> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medisao/share-through-viper-channels.md).

# Share advisories and remediations through VIPER channels

The **VIPER Channels** page is where manufacturers publish security content for the hospitals that run their devices. Hospitals receive it through ARPA-H VIPER, a vulnerability-management platform for hospitals (also called healthcare delivery organizations, or HDOs). Each device you opt in becomes a *channel*. On it you publish **advisories** (what the problem is) and **remediations** (what the hospital should do about it), and you answer **inquiries** hospitals send back about your remediations.

## Before you begin

* Your organization's plan must include MedISAO.
* The device must exist in your workspace. In a MedISAO-only workspace, select **Devices** in the sidebar to create or view devices. For the steps, see [Create your first device](/msi/get-started/create-your-first-device.md).
* The device must be opted in to VIPER channel discovery. When you pick a device in the forms below, opted-in devices are marked **(channel)** and others **(not opted in)**. You can create and publish content for a device that isn't opted in, but hospitals won't see it until the device is opted in.

{% hint style="warning" %}
**Only published content marked TLP:CLEAR or TLP:GREEN ever reaches VIPER.** Drafts stay private to your organization. The Traffic Light Protocol (TLP) marks how widely information can be shared: TLP:CLEAR is public, and TLP:GREEN is for the community. Channel content can only be marked with one of these two levels.
{% endhint %}

## How the page is organized

In the sidebar, select **VIPER Channels**. The page has four tabs:

| Tab              | What it's for                                                                                                               |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------- |
| **Advisories**   | Security bulletins you publish on your device channels.                                                                     |
| **Remediations** | Fixes, mitigations, and workarounds, with the clinical-impact details hospitals need to plan around them.                   |
| **Inquiries**    | Questions hospitals have raised about your published remediations.                                                          |
| **Protocol**     | The technical specification for how hospitals comment on remediations through VIPER, for sharing with integration partners. |

## Create and publish an advisory

1. On the **Advisories** tab, select **New advisory**.
2. Under **Source**, choose how to build the advisory:
   * **Manual:** You write it yourself.
   * **Graduate from a CVD disclosure:** You turn a vulnerability report you received into an advisory. Only disclosures assigned to your organization with the status **Fixed** or **Handled** are listed.
   * **Bundle OK'd SBOM findings:** You group vulnerabilities from your device's SBOM (software bill of materials) that you have reviewed into one advisory.
3. Select the **Device (channel)**.
4. Complete the fields for your source:

   * For **Manual**, enter a **Title** and **Description**. Both are required. Optionally list **Linked CVE / GHSA ids**.
   * For **Bundle OK'd SBOM findings**, enter a **Title** and list the **OK'd CVE / GHSA ids**. The description is optional.
   * For **Graduate from a CVD disclosure**, choose the **Disclosure**.

   Separate multiple IDs with commas or spaces, for example `CVE-2026-1234 GHSA-xxxx-yyyy-zzzz`.
5. Choose the **TLP**: **TLP:CLEAR (public)** or **TLP:GREEN (community)**.
6. Select **Create draft**. The advisory appears in the table with the status **Draft**.
7. Review the draft. When it's ready, select **Publish** in its row. The status changes to **Published**.

To take a published advisory off the channel, select **Unpublish**. It goes back to **Draft**.

### Get help writing the advisory

Select **Draft with AI** in an advisory's row. A window, **AI-suggested advisory draft**, shows a suggested **Title**, **Description**, and **Narrative**. Nothing is saved or published automatically. Copy what you want to keep.

The table's **Source** column shows how each advisory was created: **Manual**, **From CVD**, or **SBOM list**.

## Create and publish a remediation

1. On the **Remediations** tab, select **New remediation**.
2. Select the **Device (channel)**.
3. Optionally choose a **Linked advisory (optional)**. Only advisories on the device you selected are listed.
4. Choose a **Category**: **Vendor fix**, **Mitigation**, **Workaround**, **None available**, or **No fix planned**.
5. Choose a **Mechanism**: **Firmware / software patch**, **Network segmentation**, **Firewall rule**, **Access control change**, **Monitoring / detection**, or **Other**.
6. Choose the **TLP**.
7. Enter a **Description** and the **Guidance / steps** a hospital should follow, and list any **Fixed CVE / GHSA ids**.
8. Under **Clinical impact**, tell hospitals what applying the remediation means for patient care:
   * **Requires downtime**, and if so the **Estimated downtime (seconds)**
   * **Restart required**
   * **Disables features**
   * **Workflow impact**, for example which screens or settings move
   * **Clinical impact notes**, for example the best time to schedule the work
9. Select **Create draft**.
10. To attach patch notes, firmware, or another file, select **Attach file** in the remediation's row, choose a file (up to 100 MiB), and select **Upload**. Files go to VIPER only after the remediation is published. The **Files** column shows how many are attached.
11. When the remediation is ready, select **Publish**. Select **Unpublish** to take it back off the channel.

## Answer hospital inquiries

When a hospital has a question about one of your published remediations, it appears on the **Inquiries** tab with the **Device**, the **Question**, who it's **From**, its **Status**, and when it was **Received**.

1. Select **Answer** in the inquiry's row.
2. Read the question, type your answer, and select **Send answer**. The inquiry is marked **answered**. The hospital sees your answer the next time VIPER syncs with MedISAO.
3. If no further answer is needed, select **Close**. Closed inquiries can't be answered.

## Share the protocol with integration partners

The **Protocol** tab shows the Remediation Comments Protocol: how a hospital comments on your remediation without revealing its identity. The tab includes a public link that needs no login. Send that link to engineers who are integrating with VIPER.

## Next steps

* [Manage coordinated vulnerability disclosures](/medisao/manage-coordinated-vulnerability-disclosures.md): get a disclosure to **Fixed** or **Handled** so you can graduate it to an advisory.
* [Follow security advisories](/medisao/follow-security-advisories.md): see the advisories published across MedISAO.