Anyone encountered a Fleet instance that just absolutely will not trigger its webhook after detecting a CVE? This is driving me up the damn wall. I know the webhook endpoint is working as it is receiving payloads from Fleet for the policy and host status automations. It is just the damn vulnerabilities that won't trigger. The webhook URL is correct. The vulnerabilities webhook is enabled. There are CVEs being reported to Fleet and I set the vulnerability range back 5 years so they should be within it. I am at a loss on this one and it is the primary feature I am interested in (of course its the one that won't work lol)

Hey Ben, not really ran into this before. Quick thoughts, thinking maybe might only be picking up the "rising". If created after the vulnerability was detected, wouldn't necessarily trigger again. https://fleetdm.com/docs/configuration/configuration-files#vulnerabilities-webhook Also noting and you might already be aware, vulnerabilities webhook use

vulnerabilities.periodicity

in Fleet configuration (default 1hr)

“Rising edge” is what I think @Grant Bilstad meant to say.

Thank you both for your replies! Sorry, I am not familiar with that term - rising edge. If you mean, the vuln automation was enabled after the CVE was detected I have tested with a new, never added before host, and it also does not trigger the webhook. Thank you for suggesting it but I have also set the periodicity to as little as 1m with no luck. I also extended the recent_vulnerability_max_age to much longer than its default 30 days. From these lines it looks like there might not be so much logic behind the decision to trigger or not. It looks like it just gathers up the hosts affected by any CVEs, batches them according to the config, and then sends them. But not for me I guess 😞 But also is this feature premium only? I see that it changes the mapper based on lic here but also looks like it might be unrelated.

Hey @Ben the webhook is available for Fleet free users as well, but the trigger does happen every 24 hours by default rather than being based on the vulnerability periodicity. Has it still not triggered for you?

Oh, woh. I thought it was linked to the periodicity too. Although, after running it for days on end (leaving a few CVEs unresolved on several hosts) still I have not seen the vulnerability webhook. I know the webhooks at least general work because the policies webhook fires just fine to the same endpoint. This one has thoroughly stumped me.