Audit Smart

Audit raw software strings collected from a host.

One item per input string, in request order, including strings that resolved to nothing - so this is the one audit endpoint where positions do line up. Join on input anyway: it costs nothing and survives the ordering ever changing.

Free text is resolved against the extended CPE catalog (NVD plus Vulners entries), while audit/software defaults to the official one. The catalog governs which CPE name an input resolves to, not which advisories a resolved CPE matches: given the same CPE both endpoints answer with the same advisory set. cpe reports what this endpoint resolved to, so feeding it to audit/software compares like with like; a product that has no official CPE is where the two would otherwise part company.

metrics is the advisory-level answer and both its halves are rollups: cvss is the highest score across the advisory's CVEs, epss the highest probability, carried as a one-element array. The full per-CVE listing lives in cvelistMetrics - that is the one place to ask for it. date and percentile in both blocks come from a single EPSS snapshot. If the EPSS store is unreachable, metrics.epss arrives empty rather than holding bare CVE ids.