Vulnerability Scanning

Topics Discussed

Product Overview

The Vulnerability Scanning service provides for continuous vulnerability scanning. For Virtual Machines, the service is facilitated by a vulnerability scanning agent that is deployed with the Armor Agent (the "Scan Agent"). For container images, the service is facilitated by a container sensor deployed to a container host (the "Sensor").

Both the Scan Agent and Sensor collect information about the instance and includes basic asset identification information, Windows registry information (for Windows systems only), and file version and package information. This information is securely communicated to a scanning platform that assesses the data, determines the vulnerabilities that exist, and reports this data to customers in the Armor Management Portal (AMP). The Scan Agent and Sensor collect the information periodically throughout each day and reports the results to the platform. Armor posts vulnerability information in AMP on both a daily and weekly basis to represent the state of the instance as of the last scan report.

AMP provides information related to vulnerability information and includes vulnerability reports on a weekly basis. Each report contains details on the vulnerabilities identified, including the name and description of each vulnerability, the assets that are affected by each vulnerability, the CVSS score for the vulnerability, and the criticality rating (i.e., Critical, High, Medium, Low, or Informational). Customer can review the results by each vulnerability on a virtual machine/container image basis and by the criticality rating of the identified vulnerabilities.

Open

Armor's vulnerability scanning service puts our customers in control of their network. Keeping them ahead of the next threat through increased visibility, preparedness, and protection. Armor's service scans internal and external networks for technical vulnerabilities, patching, and compliance issues—providing clients with the ability to mitigate risk and ensure compliance.

Once the Scan Agent or Sensor is installed, the initial scan starts immediately. Subsequent scans take place daily (every 4 hours for virtual machines, every 24 hours for container images) and the data displayed on the Vulnerabilities tab is refreshed every day at 22:00 GMT (6pm CST or 7pm CST) depending on day light savings.

Weekly reports are generated at 22:00 GMT every Sunday. Weekly reports are available for 13 months. When a report is complete, it will be available in the Reports screen. Weekly Reports reflect imported data and does not initiate scans. Based on your dat's location and your environment, your report's availability in AMP may vary.

Vulnerabilities

You can use the Vulnerabilities screen to view information for a specific vulnerability scanning report within an interactive table.

Users can manually refresh the table data using the refresh data link at the top of the table, but the data displayed will only reflect the state of the environment at the time of the last interval scan. For example, if your next scheduled scan occurs at 4pm, refreshing the data will show the state of your environment at noon and not reflect any patching you did at 3:30pm.

This screen also displays severity levels for each detected vulnerability, along with the quantity of vulnerabilities detected for each severity level. A severity is assigned to a vulnerability based on the Common Vulnerability Scoring System (CVSS). CVSS is the accepted system to rate the severity status of a vulnerability. Armor uses NVD CVSS v3.0 to score vulnerabilities. To learn more, please see the National Vulnerability Database website.

You can use this information to prioritize how to troubleshoot these vulnerabilities, as well as understand how these vulnerabilities can affect your environment.

A user concerned with patching vulnerabilities will be primarily focused on the information in the Vulnerabilities tab.

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Vulnerability Scanning.

Clicking a Vulnerability Name will take the user to the detail screen for that vulnerability. The vulnerability detail screen includes a synopsis of the vulnerability, a table of affected assets, and the remediation guidance for the vulnerability.

The Affected Assets table includes:

• Asset Name

• If the asset has been excluded (see Vulnerability Exclusions)

• Asset ID

• Asset Type

• Date stamps for first and last time the vulnerability has been detected on the asset

Exclusions

Vulnerability Exclusions give users the ability to manage their vulnerability programs. Users can exclude vulnerabilities on specific reports or silence them to be addressed later.

Users can filter the table by any of the columns listed above.

Clicking the Menu icon to the right of the Expires On column allows users to View a read-only copy of the Exclusion Details or Remove Exclusions from the associated assets.

Reports

The Reports screen displays a table of completed reports. Reports are compiled and published on a weekly basis.

Armor generates a vulnerability report once a week on Sundays at 10:00PM UTC. These reports are stored for 13 months. This weekly report is valuable for Compliance and can be provided to auditors to illustrate patching activity over time. For example, a series of reports for an environment might show a decrease in Critical vulnerabilities over a span of weeks, showing actions taken to resolve detected vulnerabilities. A user concerned with patching vulnerabilities day to day will primarily focus on the Vulnerabilities tab.

Data from within a Report can be filtered either by Vulnerability or Virtual Machine using the tabs at the top of the report.

Enable Vulnerability Scanning for Virtual Machines

Use the following commands to manage the Vulnerability Scanning service within the Scan Agent.

Install Vulnerability Scanning:

Uninstall Vulnerability Scanning:

Detect log4shell

Vulnerability Scanning Help

Enable Vulnerability Scanning for Container Images

For instructions on how to get started with Container Images, please see the documentation provided here.

View a Report

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Vulnerability Scanning.

3. Click the Reports tab.

4. Locate and select the desired scan.

5. On the next screen, you can filter the table By Vulnerabilities or By VM (virtual machine / host).

Filter By Vulnerabilities

When you filter the table By Vulnerabilities, you will see:

Filter By Virtual Machines

You will only see vulnerabilities for your active virtual machines.

When you filter the table By VM (virtual machines / host) you will see:

Request a New Vulnerability Scan Report

A weekly vulnerability scan report is available in AMP. If you want a new report outside of the weekly report, you can request an "ad-hoc" report as needed.*

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Vulnerability Scanning.

3. Click the Reports tab.

4. Click Get New Report.

5. In the New Report Request window, click Submit.

   • The latest scan report will be requested, and will display in the list of reports on the Vulnerability Scanning screen in a Pending status.

   • You may need to refresh the page to view the report status.

*Assets not upgraded to Agent 3.0 are limited to one report every 24 hours.

Export a Report of Vulnerabilities

From the By Vulnerability section, you can also download a CSV report.

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Vulnerability Scanning.

3. Click By Vulnerability.

4. (Optional) Use the filter function to customize the data displayed.

5. Below the table, click CSV.

   • You have the option to export all the data (All) or only the data that appears on the current screen (Current Set).

Export a Report of a Virtual Machines

From the By VM section, you can also download a CSV report.

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Vulnerability Scanning.

3. Click By VM.

4. (Optional) Ue the filter function to customize the data displayed.

5. Below the table, click CSV.

   • You have the option to export all the data (All) or only the data that appears on the current screen (Current Set).

Log Search for Vulnerability Scanning

Users can search for Vulnerability events in Log Search. For instructions on how to access and use Log Search, please see our documentation here.

An example of Vulnerability logs can be seen below:

Open

For a full list of Log Search fields and descriptions, please visit our glossary here.

Related Documentation

• Vulnerability Scanning for Compliance

• Vulnerability Scanning Exclusions

• Vulnerability Remediation