Vulnerability Monitoring - CPE Mapping Rules

Introduction

CPE Mapping Rule structure

CPE Mapping Rule and Group types

Storing of System Rules and Groups

To add a CPE Mapping Rule

To add a CPE Mapping Group

To duplicate CPE Mapping Rules

Exporting and Importing CPE Mapping Rules and Groups

To enable/disable a CPE Mapping Group

To edit/delete a CPE Mapping Group

To add a CPE Mapping Rule to a group

To change the group to which a CPE Mapping Rule belongs

To move/add multiple CPE Mapping Rules to a group

To remove multiple CPE Mapping Rules from a group

To change the scan order of groups and rules

Multi-server configuration

Introduction:

From the CPE Mapping Rules tab under the Vulnerability Monitoring page, you can specify and manage CPE Mapping Rules and CPE Mapping Groups that are used to automatically discover potential/candidate CPEs (as long as vulnerability monitoring is enabled).

CPE Mapping Rules map and/or transform the values of Entuity's polled device attributes into specified CPE attributes. These CPE attributes are then used to generate potential CPEs, and the results found in the local CPE Dictionary are then assigned to the relevant device(s) as Unresolved Candidate CPEs. See this article for more information on resolving unresolved CPE candidates from the Device Management tab of the Vulnerability Monitoring page.

You can put CPE Mapping Rules into CPE Mapping Groups, which provide overruling filters to all rules within the groups. All rules belonging to a group are only used against a device if the parent group's conditions/filters are met. For example, if you wanted to apply rules to IBM devices, you would create the IBM group where only devices with the manufacturer containing 'ibm' are accepted.

The order of groups and rules in the table determines the order in which the rules are performed during a vulnerability monitoring scan.

This tab is applicable to both servers and configuration sets (see the Multi-server configuration section below).

The CPE Mapping Rules tab displays a table listing current system and user defined CPE Mapping Rules and Groups. The table displays the following information.

CPE Mapping Rule structure:

CPE Mapping Rules have the following structure:

1. Name
2. Conditions/filters:
   CPE Mapping Conditions are device filters that define the devices to which the rule's actions apply. Conditions are not mandatory for a CPE Mapping Rule - if a rule doesn't have a condition, its actions are therefore applied globally (to all devices on the network with vulnerability monitoring enabled), or to all devices that satisfy the parent Mapping Group's conditions.
    
3. Actions:
   CPE Mapping Actions are used to generate potential value(s) for a single CPE attribute, as defined by the CPE v2.3 Naming Specification. This includes the following potential attributes: part, vendor, product, version, update, edition, language, sw_edition, target_sw, target_hw, other. 
   There are two types of action:
   • Mapping actions 
   • Transformation actions

CPE Mapping Rule types:

CPE Mapping Rules and Groups can be either system or user defined. 

System rules and groups:

These are CPE Mapping Rules and Groups included with Entuity, by default, and are stored in entuity_home/etc/vulnMonMappings/system. System rules and groups cannot be edited or deleted, but you can enable/disable them and you can duplicate them (the duplicates being considered 'user defined' rules and groups and therefore can be edited). With system rules, you can add them to/move them between/delete them from user defined groups.

The system rules and groups included with Entuity are listed in the following table.

User defined rules and groups:

These are CPE Mapping Rules and Groups that you have added/edited. You can configure CPE Mapping Rules and Groups that more accurately, appropriately, and extensively fit your network's needs. These therefore take priority over system rules and groups during vulnerability monitoring scans (see the section in this article on changing the scan order of groups and rules).

Storing of System Rules and Groups

System rules and groups are stored and managed in a defined directory structure. System rules are saved as files named, “rule_system{name}.json”, while system groups follow the naming format “group_system{name}.json”. Both are located in the entuity_home/etc/vulnMonMappings/system directory.

Group files contain all of their underlying rules, ensuring that related rules are logically organized together.

All rules and groups in this directory are added (or updated) during configuration and are automatically included in every multi-server configuration set. They use the same JSON format as import/export for CPE Mapping Rules and Groups.

Removing a file from the entuity_home/etc/vulnMonMappings/system directory also removes the corresponding groups and rules during configure.

To add a CPE Mapping Rule:

1. Navigate to the CPE Mapping Rules tab of the Vulnerability Monitoring page and click Add Rule at the top of the tab (or from the Overflow Menu or right-click Context Menu).
   
   
    
   The Add CPE Mapping Rule form is displayed.
    
2. Fill out the different sections of the form:
   
   

Details

1. Name - specify a name for the Mapping Rule. This must be unique.

Mapping Conditions
 

1. Apply Filter - specify whether to apply a filter to the rule. 
   If enabled, the Operator Type field is displayed, from which you can choose either Logically ORed Filters or Logically ANDed Filters.
2. Click Add Filter to open the Add New Filter form, from which you can specify the filter using Filter Attribute and Filter Type.
   
   
    
3. Click Done to save your filter. 
   You can add as many filters as you want.

Mapping Actions

1. Click Add Action to open the Add CPE Mapping Action form. 
2. Add an Action Type of either Mapping or Transformation.
   
    
   • Mapping:
     
     
     
     A mapping action assigns the inputted value to the selected CPE attribute. Select an attribute from the CPE Attribute dropdown field, and specify a CPE Attribute Value. This must be a single value.
     
      In the previous example, the vendor is assigned to 'cisco', populating a CPE, for example, 'cpe:2.3:*:cico:*:*:*:*:*:*:*:*:*'.
     
      
   • Transformation:
     
     
     
     Transformation actions transform the value of a specified device attribute and assign it to the selected CPE attribute. By default, transformation actions trim whitespace, and transform the string to lower-case before performing the specified transformations. Transformations are performed in order, and you can reorder them.
     
     In the previous example, the transformation action generates values for the version by transforming the devVersion device attribute (this being the device's attribute). Three additional transformations have also been added in the example by using the Add Transformation feature. 
     
     Click Add Transformation to open the Add CPE Mapping Transformation form, from which you can add three types of transformation:
     • Replace All - replaces all instances of the Replace Match string with the Replace With string.
       
       
       
       In the example, all instances of '(' are replaced with '\(', for example, a device attribute value '14.3(EA)1' becomes '14.3\(EA)1'.
        
     • Capture Regex - captures/trims the device attribute value to only the first match of the regular expression.
       
       
       
       In this example, the transformation captures only the first three characters. So, if the device attribute value is '14.3(EA)1', it becomes '14.'.
       
        
     • Split By - splits the device attribute value by the string defined in Split By.
       
       
       
       In this example, the value is split by ','. So, if the device attribute value is 'hello, world', it is then split into two values: 'hello' and 'world'.
       
        
3. Click Done to save your mapping.

Add to Group

1. If you want to add a rule to a group, click Select Group to open the Add to Group form. Select from the groups you have created. It is not necessary for a CPE Mapping Rule to belong to a group.

Once you have specified the parameters of your rule, click Done to save your changes. Otherwise, click Cancel. The new CPE Mapping Rule is then displayed in the table under the CPE Mapping Rules tab.

To add a CPE Mapping Group:

1. Navigate to the CPE Mapping Rules tab of the Vulnerability Monitoring page and click Add Group at the top of the tab (or from the Overflow Menu or right-click Context Menu).
   
   
   
    The Create CPE Mapping Group form is displayed.
2. Fill out the sections of the form:
   
   

Details

1. Name - specify a name for the group. This must be unique.

Entry Conditions

1. Operator Type - specify either Logically ORed Filters or Logically ANDed Filters.
2. Click Add Filter to open the Add New Filter form, where you can specify the filter to be added by Filter Attribute (for example, 'Manufacturer') and Filter Type (for example, '=').

Once you have specified the parameters of your group, click Done to save your changes. Otherwise, click Cancel. 

Once saved, the group is displayed in the table under the CPE Mapping Rules tab with a folder icon beside its name to differentiate it from the CPE Mapping Rules.

Once you have added CPE Mapping Rules to a group, the rules are listed beneath the group in the table. In the following example, 'Test Rule 1' and 'Test Rule 2' are in the group 'Test Group', but 'Test Rule Without Group' is not in a group.
 

To duplicate CPE Mapping Rules

You can duplicate one or more CPE Mapping Rules for editing, which makes the rules become user defined rules. You can do this by selecting the rule, or rules, in the table and clicking Duplicate Rules from the Overflow Menu or right-click Context Menu.

Note, the Duplicate Rules menu option is disabled (grayed out) if you select a CPE Mapping Group in the table.

Exporting and Importing CPE Mapping Rules and Groups

You can share your user defined CPE Mapping Rules and Groups with other users and across different Entuity servers. You can do this by exporting (downloading) and then importing (uploading) the CPE Mapping Rules and Groups, in JSON format. System rules and groups can't be exported and imported, by default.

To export rules and groups:

1. From the CPE Mappings tab of the Vulnerability Monitoring page, click Download from the Overflow Menu or right-click Context Menu.
   
   
   
   The Download CPE Mapping Items form is displayed.
   
   
    
2. In the Filename field, enter the name of the JSON file that you want to download to your Entuity server.
3. Select the user defined CPE Mapping Rules and Groups that you want to download in the JSON file.
   Note, only top-level items are displayed. If you select a group (indicated by a folder icon next to its name), all of the rules belonging to that group are also exported/downloaded. 
4. Click Done to download the JSON file and close out of the form. Otherwise, click Cancel.
   You can now import the downloaded JSON file to a different Entuity server.
    

To import rules and groups:

1. From the CPE Mappings tab of the Vulnerability Monitoring page, use the Server dropdown field in the top-left of the page to select the server on which to import your CPE Mapping Rules and Groups.
2. Click Import from the Overflow Menu or right-click Context Menu.
   
   
   
   The Upload CPE Mapping Items form is displayed.
   
   
    
3. Click the Select File field, and navigate to the JSON file that you downloaded in the export procedure.
4. Either drag the JSON file to the Select File field or select the file and click Open.
   The JSON file name populates the Select File field.  
5. Click Next to open the Review Imported CPE Mapping Items form. 
   The rules and groups that you are about to import are listed on the form. A folder icon next to a name indicates a CPE Mapping Group and an exclamation (!) point next to a name indicates the CPE Mapping Rule or Group has a duplicate name.  
   
   
    
6. Optionally change the name of each rule or group that has an exclamation (!) point next to it by clicking the rule or group name, editing the value on the Rename form that is displayed, and clicking Done. 

7. Click Done to save your changes and close the form.
   If the rule or group has a duplicate name, and you didn't change the name in Step 6, a warning message is displayed that provides the option to resolve or dismiss the warning. Do one of the following:

   • Complete Step 6 and repeat Step 7 to resolve the duplicate rule or group name(s) and complete the import process.
   • Click Dismiss Warning. 
     Entuity then auto-indexes any duplicate names and completes the import process. For example, if demo_vendor is a duplicate rule name, Entuity automatically auto-indexes/changes the rule name to demo_vendor(1). 

   
   The newly imported rules and groups are now displayed in the table on the CPE Mapping tab of the Vulnerability Monitoring page. 

To enable/disable a CPE Mapping Group:

CPE Mapping Groups are enabled by default, with the exception of the three system groups included with Entuity. 

To manually enable/disable groups, select the group in the table and click Enable Group/Disable Group from the Overflow Menu or right-click Context Menu.

To edit/delete a CPE Mapping Group

You can manually edit and delete user defined CPE Mapping Groups. System groups can't be edited or deleted, by default.

To manually edit/delete a CPE Mapping Group, select the group in the table and click Edit Group/Delete Group from the Overflow Menu or right-click Context Menu

Edit Group: The Edit CPE Mapping Group form provides the same fields as the Create CPE Mapping Group form. (see above)

Delete Group: Deleting a group does not delete the child rules within it, but automatically disables those child rules. When deleting a group, a deletion confirmation dialog is displayed.

To add a CPE Mapping Rule to a group:

You can specify the group membership of a CPE Mapping Rule when creating it, or you can select the group from the table under the CPE Mapping Rules tab and click Add Rule to Group from the Overflow Menu or right-click Context Menu. This opens the Add CPE Mapping Rule to Group form, which is the same as the Create CPE Mapping Rule form, but with the Select Group field automatically populated.

To change the group to which a CPE Mapping Rule belongs:

1. From the table under the CPE Mapping Rules tab, select the CPE Mapping Rule that you want to change and click Edit Rule from the Overflow Menu or right-click Context Menu.
   Note, to change the group to which a system rule belongs, use the Move Rules to Group menu option. See To move/add multiple CPE Mapping Rules to a group.
2. In the Select Group field, specify the new group to which you want to move this rule.
3. Click Done to save your change. Otherwise, click Cancel. 
   The table updates to display the rule below its new parent group.

To move/add multiple CPE Mapping Rules to a group:

You can select multiple CPE Mapping Rules to move or add to a group at one time:

Note, Top Level system rules can't be moved into system groups (but can be moved into user defined groups). Also, Sub Level system rules that already belong to a system group can't be moved out of/removed from that system group. For more information about Top Level and Sub Level scan orders, see changing the scan order of groups and rules.

1. Use the ctrl key to select multiple CPE Mapping Rules from the table under the CPE Mapping Rules tab, and click Move Rules to Group from the Overflow Menu or right-click Context Menu.
   
   
   
   
   The Move CPE Mapping Items to Group form is displayed. 
   
   
    
2. Click the Select Group field. 
   The Add to Group form is displayed, providing a list of the available CPE Mapping Groups.
   
   
    
3. Select the group to which you want to add the rules, and click Done.
   You are returned to the Move CPE Mapping Items to Groups form with the newly selected group populating the Select Group field.
   
   
    
4. Click Done to save your changes and exit the form. Otherwise, click Cancel.
   The table updates to display the rules below their new parent group.

To remove multiple CPE Mapping Rules from a group:

You can remove multiple CPE Mapping Rules from a group at one time:

Note, Sub Level system rules that already belong to a system group can't be removed from that system group. For more information about Sub Level scan orders, see changing the scan order of groups and rules.

1. Use the ctrl key to select multiple CPE Mapping Rules from the table under the CPE Mapping Rules tab, and click Move Rules to Group from the Overflow Menu or right-click Context Menu.
   
   
   
   The Move CPE Mapping Items to Group form is displayed. 
   
   
    
2. Click the Select Group field. 
   The Add to Group form is displayed, providing a list of the available CPE Mapping Groups.
   
   
    
3. Click Remove Group and click Done to remove the selected CPE Mapping Rules from the group. 
   You are returned to the Move CPE Mapping Items to Groups form with the NO GROUP value in the Select Group field.
   
   
    
4. Click Done to save your changes and exit the form. Otherwise, click Cancel.
   The table updates with the rules no longer listed beneath the group.

To change the scan order of groups and rules:

The order of groups and rules in the table determines the order in which the rules are performed during a vulnerability monitoring scan.

There are two order options:

• Top Level Order 
• Sub Level Order

If a group is ordered above a rule that is not in a group, then the rules within that group will be executed before the rule that is not in a group. For example, if an order is as follows:

1. Separate Rule
2. Group
   1. Group Rule 1
   2. Group Rule 2
   3. Group Rule 3
3. Another Separate Rule

Then the execution of CPE Mapping Rules is as follows:

1. Separate Rule
2. Group Rule 1
3. Group Rule 2
4. Group 3
5. Another Separate Rule

Top Level Order:

This changes the scan order of groups and rules that are not groups.

1. From the CPE Mapping Rules tab, click Change Top Level Order at the top of the tab (or from the Overflow Flow Menu or right-click Context Menu).
   
   
   
   The Change Top Level Order form is displayed.
    
2. Fill out the sections of the form:
   
   
    
3. Drag the groups/rules into your preferred order, and click Done. Otherwise, click Cancel. 
   The vulnerability monitoring scan now executes in this new order.

Sub Level Order:

This changes the scan order of CPE Mapping Rules within a specified group.

1. From the CPE Mapping Rules tab, select one or more CPE Mapping Rules that are in the same group, and click Change Sub Level Order at the top of the tab (or from the Overflow Flow Menu or right-click Context Menu).
   
   
    
   The Change Sub Level Order form is displayed.
2. Drag the rules into your preferred order.
   
   
    
3. Click Done to save your changes. Otherwise, click Cancel. 
   The vulnerability monitoring scan now executes within this group in this new order.

Multi-server configuration:

If you have a multi-server configuration, you can sync CPE Mapping Rules across multiple servers using configuration sets. Use the server/config set dropdown field in the top-left to specify the server or configuration set to which you want to apply the CPE Mapping Rules.

For more information on managing server configuration sets, see this article.