Vulnerability Intelligence Sources
Tamandua tracks vulnerability intelligence as source-backed metadata, not as a
single universal truth feed. Some sources are available through local SBOM and
scanner workflows today; others are planned coverage targets.
Status labels:
| Status | Meaning |
|---|---|
available | Local tooling or existing integration can consume this source. |
planned | Candidate source with clear value, but no production sync is implemented yet. |
reference-only | Analyst context or enrichment source; not an automated verdict by itself. |
Source Baseline
| Source | Coverage | Status | Intended Use |
|---|---|---|---|
| NVD | CVE, CVSS, CPE metadata | available | Baseline vulnerability metadata |
| FIRST EPSS | Exploit probability scoring | available | Prioritization and triage ordering |
| CISA KEV | Known exploited vulnerabilities | available | Escalation for curated exploited CVEs |
| OSV.dev | Open-source package advisories | available through OSV Scanner; broader sync planned | Package-specific matching |
| GitHub Advisory / GHSA | GitHub package advisories | available through scanner tooling; direct sync planned | Package advisory cross-checks |
| Vendor advisories | Microsoft, Apple, Google, Cisco, VMware/Broadcom, Fortinet, Palo Alto, Ivanti, Atlassian, and similar vendors | planned | Vendor patch, mitigation, and product-specific context |
| Distro OVAL/secdb | Ubuntu, Debian, Red Hat, Alpine, and related distro feeds | planned | OS package applicability and fixed versions |
| Exploit-DB / Metasploit references | Public exploit references and modules | reference-only | Analyst enrichment and exploit context |
| Socket.dev malicious package intelligence | Malicious package and supply-chain behavior signals | planned | Dependency confusion, typosquat, and malicious package context |
| Mobile app store/package metadata | App store, APK/package, signing, bundle, and SDK metadata | planned | Mobile app inventory and vulnerable SDK correlation |
Claim Boundary
- NVD, EPSS, and KEV are useful but not enough for strong vulnerability coverage.
- OSV and GHSA improve package-level matching, especially for open-source
- Distro and vendor advisories are required before claiming strong OS package or
- Exploit references are enrichment until reviewed false-positive handling
- Endpoint software inventory is observed asset evidence. Incremental software
snapshot marked as complete can reconcile software that disappeared from an
asset.
- Planned sources must not be shown with fake sync state, fake feed health, or
The canonical engineering baseline is
docs/security/VULNERABILITY_INTEL_SOURCE_COVERAGE.md.