The gap between "we know" and "we'd notice." Vulnerability management tells you what is exposed; detection engineering tells you when someone tries. The CVE that can't be patched this quarter falls into the gap between them — correlating detection rules to your actual findings closes it.
From your findings to deployable rules
Your findings, correlated
Every CVE in your scanner findings is checked against the rule index — the correlated view shows only rules that matter to your estate.
Three sources, one parse
Snort community, Emerging Threats and Vulnetix research, normalized: action, protocol, flow, classtype, confidence, signature severity, affected products and MITRE ATT&CK IDs.
Ranked by real exposure
Each matched CVE carries its Threat Exposure Score from 20+ enrichment sources and its Safe Harbour status, so rules covering exploited-and-unpatchable findings float to the top.
What's in a rule
YARA signatures are threat-hunting rules that scan files and memory for the payloads exploitation leaves behind; Snort/Suricata rules block or alert on exploit traffic at the wire. Every indexed rule carries its full parse and raw text, its MITRE ATT&CK technique and tactic IDs, and its provenance — audit before you deploy, in minutes.
The Safe Harbour cross-reference
When a matched CVE has no safe version to upgrade to, the rule is flagged as the best mitigation and floated to the top. This completes the loop that starts with Safe Harbour: a clean version when one exists, the rules that watch the door when one doesn't. Every finding gets an action, even the unpatchable ones.
Correlated for everyone, searchable for Pro
The correlated view is free for every authenticated account. The full Rule Catalog search is part of Pro, Teams and Enterprise. From the CLI: vulnetix vdb snort-rules get CVE-2024-38475, vulnetix vdb yara-rules list, vulnetix vdb attack-techniques and vulnetix vdb exploits -o json for the complete exploit-intelligence document. The /vulnetix:detection-rules agent skill generates Snort/Suricata rules, YARA signatures, Nuclei templates and traffic filters — capability-aware, so no Snort installed means no Snort output.