CVE Risk Mapping
Cross-references discovered installed software against CVE databases to produce risk findings.
What it does
Cross-references the installed application inventory produced by ApplicationDiscoveryV2 against a CVE knowledge base (NVD-derived) and generates risk findings ranked by CVSS severity. Inputs (CSV, in RawDataOutput): - ApplicationIntune.csv / ApplicationEnterprise.csv / Application.csv (any combination produced by ApplicationDiscoveryV2). Expected columns include Publisher / PublisherName, Name / DisplayName, Version / DisplayVersion. - CVEDatabase.csv (operator-supplied NVD mirror; columns: CveId, Vendor, Product, VersionStartIncluding, VersionEndExcluding, VersionEndIncluding, CvssV3BaseScore, Severity, PublishedDate, Description, References). If missing the module attempts a best-effort live fetch from the NVD 2.0 API (services.nvd.nist.gov/rest/json/cves/2.0) for the top publishers; if that also fails the module exits gracefully. Matching (best-effort CPE-lite): - Vendor / Publisher equality (case-insensitive, normalised) - Product name equality on normalised tokens - Version inside [VersionStartIncluding, VersionEndExcluding) or <= VersionEndIncluding when a version is supplied; otherwise the match is recorded with confidence VERSION_UNKNOWN. Outputs (CSV, in RawDataOutput): - CVERiskFindings.csv one row per (App, CVE) pairing - CVERiskSummary.csv one row per (Publisher, Product) with severity counts, max CVSS, and recommended action - CVERiskHeatmap.csv heatmap-friendly grid: Publisher x Product x Critical/High/Medium/Low counts and exposure score (sum of CVSS * InstallCount).
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/software-cverisk-mapper Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.