Security

Vulnerability scanning with the agent

The LogPulse agent has a built-in vulnerability scanner. It reports the installed software of every Linux and Windows host and runs signed CVE sensors from the LogPulse Intelligence Hub. LogPulse matches the result every hour against known and exploited CVEs (NVD, CISA KEV, EPSS and the advisories of the distributions and Microsoft), so you see per host which vulnerabilities are really open, with evidence. You do not need Trivy, Grype or another scanner on your servers and workstations.

Overview

Vulnerability scanning in LogPulse has two parts that work together:

Part	What it does	Runs where
Software inventory	The agent lists the installed packages and programs. LogPulse compares every version with the fixed versions from the distributions and Microsoft.	Collection on the host, matching in your LogPulse environment
CVE sensors	A signed, read-only question for one high-impact CVE: a package version, file, registry key, process, port or Java library. The answer comes with evidence.	On the host, inside the agent

Both produce the same security_vulnerability events as an external scanner, so exposure in the Detection Hub, advisories, mitigations, ITSM tickets and the check that a CVE is really closed all work with them. No CVE database runs on your hosts and nothing leaves your LogPulse environment.

Requirements

What	Needs
Software inventory and CVE sensors	Agent 0.9.1 or later, every plan (Free included)
Windows on ARM64	Agent 0.9.3 or later
Root or administrator	Not required. In restricted mode the agent reports what it could not read
Switch	On by default. Settings → Organization: Send installed software from agents and Let agents check for vulnerabilities

Tip: Upgrading is enough: run the install script again or use Upgrade on the Agents page. See Agents & fleet.

Software inventory

Every six hours (the first time 2 to 10 minutes after start) the agent collects the installed software. It only sends the list when it changed, or after 24 hours, gzipped to POST /api/v1/agents/:id/inventory. Collecting takes 1 to 320 ms. Run logpulse-agent inventory --summary on a host to see what it would send.

LogPulse matches every inventory once an hour: when it changed, when new vulnerability data arrived, and at least every 20 hours. It reports each CVE with a fixed version the host does not have yet. A CVE without a fix is only reported when it is on CISA KEV or has a CVSS score of 9 or higher.

Linux packages

The agent reads dpkg, rpm (sqlite, ndb and BerkeleyDB) and apk, including the source package. LogPulse matches against the distribution's own fixed versions, never against NVD version ranges: distributions backport fixes, so only their own data says whether a package is patched.

Distribution	Releases
Debian	11, 12, 13
Ubuntu	20.04 and later, including Pro
Red Hat Enterprise Linux	8, 9, 10
Rocky Linux, AlmaLinux	8, 9, 10
SUSE Linux Enterprise	SLES and SLE Micro 15
openSUSE	Leap 15.x, Tumbleweed
Alpine	3.18 and later

Windows

On Windows the agent sends the installed programs (64-bit, 32-bit and per user), the updates (KBs) and the OS build with its update build revision (UBR). LogPulse matches Windows itself against the Microsoft Security Response Center: a host on the fixed build or later has the fix. Third-party applications (browsers, 7-Zip, Notepad++, PuTTY, KeePass, Zoom and more) are covered by CVE sensors that read the file version of the program.

CVE sensors

For high-impact CVEs the Intelligence Hub publishes a sensor: a fixed question that returns hard evidence on the host. More than 200 sensors are published, mostly for CVEs on CISA KEV, and new ones reach your agents by themselves. Every sensor passes a lab test and is published by a LogPulse engineer. You find them under Security → Detection Hub → Library → Agent sensors, where you can switch a sensor off for your organization.

What a sensor can read

A sensor is data, not code. The agent knows a fixed set of read-only building blocks and runs nothing else:

Building block	Reads
`package`	The software inventory: dpkg, rpm, apk and Windows programs
`file`	Files by glob, optionally only with a known SHA-256; the PE version on Windows
`file_regex`	Text in a file (up to 4 MB), for example a version string or a setting
`archive`	Java archives (jar, war, ear) and nested jars by Maven coordinate
`registry`	One registry value (Windows)
`process`	Running processes by name
`port`	Listening TCP ports

Every sensor runs on its own with a two-minute budget. /proc, /sys, /dev and /run are skipped. There is no shell, script, PowerShell or WMI.

Statuses

Status	Meaning
`vulnerable`	Found, and the version is in the vulnerable range
`not_vulnerable`	Not found, or only fixed versions. The versions found go along as evidence
`insufficient_privilege`	Nothing found, but the agent could not read everything. Shown as "Could not check", never as safe
`unknown`	An error, the budget ran out, or software was found without a version

Signing and local control

Your LogPulse environment signs every sensor bundle with its own ed25519 key. The agent pins that key on first contact over its own TLS connection and only accepts a new key signed by the pinned one. A bundle is valid for one agent and expires after seven days.

The administrator of the host keeps the last word, whatever the server sends:

/etc/logpulse-agent/sensors.conf

# switch sensors off on this host
enabled=false

# or: only allow these building blocks
allow=package,file

The environment variable LOGPULSE_SENSORS=0 does the same as enabled=false.

Where you see results

Where	What you see
Agents → a host	Open vulnerabilities of the last 7 days, worst first, with KEV, CVSS, installed and fixed version, plus the installed software with search
Security → Detection Hub → CVEs	Per CVE the block "Your hosts": vulnerable, could not check, and fixed or not affected
Security → Detection Hub → Software	Every installed product across the fleet, by number of devices or by software
Advisories and email	An advisory when an exploited or critical CVE is on your hosts

A host shows what was checked, for example Packages matched 30 min ago against Debian:12 · agent checks on, so a system LogPulse has no data for never looks clean.

Events and search

Findings are security_vulnerability events in index main, one per CVE per host. The field scanner says where a finding came from: logpulse-inventory for the software inventory and logpulse-sensor for a sensor.

LPQL

sourcetype=security_vulnerability scanner=logpulse-* status=vulnerable
| stats dc(host) as hosts by cve
| sort -hosts

External scanners

You can still send the JSON output of Trivy, Grype, Snyk or Clair with sourcetype security_vulnerability, for example for container images that never run an agent. Those findings are matched every six hours and show up next to the agent's findings.

Limits

Kernel packages of Debian and Ubuntu are not matched yet, and Amazon Linux is not covered yet. A Windows host without a UBR (agent older than 0.9.1) is not matched. LogPulse does not install patches: it shows what is open, creates the task and checks afterwards whether it is closed. See Security Monitoring.

FAQ

Does the LogPulse agent scan for vulnerabilities itself?

Yes. From version 0.9.1 the agent reports its software inventory and runs CVE sensors. LogPulse matches both against known and exploited CVEs every hour. No separate scanner is needed for hosts.

What does it cost on the host?

Collecting the inventory takes milliseconds every six hours. A sensor runs at most once an hour, by default once a day, one at a time with a two-minute budget.

Can I ask my own questions?

Yes, with Live queries: ask every host about installed software, a registry value, a config setting, ports or firewall rules.