Lywand Vulnerabilities

The Lywand Vulnerabilities check turns a device's lywand findings into a check result. It does not run on the device: it runs server-side on your octoja instance, every 60 minutes by default, so it does not depend on the device's operating system or architecture. It evaluates the vulnerability data octoja has already synced from lywand and does not query the lywand API itself, so new scan results take effect after the next sync.

Prerequisites

• lywand software is connected, and the device's customer is mapped to the matching lywand partner. The check only has data for devices that octoja has paired with lywand. Set up lywand software explains how, and when a device receives data.

Steps

1. Go to Devices and open the device.
2. In the Checks tab, click Add Check → Lywand Vulnerabilities.
3. Adjust the settings if needed.
4. Click Add Check.

For many devices, assign the check through a config package.

Settings

• If Risk score warning (0–10) is set higher than Risk score critical (0–10), the check swaps the two values before evaluating.
• The check's Finding scope is independent of the scope you pick in the devices list or on the device tile.

Results

Each enabled signal is evaluated independently; the overall result is the worst severity.

• Findings ignored in lywand do not count toward any signal.
• For New vulnerabilities appear, the check compares the current findings with those of the previous run. On the first run and after you change the Finding scope, there is no baseline, so the check reports no new vulnerabilities then.

The check collects:

• Risk score and rank for the scope
• Number of findings, critical findings, and new findings
• The five findings with the highest risk, each with name, severity, risk, CVEs, and CISA KEV flag

See also: Set up alerts for a check