Fleet
The Fleet page (Monitoring › Fleet, address /parc) shows the machines of the active project: every workstation, server or Mac your inventory connectors see, with its software, the vulnerabilities that affect it and what to handle first. The stack says which software is monitored; the fleet says where it is installed.
Where machines come from
Section titled “Where machines come from”Machines arrive through the inventory connectors, at each sync:
| Connector | Machines | Software per machine |
|---|---|---|
| Wazuh | active agents, with system, hardware and address | Syscollector packages |
| AWS (Systems Manager) | instances and managed servers | AWS:Application inventory |
| Microsoft Azure | machines of the Log Analytics workspace | Change Tracking and Inventory |
| Jamf Pro | managed Macs, with hardware and user | applications |
| Microsoft Intune | managed devices, with hardware and user | not yet (software stays in the stack) |
| TechWatchAlert agent | every machine it is installed on | all software, continuously |
A machine seen by two tools (Wazuh and AWS, for example) appears only once: it is recognised by its serial number, then by its host name. The IP address is never used to recognise a machine.
The list
Section titled “The list”At the top, key figures: number of machines and split by system, state (Active: seen within 7 days; Inactive: 7 to 30 days; Lost: beyond), and exposure (Vulnerable, Exploited flaw, Critical flaw, End-of-life system). Clicking a figure filters the list.
Filters (search by name, IP, serial number or user; system, state, exposure, criticality, environment, source, tag) stay in the page address, so it can be shared. Export to CSV downloads the filtered list.
Each row shows the machine (name, system, IP), its state, its open vulnerabilities by severity (the flame counts exploited ones), its risk score, its context (criticality, environment), its sources and last user. The End of life badge flags a system that no longer receives security fixes; End of support a system that only receives security fixes.
Risk score
Section titled “Risk score”The score (0 to 100) ranks machines by urgency. It starts from the worst open vulnerability (CVSS), rises when a vulnerability is exploited (KEV catalogue, public proof) or likely (EPSS ≥ 10 %), with the number of vulnerabilities, and when the system is end of life. Business context weights it: a critical or production machine comes first. The reasons are spelled out on the machine page.
Only vulnerabilities whose case is open count: marking a case Resolved, Not applicable or Accepted lowers the score of every affected machine. A Mitigated case counts half.
Machine page
Section titled “Machine page”Clicking a machine opens its page:
- Overview: identity (FQDN, serial number, manufacturer, model), system (version, build, kernel, distribution, lifecycle with its endoflife.date source), hardware, network, activity (first and last seen, last user), sources (what each tool says and when), open vulnerabilities by severity, and business context;
- Vulnerabilities: open vulnerabilities, most urgent first, with the software at fault, its version, CVSS, EPSS, exploitation and case status; a click opens the alert;
- Software: everything installed, with what the CVE watch tracks and vulnerabilities per software;
- History: appeared, reappeared, software installed, updated or removed, system changed, source added or lost.
Business context (criticality, environment, owner, location, tags, notes) is edited with Edit context (Analyst role or above). Connectors never touch it.
Remove from fleet (… menu, Admin role) deletes a decommissioned machine. If a source still sees it, it comes back at the next sync.
Exposed machines on an alert
Section titled “Exposed machines on an alert”An alert page shows Exposed machines (N): the machines carrying software targeted by the CVE, with the software and its version. One CVE can affect several programs (OpenSSH on a server, Firefox on a workstation): every affected machine is listed.
Distribution packages
Section titled “Distribution packages”Linux packages of machines whose system is known (Wazuh, AWS, Azure) are matched against their distribution’s advisories (Ubuntu, Red Hat): a fix backported by the distribution raises no alert. See Distribution packages.