Check Catalog
A signed check catalog
The shipped checks arrive signed, and new CVE records reach the catalog through a sync. For needs specific to your institution, the check definitions you write run alongside the catalog.
What is in the catalog
The catalog holds ready checks that look for known vulnerabilities in widely used software, administration panels left exposed and unsafe configurations. Every check uses the same YAML format, so a shipped check and a rule you wrote run on the same engine under the same rules.
How the catalog stays current
A sync with the national vulnerability database carries newly published CVE records into the catalog. On installations that have internet access, this flow runs on its own. In closed networks the update package is carried in as a signed file and goes through the same verification.
What the signature guarantees
Every check that enters the catalog carries a cryptographic signature. Content whose signature does not verify, or content that has been placed on the revocation list, is not executed whatever its source. You can tell at any moment what is running in your scan engine.
Common questions
Do my own rules run alongside the catalog?
Yes. A shipped check and a check you wrote are the same YAML format and run in the same engine under the same rules.
Can unsigned content run?
No. Every check in the catalog carries a cryptographic signature. Content that fails verification or sits on the revocation list never runs, whatever its source.
Does the catalog stay current on a closed network?
Yes. The update package is carried in as a signed file and passes the same verification as an online install. New CVE records enter the catalog through the same path.