📧 Email & Reports

Gabriel closes the loop — owner-routed remediation, KEV fire-alarms, cert countdowns and briefings, emailed to the right humans with Tenable deep-links. Owner routing reads Atlas Owner: tags. Preview first; sending goes through navi_action_mail — double-gated (writes + NAVI_EMAIL=1 + confirm).

Each owner gets only their assets. Set an email domain to auto-guess addresses, or edit inline in the preview.

Schedule & defaults

Per-agent policy

Blank policy → risk-weighted top-N. e.g. IoT → "tag all IoT but not Dell or Intel — those are laptops"; Custom apps → "only /opt apps and jenkins matter".

When armed, the contract removes these tags first, forces a pause, runs navi update, then re-runs the tagging workflow. Add tags from the Tag removal page, or type them below.

Every cycle, Gabriel emails a summary of what the contract did — tags queued, ACR applied, tags removed, and any Alert Raven alerts that fired. On by default; uncheck to stop getting an email each run. Sending is still gated by NAVI_EMAIL, so a gated inbox just records what would have gone out.

Loop log

✨ Craft an alert

Describe it in plain English. Alert Raven searches the fields that define an asset — tag category & tag value, and navi's purpose-built tables: software, certs, routes, paths, and plugins (which navi pre-parses from plugin output, so they're faster and cleaner than scanning raw output). Join conditions with and to intersect — only assets matching all of them count.

e.g. "alert me on assets that have a MITRE and CISA KEV and EOL and NHI tag" · "assets running OpenSSL 1.0" · "certs signed with SHA-1" · "assets with a file under /opt/tomcat" · "critical when new CISA KEV appears". It drafts a read-only query you can test before saving.

🧾 Recent evaluations

Classes

Quantum-vulnerable surface

Every source in navi.db — certificates (RSA/ECC/DSA), transport crypto (TLS/SSH), and Tenable's Post-Quantum Cipher Analysis plugins where present.

PQC migration backlog

Ranked by priority = ACR-weighted exposure across certs, transport, agility, and active exploitation (KEV). Migrate the top of this list first.

🗓️ CNSA 2.0 / NIST PQC migration timeline — reference

NSA's Commercial National Security Algorithm Suite 2.0 milestones — use to frame remediation deadlines. Verify against the latest CNSA 2.0 guidance for your sector.

Hunt CISA KEV — ask in plain English

Turn a question into a read-only SQL over navi.db / tags — e.g. "assets with a CISA KEV and ACR over 7", "KEV added in 2025 by hostname", "which assets already carry a CISA KEV tag". Review the SQL, then run it.

① Tag by a list of group names

Paste group names (one per line or comma-separated). Each is matched to a real agent group and tagged.

③ Tag every agent group

Runs through every group and tags each — the classic agent-group-tags script, on the background queue.

📊 Dashboards build · pin · map

Jump to any dashboard tool from the bar above — it follows you across each one. Build views in the builder, pin them to a Custom Dashboard (keep up to five), or open the Ownership Map.

🔎 Search Hounds navi.db search pack

Jump to any search hound from the bar above — it follows you across every search view so you can hop between assets, vulns, plugins, routes, and paths without coming back here. Each reads navi.db (read-only).

🛠 Tools navi.db utilities

Jump to any tool from the bar above — it follows you across every tool view so you can move between the tagging log and the comparisons without coming back here. Refresh navi.db re-syncs in place.

🧠 Advanced search cross-table NL→SQL

Ask anything across the whole of navi.db and the model writes the joins for you. e.g. "assets in the Production tag with the highest EPSS score" · "critical vulns with EPSS over 0.5 on cloud assets" · "hosts running OpenSSL that also have an expiring certificate". Two-step: it drafts the SQL with joins, you review/refine, then execute (read-only).

The tables present in your navi.db and how they join. The advanced search uses these keys automatically.

🔦 Asset Deep-Dive

Argos recognizes one asset by UUID or IP and tells its whole story — risk band, the pack's tags deciphered, top CVEs, software and certs. Reads navi.db.

Attack paths

Ranked by path risk = target ACR + entry exploitability + credential pivot. Break the chain at the foothold, or harden the target.

Gate 1 — discovered IoT devices

Agent 1 tags each IoT : <name> (ephemeral, remove=True). Approve to queue gated writes.

Gate 2 — proposed new detections

Agent 3 asks: promote these auto-discovered plugins to the default detection registry? Approve = persist & reuse; Reject = remembered, never re-proposed.

Cross-reference candidates

Other assets sharing the expanded plugin signatures — possible IoT Agent 1 missed. Inspect the matching plugin output to judge false positives, then tag the asset IoT:<name> (gated) or mark it a false positive.

QA & detection registry

Bulk ACR — natural language

Describe what you want in plain English. The AI maps it to ACR changes across the live tag list; you preview every change before anything is written. (Uses on-device inference; falls back to a deterministic rule parser if unavailable.)

All tags

Live from navi explore info tags (not the tags table). Grouped by category — click a category to expand.

🏷 Tag a custom app — just say it

Describe the app in plain English (e.g. Tag my custom app navi). The agent finds the name + searches both vuln_route (app name) and vuln_paths (path), shows what it matched, and tags Custom App : <name> only after you confirm — paths via --query, routes via --route_id.

Planned MITRE tags

Each row = one Mitre : <impact/technique> applied to every asset whose findings cite that CVE. Approve, then apply.

High-risk assets (ACR > 7) with ATT&CK-mapped CVEs

These are the crown-jewel assets behind the “MITRE techniques on assets (ACR > 7)” insight — click to drill in.

Only routes/paths with an owner draw a thread; un-owned ones are listed as gaps below. Hover a node to trace its threads.

Owner workload

How much each owner carries — routes + paths assigned and the distinct assets behind them. A single owner on a large slice of the surface is a bottleneck.

📉 The reduction — CVE → Plugin → App → Path

Most teams track CVEs — the most duplicated unit of work. But multiple CVEs roll up into one plugin (a single detection & fix), multiple plugins into one app / route (the owner-actionable unit), and each app spreads across many paths (where it lives). Climb the ladder and the backlog collapses: own a handful of apps instead of tens of thousands of CVEs.

🔎 Double-filter — pick an app, see its paths

A route (app/device) links to a path when one of its plugins was found there — so one app can cover many paths. Filter by app on the left, then by its unique paths on the right. Paths that belong to no route are listed below as orphans — they need a direct owner.

Coverage gaps — Ownerless Risk

Ownerless Risk is exposure with nobody assigned to it — routes and paths hiding risk because no one is on the hook to fix them. Plus the under-owned surface (too few owners for all its assets). Assign these on the Ownership Assignment page.

AI assets

Assets running AI/ML software. Click a host to drill in, or ↗ to open it in Tenable One. Use Tag to label them (rename the value first if you like).

Tag with a sentence — natural language

e.g. "tag every non-human identity as NHI : automation, and tag root/admin as Identity : privileged". The model proposes per-identity tags; approve before any gated write.

Each identity maps to the asset(s) it was enumerated on. Tag labels those assets; ↗ opens the asset in Tenable One.

Credential coverage

⚠ Assets WITH a credential failure

These assets returned plugin 104410 — Nessus could not authenticate, so their scans are uncredentialed (results incomplete). Click a host to drill in.

By scanner

By policy

By scan

🔎 Assets

Search navi.db assets by hostname, IP, OS or network. Click a host to open its full detail.

🔎 Vulnerabilities

Search the vulns table — one row per finding — by plugin, ID, CVE, severity, or finding ID. Click a Finding ID to open it in the Tenable platform; click the asset for its deep-dive.

🔎 Plugins

Every distinct plugin in navi.db — search by ID, name, or family. Click to see affected assets + outputs.

🔎 Routes

Application routes from navi.db (vuln_route) — search by app name or type.

🔎 Paths

Filesystem paths discovered on assets (vuln_paths) — search by path text. Click a host to drill in.

Vulnerabilities & plugins

Click a plugin to see every asset it affects.

Certificates

Affected assets

Click an asset to see all of its findings and certificates.

Describe the ownership mapping

e.g. "give all payment & billing routes to VM Team, put /opt and nginx paths under Networking Systems, and assign the docker routes to Custom Apps." The agent matches each route/path and proposes an owner per item.

Capability & routing matrix

Where each job naturally lives. ✅ first-class · ☑ possible · — not supported.

Limits & handoffs that matter

✨ Ask the software inventory (NL→SQL)

Plain-English question → one read-only SELECT over the software table, joined to assets / vulns — note software.asset_uuid is a list string, matched with LIKE, not equality. e.g. "openssl versions on assets with ACR over 8" · "products on hosts that have a critical CVE" · "most common software on cloud assets".

Assets in this tag

From navi.db tags → assets. Click a host to open its full detail.