Back
Canonical Names and what to watch out for

Canonical Names and what to watch out for

WARNING Publication date: 2023-08-30

At BaseFortify.eu (formerly HAITI), we use Canonical Names to standardize how vendors and products are displayed in the user interface (UI) while maintaining alignment with CVE and CPE conventions in the backend.

This ensures that data is both user-friendly and technically accurate, providing a seamless experience for security professionals tracking vulnerabilities and managing their infrastructure.

 

Why Canonical Naming Matters

The names of vendors and products in cybersecurity databases are often formatted differently than what users expect. CPE (Common Platform Enumeration) records and CVE (Common Vulnerabilities and Exposures) reports frequently use lowercase names and underscores, which can be confusing when displayed in an interface.

For example:

 

  • Microsoft is stored as microsoft in our database to match how CVEs and CPEs document vendor names.
  • Windows 11 is displayed in the UI for readability, even though its official CPE format is windows_11_22h2.

 

By applying Canonical Naming, we ensure that the platform remains consistent, clear, and easy to navigate while maintaining full compatibility with standardized security records.

 

Canonical Naming in Action

While our UI presents readable vendor and product names, it is crucial that users input new components using the correct CPE format.

When adding a new asset, users should rely on the PowerShell or Terminal commands we provide to retrieve the correct CPE notation.

For example, when identifying a system’s operating system:

 

PowerShell Command (Windows)

 

        Get-CimInstance Win32_OperatingSystem | foreach {Write-Output "cpe:/o:$($_.Caption):$($_.Version):"}

 

Expected output:

 

        cpe:/o:microsoft:windows_11_22h2:10.0.22621

 

Terminal Command (Linux/macOS)

 

        uname -a

 

Expected output:

 

        cpe:/o:canonical:ubuntu_linux:22.04

 

In these cases, the CPE name should be used exactly as retrieved to ensure proper vulnerability matching and accurate CVE tracking.

 

How BaseFortify Ensures Consistency

To prevent inconsistencies, BaseFortify automatically maps Canonical Names in the UI while ensuring that all backend processing, security monitoring, and CVE matching rely on the correct CPE annotation.

This dual approach provides:

 

✅ User-friendly UI labels – Making it easier to search, read, and manage assets.
✅ Technical accuracy – Ensuring security tools and vulnerability scans operate without issues.
✅ Standardized vulnerability matching – Aligning user input with global cybersecurity databases.

 

Final Thoughts

Canonical Naming bridges the gap between usability and technical accuracy, ensuring that CVE and CPE data remains structured while keeping interfaces readable. Users should always input components exactly as retrieved from PowerShell or Terminal commands to maintain data consistency and accurate vulnerability assessments.

 

For more details on CPE conventions and best practices, visit:
🔗 BaseFortify CVE Reports