Extend Vigiles Coverage Across Your Software Ecosystems

Embedded products rarely contain software from only one source or technology stack.

A Linux-based product might also include Python packages, npm dependencies, Java/Maven components, Rust crates, distribution packages, container images, or other software with its own package and release model. Each ecosystem may publish or maintain vulnerability information for its packages, versions, and release process.

The practical question is not whether you need every available feed. It is:

Which ecosystem-specific vulnerability feeds are relevant to the software in your product?

Vigiles Curated

The baseline vulnerability intelligence used by Vigiles, drawing on vulnerability, vendor, and distribution sources with curation and engineering analysis.

Depending on the issue and available source material, that work can add corrections, applicability context, improved references, and links to fixes or remediation resources.

Relevant ecosystem feeds

Additional vulnerability intelligence associated with the operating systems, distributions, languages, package managers, containers, and other ecosystems represented in your product.

The result

Vigiles analysis informed by the technologies that are actually present in your product and SBOM.

This page is about extending relevant coverage. It is not a claim that baseline Vigiles only uses one source, or that selecting more feeds automatically produces better results.

Review the software represented in your product and SBOM:

• Which operating systems or distributions are present?
• Which programming languages are used?
• Which package managers supply application dependencies?
• Do container images or specialized container distributions form part of the product?
• Which ecosystems appear in your SBOM?

You do not necessarily need every feed in the selector. The relevant coverage depends on the technologies in your software. Lynx can help map that stack to the ecosystem-specific vulnerability feeds available for your Vigiles deployment.

At a high level, the workflow is:

1. Generate or upload an SBOM.
2. Identify the ecosystems represented in the product.
3. Apply the relevant ecosystem-specific vulnerability feeds.
4. Generate and monitor vulnerability results in Vigiles.

This workflow helps align Vigiles vulnerability analysis with the ecosystems represented in your product.