> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medcrypt-documentation/medisao/share-through-viper-channels.md).

# Share advisories and remediations through VIPER channels

The **VIPER Channels** page is where manufacturers publish security content for the hospitals that run their devices. Hospitals receive it through ARPA-H VIPER, a vulnerability-management platform for hospitals (also called healthcare delivery organizations, or HDOs). Each device you opt in becomes a *channel*. On it you publish **advisories** (what the problem is) and **remediations** (what the hospital should do about it), and you answer **inquiries** hospitals send back about your remediations.

## Before you begin

* Your organization's plan must include MedISAO.
* The device must exist in your workspace. In a MedISAO-only workspace, select **Devices** in the sidebar to create or view devices. For the steps, see [Create your first device](/medcrypt-documentation/msi/get-started/create-your-first-device.md).
* The device must be opted in to VIPER channel discovery. When you pick a device in the forms below, opted-in devices are marked **(channel)** and others **(not opted in)**. You can create and publish content for a device that isn't opted in, but hospitals won't see it until the device is opted in.

{% hint style="warning" %}
**Only published content marked TLP:CLEAR or TLP:GREEN ever reaches VIPER.** Drafts stay private to your organization. The Traffic Light Protocol (TLP) marks how widely information can be shared: TLP:CLEAR is public, and TLP:GREEN is for the community. Channel content can only be marked with one of these two levels.
{% endhint %}

## How the page is organized

In the sidebar, select **VIPER Channels**. The page has four tabs:

| Tab              | What it's for                                                                                                               |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------- |
| **Advisories**   | Security bulletins you publish on your device channels.                                                                     |
| **Remediations** | Fixes, mitigations, and workarounds, with the clinical-impact details hospitals need to plan around them.                   |
| **Inquiries**    | Questions hospitals have raised about your published remediations.                                                          |
| **Protocol**     | The technical specification for how hospitals comment on remediations through VIPER, for sharing with integration partners. |

## Create and publish an advisory

1. On the **Advisories** tab, select **New advisory**.
2. Under **Source**, choose how to build the advisory:
   * **Manual:** You write it yourself.
   * **Graduate from a CVD disclosure:** You turn a vulnerability report you received into an advisory. Only disclosures assigned to your organization with the status **Fixed** or **Handled** are listed.
   * **Bundle OK'd SBOM findings:** You group vulnerabilities from your device's SBOM (software bill of materials) that you have reviewed into one advisory.
3. Select the **Device (channel)**.
4. Complete the fields for your source:

   * For **Manual**, enter a **Title** and **Description**. Both are required. Optionally list **Linked CVE / GHSA ids**.
   * For **Bundle OK'd SBOM findings**, enter a **Title** and list the **OK'd CVE / GHSA ids**. The description is optional.
   * For **Graduate from a CVD disclosure**, choose the **Disclosure**.

   Separate multiple IDs with commas or spaces, for example `CVE-2026-1234 GHSA-xxxx-yyyy-zzzz`.
5. Choose the **TLP**: **TLP:CLEAR (public)** or **TLP:GREEN (community)**.
6. Select **Create draft**. The advisory appears in the table with the status **Draft**.
7. Review the draft. When it's ready, select **Publish** in its row. The status changes to **Published**.

To take a published advisory off the channel, select **Unpublish**. It goes back to **Draft**.

### Get help writing the advisory

Select **Draft with AI** in an advisory's row. A window, **AI-suggested advisory draft**, shows a suggested **Title**, **Description**, and **Narrative**. Nothing is saved or published automatically. Copy what you want to keep.

The table's **Source** column shows how each advisory was created: **Manual**, **From CVD**, or **SBOM list**.

## Create and publish a remediation

1. On the **Remediations** tab, select **New remediation**.
2. Select the **Device (channel)**.
3. Optionally choose a **Linked advisory (optional)**. Only advisories on the device you selected are listed.
4. Choose a **Category**: **Vendor fix**, **Mitigation**, **Workaround**, **None available**, or **No fix planned**.
5. Choose a **Mechanism**: **Firmware / software patch**, **Network segmentation**, **Firewall rule**, **Access control change**, **Monitoring / detection**, or **Other**.
6. Choose the **TLP**.
7. Enter a **Description** and the **Guidance / steps** a hospital should follow, and list any **Fixed CVE / GHSA ids**.
8. Under **Clinical impact**, tell hospitals what applying the remediation means for patient care:
   * **Requires downtime**, and if so the **Estimated downtime (seconds)**
   * **Restart required**
   * **Disables features**
   * **Workflow impact**, for example which screens or settings move
   * **Clinical impact notes**, for example the best time to schedule the work
9. Select **Create draft**.
10. To attach patch notes, firmware, or another file, select **Attach file** in the remediation's row, choose a file (up to 100 MiB), and select **Upload**. Files go to VIPER only after the remediation is published. The **Files** column shows how many are attached.
11. When the remediation is ready, select **Publish**. Select **Unpublish** to take it back off the channel.

## Answer hospital inquiries

When a hospital has a question about one of your published remediations, it appears on the **Inquiries** tab with the **Device**, the **Question**, who it's **From**, its **Status**, and when it was **Received**.

1. Select **Answer** in the inquiry's row.
2. Read the question, type your answer, and select **Send answer**. The inquiry is marked **answered**. The hospital sees your answer the next time VIPER syncs with MedISAO.
3. If no further answer is needed, select **Close**. Closed inquiries can't be answered.

## Share the protocol with integration partners

The **Protocol** tab shows the Remediation Comments Protocol: how a hospital comments on your remediation without revealing its identity. The tab includes a public link that needs no login. Send that link to engineers who are integrating with VIPER.

## Next steps

* [Manage coordinated vulnerability disclosures](/medcrypt-documentation/medisao/manage-coordinated-vulnerability-disclosures.md): get a disclosure to **Fixed** or **Handled** so you can graduate it to an advisory.
* [Follow security advisories](/medcrypt-documentation/medisao/follow-security-advisories.md): see the advisories published across MedISAO.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.medcrypt.com/medcrypt-documentation/medisao/share-through-viper-channels.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.