Vulnerability Monitoring - CPE Management

Introduction

CPE structure

CPEs table

Devices table

Introduction:

From the CPE Management tab under the Vulnerability Monitoring page, you can view and configure existing CPE Names, and add, modify, or delete CPE Names across the devices with which they are associated. You can add any CPE Name to any device, and you can perform a search on a selected CPE Name to view its matching CPEs (including deprecated CPEs) and subset CPEs.

This tab has two tables - the CPEs table and the Devices table. The CPEs table lists the CPE Name entries on the Entuity server. The CPEs table is populated by the CPEs that are assigned to managed devices in your network. This data is drawn from the CPE Dictionary database in the Entuity backend and requires the Online Sync be enabled for the latest changes.

You can manually add CPEs to this table (which is useful if you can't find it using CPE Search in the CPE Dictionary, or if you already know which CPE Names you want to add) and you can remove CPEs from the table. CPEs in the table are not necessarily required to be assigned to any devices. For example, you can disassociate a CPE from a device, and the CPE won't be removed from this table, but is marked as 'Unassigned' in the table and its Device Count is shown as 0.

Selecting a CPE from the CPEs table populates the Devices table with all the devices to which the selected CPE is associated.

This tab is applicable only to servers, not configuration sets.

CPE structure:

A CPE is an identifier used to match a vulnerability against hardware, an OS, or an application.

Entuity uses the CPE v2.3 Naming Specification for CPE names. The structure of CPE Names is as follows:

cpe:2.3:<part>:<vendor>:<product>:<version>:<update>:<edition>:<language>:<sw_edition>:<target_sw>:<target_hw>:<other>

where:

CPEs table:

This table displays the following information:

To add CPE Names:

You can add CPE Names to the CPEs table, from which you can then assign them to devices.

1. Navigate to the CPE Management tab of the Vulnerability Monitoring page.

2. Click Add CPEs at the top of the CPEs table (or via the Overflow Menu or right-click Context Menu).
   
   
   
   The Add CPEs form is displayed.

   
   
   
   From this form, you can individually or bulk add CPE Names to the CPEs list that exists on the current server. You can remove a CPE or CPEs from this list using Remove CPEs.

Add CPE:

Click Add CPE to add a single new CPE. You can add a new CPE by selecting Text Input or Attribute Form from the Input Method field:

• Text Input: manually specify the CPE Name in the CPE Name field. You can paste in a CPE Name from the clipboard.
  
  
  
   
• Attribute: The CPE Name is created from the input fields below, each corresponding to a specific attribute for the CPE Name. Empty fields default to ANY, which are then formatted as a * wildcard in the CPE Name.
  
  Complete the fields in any order, although it's best practice to complete the Part, Vendor and Product fields first to narrow down the suggestions provided for the subsequent fields.
  
  
  
   
• When you click Done to add your new CPE, Entuity validates the CPE against the local CPE Dictionary with the following potential warnings:
  • '[CPE] was not found in the local CPE Dictionary. Do you still wish to add this CPE?' - Yes adds CPE, No resumes form.
  • '[CPE] is potentially too vague. [X] matching CPE(s) found! This may significantly increase scan times. Do you still wish to add this CPE?' - Yes adds CPE, No resumes form.
  • '[CPE] has been deprecated by [Updated CPE]. Do you wish to add the updated CPE instead?' - Yes adds updated CPE, No adds original outdated CPE.

Any CPE Name added here then populates the list on the original Add CPEs form, like so:



 

Bulk Add:

Click Bulk Add to add multiple CPEs.



Enter a list of CPE Names, separated by either commas or new lines. You can directly paste in the CPE names that have been added to your clipboard with the Copy CPE Name(s) to Clipboard or Export options from the CPE tables of both the Device Management tab or the CPE Management tab (see this section for Device Management or the below section for CPE Management).

CPE Names added here then populate the list on the original Add CPEs form, like so:

To replace a CPE Name:

You can select a single CPE Name in the CPE table and replace it with another. The previous CPE Name is deleted from the server, and replaced with the new CPE Name. The new CPE Name is a new object. Any existing device associations are retained.

Note, you can't replace multiple CPE Names at the same time. But if the CPE Name you want to replace is assigned to multiple devices, that CPE Name is replaced on those multiple devices.

1. Navigate to the CPE Management tab of the Vulnerability Monitoring page.
2. From the CPEs table, select the CPE Name you wish to replace, and click Replace CPE above the table (or from the Overflow Menu or right-click Context Menu).
   
   
   
   The Replace CPE form is displayed. This is the same form as the Add CPE form (see above).
   
   
    
3. Once you have specified your new CPE Name, click Done. Otherwise, click Cancel.
   Once added, the new CPE Name is displayed in the CPE table in place of the existing CPE Name.

To assign CPEs to devices:

1. Navigate to the CPE Management tab under the Vulnerability Monitoring page.
2. From the CPEs table, select a CPE and click Assign to Devices at the top of the table (or from the Overflow Menu or right-click Context Menu).
   
   
   
   The Devices form is displayed, listing the devices under management by Entuity.
   
   
3. Select the device(s) to which you want to assign the CPE and click Done. Otherwise, click Cancel.

To search for a selected CPE:

To help refine your assigned CPEs, you can search for and view how many matching CPEs there are (including deprecated CPEs), and if there are any subset CPEs, for a selected CPE:

1. From the CPEs table, select a CPE for which you want to perform a search.
2. Right-click to open the Context Menu.
3. Click Search for CPE.
   
   
   
   This takes you to the Search for CPE tab of the Vulnerability Monitoring page.
4. Click Search at the top of the Search for CPE tab or from the Overflow Menu.
   
   
   
   The CPE Name Search form is displayed with the name of the selected CPE populated in the Search field.
   
   
    
5. Optionally fill in any other search criteria, and click Done. For more information about the fields and search criteria on the CPE Name Search form, see this article.
   The search results are populated in the table under the Search for CPE tab of the Vulnerability Monitoring page.
    

To delete CPE Names:

1. Navigate to the CPE Management tab under the Vulnerability Monitoring page.
2. From the CPEs table, select the CPE Name(s) you wish to delete, and click Delete CPEs at the top of the table (or from the Overflow Menu or right-click Context Menu).
   
   
    
3. Click Yes at the confirmation window that is displayed to delete the CPE Name(s). Otherwise, click No.
   
   

To export CPE Names:

From the CPE table, you can select one or more CPEs to export. There are two ways to do this:

Copying to clipboard:

1. From the CPEs table, select the CPE Names you want to copy/export.
2. Right-click to open the Context Menu. 
3. Click Copy CPE Name(s) to Clipboard.
   
   
   
   This copies the selected CPE Name(s) to your clipboard as a comma-separated list, which means you can paste the CPE Name(s) in this format where needed, for example, when adding CPE Names in bulk (see above).

Table export:

1. From the CPEs table, select the CPE Names you want to copy/export (no selection needed if you are exporting the entire table)
2. From the Overflow Menu, click Export.
   
   
   
   The Export Table Content form is displayed. 
   
   
    
3. Specify your export parameters, and click Done.
4. From the resultant .csv file, you can copy the CPE Name column and paste it where needed, for example, when adding CPE Names in bulk (see above).

Devices table:

The Devices table is populated with the list of devices to which the CPEs selected in the CPEs table above are assigned.

This table displays the following information.

To remove a device from the list of devices to which a CPE is assigned:

1. Navigate to the CPE Management tab under the Vulnerability Monitoring page.
2. From the CPEs table, select a CPE.
3. From the Devices table, select the device(s) to which you no longer want the specified CPE assigned.
4. Click Remove Devices at the top of the table (or from the Overflow Menu or right-click Context Menu).
   
   
    
5. Click Yes at the confirmation window to remove the device(s). Otherwise, click No.