a security information management system is described , wherein client - side devices preferably collect and monitor information describing the operating system , software , and patches installed on the device , as well as configuration thereof . a database of this information is maintained , along with data describing vulnerabilities of available software and associated remediation techniques available for it . the system exposes an api to support security - related decisions by other applications . for example , an intrusion detection system accesses the database to determine whether an actual threat exists and should be blocked .