Software Inventory
The Software Inventory gives you a single, searchable view of the software installed across the devices in your organization. Instead of logging into each host to see what is running, you get one consolidated list — every application and package, the versions in use, the devices it is installed on, and any known vulnerabilities affecting it.
Most of this data is collected automatically by the Bitcollector scanner agent, so the inventory stays current as your fleet changes. You can also add records by hand for software the agent cannot reach.
Software Inventory is built from what your agents actually report, plus any manual entries you create. A device's software appears only after a Bitcollector agent installed on (or scanning) that host has reported it — there is no external guessing about what "should" be present.
How software is discovered
Agent-based discovery (primary)
The Bitcollector agent is the main source of software data. Once deployed on your internal network, it gathers asset telemetry from each host — including the list of installed packages and applications and their versions — and streams it back to Cert-IX. As software is installed, upgraded, or removed on a managed device, the inventory reflects the change on the agent's next report.
Bitcollector is downloaded from downloads.cert-ix.com and registered with your Tenant ID, found under Settings → Organization. See the Scanner Agents overview and the Agent Deployment Guide for how to roll it out across your environment.
Manual entries
For software the agent does not see — appliances, air-gapped systems, or products tracked outside your managed fleet — you can add a record manually and associate it with the relevant devices. Manual entries behave like discovered ones in the list and can be edited or removed later.
What a software record contains
Each entry brings together identity, deployment, and risk information:
| Field | Description |
|---|---|
| Name & vendor | The application or package name and its publisher. |
| Version | The version (or versions) reported across your devices. |
| Installation count | How many devices the software is installed on. |
| Installed on | The specific devices where it was found. |
| Vulnerabilities | Known CVEs affecting the reported version, with severity. |
Because the same package can appear at different versions on different hosts, the inventory makes version spread visible — useful for spotting the one machine still running an old, vulnerable build.
Working with the inventory
Viewing and filtering
Open the Software Inventory page under Asset Management to browse the full list. Filters help you narrow a large catalog to what matters right now — for example by vendor, by version, or by whether an entry has open vulnerabilities. Select any item to see its full detail, including every device it is installed on.
Adding software manually
To record software that was not auto-discovered, add a new entry, provide its name, vendor, and version, and associate it with the devices where it runs. The entry then appears alongside agent-discovered software and is matched against the CVE database like any other record.
Vulnerability tracking
The most valuable thing the inventory does is connect what you have installed to what is known to be vulnerable. Reported software and versions are matched against Cert-IX's CVE database, and affected entries are flagged with the relevant advisories.
Findings are ranked by severity — Critical, High, Medium, and Low — with remediation guidance so you can act on the highest-impact issues first. Deeper analysis, prioritization, and remediation tracking live in Vulnerability Management, and the underlying network vulnerability and CVE scanning is performed by the Bitscanner agent.
Illustrative example
| Software | Version | Finding | Severity | Suggested action |
|---|---|---|---|---|
| OpenSSL | 1.1.1l | CVE-2022-0778 (denial-of-service) | High | Upgrade to OpenSSL 1.1.1n or later |
Example only — your findings reflect the actual CVEs matched against your reported software.
Container images and dependencies
Software installed on hosts is only part of the picture. For container images and application dependencies, Cert-IX provides complementary vulnerability coverage:
- The Scan API includes Trivy, which scans container images and filesystems for vulnerable packages.
- DepCheck MCP (
https://mcp.cert-ix.com/depcheck) lets AI coding agents check dependency manifests for known-vulnerable packages before they ship.
Best practices
- Deploy Bitcollector broadly. The inventory is only as complete as your agent coverage — the more hosts reporting, the fewer blind spots.
- Prioritize by severity. Work Critical and High findings first, then Medium and Low.
- Keep agents current. Up-to-date agents report accurately and match against the latest CVE data.
- Fill gaps manually. Add entries for appliances and unmanaged systems so they are not invisible to your vulnerability review.
Pair Software Inventory with the Devices page: from a vulnerable software entry you can see exactly which devices are affected, and from a device you can see everything it has installed.
Learn more
- Scanner Agents — how Bitcollector, Bitscanner, and the other agents collect asset and vulnerability data.
- Agent Deployment Guide — deploy and register agents on your network.
- Vulnerability Management — prioritize and track remediation of the findings surfaced here.
- Asset Management Overview — how software fits into your broader asset picture.
War diese Seite hilfreich?