> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aegister.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CSIRT bulletins: vulnerability alerts checked against your systems

> How the Cyber Console checks every CSIRT Italia vulnerability bulletin against your V-CISO hardware and software inventories, what the CSIRT bulletins page shows, and who is told.

CSIRT Italia, ACN's national CSIRT, publishes a few vulnerability bulletins every day. NIS 2 asks you
to receive and analyse them (measure I-2.2.4). **CSIRT bulletins** does that work for you: every
morning it checks each new bulletin against the hardware and software inventories you keep in
V-CISO, so you see first the bulletins that concern your systems, with what to do. There is no agent
to install.

**What you need:** the **CSIRT bulletins** licence and the **V-CISO** licence on your organization.
CSIRT bulletins reads the inventories kept in V-CISO, so it needs both. Every member of the
organization can open the page.

## How it works

1. **CSIRT Italia publishes** its alerts on new vulnerabilities.
2. **We check every morning** against your two NIS 2 inventories: the **hardware inventory** and the
   **software inventory** tasks on **vCISO → Cyber Posture → Tasks**.
3. **Matches come first.** A bulletin that names a product you listed is marked, with the systems it
   hits.
4. **You open it and act.** Read what to do and apply the fix. Opening it is your record of reading
   it.

Only what you listed is checked. A browser, Zoom or a phone app that is not in your inventory is not
matched. Look through the full list of bulletins, or add the product to your inventory so the next
bulletin is matched.

The check sends no details that could identify you. Each inventory row is compared as a product
text alone (name, kind, supplier and notes), without your organization, asset ids, locations or
criticality. Addresses, links and internal host names are removed from the notes.

The first check runs the morning after the licence starts and covers the bulletins of the year
before it. After that, a change to an inventory checks the whole year again.

## The page

Open **vCISO → CSIRT bulletins**, and pick the organization if you belong to more than one.

* **Next step first.** The top of the page names the bulletins about your systems that nobody has
  opened yet, and suggests one to start with, saying how many of your systems it names and whether
  it is already exploited. **How it works** shows the steps above.
* **Your inventories.** Each inventory shows how many devices or products it lists and when it last
  changed. One older than 6 months is marked: **Update it** opens the task, so the check sees what
  you run now. With both inventories empty, nothing can match.
* **Bulletins and your systems.** Either **Every system**, with the systems a bulletin names lit,
  or **Bulletin to system**, which links each bulletin to the systems it hits. Pick a lit system to
  list only its bulletins. The page remembers your choice.
* **Every bulletin.** Every bulletin since a year before your licence started, newest first. Each row
  shows when it was published, its title, severity, whether it is exploited, the systems it names
  (or **Not in your inventory**), whether it was opened, and **Open on ACN**. Search a product,
  vendor or title, filter by vendor, kind of product, **About your systems** or **Exploited**, and
  sort by **Newest first**, **Your systems first** or **Most severe first**. The filters, sort and
  page stay in the address, so a link opens the same view.

A bulletin with no match can still concern you: if you use the product it names, follow its steps
and add the product to your software inventory.

## One bulletin

Click a bulletin to open it in a side panel:

* **In short:** the bulletin in plain words.
* **Does it affect you:** each of your systems it names, with **Vulnerable version**, **Check the
  version** or **Fixed by the vendor**. A bulletin still being matched says **Being checked**: the
  result comes with the next check.
* **What to do:** the steps, as the bulletin gives them. **Open the bulletin on ACN** opens the
  original.
* **Details:** the vulnerabilities (CVEs, and which are exploited), the kinds of vulnerability, the
  affected and fixed versions, whether a patch is available, and who opened it.

**Opening the panel, or the ACN page, records that you read it**, with your name and the time. The
first time anyone in the organization opens a bulletin is when the organization received it. That
record is your NIS 2 evidence.

## Who is told

Emails and bell notifications are off until each person switches them on:

* **Email:** a bulletin that concerns one of your systems, with what to do. It covers the bulletins
  of the last 30 days that match your inventories and were not emailed to your organization before.
  It is written in the organization's communication language.
* **Bell:** how many bulletins about your systems nobody has opened yet, until someone opens them.

Each person switches these on for themselves in **Profile → Notifications**. An Owner sets them for
every member in **Organizations → your organization → Members**. See
[choosing who receives alerts](https://docs.aegister.com/documentation/en/cloud-defender/alerts-and-reports.md#choosing-who-receives-alerts).

## From the API

The page's data is also available with an API token: the
[bulletin list](https://docs.aegister.com/api-reference/v-ciso/list-csirt-bulletins.md), with the same filters, and
[one bulletin](https://docs.aegister.com/api-reference/v-ciso/get-csirt-bulletin.md). Reading through the API records no read.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.