the CSIRT bulletins licence and the V-CISO licence on your organization. CSIRT bulletins reads the inventories kept in V-CISO, so it needs both. Every member of the organization can open the page.

How it works

  1. CSIRT Italia publishes its alerts on new vulnerabilities.
  2. We check every morning against your two NIS 2 inventories: the hardware inventory and the software inventory tasks on vCISO → Cyber Posture → Tasks.
  3. Matches come first. A bulletin that names a product you listed is marked, with the systems it hits.
  4. You open it and act. Read what to do and apply the fix. Opening it is your record of reading it.
Only what you listed is checked. A browser, Zoom or a phone app that is not in your inventory is not matched. Look through the full list of bulletins, or add the product to your inventory so the next bulletin is matched. The check sends no details that could identify you. Each inventory row is compared as a product text alone (name, kind, supplier and notes), without your organization, asset ids, locations or criticality. Addresses, links and internal host names are removed from the notes. The first check runs the morning after the licence starts and covers the bulletins of the year before it. After that, a change to an inventory checks the whole year again.

The page

Open vCISO → CSIRT bulletins, and pick the organization if you belong to more than one.
  • Next step first. The top of the page names the bulletins about your systems that nobody has opened yet, and suggests one to start with, saying how many of your systems it names and whether it is already exploited. How it works shows the steps above.
  • Your inventories. Each inventory shows how many devices or products it lists and when it last changed. One older than 6 months is marked: Update it opens the task, so the check sees what you run now. With both inventories empty, nothing can match.
  • Bulletins and your systems. Either Every system, with the systems a bulletin names lit, or Bulletin to system, which links each bulletin to the systems it hits. Pick a lit system to list only its bulletins. The page remembers your choice.
  • Every bulletin. Every bulletin since a year before your licence started, newest first. Each row shows when it was published, its title, severity, whether it is exploited, the systems it names (or Not in your inventory), whether it was opened, and Open on ACN. Search a product, vendor or title, filter by vendor, kind of product, About your systems or Exploited, and sort by Newest first, Your systems first or Most severe first. The filters, sort and page stay in the address, so a link opens the same view.
A bulletin with no match can still concern you: if you use the product it names, follow its steps and add the product to your software inventory.

One bulletin

Click a bulletin to open it in a side panel:
  • In short: the bulletin in plain words.
  • Does it affect you: each of your systems it names, with Vulnerable version, Check the version or Fixed by the vendor. A bulletin still being matched says Being checked: the result comes with the next check.
  • What to do: the steps, as the bulletin gives them. Open the bulletin on ACN opens the original.
  • Details: the vulnerabilities (CVEs, and which are exploited), the kinds of vulnerability, the affected and fixed versions, whether a patch is available, and who opened it.
Opening the panel, or the ACN page, records that you read it, with your name and the time. The first time anyone in the organization opens a bulletin is when the organization received it. That record is your NIS 2 evidence.

Who is told

Emails and bell notifications are off until each person switches them on:
  • Email: a bulletin that concerns one of your systems, with what to do. It covers the bulletins of the last 30 days that match your inventories and were not emailed to your organization before. It is written in the organization’s communication language.
  • Bell: how many bulletins about your systems nobody has opened yet, until someone opens them.
Each person switches these on for themselves in Profile → Notifications. An Owner sets them for every member in Organizations → your organization → Members. See choosing who receives alerts.

From the API

The page’s data is also available with an API token: the bulletin list, with the same filters, and one bulletin. Reading through the API records no read.