Vulnerability Monitoring - Device Management

Introduction

CPE structure

Devices table

CPEs table

Introduction:

From the Device Management tab of the Vulnerability Monitoring page, you can view and configure devices for vulnerability monitoring. This tab has two tables - the Devices table and the CPEs table. By default, the Devices table lists all the devices in your network that are managed by Entuity. When you select a device in the Devices table, the CPEs table is populated with the CPE Names assigned to the selected device.

From this tab, you can enable and disable vulnerability monitoring for a selected device or devices, assign CPEs to a selected device or devices, and reset CVEs for a selected device or devices. There are no restrictions on which CPEs you can manually assign to a device (including custom devices and ping-only devices), meaning you can scan for potential vulnerabilities relating to, for example, hardware, OS/firmware, and applications.

You can also add CPEs (either individually or in bulk) from this tab, (which is useful if you can't find the CPE with CPE Search in the CPE Dictionary, or if you already know which CPE Names you want to add) and you can remove CPEs. Once added, you can perform a search on a selected CPE Name in the CPEs table to view its matching CPEs (including deprecated CPEs) and subset CPEs.

This tab also lets you view the CPE candidates that have been discovered through the use of CPE mapping rules. CPE candidates are only discovered for devices that have vulnerability monitoring enabled. Candidates are displayed in the CPEs table.

By default, devices are disabled for vulnerability monitoring.

This tab is applicable only to servers, not configuration sets.

CPE structure:

A CPE is an identifier used to match a vulnerability against hardware, an OS, or an application.

Entuity uses the CPE v2.3 Naming Specification for CPE names. The structure of CPE Names is as follows:

cpe:2.3:<part>:<vendor>:<product>:<version>:<update>:<edition>:<language>:<sw_edition>:<target_sw>:<target_hw>:<other>

where:

Devices table:

The Devices table lists all devices under management by Entuity. This table displays the following information.

To enable vulnerability monitoring for a device or devices:

1. Navigate to the Device Management tab of the Vulnerability Monitoring page.
2. From the Devices table, select the device(s) that you want to enable for vulnerability monitoring.
3. Click Enable at the top of the table (or from the Overflow Menu or right-click Context Menu).
   
   
    

To disable vulnerability monitoring for a device or devices:

1. Navigate to the Device Management tab of the Vulnerability Monitoring page.
2. From the Devices table, select the device(s) that you wish to disable from vulnerability monitoring.
3. Click Disable at the top of the table (or from the Overflow Menu or right-click Context Menu).
   
   
    
4. At the confirmation window that is displayed, click Yes to disable vulnerability monitoring for the selected device(s). Otherwise, click No.
   
   

To add/assign CPEs to a device or devices:

1. Navigate to the Device Management tab of the Vulnerability Monitoring page.
2. From the Devices table, select the device to which you want to assign a CPE.
3. Click Add CPEs at the top of the table (or from the Overflow Menu or the right-click Context Menu).
   
   
   
    The Add CPEs form is displayed.
   
   
   
   From this form, you can individually or bulk add CPE Names to the CPEs list that exists on the current server. You can remove a CPE or CPEs from this list with the Remove CPEs button.
   
   When you are ready to add a CPE or CPEs to the selected device(s), select the CPE Names from the list, and click Done. Otherwise, click Cancel.

Add CPE:

Click to add a single new CPE. You can add a new CPE by selecting Text Input or Attribute from the Input Method field:

• Text Input: Manually specify the CPE Name. You can paste in a CPE Name from the clipboard.
  
  
  
   
• Attribute: The CPE Name is created from the input fields below, each corresponding to a specific attribute for the CPE Name. Empty fields default to ANY, which are then formatted as a * wildcard in the CPE Name.
  
  The fields can be completed in any order, although it is recommended that you complete the Part, Vendor and Product fields first to narrow down the suggestions provided for the subsequent fields.
  
  
  
   
• When you click Done to add your new CPE, Entuity validates the CPE against the local CPE Dictionary with the following potential warnings:
  • '[CPE] was not found in the local CPE Dictionary. Do you still wish to add this CPE?' - Yes adds CPE, No resumes form.
  • '[CPE] is potentially too vague. [X] matching CPE(s) found! Thi smay significantly increase scan times. Do you still wish to add this CPE?' - Yes adds CPE, No resumes form.
  • '[CPE] has been deprecated by [Updated CPE]. Do you wish to add the updated CPE instead?' - Yes adds updated CPE, No adds original outdated CPE.
•  Any CPE Name added here then populates the list on the original Add CPEs form, like so:
  
  
  
   

Bulk Add:

Click to add multiple CPEs.



Enter a list of CPE Names, separated by either commas or new lines. You can directly paste in the CPE names that have been added to your clipboard using the Copy CPE Name(s) to Clipboard or Export options from the CPE tables of both the Device Management tab or the CPE Management tab (see this section for Device Management or this section for CPE Management).

CPE Names added here then populate the list on the original Add CPEs form, like so:



Add Existing CPEs: Click to add CPE Names that already exist on this server to the Add CPEs form.

The Add Existing CPEs form lists the CPE Names already existant on this. Select the CPE Names that you want to add, and click Done.



CPE Names added here then populate the list on the original Add CPEs form, like so:

Resetting CVEs on a device or devices 

When a vulnerability monitoring scan finds a CVE that matches a CPE on an enabled device or devices, the scan raises a Potential Vulnerability event (and corresponding Potential Vulnerability incident). That event is never raised again for the same match. However, you can reset CVEs for an enabled device or devices so that during the next vulnerability scan of the device(s), a Potential Vulnerability event can be raised again for that match. This is helpful, for example, if a potential vulnerability is detected during the commissioning and testing of a system, and then the system goes into production. Once in production, you can reset the CVEs on the device(s) to regenerate that Potential Vulnerability event.

Note, resetting CVEs clears and forcibly expires all open and closed Potential Vulnerability events for the selected devices. Events that are forcibly expired in this way are shown in the UI as “Expired via Device Management 'Reset CVEs' action”. 

To reset CVEs on a device or devices:

1. Navigate to the Device Management tab of the Vulnerability Monitoring page.
2. From the Devices table, select the device(s) whose CVEs you want to reset.
3. Right-click to open the Context Menu.
4. Click Reset CVEs.
   
   
    
5. From the confirmation window that is displayed, click Yes to reset the CVEs on the selected device(s). Otherwise, click No.
   
   
   
    

To view further details of a device:

1. Navigate to the Device Management tab of the Vulnerability Monitoring page.
2. From the Devices table, select the device for which you want to view further details and right-click to open the Context Menu.
3. Click Explore Device. 
   The Summary dashboard is displayed for that device.

CPEs table:

This table displays the following information:

To resolve unresolved CPE candidates:

Unresolved CPE candidates are CPE Names that have been discovered using CPE Mapping Rules (managed under the CPE Mapping Rules tab). Unresolved CPE candidates are listed in the CPEs table with the Status 'Unresolved Candidate'. The total count of unresolved CPE candidates for a device can be found on the Devices table under the Unresolved Candidates column.

By default, unresolved candidates are not scanned. You can edit this through the Scan Unresolved Candidates option on the Edit Global Settings form. Any candidate generated must match the rule specifications.

If you resolve an unresolved CPE candidate, it is added to the device(s) for the next scan. It loses its 'Unresolved Candidate' status and will be considered during scans (for example, the Scan Unresolved Candidates global setting is no longer applicable).

1. Navigate to the Device Management tab of the Vulnerability Monitoring page.
2. From the Devices table, select the device containing the unresolved CPE candidates.
3. From the CPEs table, select the unresolved CPE and click Resolve Candidates at the top of table (or from the Overflow Menu or right-click Context Menu). 
   Note, you can only resolve one CPE at a time.

To replace a CPE:

You can select a single CPE Name in the CPE table and replace it with another. The previous CPE Name is deleted from the server, and replaced with the new CPE Name. The new CPE Name is a new object. Any existing device associations are retained.

Note, you cannot replace multiple CPE Names at the same time. But if the CPE Name you want to replace is assigned to multiple devices, you can select one or more of those devices in order to replace that CPE Name on those multiple devices.

1. Navigate to the Device Management tab of the Vulnerability Monitoring page.
2. From the Devices table, select the device(s) that are assigned the CPE Name that you want to replace.
3. From the subsequently populated CPEs table, select the CPE Name you want to replace, and click Replace CPE above the table (or from the Overflow Menu or right-click Context Menu).
   
   
   
   The Replace CPE form is displayed. This is the same form as the Add CPE form (see above).
   
   
    
4. Once you have specified your new CPE Name, click Done to add the new CPE Name. Otherwise, click Cancel.
   Once added, the new CPE Name is displayed in the CPE table in place of the existing CPE Name.

To remove CPE Names from a device:

You can remove a CPE Name from a device using the Remove CPEs button. You can remove more than one CPE Name at a time, and can remove either resolved CPE Names or unresolved CPE candidates.

1. Navigate to the Device Management tab of the Vulnerability Monitoring page.
2. From the Devices table, select the device that is assigned the CPE Name(s) that you want to remove.
3. From the subsequently populated CPEs table, select the CPE Name(s) you want to remove from the device, and click Remove CPE above the table (or from the Overflow Menu or right-click Context Menu).
   
   
    
4. At the confirmation window that is displayed, click Yes to remove the selected CPE Name(s) from the device. Otherwise, click No..
   
   

To search for a selected CPE:

To help refine your assigned CPEs, you can search for and view how many matching CPEs there are (including deprecated CPEs), and if there are any subset CPEs, for a selected CPE:

1. From the CPEs table, select a CPE for which you want to perform a search.
2. Right-click to open the Context Menu.
3. Click Search for CPE.
   
   
   
   This takes you to the Search for CPE tab of the Vulnerability Monitoring page.
4. Click Search at the top of the Search for CPE tab or from the Overflow Menu.
   
   
   
   The CPE Name Search form is displayed with the name of the selected CPE populated in the Search field.
   
   
    
5. Optionally fill in any other search criteria, and click Done. For more information about the fields and search criteria on the CPE Name Search form, see this article.
   The search results are populated in the table under the Search for CPE tab of the Vulnerability Monitoring page.
    

To export CPE Names:

From the CPE table, you can select one or more CPEs to export. There are two ways to do this:

Copying to clipboard:

1. From the CPEs table, select the CPE Names you want to copy/export.
2. Right-click to open the Context Menu. 
3. Click Copy CPE Name(s) to Clipboard.
   
   
   
   This copies the selected CPE Name(s) to your clipboard as a comma-separated list, which means you can paste them in this format where needed, for example, when adding CPE Names in bulk (see above).

Table export:

1. From the CPEs table, select the CPE Names you wish to copy/export (no selection needed if you are exporting the entire table)
2. From the Overflow Menu, click Export.
   
   
    
3. On the Export Table Content form that is displayed, specify your export parameters, and click Done.
   
   
    
4. From the resultant .csv file, you can copy the CPE Name column and paste it where needed, e.g. when adding CPE Names in bulk (see above).