> For the complete documentation index, see [llms.txt](https://docs.patchmypc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.patchmypc.com/patch-my-pc-insights/dashboard-guides/advanced-insights-threat-analytics-dashboard.md). # Advanced Insights "Threat Analytics" Dashboard Applies to: Patch My PC Advanced Insights for Configuration Manager The Threat Analytics dashboard turns your Configuration Manager software update compliance data into a picture of CVE (Common Vulnerabilities and Exposures) risk. Instead of thinking in terms of individual updates, it lets a Configuration Manager administrator see which vulnerabilities are most prevalent and most severe across the estate, exactly which updates remediate each one, and whether those updates are already deployed and reaching compliance. {% hint style="info" %} Threat Analytics correlates published vulnerability intelligence with the updates your devices actually require. The CVE metadata; severity scores, affected products, remediating updates and notes, is sourced by the Patch My PC service from vendor and industry vulnerability feeds (including the Microsoft Security Response Center (MSRC), NIST and Red Hat). This is then matched against: * the **Microsoft update manifest** (Microsoft security updates synchronised into Configuration Manager), and * the **Patch My PC catalog** (third-party application updates). A device is only counted against a CVE when Configuration Manager reports that it **requires** an update that remediates that CVE. {% endhint %} Because vulnerability exposure is evaluated across all managed devices, the **collection selector does not apply** to this dashboard (it shows *Collection Filter not applicable*). Results are still limited by your Role-Based Access Control (RBAC) scope. ### Summary statistics | Statistic | Meaning | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Vulnerable Devices** | The number of managed devices that require at least one update associated with a CVE, shown as a count and as a percentage of managed devices. | | **Critical Devices** | The subset of vulnerable devices that are exposed to a **critical** CVE (a CVE with a CVSS base score of 9 or higher). | | **Microsoft Critical CVEs** | The number of distinct critical (base score ≥ 9) Microsoft CVEs present in your environment. Click the tile for the full **Microsoft Critical CVEs** list (see below). | | **Microsoft Critical Updates** | The number of critical Microsoft security updates needed to remediate those critical CVEs. Click the tile for more detail. | ### Microsoft Common Vulnerability Exposure The main table lists the Microsoft CVEs associated with updates that are **required by at least one device**. Each row is a vulnerability, ordered so the most widely exposed appear first. | Column | Description | | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **CVRF** | The Microsoft Common Vulnerability Reporting Framework release (month) the CVE was published in. | | **CVE** | The CVE identifier. | | **Title** | The vulnerability title. | | **Devices** | The number of devices in scope that require a remediating update for this CVE. | | **BaseScore** | The CVSS base score and severity (for example, *9.8 (Critical)*). | | **TemporalScore** | The CVSS temporal score, which adjusts the base score for real-world factors such as exploit maturity and remediation availability. | | **Vector** | Hover the information icon to see the **processed vector string** broken down into plain language (attack vector, attack complexity, privileges required, user interaction, scope, confidentiality/integrity/availability impact, exploit code maturity, remediation level and report confidence). | Click any row to open the **CVE detail modal** (described below). ### Patch My PC Update Vulnerability Exposure This table mirrors the Microsoft table but covers CVEs remediated by **Patch My PC catalog** (third-party application) updates required by at least one device — for example, browser and application vulnerabilities. | Column | Description | | ------------------ | ------------------------------------------------------------------- | | **CVE** | The CVE identifier. | | **CVETitle** | The title of the affected product/update. | | **CVEDescription** | The published description of the vulnerability. | | **Devices** | The number of devices requiring the remediating Patch My PC update. | | **BaseScore** | The CVSS base score and severity. | | **Vector** | The processed vector string (hover the information icon). | ### Cyber Essentials The Cyber Essentials panel tracks **critical update compliance** against the 14-day patching expectation used by the Cyber Essentials scheme. It lists the critical updates that are still missing from one or more devices: | Column | Description | | -------------- | --------------------------------------------------------------------------------------------------------------------- | | **ArticleID** | The KB article for the update. | | **DatePosted** | The date the update was released. | | **Missing** | The number of devices still missing the update. | | **Status** | **Breached** when the update has been available for 14 days or more, **Warning** at 7 days or more, otherwise **OK**. | This gives an at-a-glance view of whether critical patching is keeping pace with the timescales an assessment would expect. ### Microsoft Critical CVEs list Clicking the **Microsoft Critical CVEs** statistic (or its *Click for more details* banner) opens the full list of critical CVEs (base score ≥ 9). It behaves like the main table — CVRF, CVE, Title, Devices, BaseScore, TemporalScore — with a quick search box and the same **VectorString** hover breakdown. ### CVE detail modal Clicking a CVE opens a modal with four tabs. Together they take you from *understanding* the vulnerability to *knowing exactly what to do about it*. #### Vulnerability tab Shows the **Susceptible Products** — the products the vulnerability applies to — with the threat type (for example, *Remote Code Execution*), BaseScore, TemporalScore and vector. This is the published metadata describing the CVE. #### Exposure tab This is the tab that tells the administrator **what to do**. It shows only what is relevant to *your* environment: * **Exposed Devices** – the devices that actually require an update for this CVE, with computer name, user and online status. Checkboxes and a **Bulk Actions** menu let you act on selected devices. * **Required Microsoft Security Updates** – the **subset** of the CVE's updates that are genuinely **required by at least one device in your environment**. Each update shows its title, how many devices **Required** it, and the current **Compliance (%)**. {% hint style="success" %} Start here. The Exposure tab filters out the noise and shows the specific updates that will remediate the CVE on the devices that need them, along with how close you already are to full compliance. {% endhint %} #### Remediations tab Shows **all** Microsoft security updates referenced by this CVE — not just the ones your environment needs — with ArticleID, DateRevised, Title, and the **Installed**, **Required** and **Unknown** device counts plus **Compliance (%)**. Because a single CVE is typically remediated across many operating systems, architectures and product versions, this list is usually long and **most rows will not be relevant to any one environment**. Rows can also appear as *not present in configuration manager*: this usually means the referenced update has been superseded or expired, or has not yet been synchronised into the Configuration Manager database. #### Notes tab Shows any additional notes published for the CVE (for example, mitigations or workarounds where the remediation is not simply a Microsoft security update). Where the Remediations tab is sparse, the Notes tab is often where the relevant guidance is found. #### Understanding Compliance (%) On both the Exposure and Remediations tabs, **Compliance (%)** for an update is calculated as the proportion of in-scope devices where the update is either already installed or not applicable: $$\text{Compliance (%)} = \frac{\text{Installed} + \text{Not Applicable}}{\text{Total in-scope devices}} \times 100$$ A low percentage on a required update highlights where deployment work remains; 100% means every relevant device is already remediated. ### Related data sources For administrators who want to trace the dashboard back to source: * CVE intelligence (scores, vectors, susceptible products, referenced KBs and notes) is provided by the Patch My PC service from vendor and industry feeds. * Device exposure and update compliance are derived from Configuration Manager update compliance data (`fn_ListUpdateCIs`, `Update_ComplianceStatus`, `v_UpdateScanStatus`) for both Microsoft updates and the Patch My PC catalog. * Critical thresholds use a CVSS base score of **9 or higher**; Cyber Essentials status uses the update's age since release (7-day warning, 14-day breach). All figures are limited by your RBAC scope; the collection selector does not apply to this dashboard. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.patchmypc.com/patch-my-pc-insights/dashboard-guides/advanced-insights-threat-analytics-dashboard.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.