Vulnerability Monitoring - Summary; enable vulnerability monitoring

Introduction

To enable vulnerability monitoring and edit vulnerability monitoring global settings

The processes of a vulnerability monitoring scan

To schedule a vulnerability monitoring job

To view the results of a vulnerability monitoring job

Introduction:

From the Summary tab of the Vulnerability Monitoring page, you can view a summary of the following functionality (These settings are specified in the vulnerability monitoring settings.):

• Vulnerability Scan
  • Online Sync - if online synchronization is enabled.
  • NIST Data - if online synchronization for NIST data is enabled.
  • MSRC CVRF Data - if online synchronization for MSRC CVRF data is enabled.
  • Scan Deprecated CPEs - if deprecated CPEs are set to be scanned during the next scan.
  • Scan Unresolved Candidates - if CPE candidates don't need to be confirmed for their device(s) before being considered during scans. 
• Vulnerability Monitoring Status
  • Job Progress - which step is currently in progress for the job, or if the job has succeeded/failed once complete: Preparing Job; Importing Data Files; Syncing CVE API Data (if enabled); Syncing CPE API Data (if enabled); Syncing Match Criteria Data (if enabled); Syncing MSRC CVRF API Data (if enabled); Retiring Deprecated CPEs (if not 'Never'); Discovering CPE Candidates; Scanning for Vulnerabilities
  • Vulnerability Scan - progress of the current scan of the local CVE data files.
  • Last Run - timestamp of when the vulnerability scan was last completed.
  • Next Run - timestamp of when the vulnerability scan is next scheduled to run.
• Online Auto Sync
  • NIST CVEs - progress of the current online auto synchronization for the NIST CVE API data (if enabled and running).
  • NIST CPEs - progress of the current online auto synchronization for the NIST CPE API data (if enabled and running).
  • NIST Match Criteria - progress of the current online auto synchronization for the NIST Match Criteria API data (if enabled and running).
  • MSRC CVRF - progress of the current online auto synchronization for the MSRC CVRF API data (if enabled and running).
  • Connect Timeout - the amount of time the system waits to establish the online auto synchronization connection, in milliseconds. Default is 1 minute, or 60000 ms.
  • Read Timeout - the amount of time the client/target waits to receive data from the online auto synchronization, in milliseconds. Default is 1 minute, or 60000 ms.
• CPE Settings
  • Retire Deprecated CPEs - how long Entuity will wait before retiring deprecated CPEs (based on their NVD Last Modified value).
  • Minimum Candidate Criteria - minimum attributes required for a CPE candidate.
• CVE filters
  • Included CVSS Base - range of which CVSS Base Scores to be included/considered during scans. CVEs not within this CVSS base score range will be ignored.
  • Included Severities - which severities to be included/considered during scans. CVEs not matching any of the selecting severities will be ignored.
  • Last Modified - timeframe to be included/considered during jobs. CVEs not within the specified timeframe will be ignored.
• Disclaimers
  •  NVD Notice - disclaimer required by NVD about Entuity using the NVD API.

You can also edit global settings for the above functionality, and schedule, resume, or suspend vulnerability monitoring jobs of your network.

This tab is applicable only to servers, not configuration sets.

To enable vulnerability monitoring and edit vulnerability monitoring global settings:

1. Navigate to the Summary tab of the Vulnerability Monitoring page, and click Edit Global Settings at the top of the tab (or from the Overflow Menu).
   
   
   
   The Schedule Vulnerability Settings form is displayed.
2. Specify your preferences in the following sections:
   
   
3. Enable Online Sync - specify whether to enable or disable the automatic download of recent CVE data, match criteria, CPE dictionary changes, and Microsoft hotfix data from enabled APIs.
4. Download NIST Data - (available if Enable Online Sync is enabled) - specify whether to collect recent CVE data, match criteria, and CPE dictionary changes from the NVD API. 
   Notes to consider about downloading data for Entuity Vulnerability Monitoring:
   • Before downloading NIST Data, ensure you have at least 2.5 GB of disk space available, and allow a few hours for the initial download.
   • Vulnerability monitoring requires CVE data to raise vulnerabilities.
   • Vulnerability monitoring must have the match criteria to match CVEs to the specific CPEs that are applicable, otherwise matching CVEs and related CPE Names might be inaccurate.
   • Vulnerability monitoring requires the CPE Dictionary for detecting and updating deprecated and/or modified CPEs. It is also used for CPE Name/Attribute suggestions when adding CPE Names, thereby streamlining the process of finding suitable CPE Names.

5. Use NVD API Key - (available if Download NIST Data is enabled) - specify whether to use an NVD API key for API requests during online synchronization of NVD data. Using NVD API keys improves the robustness in networks where multiple users are using NVD resources, and reduces sleep times between API requests. To enable this feature:

   1. Select the Use NVD API Key option.
      The Credential field is displayed.
   2. If you don't already have one, go to the NVD website and request an NVD API key by filling out the Request an API Key form.
   3. Click the Credential field to open the Credential form.
      
   4. Either select an existing credential set that includes an NVD API key, or click the plus (+) sign to open the Create Credential form.
      
   5. If you selected an existing credential set in the previous step, skip to Step viii. If you opened the Create Credential form in the previous step, enter the credential name in the Credential Name field and optionally enter a description in the Description field.
   6. Leave the Credential Type field as API Key.
   7. Copy the NVD API key that you requested in Step ii and paste it into the API Key field.
   8. Click Done to return to the Credential form, and click Done again to return to the Schedule Vulnerability Settings form.
      Note, if you enable the Use NVD API Key feature, but you don't specify a credential in the Credential field, or if the credential that you specify is later deleted from Administration > Asset Credential Management, then the online sync for NVD data defaults back to the public rate limit. 

    

6. Download MSRC CVRF - (available if Enable Online Sync is enabled) - specify whether to collect recent Microsoft hotfix data from the Microsoft API, which is required to check if a raised vulnerability has been fixed. 
   Notes to consider about downloading MSCR CVRF data:
   • This is only applicable to Windows OS Server devices.
   • You can also manually download MSRC CVRF data files using the MSRC CVRF API 'Get Security Updates' operation.
   • The endpoint for this operation is: https://api.msrc/microsoft.com/cvrf/v2.0/cvrf/{CVRF-document-ID}.
   • The CVRF document ID is in the format: yyyy-mmm. For example, enter '2022-aug' to retrieve the security updates for August 2022.

   • The following is an example curl command:

     curl https://api.msrc.microsoft.com/cvrf/v2.0/cvrf/2022-aug > entuity_home/etc/msrc/2022-aug.json

   • Once manually downloaded, you can then import this data into Entuity by moving the appropriate data files into entuity_home/etc/vulnMon/msrcData. For more information on manually importing vulnerability monitoring data, see this article.
7. Connect Timeout (Ms) - optionally update the online auto synchronization connection timeout setting, in milliseconds.
8. Read Timeout (Ms) - optionally update the online auto synchronization read timeout setting, in milliseconds.

Scan Filters

1. Scan Deprecated CPEs - specify whether to scan CVEs for configurations that include deprecated CVEs.
   Deprecated CPEs are typically updated automatically if an updated CPE can be found, therefore you may not wish scan deprecated CPEs because these are outdated. This is disabled by default.
   Note, any Potential Vulnerability incidents that are opened when this setting is enabled are then closed when the setting is next disabled.
2. Scan Unresolved Candidates - specify whether to scan unresolved CPE candidates. This option is disabled by default. 
   If you are confident in your CPE mapping rules, you can enable this scanning of unresolved candidates, which means that CPE candidates do not need to be confirmed for their device(s) before being considered during scans. 
   Note, CPE candidates discovered for a device with CPE mapping rules are automatically allocated 'Unresolved Candidate' status, meaning that they are unconfirmed. You can resolve/confirm or remove/decline unresolved CPE candidates from the Device Management tab of the Vulnerability Monitoring page.

CPE Settings

1. Retire Deprecated CPEs - specify whether to automatically remove deprecated CPEs from your devices, and/or clean up your local CPE Dictionary, Never, Immediately, or After. If After, specify the time period after which to remove.
   • By default, deprecated CPEs are retired after 1 year (which is the timeframe in which they are retired from the official NIST CPE Dictionary).
   • If a CPE is retired with no updated CPE, it is deleted immediately.
   • If the CPE has an updated CPE, each device with the deprecated CPE is automatically updated and the old CPE is deleted from the device and the local dictionary.
2. Minimum Candidate Criteria - specify the minimum attributes required for a CPE candidate. By default, Entuity requires CPE candidates to specify at least the following three attributes: vendor, product, and version. Configure further minimum attributes with this field.

CVE Filters

1. Filter By - specify the parameter(s) by which you want to filter vulnerabilities to display, either Severity or CVSS Base Score.
   • Included Severities - available if Severity is selected for Filter By field. Specify the severity of vulnerabilities by which you want to filter. Choose one or more of Information, Minor, Major, Severe, and Critical.
   • Included CVSS Base Scores - available if CVSS Base Score is selected for Filter By field. Specify the CVSS base score by which you want to filter vulnerabilities. Choose from All, In Between, Greater Than, or Less Than, and if one of the latter three, you can specify the values (between 0 and 10 inclusive).
2. Filter By Last Modified - specify the date range by which to filter, either Any or After.

Once you have completed your changes, click Done to save and exit out of the form. Otherwise, click Cancel.

The processes of a vulnerability monitoring scan

Once any data is manually imported, and NIST and Microsoft MSRC data is updated (if enabled), a vulnerability monitoring scan executes the following:

• gets all enabled devices with their corresponding CPEs.
• scans against the NIST CVE data files (stored in entuity_home/etc/vulnMon/cveData) and checks against each device's CPE configuration for a match. 
  Note, the scan orders CVE data files by their index number (For example, a file with the name 'cveData(567).json' would have an index number of 567.). When importing data, it is recommended that you maintain this indexing system by giving your files an appropriate index number.
  • if a new match is found, a Potential Vulnerability event is raised (and corresponding Potential Vulnerability incident is opened).
  • if no match is found, but a matching CVE was previously raised on the device, a Potential Vulnerability Cleared event is raised to close the incident.
• performs a Windows Hotfix check for Windows OS Server devices (if MSRC CVRF data is enabled). The patch levels of Windows OS Servers are extracted from devices, and these matched against patched CVEs (if they have been raised against the device). If a match is found, a Potential Vulnerability Patched event is raised (and corresponding Potential Vulnerability incident is closed).

To schedule a vulnerability monitoring job:

Note, the initial download for online synchronization will require a few hours. Data downloads may fail. This is not usually a cause for concern, and can happen if there is a read or connect timeout on the API call. Running the job again resumes the download from where you left off. The default timeouts are both 60,000 ms (or 1 minute). These values can be changed using the Connect Timeout and Read Timeout fields on the Schedule Vulnerability Settings form, or using the read_timeout and connect_timeout settings in [vulnMon] under entuity.cfg.

1. Navigate to the Summary tab of the Vulnerability Monitoring page, and click Schedule Job at the top of the tab (or from the Overflow Menu).
   
   
    
   The Schedule Vulnerability Monitoring form is displayed.
2. Click the Schedule Vulnerability Scan field to open the Schedule form.
3. Using the switch, specify whether to use a Predefined Schedule or a New Schedule.

Predefined Schedule:

1. Predefined Schedule - specify either Weekly or Daily. 
   These are system schedules with the following parameters:
   • Weekly - every 7 days from Monday at 00:00. For example, if you specified a scan to be weekly on a Wednesday, the scan would first start at 00:00 on the following Monday.
   • Daily - every 24 hours from 00:00.

New Schedule:

1. Using the switch, specify whether to Start On Selected Date or Start Immediately. The form will update depending on your choice.
   
   
   
    
2. If you choose Start On Selected Date, specify the Start Time.
3. Recurrence - specify the schedule of the scan's recurrence, either None, Simple, or Calendar:
   • None - no further parameters are required.
   • Simple - in the following example, the scan is set to recur 3 times, at an interval of every 6 hours, starting at 10:28 on 9th June, 2026:
     
      
   • Calendar - specify the exact minutes, hours, days of the week, and months of the year in which the scan will run, and an end date, if required. For example, you might want to start the scan schedule at 11:25, 05 December 2026, and end it at 16:50, 12 February 2029, and run the scan on the 15th, 23rd, and 30th minute of the 4th, 10th, 16th, and 23rd hour of the day, on Tuesdays and Fridays, in March, April, July, and October.
4. Once you have completed your changes, click Done to save and exit out of the form. Otherwise, click Cancel.

To immediately start a vulnerability monitoring job:

1. From the Summary tab of the Vulnerability Monitoring page, click Schedule Job at the top of the tab (or from the Overflow Menu).
   The Schedule Vulnerability Monitoring form is displayed.
2. Click the Schedule Vulnerability Scan field to open the Schedule form.
3. Using the Predefined Schedule / New Schedule switch, select New Schedule.
4. Using the Start on Selected Date / Start Immediately switch, select Start Immediately.
5. Click Done. Otherwise, click Cancel.
    

To immediately start a vulnerability monitoring job with Run Now:

You can immediately start a vulnerability monitoring job and configure which tasks to run in the job by using the Run Now action. For example, you can start just the CPE Candidate Discovery task to test new CPE Mapping Rules. If a vulnerability monitoring job is currently running, the job initiated by the Run Now action is queued after the current vulnerability monitoring job is completed.

Note, only one vulnerability monitoring job initiated by Run Now can be queued at a time.

1. From the Summary tab of the Vulnerability Monitoring page, click Run Now from the Overflow Menu.
   
   
   
   The Run Now form is displayed. 
   Note, the settings on this form are dependent on, and superseded by, the global settings that you defined on the Schedule Vulnerability Settings form. 
   
   
2. Configure which tasks to start in the vulnerability monitoring job:
   • Process Imported Data - specify whether to process manually imported CPE and match criteria data and insert the data into the database. 
   • Online Auto Sync - specify whether to start the automatic download of CVE, CPE, match criteria, and Microsoft hotfix data from enabled APIs.
   • Download NIST Data - specify whether to start the automatic download of CVE, CPE, and match criteria data from the NVD API. 
     Note, this requires at least 2.5 GB of disk space.
   • Download MSRC CVRF Data - specify whether to start the automatic download of MSRC CVRF data from the Microsoft API.  
     Note, this is only applicable to Windows OS Server devices.
   • Retire Deprecated CPEs - specify whether to remove deprecated CPEs from the local dictionary if they’ve remained unchanged for x amount of time.
     Note, this is disabled if x is set to Never in the vulnerability monitoring global settings.
   • CPE Candidate Discovery - specify whether to use CPE Mapping Rules to automatically discover CPE candidates for enabled devices. 
   • Vulnerability Scan - specify whether to scan enabled devices with assigned CPEs for potential vulnerabilities/CVEs. 
3. Click Done to save your changes. Otherwise, click Cancel.
   A banner is displayed showing the status of the newly initiated vulnerability monitoring job. You can also view the progress of the job in the Vulnerability Monitoring Status section of the Vulnerability Monitoring page.

To view the results of a vulnerability monitoring job:

You can view the results of a vulnerability monitoring scan via the Security Analysis dashboard. This dashboard is available from the context of a View and a device.

During a scan, a CVE/vulnerability matched against a device raises a Potential Vulnerability event (and a corresponding Potential Vulnerability incident). The severity of the incident/event is determined by the CVE's CVSS Base Score, which is detailed as follows:

CVSS v2.0 Base Score	CVSS v3.x Base Score	CVSS severity	Entuity severity
n/a	0.0	none	information or cleared
0.0 - 3.9	0.1 - 3.9	low	minor
4.0 - 6.9	4.0 - 6.9	medium	major
7.0 - 10.0	7.0 - 8.9	high	severe
n/a	9.0 - 10.0	critical	critical

• Potential Vulnerability event - raised if a CVE is matched against a device. This opens the Potential Vulnerability incident. CVEs have three potential configuration types from which a match can be made. Potential vulnerability events are only raised where the CVE configuration matches the device's CPE configuration. Partial matches are not currently supported.
   

  • Basic - only one CPE needs to match for a device to be considered potentially vulnerable, e.g. cpe:2.3:a:fusionpbx:*:*:*:*:*:*:*:*
  • Running on/with - a combination of potentially vulnerable and non-vulnerable CPEs must be present, e.g. cpe:2.3:o:netgear:wnr3500u_firmware:1.2.2.44_35.0.53na:*:*:*:*:*:*:* running on/with cpe:2.3:h:netgear:wnr3500u:-:*:*:*:*:*:*:*
  • Advanced - a complex enumeration of CPEs must be present, e.g. cpe:2.3:a:hm-print_project:hm-print:1.2a:*:*:*:*:*:*:* AND cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:* AND cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*

  Note, the CVE is only matched against the first matching CPE configuration, e.g. if the CVE's configuration is cpe:2.3:a:fusionpbx:1.1:*:*:*:*:*:*:* OR cpe:2.3:a:fusionpbx:1.2:*:*:*:*:*:*:*, and both of those CPEs are assigned to the device, then only the first CPE checked contributes towards the potential vulnerability incident in Entuity.

• Potential Vulnerability Patched event - raised if patch levels of Windows OS Server devices are matched against patched CVEs. This closes the Potential Vulnerability incident.
• Potential Vulnerability Cleared event - raised if no CVE is matched against a device following an earlier match. This closes the Potential Vulnerability incident.

Note, you can reset CVEs on an enabled device or devices on the Device Management tab, which clears and forcibly expires all open and closed Potential Vulnerability events for the selected devices. Events that are forcibly expired in this way are shown in the various Entuity dashboards, dashlets, and reports as “Expired via Device Management 'Reset CVEs' action”.  For more information, see this article.