# Pharus

> Documentation for Pharus: CRA Article 14 vulnerability handling for Nordic product companies. SBOM monitoring, reporting clocks, Art. 14(7) routing, ENISA SRP paste packs, coordinated disclosure, CSAF advisories and on-call paging.

- [Introduction](https://docs.pharussecurity.com/index.md): Pharus handles CRA Article 14 for product companies: it finds exploited vulnerabilities in your SBOMs, starts the clocks and prepares every report.
- [Quickstart](https://docs.pharussecurity.com/quickstart.md): Create a workspace, add a product family, match your first SBOM and get ready for the 24-hour clock, in about ten minutes.
- [Key concepts](https://docs.pharussecurity.com/concepts.md): The building blocks of Pharus: workspaces, product families, SBOMs, matches, incidents, awareness, clocks, routing and records.
- [Plans and features](https://docs.pharussecurity.com/plans.md): What Free, Starter, Core and Plus include, what the 14-day trial covers, and the add-ons you can buy on top.
- [Product families](https://docs.pharussecurity.com/monitoring/product-families.md): Add, edit and archive the product lines you ship. SBOMs, API tokens, matches, support periods and your plan all follow the product family.
- [SBOMs](https://docs.pharussecurity.com/monitoring/sboms.md): Send CycloneDX or SPDX SBOMs to Pharus by upload, from CI or from Dependency-Track, and see what Pharus read from each one.
- [Vulnerabilities](https://docs.pharussecurity.com/monitoring/vulnerabilities.md): How Pharus matches your SBOMs against OSV.dev, CISA KEV and ENISA EUVD, when a match opens an incident, and how to record a VEX status.
- [Support periods](https://docs.pharussecurity.com/monitoring/support-periods.md): Record until when each release line gets security updates, copy the sentence for the point of sale, and tell users when support ends.
- [Weekly digest](https://docs.pharussecurity.com/monitoring/weekly-digest.md): What the Monday exposure digest contains, who gets it, and how to preview it, test it or switch it off.
- [Incidents](https://docs.pharussecurity.com/incidents/overview.md): What an incident is in Pharus, the ways one opens, and how to work it from the awareness time to closing it.
- [Reporting clocks](https://docs.pharussecurity.com/incidents/clocks.md): How Pharus runs the CRA Art. 14 deadlines for the early warning, notification and final report, and warns you before each.
- [Decision record](https://docs.pharussecurity.com/incidents/decision-record.md): Record whether an incident is reportable under the CRA, with your rationale, evidence and four-eyes approvals that can't be changed afterwards.
- [Routing](https://docs.pharussecurity.com/incidents/routing.md): How Pharus works out which CSIRT receives your CRA reports under Art. 14(7), where you set the facts it uses, and how other regimes are triaged.
- [SRP paste pack](https://docs.pharussecurity.com/incidents/srp-pack.md): Copy each CRA report into ENISA's Single Reporting Platform field by field, then record the submission and the SRP's receipt in Pharus.
- [Norwegian notices](https://docs.pharussecurity.com/incidents/norwegian-notices.md): Assess GDPR and digitalsikkerhetsloven on an incident, follow each regime's own deadlines, and file with NSM and Datatilsynet from Norwegian paste packs.
- [DORA triage](https://docs.pharussecurity.com/incidents/dora.md): Classify an incident against Delegated Regulation (EU) 2024/1772, approve it with four eyes, and report a major incident to Finanstilsynet on time.
- [Inform users](https://docs.pharussecurity.com/incidents/inform-users.md): Draft the CRA Art. 14(8) notice to your users, send it through your own channels, and record when and how they were told.
- [Report upstream](https://docs.pharussecurity.com/incidents/report-upstream.md): Report a flaw in a third-party component to its maintainers under CRA Art. 13(6), from a draft Pharus writes, and track their answer and fix.
- [Expert help](https://docs.pharussecurity.com/incidents/expert-review.md): Ask a partner consultant to review an incident through a read-only link, and read their notes on the incident's Overview tab.
- [Drills](https://docs.pharussecurity.com/incidents/drills.md): Rehearse a CRA Art. 14 filing end to end with a tabletop drill: real clocks, a simulated SRP, and nothing sent to authorities.
- [Disclosure page](https://docs.pharussecurity.com/disclosure/disclosure-page.md): Set up your public disclosure page: the report form, hosted policy and privacy notice, security.txt and the address to forward security@ to.
- [Disclosure inbox](https://docs.pharussecurity.com/disclosure/inbox.md): Read, answer and triage vulnerability reports from your disclosure page and security mailbox, and declare an incident from one.
- [Security advisories](https://docs.pharussecurity.com/disclosure/advisories.md): Draft, review and publish CSAF 2.0 VEX advisories that tell customers which product versions a vulnerability affects and what to do.
- [On-call rota](https://docs.pharussecurity.com/on-call/rota.md): Set up a weekly on-call rota with a primary, a backup and a final escalation, so someone answers when a CRA clock starts on a Friday night.
- [Paging](https://docs.pharussecurity.com/on-call/paging.md): How Pharus texts the person on call, how acknowledging stops the escalation, and what happens when nobody answers within 15 minutes.
- [Notifications](https://docs.pharussecurity.com/notifications/overview.md): Every way Pharus tells your team something: emails, the notification bell, the weekly digest, on-call pages, and alerts to Slack, Teams and webhooks.
- [Audit trail](https://docs.pharussecurity.com/reports/audit-trail.md): The append-only log of every determination, approval, filing and setting in your workspace: how to read it, filter it and export it.
- [Board report](https://docs.pharussecurity.com/reports/board-report.md): The quarterly board report: one Oslo calendar quarter of vulnerability handling in ten sections, ready to print or save as PDF for the board pack.
- [Technical documentation (Annex VII)](https://docs.pharussecurity.com/reports/technical-file.md): Write the CRA Annex VII technical documentation per product family, sign sealed editions with the EU declaration of conformity, and download them.
- [Sign up](https://docs.pharussecurity.com/workspace/sign-up.md): Create your Pharus account, confirm your email address, set up your company, or join a company you were invited to.
- [Members and roles](https://docs.pharussecurity.com/workspace/members-and-roles.md): Invite colleagues, choose who is owner, admin or member, change roles and remove people from your company in Pharus.
- [Account security](https://docs.pharussecurity.com/workspace/account-security.md): Sign in, reset your password, set up two-step verification, verify your phone for paging and sign out of Pharus.
- [Companies](https://docs.pharussecurity.com/workspace/companies.md): Belong to several companies with one account, switch between them, start a new one and keep each company's settings up to date.
- [Billing](https://docs.pharussecurity.com/workspace/billing.md): The 14-day free trial, subscribing to Starter or Core, add-ons, extra product families, invoices, and what Free keeps when a subscription ends.
- [Data and deletion](https://docs.pharussecurity.com/workspace/data-and-deletion.md): Where Pharus stores your data, how to export it, delete your account or close a workspace, and when Pharus deletes data by itself.
- [FAQ](https://docs.pharussecurity.com/help/faq.md): Answers to the questions customers ask most about reporting, SBOMs, plans, data and support.
- [Glossary](https://docs.pharussecurity.com/help/glossary.md): Short definitions of the CRA, reporting and SBOM terms used in Pharus and in these docs.
- [Introduction](https://docs.pharussecurity.com/api-reference/introduction.md): Base URL, API tokens, request and response conventions, error codes and rate limits for the Pharus SBOM API.
- [Upload an SBOM](https://docs.pharussecurity.com/api-reference/sboms.md): POST /api/v1/sboms: send a CycloneDX or SPDX JSON SBOM for a product family from CI or any HTTP client.
- [Dependency-Track](https://docs.pharussecurity.com/api-reference/dependency-track.md): Forward every BOM that Dependency-Track 4.11 or later 4.x processes to Pharus with an Outbound Webhook alert, one per product family.
- [GitHub Actions](https://docs.pharussecurity.com/api-reference/ci/github-actions.md): Generate a CycloneDX SBOM with Syft on every GitHub release and send it to Pharus with curl.
- [Azure Pipelines](https://docs.pharussecurity.com/api-reference/ci/azure-pipelines.md): Generate a CycloneDX SBOM with Syft in Azure DevOps and send it to Pharus with curl, with the token kept as a secret variable.
- [GitLab CI](https://docs.pharussecurity.com/api-reference/ci/gitlab-ci.md): Generate a CycloneDX SBOM with Syft for every Git tag in GitLab CI/CD and send it to Pharus with curl.
- [Outgoing webhooks](https://docs.pharussecurity.com/api-reference/webhooks.md): The signed JSON POST Pharus sends to your endpoint: headers, body per event, how to verify the signature, delivery rules and how to respond.
- [CSAF feed](https://docs.pharussecurity.com/api-reference/csaf-feed.md): The public CSAF 2.0 endpoints for your TLP:WHITE advisories: provider metadata, index.txt, changes.csv, documents and hash files.
- [security.txt](https://docs.pharussecurity.com/api-reference/security-txt.md): The RFC 9116 security.txt Pharus generates for you: its fields, how Expires stays fresh, and how to serve it from your own domain.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.