Introduction to Vulnerability Monitoring

Introduction

Use cases

Performance

Terminology

To manage, view and monitor vulnerabilities

Configuring vulnerability monitoring for the first time, and example workflow

Permission requirements

Multi-server configuration

Vulnerability incidents and events

Viewing vulnerability monitoring data (dashboards and reports)

CPE Dictionary

Introduction:

Entuity lets you monitor your network devices for security vulnerabilities, as published in the NIST National Vulnerability Database (NVD)'s list of Common Vulnerabilties and Exposures (CVEs).

Entuity does this by scanning local CVE Data files to find potential vulnerabilities that are matched against the Common Platform Exposure (CPE) configurations assigned to the devices on your networks. Incidents and events can then be raised against any matched CVEs, thereby alerting you when new vulnerabilities are identified.

Entuity Vulnerability Monitoring requires internet connection, online syncing, and enabled downloads from NIST. For more information, see how to edit global vulnerability monitoring settings in this article. Vulnerability monitoring supports any type of device, including custom devices.

Use cases:

Vulnerability monitoring provides the following benefits:

• alerting when:
  • network devices are running a firmware version with known vulnerabilities.
  • servers are running with vulnerable packages or software.
  • server VMs are running an OS with known vulnerabilities.
• discovery of potential vulnerabilities to a customizable schedule.
• assignment of CPEs to devices, as suits your network requirements.
• raising of incidents and events with severities appropriate to the risk of the vulnerability.
• visibility of CVE number and URL to the corresponding NIST webpage from the Event Details of a raised vulnerability event.
• visibility of vulnerabilities from a View and device context.

Performance:

For best performance when running this functionality, Entuity recommends that vulnerability monitoring be run on a server with a minimum of 16 GB of RAM. If you have a lesser specified system, you can update the entuity.cfg file.

Before downloading NIST data, ensure that you have at least 2.5GB of disk space available.

Terminology:

• NIST - National Institutes of Standards and Technology
• CVE - Common Vulnerability and Exposure
• CPE - Common Platform Exposure
• CVSS - Common Vulnerability Scoring System
• NVD - National Vulnerability Database
• MSRC - Microsoft Security Response Center
• CVRF - Common Vulnerability Reporting Framework

To manage, view and monitor vulnerabilities:

You can manage, view, and monitor vulnerabilities from the Vulnerability Monitoring page, accessible from the Main Menu by clicking Administration and then Vulnerability Monitoring.

Vulnerability Monitoring tabs

Management functionality can be found under the following tabs, accessible at the top of the Vulnerability Monitoring page:

• Summary - configure the settings and schedule of the vulnerability scan, specify online data synchronization (to download the files required to run the vulnerability scan), and view the progress of running processes and vulnerability scanning.
• Acknowledged CVEs - view, add, and remove CVEs that are acknowledged or ignored during scans.
• Device Management - configure devices for vulnerability monitoring, including assigned CPEs.
• CPE Management - add, replace, and delete CPE Names on your network.
• CPE Search - search the local database for appropriate CPE Names using keywords, CPE attribute values, and/or CPE Names.
• CPE Mapping Rules - specify and manage mapping rules and groups used to discover potential/candidate CPEs. 
• Data Files - view a local repository of NIST data, and manually import and edit data files.
   

Use the server dropdown box in the top-left of the page to select the server on which you want to view vulnerability monitoring details and to manage vulnerability monitoring. If you are on the CPE Mapping Rules tab, you can use the dropdown to select servers or configuration sets (see the Multi-server configuration section).

Configuring vulnerability monitoring for the first time, and example workflow:

Set up vulnerability monitoring scanning:

1. Ensure that you are managing some devices on your network using Asset Management. 
   Vulnerability monitoring supports any type of device, including custom devices.

2. Navigate to the Summary tab of the Vulnerability Monitoring page. 
   From this tab, you can populate your server with the data required to run vulnerability monitoring scans. There are four types of data:

   • NIST CVE Data
   • NIST CPE Data
   • NIST Match Criteria Data
   • MSRC CVRF Data - this data is only necessary if you are planning to monitor Windows OS devices, and wish for patched vulnerabilities to automatically be closed.

   You can acquire this data in two different ways:

   • online synchronization (using the Edit Global Settings button on the Summary tab).
     
     
     
     With online synchronization enabled, when the vulnerability monitoring job is next run, these data sets are automatically synchronized to the most recent state. The initial download requires a few hours. Data downloads might fail. This is not usually a cause for concern, and can happen if there is a read or connect timeout on the API call. Running the job again resumes the download from where you left off. The default timeouts are both 1 minute. These values can be changed using the Connect Timeout and Read Timeout fields on the Schedule Vulnerability Settings form, or using the read_timeout and connect_timeout settings in [vulnMon] under entuity.cfg. 
   • manual import (using the Import Files button on the Data Files tab).
     
     
      

   You can monitor the status of downloaded data in the Online Auto Sync section of the Summary tab.
   
   
    

Schedule a vulnerability monitoring job:

1. Specify when to run a vulnerability monitoring job using the Schedule Job button of the Summary tab.
   
   
   
   You can specify the job to start immediately if you want. The vulnerability monitoring job has the following steps:
   1. Process Imported Data (if uploaded using Manual Import). 
   2. Download NIST CVE Data (if enabled in Global Settings).
   3. Download NIST CPE Data (if enabled in Global Settings).
   4. Download NIST Match Criteria Data (if enabled in Global Settings).
   5. Download MSRC CVRF Data (if enabled in Global Settings).
   6. Retire Deprecated CPEs (if not set to "Never" in Global Settings).
   7. Discover CPE Candidates using CPE Mapping Rules.
   8. Run Vulnerability Scan.
      
       

2. At this stage, none of your devices are enabled for vulnerability monitoring, so the job just runs for steps 1-5.

   • If you automatically synced data via online synchronization, this data is downloaded and processed into the local database during steps 2-5.
   • If you manually imported data, then the CPE, Match Criteria and MSRC data is processed into the local database in step 1.

   
   You can track which step the job is at in the Vulnerability Monitoring Status section of the Summary tab:
   
   
    

Enable devices for vulnerability monitoring:

For devices to be included in vulnerability monitoring jobs, you must enable them for vulnerability monitoring.

For CVEs/potential vulnerabilities to be matched and raised against your devices, you must assign appropriate CPEs to the devices.

1. Navigate to the Device Management tab, where you can view all the devices on your network and choose whether to enable or disable the devices for vulnerability monitoring.
   • Here you can set up some CPEs on your devices. CPEs are effectively the labels that are used to match the CVEs (vulnerabilities) against a device. You can assign any CPE you want to a device.
   • You can also manage CPEs and assign them to devices from the CPE Management tab. You can add CPEs individually or in bulk, and can manage the devices to which they are assigned.
   • If you do not already have a list of CPEs for your device(s), you can also find valid CPEs by searching for suggestions using the CPE Search tab. You can also find CPEs for your device, OS, or application using a search engine.
2. Navigate to the Acknowledged CVEs tab, where you can specify CVEs that will be acknowledged and therefore filtered out from (ignored by) scans. Acknowledged CVEs will not be matched against devices.

Run a vulnerability monitoring job

1. At this stage, you have the following:
   • a local store of CVE, CPE, Match Criteria, and MSRC CVRF data
   • device(s) enabled for vulnerability monitoring
   • CPEs assigned to enabled device(s)
2. Navigate back to the Summary tab and run the vulnerability monitoring job using the Schedule Job button. 
   Running the job then goes through all the steps mentioned above, including the Vulnerability Scan itself. You can check the progress of the scan under the Vulnerability Monitoring Status section of the Summary tab:
   
   

Results of a vulnerability monitoring scan:

1. Once a scan has run, from the Device Management tab you can see the potential vulnerabilities matched against a device in the Potential Vulnerabilities column of the devices table. You can also view the potential vulnerabilities on devices within a View, and on specific devices themselves, from the Security Analysis dashboard for either context.
2. When a vulnerability is found (a CVE is matched against a device), a Potential Vulnerability event (and a corresponding Potential Vulnerability incident) is raised, based on the CVSS severity.
   • If a previously raised CVE event is now patched for a CPE, a new event will be raised (Potential Vulnerability Patched event), which closes the previously raised incident.

Notes for CPEs:

• You can assign any CPE you want to a device. For example, if you know the libraries and applications a device is using, then you can curate the CPEs relevant to those libraries and applications and assign them to the devices.
• CPEs are not editable, but they can be replaced by new ones. CPEs can be managed per device (from the Device Management tab) or per the CPE itself (from the CPE Management tab).
• CPEs can be officially recognized by the local database (CPE Dictionary), or you can have unrecognized CPEs that do not necessarily match a CPE in the database. A CPE might also be part of a superset of CPEs, the name of which you can use to search for related CPEs via the CPE Search tab.
• CPEs might also become deprecated, and these will be automatically updated over time via the online synchronization. By default, deprecated CPEs are not scanned, but you can amend this in the vulnerability monitoring settings.
• From the CPE Mapping Rules tab, you can generate CPEs based on filtering conditions (specifying the devices to which the rules apply) and mapping actions.

Permission requirements:

Members of the Administrators user group have full access to vulnerability monitoring functionality.

You must explicitly assign other user groups access to vulnerability monitoring functionality through the Vulnerability Monitoring tool permissions. This enables users to:

• manage, view, and monitor potential vulnerabilities on devices.
• configure, schedule, and run vulnerability monitoring scans.
• enable devices for vulnerability monitoring.
• assign CPEs to devices and create CPE mapping rules. 

In addition to giving users the Vulnerability Monitoring tool permissions to access vulnerability functionality, you can control which devices the users can access on the Vulnerability Monitoring page. You do so by defining the user group No Access, Edit, or View access control settings when you create a view. A view's user group access control settings determine whether a user can view, edit, or delete specified devices, and thus whether a user can assign/manage CPEs and mapping rules for those devices. For more information on creating a view and defining user group access control settings for a view, see this article.

Note, users (given the Vulnerability Monitoring tool permissions) without access to the All Objects view can manage CPEs from the Vulnerability Monitoring page but can't view CPEs in Contents unless the CPEs are moved to a new/accessible view. 

For more information on user access permissions in Entuity, see this article.

Multi-server configuration:

You can sync CPE mapping rules across multiple servers using configuration sets (from the CPE Mapping Rules tab). All other Vulnerability Monitoring tabs are applicable only to the server to which you are logged in.

See this article for more information on managing server configuration sets in Entuity.

Vulnerability incidents and events

During a vulnerability monitoring scan, a CVE/vulnerability matched against a device raises a Potential Vulnerability event (and a corresponding Potential Vulnerability incident). The severity of the incident/event is determined by the CVE's CVSS Base Score, which is detailed as follows. Entuity supports CVSS v2.0, v3.0 and v3.1, but always shows the highest available version. The other version(s) are used as a fallback.

Note, this means that Potential Vulnerability incidents and events can have any Entuity severity. This is unlike other Entuity incidents and events that have a single fixed severity.

CVSS v2.0 Base Score	CVSS v3.x Base Score	CVSS severity	Entuity severity
n/a	0.0	none	information or cleared
0.0 - 3.9	0.1 - 3.9	low	minor
4.0 - 6.9	4.0 - 6.9	medium	major
7.0 - 10.0	7.0 - 8.9	high	severe
n/a	9.0 - 10.0	critical	critical

During a subsequent scan, if a CVE is no longer matched against the device, then a Potential Vulnerability Cleared event will be raised to close the incident.  The same will also happen if a CVE is 'acknowledged' under the Acknowledged CVEs tab of the Vulnerability Monitoring page.

Any Potential Vulnerability incidents that are opened when the Scan Deprecated CPEs setting is enabled in the vulnerability monitoring settings are then closed when that setting is disabled.

Viewing vulnerability monitoring data (dashboards and reports)

You can view the results of a vulnerability monitoring scan from the Security Analysis dashboard. This dashboard is available from the context of a View and a device. It displays vulnerability information such as open vulnerabilities, CPE status, and Potential Vulnerability incidents in the context of a View or device.

Potential Vulnerability incidents and events are also displayed on Incidents dashboards, Incidents List dashlets, Events dashboards and Events List dashlets.

You can also run reports on vulnerability monitoring data.

Note, you can reset CVEs for an enabled device, or devices, from the Device Management tab, which clears and forcibly expires all open and closed Potential Vulnerability events for the selected devices. Events that are forcibly expired in this way are shown in the various Entuity dashboards, dashlets, and reports as “Expired via Device Management 'Reset CVEs' action”.  For more information, see this article.

CPE Dictionary:

The CPE Dictionary is the local database that stores CPE data. This can be populated by manually importing files (see Data Files tab) or with auto sync (see Vulnerability Monitoring Settings on the Summary tab). If you cannot find a CPE Name in the CPE Dictionary, you can also manually add CPE Names using the Add CPEs functionality on the Device Management and CPE Management tabs.