CyberFOCUS

CyberFOCUS is a threat intelligence and remediation feature within BigFix UI that combines MITRE ATT&CK intelligence with CISA Known Exploited Vulnerabilities (KEV) metadata and BigFix Fixlet and device relevance data. It enables users to assess their security posture and take proactive remediation actions based on real-world threat intelligence.

Note: To access the CyberFOCUS application, the user must enable the CyberFOCUS site, the BigFix Scanner site, and the platform-specific Known Exploited Vulnerabilities sites from the BigFix Console.

CyberFOCUS combines MITRE ATT&CK intelligence with CISA Known Exploited Vulnerabilities (KEV) metadata and BigFix Fixlet and device relevance data in a single dashboard, providing interactive filtering, correlation of vulnerabilities with attack tactics, and detailed reporting to help organizations prioritize and act on critical threats efficiently. It enables organizations to act swiftly on critical threats, minimizing the risk of exploitation. By leveraging CyberFOCUS, security teams can streamline vulnerability management, improve compliance with regulatory frameworks, and strengthen their overall security posture through detailed reporting and audit-ready insights.

Prerequisites for CyberFOCUS

Complete the required licensing, operator access, and role assignments to enable the CyberFOCUS application for users in the BigFix UI.
Note:

  • You must have administrator rights in the BigFix Console to update license entitlements and operator permissions.

  • You must be logged in as an administrator in the BigFix UI to assign roles.

To grant a user access to the CyberFOCUS application, you must complete the following three-step procedure:

  1. Entitle the BigFix license to the CyberFOCUS site, the BigFix Scanner site, and the required platform-specific Known Exploited Vulnerabilities (KEV) sites. For full coverage, enable all of the following sites:

    • http://sync.bigfix.com/cgi-bin/bfgather/bigfixscanner

    • http://sync.bigfix.com/cgi-bin/bfgather/kevcontentwindows

    • http://sync.bigfix.com/cgi-bin/bfgather/kevcontentnix

    • http://sync.bigfix.com/cgi-bin/bfgather/kevcontentmacos

    • http://sync.bigfix.com/cgi-bin/bfgather/kevcontentmobile

  2. Grant the BigFix operator account permission to access the CyberFOCUS site, the BigFix Scanner site, and the enabled platform-specific KEV site or sites.

  3. Grant the user role access to the CyberFOCUS application in the BigFix UI:

    • Navigate to Administration > Identity management > User & Role Management. For more information, see Identity management.

    • When creating a new user or editing an existing role, navigate to the Applications step.

    • Turn on the toggle for the CyberFOCUS application.

    • Save the role configuration.

Result:

The user can now view and access the CyberFOCUS application under the Resolve menu in the BigFix UI.
Note: If the license is not entitled, the operator lacks site permissions, or the CyberFOCUS role is not assigned, the CyberFOCUS option will remain hidden from the user.

Vulnerability management

  • CyberFOCUS correlates published threat intelligence with BigFix remediation content and device relevance data to provide actionable vulnerability reporting.
  • The CISA KEV report uses the CISA Known Exploited Vulnerabilities catalog metadata. The MITRE APT report gets ATT&CK group-to-CVE mappings from MITRE ATT&CK data and enriches those CVEs with vulnerability metadata such as CVSS score, severity, due date, and remediation guidance from the CISA KEV catalog.
  • Each vulnerability is linked to Fixlets, enabling automated remediation of affected devices. Additionally, correlations with MITRE ATT&CK tactics help security teams understand exploitation methods and take proactive defense measures.

Reports

CyberFOCUS in BigFix UI includes two key reports:
  • CISA KEV Report – A collection of known exploited vulnerabilities. The CISA Known Exploited Vulnerabilities (KEV) web report uses the catalog metadata published by the Cybersecurity & Infrastructure Security Agency (CISA) and the associated CISA due dates, analyses and compares them with the patch levels of the devices in your BigFix environment, and visualizes the vulnerability intelligence as a bubble chart to assess and prioritize the vulnerabilities.
  • MITRE APT report – Maps adversary groups and ATT&CK techniques to related CVEs using MITRE ATT&CK data, then correlates those CVEs with CISA KEV metadata and BigFix Fixlet and device exposure data to help prioritize mitigation. The report visualizes the analysis as a bar chart to help you take an informed decision to mitigate the security threat.

Both reports share one page layout: a heading with an Updated stamp that shows when the data was last refreshed, a Summary section that holds the chart, and a CVEs section that holds the table. Switch between the reports with the CISA KEV and MITRE APT buttons in the upper right of the page; the active report is highlighted. Selecting a CVE in either table opens its CVE details page.

Note:
  • Both CISA KEV and MITRE reports are visualized using tables and charts.
  • By default, the dashboard displays the CISA KEV report.
  • The MITRE APT CVE view shows the intersection of MITRE ATT&CK CVE mappings, CISA KEV metadata, and BigFix exposure data. As a result, the report can contain fewer CVEs than a raw MITRE ATT&CK source list.

What the reports show by default

Each report applies a filter that keeps only the CVEs with an exposure count greater than zero, so the list reflects the work that remains rather than the whole published catalog. A CVE that no device is exposed to is filtered out rather than shown with a count of zero, and a CVE drops out of the report once it is fully remediated. The CISA KEV report also opens sorted by N° exposures in descending order, so the vulnerabilities that create the most work appear first.

Note: A report can list fewer CVEs than the published catalog contains. That is the default filter at work, not missing data.

How CyberFOCUS counts Fixlets, devices, and exposures

CyberFOCUS counts Fixlets, devices, and exposures in specific ways, and labels the same quantity differently on the report and on the details page. Use these definitions to read the counts correctly.

Table 1. CyberFOCUS counting terms
Term Definition Labels in the UI
Applicable Fixlet A Fixlet that addresses the CVE, whether or not it is currently relevant to any of your devices. Answers "how many Fixlets exist for this vulnerability". Because a device that is already patched no longer makes a Fixlet relevant, the applicable count can be higher than the relevant count. N° applicable Fixlets (CISA KEV table); # of applicable Fixlets (MITRE APT table); Applicable fixlet content (details)
Relevant Fixlet An applicable Fixlet that is relevant to at least one device, which means it still needs to be applied. Answers "how much work is left". As you remediate, this count falls while the applicable count stays the same. N° relevant Fixlets (CISA KEV table); # of relevant Fixlets (MITRE APT table); Relevant fixlet count (details)
Unique device A distinct device that the CVE affects, counted once however many Fixlets it needs. N° unique devices (CISA KEV table); Unique device count (details); # of Unique Devices (CISA KEV chart axis)
Exposure One mapping between a relevant Fixlet and an affected device. One device that needs three Fixlets is 3 exposures; two devices that each need the same three Fixlets are 6. N° exposures (CISA KEV table); # of exposures (MITRE APT table and chart axis); Exposure count (details)

Operations teams work from the relevant count, because it is the work to schedule. Security teams work from the applicable count, because compliance is measured against how many of the applicable Fixlets have been satisfied.

For example, a CVE in the CISA KEV report that shows N° applicable Fixlets 8, N° relevant Fixlets 2, N° unique devices 2, and N° exposures 2 has eight Fixlets that address it, six of which your devices already satisfy. Two devices are still affected, and two Fixlet-to-device mappings remain. Remediating both mappings drops the exposure count to zero, and the CVE then falls out of the default view.

Note: The two reports label these counts differently. The CISA KEV CVEs table uses the N° form, for example N° exposures. The MITRE APT table, the chart axes, the chart tooltips, and the chart data table panels all use the # form, for example # of exposures. The labels differ, but the quantity is the same.

Fixlet Creation & Cyber Focus Content Pack

  • The BigFix content team creates Fixlets.
  • The CISA KEV content pack provides Fixlets for vulnerabilities at no additional cost for those with CyberFOCUS.
  • Users can view vulnerability details in the BigFix Console or API.

Insights Gained from CyberFOCUS

By analyzing the CyberFOCUS dashboard, users can:
  • Identify high-risk vulnerabilities currently exploited in the wild.
  • Understand the impact on their organization based on affected devices.
  • Assess the urgency of patching based on severity and exploitation status.
  • Monitor remediation progress over time.
  • Correlate threats with MITRE ATT&CK tactics to understand attack techniques used by adversaries.

Actions Users Can Take

CyberFOCUS allows users to take direct remediation actions, including:

  • Automated Patching: Remediate vulnerable software and devices by deploying relevant Fixlets.
  • Isolation of Compromised Systems: Quarantine affected endpoints to prevent lateral movement.
  • Policy Enforcement: Apply security configurations to reduce exposure.
  • Threat Hunting: Investigate indicators of compromise (IoCs) linked to KEV vulnerabilities.
  • Reporting & Compliance: Generate reports for audits and compliance tracking.