Skip to content

Monitoring

Summary

When monitoring is enabled, the platform performs a daily analysis of the firmware. If there are new findings, you will receive an email listing the differences, or you can compare the two analyses directly on the platform.

A firmware analysis is a snapshot in time. The firmware image does not change after you upload it, but the world around it does: new CVEs are published every day against components that are already in your firmware, and vulnerability databases are continuously updated. An analysis that was clean last month may surface critical vulnerabilities today, without a single byte of the firmware changing.

Monitoring closes that gap. Instead of rerunning the analysis by hand, you let the platform reanalyze the firmware every day and notify you only when something actually changed. This helps you:

  • Catch newly disclosed vulnerabilities affecting firmware you have already shipped or are still maintaining.
  • Stay audit-ready. Continuous monitoring of products throughout their lifecycle is mandated by many cybersecurity guidelines.
  • Avoid manual busywork. You are notified of relevant changes instead of periodically rechecking each firmware yourself.

How it works

Once monitoring is enabled on a firmware, the platform repeats the following cycle once a day:

  1. Schedule. A daily background job collects every firmware that has monitoring enabled and queues a fresh analysis for each one.
  2. Reanalyze. Each firmware is analyzed again with its current Analysis Profile and configuration, so results stay comparable from one run to the next.
  3. Compare. When the new analysis finishes, the platform compares it against the firmware's previous analysis and counts the new and dropped issues, CVEs, and components.
  4. Notify. If – and only if – the comparison detects a change, an email summarizing the differences is sent to the firmware's uploader.

Every run is stored as a separate analysis under the Analysis History page; monitoring runs never overwrite each other.

Note

A monitoring run is only scheduled once the firmware has completed at least one successful analysis. The daily job runs at a fixed time (23:00 UTC by default) and skips any firmware whose most recent successful analysis finished less than 12 hours earlier, or that already has an analysis running.

What counts as a change?

A run is considered changed if there is at least one new or dropped item in the following categories:

  • Issues and CVEs — only vulnerabilities in an open status are compared. Findings you have already triaged to a closed status (for example Accepted risk, False positive, Fixed, or Not affected) are excluded, so resolving a finding does not generate noise on the next run.
  • Components — compared by Name, Version, and Update.

Only changed runs trigger an email.

Enable monitoring

There are multiple ways to turn on monitoring:

  • When uploading a firmware, click on Monitoring.
  • Enable Monitoring from any page within Firmware analysis view.
  • Enable Monitoring in the Firmware info page.

Note

Enabling or disabling monitoring requires the Admin, Manager, or Analyst user role.

Check monitoring result

Automatic email

The notification email sent to the firmware's uploader lists the new and dropped issues, CVEs, and components, with a link to the full comparison so you can review the differences in detail.

Compare analyses

  1. Select a firmware.
  2. Open the Analysis History page (under the History dropdown).
  3. Click the checkboxes next to the analyses you want to compare (you can select two).
  4. Click Compare firmwares.

By default, you will only see analyses that show changes compared to the previous one. To see all analyses uncheck Show changes only.

Automatic cleanup

Monitoring runs are kept for at least 7 days. After 7 days, runs with no change compared to the previous run are deleted automatically; runs that changed (or failed) are kept until they are 90 days old. The results of deleted runs remain available for download as an .xlsx file.

Manually triggered analyses are never deleted automatically.

Quick reference

Feature Details
Enable / disable Toggle from the upload form, any page in Firmware analysis view, or the Firmware info page. Requires the Admin, Manager, or Analyst role.
Prerequisite The firmware must have completed at least one successful analysis before monitoring runs.
Schedule Once a day (23:00 UTC by default). A firmware is skipped that day if its last successful analysis finished less than 12 hours earlier, or an analysis is already running.
Analysis profile Uses the firmware's current Analysis Profile and configuration so runs stay comparable.
Notification email Sent to the firmware's uploader, and only when the comparison detects a change.
What counts as a change A new or dropped open-status issue or CVE, or a new or dropped component (by Name, Version, and Update).
Automatic cleanup Monitoring runs are kept for at least 7 days; after that, runs with no change are deleted, while changed or failed runs are kept until they are 90 days old. Manually triggered analyses are never deleted automatically. Cleaned-up runs remain downloadable as .xlsx.