Threat Intelligence
What it is
Threats (Security → Threats) is CMDash's threat feed: zero-day, published, and unpublished (pre-CVE) items, swept every 8 hours and filtered to your organization's own window and product list. It is ungated — every tier gets the feed, the same as Incidents and Remediations beside it.
The feed reads from twenty sources: eight official feeds (CISA Advisories, CISA KEV, Microsoft MSRC, Google Project Zero, NVD, the CVE list, FBI IC3, and CERT/CC), eight vendor PSIRT feeds (Cisco, Palo Alto Networks, Fortinet, Ivanti, Citrix, Broadcom, SonicWall, and GitHub Security Advisories), and four social sources (Mastodon, Bluesky, Reddit, and X) that feed the unpublished lane only.
When to use it
Check Threats as a daily habit to see what is newly exploited, published, or pre-CVE-rumored for the products your organization actually runs. Use the Tool Coverage matrix when you need to know whether a connected security tool can actually see a given threat in your estate, not just whether the threat exists. Use Threat Exposure Settings once, when you onboard, to scope the feed's window and products — and again whenever your tool stack or risk appetite changes.
Before you start
| Page | Nav location | Tier | Role notes |
|---|---|---|---|
Threats (/threats) | Security | No tier gate | Any authenticated tenant member can view; filters are per-session, not saved. |
Tool coverage (/threats/coverage) | Security → Threats → Tool coverage | No tier gate | Same read access as Threats; a child page, not its own sidebar row. |
Threat Exposure Settings (/settings/threat-exposure) | Settings | No tier gate | Any authenticated tenant member can view and change the settings. |
How to
Read the feed
- Go to Security → Threats. Every item lands in one of three lanes: Zero-day (actively exploited, in your window), Published (CVE-assigned, in your window), or Unpublished (pre-CVE vendor advisories and corroborated social reports, labelled "reported, unconfirmed" rather than presented as equivalent to a published CVE).
- The header strip shows every source's health — OK, ERROR with its error text, or Off (no credential configured) — so a red source reads as "this feed has stopped updating," never as "nothing is happening."
- Filter by product (free text, matched against what the feed tagged) or severity. The feed caps at 300 items server-side; at the cap, a notice says so explicitly rather than letting the list look complete when it isn't.
- Each item can carry an estate status: exposed, not seen, or unknown — unknown is the deliberate default whenever no source can answer, and an item can also show no estate status at all (a third, distinct state) when the cross-reference hasn't loaded or failed; that failure never blocks the underlying feed item from rendering.
Read the tool coverage matrix
- Go to Security → Threats → Tool coverage for a matrix of your connected tools against the in-window threats.
- Every cell is one of four states — COVERED, EXPOSED, UNKNOWN, or N/A — and UNKNOWN is the honest default whenever a tool cannot answer or has no per-CVE lookup at all, never a false green.
- A tool's letter grade is covered ÷ assessable, shown beside what it could actually assess (e.g. "B — 14 of 19 assessable"); a tool with nothing assessable grades "—", never a letter. A red ERROR badge means its last lookup failed, so its cells read UNKNOWN until the next successful recompute.
- Open a tool's history to chart its daily grade trend; days with no recompute are left out rather than shown as a zero.
Configure Threat Exposure Settings
- Go to Settings → Threat Exposure.
- Set the window — how far back the feed looks, 7 to 90 days (default 30). The ceiling is 90 because the sweep itself only retains 90 days of history.
- Manage Products of interest — pre-populated with names your connected integrations already report, plus any you add by hand.
- Toggle the Social lane (on by default) — turning it off hides unconfirmed early Mastodon/Bluesky/Reddit/X sightings and leaves only published and sourced-unpublished items.
- Turn on Alert on a zero-day in your estate to be notified when a new in-window zero-day matches a product you run.
- Set the Coverage-drop alert threshold (1–100%) to be notified when a connected tool's coverage grade falls by at least that many percentage points.
Common questions
Does the feed automatically open a risk or remediation task? No. The feed is read-only intelligence and estate correlation; use Remediations or the Risk Register to act on an item it surfaces.
How is this different from Maturity's ATT&CK coverage heatmap? They are separate systems with no shared data path. Maturity's ATT&CK coverage maps your controls and detections against MITRE ATT&CK techniques; Threats tracks live CVEs and advisories.
Why does an item show "unknown" instead of a clean result? Unknown is the honest default whenever no source — the estate cross-reference or a connected tool — can actually answer. It is never rendered as a false "not exposed" or a false "covered."