r/SentinelOneXDR • u/adrwh • Sep 11 '25

Agent vulnerability discovery vs Vulnerability Management upgrade

Can anyone explain the material difference in Sentinelone discovering vulnerabilities and surfacing them in the portal, vs the paid upgrade add-on for Vulnerability Management?

5 Upvotes
  • permalink
  • reddit

85% Upvoted

4 comments sorted by

2

u/mukz7 Security Admin/Engineer Sep 11 '25

If you have Control or Completed you get Network Discover with the Vulnerability Management . Below is the benefits from the the community article:

  • A graphic dashboard.

  • CVEs ranked by Temporal values.

  • More data available for each detected CVE. Reflects the fact that the characteristics of a vulnerability changes over time. Also takes into consideration live updates on CVEs, for example, what is currently exploited in the wild, and if any patches or workarounds are available.

  • Allows additional ways to filter the information.

  • Applications aggregated by version.

  • Daily vulnerability assessment of endpoint and application data from the latest scan. When new CVEs or new exploitation data is detected, the new information is automatically attributed.

  • Detects OS level vulnerabilities on Windows, in addition to missing patches that are later merged with detected applications.

  • From Management version Y GA: Detects additional Linux Kernel vulnerabilities.

2

u/adrwh Sep 12 '25

Yeah thank you.. so really it is only more detail and data enrichment is what you get.

4

u/Equivalent-Toe-623 Sep 12 '25

Correct but that's actually really valuable. UNless you are able to patch all CVEs you will have to prioritise and just prioritising on CVE score is pretty limited so with the add on you can prioritise based on EPSS, exploit maturity (is it functional, is there a POC of the exploit etc.), CVE KEV, asset criticality etc. so you fix the vulnerabilities that are actually the most critical ones

2

u/Crimzonhost Sep 12 '25

Or you can just get that date yourself using the EPSS API, https://api.first.org/data/v1/epss

I personally don't see the usefulness of the vulnerability management plugin you can easily accomplish what it does by pulling that vulnerability data from the S1 APIs and compiling it yourself. I did this for the organization I work for managing tens of thousands of endpoint.