Remediation campaigns
The Campaigns page (navigation, under Alerts) tracks how one or more CVEs get fixed across every project and every machine of the organization. Its rule: the counter only moves on a verified fix. Setting a case to “Resolved” or changing a version by hand in the stack is not enough; an automatic source has to observe that the vulnerable version is gone.
Starting a campaign
Section titled “Starting a campaign”- Open Campaigns, then New campaign (organization administrators, security officer, management).
- Enter a title, the targeted CVEs (20 at most) and a due date if you have one.
- Start campaign: vulnerable occurrences are looked up right away, with the same rules as alerts.
Each occurrence is a target: a fleet machine carrying the vulnerable software, or a project component outside machines (repository, image, SBOM, stack). A machine that shows up later with the vulnerable version joins the campaign.
What counts as a verified fix
Section titled “What counts as a verified fix”| State | Meaning |
|---|---|
| Verified | an automatic source (agent, inventory connector, code repository, pushed SBOM) re-read the machine or project after launch and no longer sees the vulnerable version. The evidence names the source, the tool, the read date and, when known, the observed update (“1.5 → 2.5”) |
| Declared, not verified | fixed according to a case or a manual entry, or waiting for a new read: does not count |
| To fix | the vulnerable version is still seen |
| Exception | accepted, mitigated or “not affected” risk: tracked separately |
| No longer inventoried | the machine left the inventory: neither fixed nor to fix |
The counter reads “N of M fixes verified”; declared ones are shown next to it, never added. A verified target whose vulnerable version comes back (reinstall, a scan finding it again) goes back to “To fix”. A provisional match (scan by name) proves nothing.
Verification runs automatically every 15 minutes; Verify now runs it again. Close campaign stops verifications; the history stays available. A member who does not see every project only sees the targets of their own projects, and the page says so.
“Ongoing incident” banner
Section titled ““Ongoing incident” banner”When the TechWatchAlert team publishes a high-profile CVE, a persistent banner appears under the top bar:
- You are affected: the number of affected projects and machines, then Start a campaign (or View campaign if one exists);
- You are not affected: no tracked component matches the vulnerable version, with the check date; projects that could not be checked (inventory to refresh, empty stack) are counted separately.
Collapse folds it for the session; it opens again if the situation changes. This banner never carries advertising.