# Kernwatch tutorials

Short narrated videos of the real Kernwatch app - from creating your account to filing a CRA report. Each takes a few minutes.

The videos are narrated in English, with English captions in the picture.

Source: https://kernwatch.com/tutorials · Last updated: 2026-10-17

## 1. Getting started with Kernwatch (4:55)

Compare the four plans, create your account with a free trial of a paid plan, sign in to the dashboard and invite a colleague who joins your workspace.

Video: https://kernwatch.com/videos/kernwatch-1-getting-started.mp4

## 2. Products, releases and SBOMs (3:30)

Add a product and a release with its support period, upload an SPDX or CycloneDX SBOM, and look at the components, the dependency graph and the stored SBOM files.

Video: https://kernwatch.com/videos/kernwatch-2-products-and-sboms.mp4

## 3. Upload SBOMs from CI with an API key (2:28)

Create an API key, send a release's SBOM from your build pipeline with one HTTP call, see the upload in Kernwatch and revoke a key that is no longer needed.

Video: https://kernwatch.com/videos/kernwatch-3-ci-upload-api-keys.mp4

## 4. Vulnerability monitoring and the dashboard (3:06)

How Kernwatch checks every release against OSV, the CISA KEV catalogue and the EU Vulnerability Database, the findings of a release, the Vulnerabilities page, the CRA overview and alerts.

Video: https://kernwatch.com/videos/kernwatch-4-monitoring-and-dashboard.mp4

## 5. Triage, release comparison and SBOM export (2:49)

Record VEX decisions - not affected with a justification, or affected with a response - for one or several findings, compare two releases and export CycloneDX with VEX.

Video: https://kernwatch.com/videos/kernwatch-5-triage-diff-export.mp4

## 6. The CRA reporting workflow (4:12)

Open a reporting case for an exploited vulnerability, complete and sign off the early warning, record the filing with the ENISA reference and receipt, set the fix date and log the informed users.

Video: https://kernwatch.com/videos/kernwatch-6-cra-reporting.mp4

## 7. Vulnerability reports, advisories and technical documentation (3:59)

Your public vulnerability reporting page and security.txt, a security advisory published as CSAF, the technical documentation, the EU declaration of conformity and a link for authorities.

Video: https://kernwatch.com/videos/kernwatch-7-disclosure-advisories-docs.mp4

## 8. The action inbox (6:17)

How the inbox fills itself: triage suggestions with reasons, a reporting case for an exploited vulnerability, reports prepared for sign-off, the ENISA filing aid, fix detection and informing users.

Video: https://kernwatch.com/videos/kernwatch-8-action-inbox.mp4