IBM Partner Pavilion Proventia Network Enterprise Scanner User Manual

Download

Page 1

IBM Proventia Network Enterprise Scanner

User Guide Version 2.3



Page 2

U.S. Government Users Restricted Rights — Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Publication Date: February 2009

Page 3

Trademarks and Disclaimer

IBM®and the IBM logo are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. ADDME RealSecure®, SecurePartner™, SecurityFusion™, SiteProtector™, System Scanner™, Virtual Patch®, X-Force®and X-Press Update are trademarks or registered trademarks of Internet Security Systems or both. Internet Security Systems, Inc. is a wholly-owned subsidiary of International Business Machines Corporation.

Microsoft in the United States, other countries, or both.

Other company, product and service names may be trademarks or service marks of others.

References in this publication to IBM products or services do not imply that IBM intends to make them available in all countries in which IBM operates.

Disclaimer: The information contained in this document may change without notice, and may have been altered or changed if you have received it from a source other than IBM Internet Security Systems (IBM ISS). Use of this information constitutes acceptance for use in an “AS IS” condition, without warranties of any kind, and any use of this information is at the user’s own risk. IBM Internet Security Systems disclaims all warranties, either expressed or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall IBM ISS be liable for any damages whatsoever, including direct, indirect, incidental, consequential or special damages, arising from the use or dissemination hereof, even if IBM Internet Security Systems has been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

™

, Ahead of the threat, BlackICE™, Internet Scanner®, Proventia®,

, Windows®, and Windows NT®are trademarks of Microsoft Corporation

™

, Inc. in the United States, other countries,

Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by IBM Internet Security Systems. The views and opinions of authors expressed herein do not necessarily state or reflect those of IBM Internet Security Systems, and shall not be used for advertising or product endorsement purposes.

Links and addresses to Internet resources are inspected thoroughly prior to release, but the ever-changing nature of the Internet prevents IBM Internet Security Systems, Inc. from guaranteeing the content or existence of the resource. When possible, the reference contains alternate sites or keywords that could be used to acquire the information by other methods. If you find a broken or inappropriate link, please send an email message with the topic name, link, and its behavior to mailto://support@iss.net.

Page 4

iv Enterprise Scanner: User Guide

Page 5

Trademarks and Disclaimer ......iii

About this book ...........vii

Related publications ...........viii

Technical support contacts .........viii

Part 1. Scanning from the Proventia

Manager ..............1

Chapter 1. Ad hoc scanning in the

Proventia Manager ..........3

Section A: Network configuration .......4

Configuring the management network interface . 4 Configuring the scanning network interface . . . 5 Configuring scanning interface DNS settings . . 6 Assigning perspective to a scanning interface . . 7

Configuring routes for perspective ......7

Section B: Policy configuration ........8

Defining assets for a discovery scan .....8

Displaying assessment checks by groups ....9

Displaying information about assessment checks 10

Selecting assessment checks with filters ....11

Configuring common assessment settings for an

Assessment policy ...........12

Defining assessment credentials for a policy . . 16 Defining the service names associated with TCP

and UDP ports ............18

Defining ports or assets to exclude from a scan 19 Configuring and saving a scan policy in the

Proventia Manager ...........20

Chapter 2. Interpreting scan results in

the Proventia Manager ........21

Running an ad hoc scan ..........22

Monitoring the status of a scan ........23

Viewing the results of an ad hoc scan .....24

Exporting scan results from Proventia Manager . . 24

Purging scan data from the database ......25

Part 2. Scanning from the

SiteProtector Console .......27

Chapter 3. Enterprise Scanner policies 29

Policy inheritance with Enterprise Scanner policies 30 Deploying an Enterprise Scanner policy from the

policy repository ............31

Migrating a locally managed Enterprise Scanner

agent into SiteProtector ..........32

Viewing asset or agent policies for Enterprise

Scanner................33

Getting vulnerability help for a SiteProtector

Console without Internet access .......34

Agent policies for Enterprise Scanner ......35

Agent policy descriptions for Enterprise Scanner 35

Network Locations policy ........36

Notification policy ...........38

Access policy .............39

Networking policy ...........40

Services policy ............43

Time policy .............44

Update Settings policy..........45

Asset policies for Enterprise Scanner ......45

Asset policy descriptions for Enterprise Scanner 45

Discovery policy............46

Assessment policy ...........48

Assessment Credentials policy .......55

Scan Control policy ...........57

Scan Window policy ..........59

Scan Exclusion policy ..........61

Network Services policy .........62

Ad Hoc Scan Control policy ........64

Chapter 4. Understanding scanning

processes in SiteProtector ......67

What is perspective? ...........68

Defining perspectives ...........69

Scan jobs and related terms .........71

Types of tasks .............72

Priorities for running tasks .........73

Stages of a scanning process .........74

Optimizing cycle duration, scan windows, and

subtasks for Enterprise Scanner........76

Chapter 5. Background scanning in

SiteProtector ............79

Determining when background scans run ....80

How policies apply to ad hoc and background scans 81 Background scanning checklists for Enterprise

Scanner................83

Enabling background scanning ........84

Defining when scanning is allowed ......85

Defining ports or assets to exclude from a scan . . 87

Defining network services .........88

Defining assessment credentials for a policy . . . 89

Chapter 6. Monitoring scans in

SiteProtector ............91

Viewing your scan jobs ..........92

Viewing discovery job results ........92

Viewing assessment job results ........93

Chapter 7. Managing scans in

SiteProtector ............95

Stopping and restarting scan jobs .......96

Suspending and enabling all background scans . . 97

Minimum scanning requirements .......98

Page 6

Scanning behaviors for ad hoc scans ......99

Part 3. Maintenance........139

Chapter 8. Interpreting scan results in

SiteProtector ...........103

OS identification (OSID) certainty ......104

How OSID is updated in Enterprise Scanner . . . 105 Setting up a Summary view for vulnerability

management .............106

Summary page for vulnerability management . . 106 Viewing vulnerabilities in the SiteProtector Console

using Enterprise Scanner .........108

Viewing vulnerabilities by asset in Enterprise

Scanner ..............108

Viewing vulnerabilities by detail in Enterprise

Scanner ..............111

Viewing vulnerabilities by object in Enterprise

Scanner ..............113

Viewing vulnerabilities by target operating

system in Enterprise Scanner .......114

Viewing vulnerabilities by vulnerability name in

Enterprise Scanner...........115

Running reports in the SiteProtector Console . . . 117

Types of assessment reports ........117

Viewing an Enterprise Scanner report in the

SiteProtector Console ...........119

Chapter 9. Logs and alerts......121

Log files and alert notification ........122

System logs ..............123

Getting log status information .......124

Enterprise Scanner (ES) logs ........124

Downloading Enterprise Scanner (ES) log files 126

Alerts log ..............127

Downloading and saving an Alerts log ....128

Clearing the Alerts log .........129

Finding specific events in the Alerts log . . . 129

Chapter 10. Ticketing and remediation 133

Ticketing and Enterprise Scanner .......134

Remediation process overview for Enterprise

Scanner ...............135

Remediation tasks for Enterprise Scanner ....136

Chapter 11. Performing routine

maintenance............141

Shutting down your Enterprise Scanner ....142

Removing an agent from SiteProtector .....143

Options for backing up Enterprise Scanner . . . 144

Backing up configuration settings ......145

Making full system backups ........146

Chapter 12. Updating Enterprise

Scanner..............147

XPU basics ..............148

Updating options ............149

Configuring explicit-trust authentication with an

XPU server ..............150

Configuring an Alternate Update location ....151

Configuring an HTTP Proxy ........153

Configuring notification options for XPUs ....153

Scheduling a one-time firmware update ....154

Configuring automatic updates .......154

Manually installing updates ........156

Chapter 13. Viewing the status of the

Enterprise Scanner agent ......157

Proventia Manager Home page .......158

Viewing agent status in the SiteProtector Console 160

Viewing agent status ...........160

Viewing the status of the CAM modules ....161

Troubleshooting the Enterprise Scanner sensor . . 161

Part 4. Appendixes ........163

Appendix. Safety, environmental, and

electronic emissions notices .....165

Index ...............177

Enterprise Scanner: User Guide

Page 7

About this book

This section describes the audience for this guide; identifies related publications; and provides contact information.

Audience

Users of this guide should understand their network topology, including the criticality of network assets. In addition, because Enterprise Scanner can be managed through the SiteProtector Console, you must have a working knowledge of the SiteProtector system, including how to set up views, manage users and user permissions, and deploy policies.

Topics

“Related publications” on page viii

“Technical support contacts” on page viii

Page 8

Related publications

Use this topic to help you access information about your Enterprise Scanner appliance.

Publications

The following documents are available for download from the IBM ISS Documentation Web site at http://www.iss.net/support/documentation/.

v IBM Proventia Network Enterprise Scanner Version 2.3 Quick Start Card (Models

ES750 and ES1500)

v IBM Proventia Network Enterprise Scanner Version 2.3 Getting Started Guide

v IBM Proventia Network Enterprise Scanner Version 2.3 User Guide

License agreement

For licensing information on IBM Internet Security System products, download the IBM Licensing Agreement from http://www.ibm.com/services/us/iss/html/ contracts_landing.html.

Technical support contacts

IBM Internet Security Systems (IBM ISS) provides technical support through its Web site and by email or telephone.

The IBM ISS Web site

The IBM ISS Customer Support Web page at http://www.ibm.com/services/us/ iss/support/ provides direct access to online user documentation, current versions listings, detailed product literature, white papers, and the Technical Support Knowledgebase.

Hours of support

The following table provides hours for Technical Support at the Americas and other locations:

Table 1. Hours of technical support

Location Hours

Americas 24 hours a day

All other locations Monday through Friday, 9:00 A.M. to 6:00

P.M. during their local time, excluding IBM ISS published holidays Note: If your local support office is located outside the Americas, you may call or send an email to the Americas office for help during off-hours.

Contact information

For contact information, go to the IBM Internet Security Systems Contact Technical Support Web page at http://www.ibm.com/services/us/iss/support/.

viii Enterprise Scanner: User Guide

Page 9

Part 1. Scanning from the Proventia Manager

This section explains how to manage scans from the Proventia Manager for the Enterprise Scanner agent.

Chapters

Chapter 1, “Ad hoc scanning in the Proventia Manager,” on page 3

Chapter 2, “Interpreting scan results in the Proventia Manager,” on page 21

Page 10

2 Enterprise Scanner: User Guide

Page 11

Chapter 1. Ad hoc scanning in the Proventia Manager

This chapter explains how to use perspective and the high-level processes behind ad hoc scanning from the Proventia Manager.

Section A: Network configuration

“Configuring the management network interface” on page 4

“Configuring the scanning network interface” on page 5

“Configuring scanning interface DNS settings” on page 6

“Assigning perspective to a scanning interface” on page 7

“Configuring routes for perspective” on page 7

Section B: Policy configuration

“Defining assets for a discovery scan” on page 8

“Displaying assessment checks by groups” on page 9

“Displaying information about assessment checks” on page 10

“Selecting assessment checks with filters” on page 11

“Configuring common assessment settings for an Assessment policy” on page 12

“Defining assessment credentials for a policy” on page 16

“Defining ports or assets to exclude from a scan” on page 19

“Configuring and saving a scan policy in the Proventia Manager” on page 20

Page 12

Section A: Network configuration

This section explains how to define the network interfaces for the management and scanning ports, how to assign perspectives to network interfaces, and how to configure the Enterprise Scanner appliance to select routes for traffic.

Configuring the management network interface

Use the Management Interface tab on the Network Interface Configuration page on the appliance to configure the management interface network settings (ETH0).

About this task

You configured the management interface when you set up the appliance with the Proventia Setup Assistant. Use the procedures in this topic to change those settings.

Procedure

1. Click Configuration → Network Interfaces in the navigation pane.

2. Click the Management Interface tab, and then type or change the following

information:

Option Description

Host Name The fully qualified domain name for the

Interface The management port used by the

IP address The IP address of the management interface

Subnet Mask The IP address of the subnet mask for the

Gateway The address of the network gateway.

Enterprise Scanner agent. Use the format:

gateway1.example.com

Enterprise Scanner agent.

for the agent.

agent.

3. Select the Use Persistent IP if sensor is behind NAT if you want to avoid conflicts with NAT rules, and then provide the IP address.

4. Click Save Changes.

4 Enterprise Scanner: User Guide

Page 13

Configuring the scanning network interface

Use the Scan Interface tab on the Network Interface Configuration page on the appliance to configure the scanning interface network settings (ETH1 - ETH5).

About this task

You configured the scanning interface when you set up the appliance with the Proventia Setup Assistant. Use the procedures in this topic to change those settings.

Procedure

1. Click Configuration → Network Interfaces in the navigation pane.

2. Click the Scan Interface tab, and then type or change the following

information:

Option Description

Interface The Ethernet port of the interfaces for the

agent.

IP Address The IP address of the scanning network

interface for the agent.

Subnet Mask The IP address for the scanning network

interface subnet mask of the agent.

Gateway The address of the network gateway.

Maximum IPs per discovery subtask The maximum number of IP addresses to

discover in a subtask (of a task for each scan job). Note: This value applies to all discovery scans that the agent runs.

Maximum assets per assessment subtask The maximum number of assets to scan in a

subtask (of a task for each scan job). Note: This value applies to all assessment scans that the agent runs.

Perspective (network location) The name of the network location to

associate with this scanning port. Values: Global, the default, and any network locations defined in the Network Locations policy.

3. Click Save Changes.

Chapter 1. Ad hoc scanning in the Proventia Manager 5

Page 14

Configuring scanning interface DNS settings

Use the DNS tab on the Network Interface Configuration page on the appliance to configure the DNS settings for the scanning interface.

About this task

You configured these settings when you set up the appliance with the Proventia Setup Assistant. Use the procedures in this topic to change those settings.

Procedure

1. Click Configuration → Network Interfaces in the navigation pane.

2. Click the DNS tab.

3. Choose an option:

If you want to... Then...

Specify DNS settings

Add a DNS search path

Edit a DNS search path

Copy and paste a DNS search path

Remove a DNS search path

Change the order of a DNS search path

1. Type the IP addresses for the primary, secondary, and tertiary DNS servers.

2. Click Save Changes.

1. In the DNS Search Path section, click the

Add icon.

2. Type the domain name to add to the search list, and then click OK.

3. Click Save Changes.

1. In the DNS Search Path list, select a

domain name, and then click the Edit icon.

2. Edit the domain name, and then click OK.

3. Click Save Changes.

1. In the DNS Search Path section, select a

domain name, and then click the Copy icon. The agent copies the search path to the clipboard.

2. Click the Paste icon. The agent copies the search path to the end of the list.

3. If necessary, edit the policy, and then click OK.

4. Click Save Changes.

1. In the DNS Search Path section, select a

domain name, and then click the Remove icon.

2. Click Save Changes.

1. In the DNS Search Path section, select a

domain name.

2. Click the Up or Down arrows. Tip: It is more efficient to place the most

likely used search path at the top of the list.

3. Click Save Changes.

6 Enterprise Scanner: User Guide

Page 15

Assigning perspective to a scanning interface

Use the Network Locations tab on the Network Locations page on the appliance to assign a perspective (network location) to a scanning interface.

About this task

You can only configure the ETH0 and ETH1 interfaces in Proventia Setup. You must configure the remaining interfaces on this page (Network Locations page). When you register the agent with SiteProtector, the perspectives you set here (ETH2 - ETH5) are not automatically imported by the Network Locations policy in SiteProtector. You must redefine those perspectives for this policy in SiteProtector.

Procedure

1. Click Configuration → Network Locations in the navigation pane.

2. Click the Network Locations tab.

3. Click the Add icon.

4. Type a name for the perspective in the Network Locations Name field, and

then click OK.

Important: You can only assign one unique perspective per scanning port. You

cannot assign the same perspective to more than one scanning port.

Configuring routes for perspective

Use the Routes tab on the Network Locations page on the appliance to configure the appliance to select paths for (routes) traffic.

About this task

In a multi-segmented network, you might experience unnecessary network traffic if your agent traffic is routed through your default gateway. You can reduce network traffic if you configure routes for perspectives that provide more direct routes to targeted segments.

Procedure

1. Click Configuration → Network Locations in the navigation pane.

2. Click the Routes tab.

3. Click the Add icon.

4. Complete the following fields:

Option Description

Perspective The perspective for which you are defining a

route.

Destination Network A network segment for which you want to

define a specific route for a perspective.

Gateway The IP address of the router the agent

should use to find IP addresses in the Destination Network. Use the IP address that is on the same network as the agent, not the IP address of the route from inside the target segment.

Chapter 1. Ad hoc scanning in the Proventia Manager 7

Page 16

Option Description

Metric If you configure more than one route to the

5. Click Save Changes.

Section B: Policy configuration

This section explains how to configure policy settings in order to manage vulnerabilities.

Defining assets for a discovery scan

Use the Discovery policy type on the Policy Management page on the appliance to configure a policy that defines the parameters used to perform a discovery scan on a portion of a network.

Before you begin

Before it can perform OS fingerprinting on an asset, your agent must find one open and one closed port. To find an open and a closed port, the agent scans ports 1–1023 and any other ports specified in the applicable Network Services policy.

same segment for one perspective, a number that indicates the preferred route. The closer to 1, the more preferred the route. Note: The numbers you use do not have to be consecutive.

About this task

In a discovery task, a range of IP addresses is scanned to locate active network interfaces, and the type of device associated with each active network interface is determined through OS identification.

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Select Discovery from the Policy Types list, and then click Add.

3. Type a name for the scan policy.

4. Type the IP addresses (in dotted-decimal or CIDR notation) of the assets to

discover in the IP range(s) to scan box as in the following examples:

v Type an IP address, and then press ENTER. v Type a range of IP addresses, and then press ENTER.

Example: 172.1.1.100-172.1.1.200

v Type a combination of both choices above, and then press ENTER.

Note: A red box appears around the IP range(s) to scan box until the data is validated.

5. If you want to ping each IP address before scanning to exclude unreachable hosts from the scan, select the Ping hosts in this range, before scanning, to exclude unreachable hosts check box.

6. If you want to add newly discovered assets to the group where you have defined the scan, rather than to the Ungrouped Assets group, select the Add

newly discovered assets to group check box.

8 Enterprise Scanner: User Guide

Page 17

7. If you want to add previously known assets that are already defined in other groups to the scan group, select the Add previously known assets to group check box.

Displaying assessment checks by groups

Use the Checks tab in the Assessment policy to group checks by any combination of columns that you have chosen to display. For example, you might want to see checks by category, then by severity within that category.

About this task

The current grouping selections are displayed just above the column headers of the checks.

v If no groups are selected, the following message is displayed on the screen:

Right click on the column header to group by that column.

v If groups are selected, the group names are displayed on in the screen as in the

following example:

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Select Assessment from the Policy Types list, and then click Add.

3. Type a name for the scan policy.

4. Click the Checks tab.

5. Choose an option:

If you want to... Then...

Clear groupings Choose an option:

v Right-click any column header, and then

select Clear Groupings from the pop-up menu.

v Click Clear Groupings.

Create groupings interactively

1. Right-click a column heading, and then select Group By from the pop-up menu.

2. Repeat the previous step until you have created the groupings that you want.

Chapter 1. Ad hoc scanning in the Proventia Manager 9

Page 18

If you want to... Then...

Create groupings from a selection list

1. Click the Group By icon. The Group by Columns window

appears.

2. Select a column to group by in the All Columns list, and then click Add.

The column moves to the Group by these Columns list.

3. Repeat the previous step for each column that you want to group by.

4. If you want to remove items from the list, select an item in the Group by these Columns list, and then click Remove.

The item and any items below it move to the All Columns list.

5. Click OK.

Displaying information about assessment checks

Use the Checks tab in the Assessment policy to choose how much information to display about each assessment check in the Assessment policy.

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Select Assessment from the Policy Types list, and then click Add.

3. Type a name for the scan policy.

4. Click the Checks tab.

5. Choose an option:

If you want to... Then...

Add a single column Right-click a column and then select the

column to add from the pop-up menu.

Note: The column appears at the far right.

Remove a single column Right-click a column and then select the

column to remove.

Note: The column is removed.

Add multiple columns Click the Column to display icon, and then

select the check box for each column to add.

Remove multiple columns Click the Column to display icon, and then

clear the check box for each column to remove.

10 Enterprise Scanner: User Guide

Page 19

Selecting assessment checks with filters

Use the Checks tab in the Assessment policy to provide filtering values on a selected list of assessment checks.

About this task

The following rules apply to using regular expressions: v The match occurs against all columns in the table, whether or not the column is

displayed.

v If you use more than one regular expression, every regular expression must

match for a check to be selected.

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Select Assessment from the Policy Types list, and then click Add.

3. Type a name for the scan policy.

4. Click the Checks tab.

5. Select the Filter check box, and then click Filter.

6. To filter with a regular expression, type one or more regular expressions on

separate lines in the Regular Expression box.

Tip: For example, use http.* to match the value in any column that starts with

http; or use .*http.* to match the value in any column that contains http.

7. To filter by one or more of the remaining filter types, select the values to filter by in the filtering boxes.

Tip: You can select ranges of filtering values by holding down the SHIFT key and random filtering values by holding down the CTRL key.

8. Click OK.

Chapter 1. Ad hoc scanning in the Proventia Manager 11

Page 20

Configuring common assessment settings for an Assessment policy

Use the Common Settings tab in the Assessment policy to choose settings that define additional scanning behavior for the checks you have selected to run in an assessment scan.

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Select Assessment from the Policy Types list, and then click Add.

3. Type a name for the scan policy.

4. Click the Common Settings tab.

5. Type the URL or file location for the assessment check Help documentation in

the Help HTML Prefix box: v The IBM ISS Web site location of up-to-date assessment check

documentation.

v The file location of a locally stored version of the documentation.

6. If you want to run the checks that are enabled by default, including checks added in an X-Press Update (XPU), select a policy in the Compliance Policies section.

CAUTION: Custom Policy (All) runs all vulnerability checks, including DOS checks.

7. Configure options for service discovery in the Service Discovery section:

Option Description

Discover and report TCP services Reports active TCP services for which the

Service Scan flag is enabled in the Network Services policy.

Discover and report UDP services Reports active UDP services for which the

Service Scan flag is enabled in the Network Services policy.

8. Configure options for assessment port ranges in the Assessment Port Ranges section:

Option Description

Ports to scan with generic TCP checks The set of TCP ports to scan with generic

TCP checks. You can specify ports using any of the following methods:

v Type a port or range of ports. v Click Well known and select ports from

the list.

v Select All.

Note: A generic TCP check is one whose

target type is tcp.

12 Enterprise Scanner: User Guide

Page 21

Option Description

Ports to scan with generic UDP checks The set of UDP ports to scan with generic

UDP checks. You can specify ports using any of the following methods:

v Type a port or range of ports. v Click Well known and select ports from

the list.

v Select All.

Note: A generic UDP check is one whose

target type is udp.

9. Configure options for using OS information in the Use of OS Information section:

Option Description

Dynamically determine OS if previously obtained information is older than

For unverified OS’s: Specify which checks to run if the OS is

The maximum age (in minutes) of usable OS information.

If the OS information for an asset is older than the time specified, Enterprise Scanner reassesses OSID when it runs an assessment scan. Default: 120

uncertain. v Run all checks (lowest performance): If

Enterprise Scanner is uncertain about the OS of the asset, it runs all assessment checks.

v Run all checks that apply to general OS

(intermediate performance): If Enterprise

Scanner is uncertain about the OS of the asset, it runs checks for all versions of an operating system. (For example, if Enterprise Scanner is uncertain about which version a Windows operating system is, it runs all the checks for all versions of Win dows operating systems.)

v Run only checks that apply to specific

OS (Best performance): If Enterprise

Scanner is uncertain about the OS of the asset, runs only the checks that apply to the exact version of the operating system.

10. Configure options for application fingerprinting in the Use of Application Fingerprinting section:

Chapter 1. Ad hoc scanning in the Proventia Manager 13

Page 22

Option Description

Do not perform application fingerprinting Does not try to specifically identify which

applications are communicating over which ports, and runs the checks as selected in the Assessment policy.

This option does not identify applications communicating over non-standard ports. (Checks are run against standard ports as defined in the Network Services policy.)

Fingerprint applications and run checks that apply to application protocol (e.g., http)

Fingerprint applications and run checks that apply to specific application (e.g., apache)

Identifies applications communicating over specific ports, and then runs checks that apply to the protocol in use.

This option identifies applications communicating over non-standard ports.

Identifies applications communicating over specific ports, and then runs checks that apply only to the application identified.

This option identifies applications communicating over non-standard ports.

11. The settings in the Account Verification section apply only if an Assessment Credentials policy is available for the group being scanned.

Option Description

Verify account access level before using

Access domain controllers to verify access level

Check local group membership to verify access level

v If disabled, Enterprise Scanner assumes

that whatever is specified in the Assessment Credentials policy is accurate.

v If enabled, Enterprise Scanner tries to

confirm that the access level specified in the Assessment Credentials policy is correct.

Important: You should enable the Check local group membership to verify access level if you enable account verification.

v If disabled, Enterprise Scanner does not

communicate with a Domain Controller in the process of verifying access levels.

v If enabled, Enterprise Scanner tries to

communicate with a Domain Controller in the process of verifying access levels.

v If disabled, Enterprise Scanner does not

try to confirm the access level for the account during assessment by checking which local groups the asset belong to.

v If enabled, Enterprise Scanner tries to

confirm the access level for the account during assessment by checking which local groups the asset belong to.

12. Configure the options for locking out accounts in the Account Lockout

Control section:

14 Enterprise Scanner: User Guide

Page 23

Option Description

Allowed account lockout Select a type of lockout:

v No lockout allowed: Enterprise Scanner

avoids running password guessing checks if account lockout is enabled on the target host, or if its status cannot be determined.

v Temporary lockout allowed: Enterprise

Scanner runs password guessing checks only if the account lockout duration is less than or equal to the value specified in the

Maximum Allowable Lockout Duration

option later in this section.

v Permanent lockout allowed:Enterprise

Scanner runs password guessing checks even if the account lockout duration is set to run infinitely.

Longest allowed temporary lockout Specifies the maximum time (in minutes)

that accounts are allowed to be locked out by password guessing checks.

This value applies only if Temporary Lockout Allowed is enabled. When temporary lockout is allowed, password guessing checks are run only against assets whose lockout policy disables locked out accounts for no more than the maximum allowed lockout time.

Chapter 1. Ad hoc scanning in the Proventia Manager 15

Page 24

Defining assessment credentials for a policy

Use the Assessment Credentials policy type on the Policy Management page to define authentication credentials for your assets.

About this task

The appliance uses authentication credentials to access accounts during assessment scans. Enterprise Scanner uses all instances of the credentials that are defined for the group when it scans assets in the group. You can define different instances of this policy for different groups, which makes it possible to supply different log on credentials to scan different parts of the network.

Important: The Assessment Credentials policy currently works only with assets that run Windows operating systems.

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Select Assessment Credentials from the Policy Types list, and then click Add.

3. Confirm your password, and then click OK.

4. Type a name for the scan policy.

5. In the Assessment Credentials tab, click Add, and then provide the following

account information:

Option Description

Username The user identification for an account.

Password The password to use with the user name to

log into an account.

Account Type: Windows Local Indicates that the user account is defined

locally on a single Windows device. The account is used to attempt to log in to a single Windows device.

When you choose this option, you must provide a Windows host name in the Domain/Host box.

Account Type: Windows Domain/Workgroup

Account Type: Windows Active Directory Indicates that the user account is defined in

Indicates that the user account is defined in a Windows Domain or Workgroup. The account is used to attempt to log in to all Windows devices within the domain or workgroup.

When you choose this option, you must provide the Windows Domain or Workgroup name in the Domain/Host box.

a Windows Active Directory Domain. The account is used to attempt to log in to all Windows devices within the Active Directory domain.

16 Enterprise Scanner: User Guide

When you choose this option, you must provide the Active Directory Domain name in the Domain/Host box.

Page 25

Option Description

Account Type: SSH Local

Account Type: SSH Domain

Domain/Host Applies to one of the following domains or

Account Level Applies to one of the following accounts:

Indicates that the user account is defined locally on a single Unix device that allows SSH logons. The account is used to attempt login to a single Unix device.

When you choose this option, you must provide an IP address in the Domain/Host box.

Indicates that the user account is defined for Unix devices that allow SSH logons. In this context, ″Domain″ loosely refers to a set of devices, rather than to a specific type of domain. The account is used to attempt to log in to all SSH devices covered by the policy.

When you choose this option, you should supply a descriptive name in the Domain/Host box. This is for documentation purposes only; it is not used by Enterprise Scanner.

hosts: v For Windows accounts, the domain or

host name to which the account applies.

v For SSH Local accounts, the IP address of

the device to which the account applies.

v For SSH Domain accounts, any text.

v Administrator v User v Guest

Important: To avoid locking an account, do not add the account more than once.

Chapter 1. Ad hoc scanning in the Proventia Manager 17

Page 26

Defining the service names associated with TCP and UDP ports

Use the Network Services policy type on the Policy Management page to define service names associated with TCP and UDP ports.

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Select Network Services from the Policy Types list, and then click Add.

3. Type a name for the scan policy.

4. For default or customized services, choose an option:

If you want to... Then...

Change the description of a service Slowly click Description two times to switch

to edit mode, and then change the description.

Allow each service to operate over SSL in at least some part of your network

Allow service scans for this service over any TCP and UDP ports specified in the Assessment policy

Note: You cannot change the Service name, Port, or Protocol of default

services. You cannot delete default services.

5. For customized services, choose an option:

Select the May use SSL check box for that service.

Select the Service scan check box.

If you want to... Then...

Add a service Click the Add icon.

Modify a service Click the Modify icon.

Delete a service Click the Delete icon.

18 Enterprise Scanner: User Guide

Page 27

Defining ports or assets to exclude from a scan

Use the Scan Exclusion policy type on the Policy Management page to define specific ports or assets to exclude from a scan of a group of assets.

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Select Scan Exclusion from the Policy Types list, and then click Add.

3. Type a name for the scan policy.

4. Choose an option:

If you want to... Then...

Exclude ports Use a combination of typing the ports to

exclude and choosing the ports: v Type the ports to exclude, separated by

commas, in the Excluded Ports box.

v Click Well Known Ports, and then select

the ports to exclude.

Exclude assets Type the IP addresses (in dotted-decimal or

CIDR notation) of the hosts to exclude in the Excluded Hosts box:

v Type an IP address, and then press ENTER. v Type a range of IP addresses, and then

press ENTER. Example: 172.1.1.100-172.1.1.200

v Type a combination of both choices above,

and then press ENTER.

Note: A red box is displayed around the Excluded Hosts box until the data is

validated.

Chapter 1. Ad hoc scanning in the Proventia Manager 19

Page 28

Configuring and saving a scan policy in the Proventia Manager

Use the Policy Management page on the appliance to configure discovery and assessment scan policies from Proventia Manager for auditing purposes, and then use those policies for one-time (ad hoc) scans that you initialize from the LMI Scan Control page.

Before you begin

You will not be able to run scans from Proventia Manager if the appliance is registered with SiteProtector.

Procedure

1. Click Scan → Policy Management in the navigation pane.

2. Choose the scan policy that you want to configure from the Policy Types list,

and then click Add.

3. Type a name for the scan policy, and then configure the settings for the scan

policy. Policy names are limited to 32 characters using any combination of letters or numbers. You cannot use a dash (-) or underscore (_) in the policy name. You can run the following combinations of scans:

v Discovery scan v Discovery and an assessment scan

You cannot run an assessment only scan from the Proventia Manager. The following table lists which scan policies are required to run an ad hoc scan from Proventia Manager:

Table 2. Policies used for ad hoc scanning in Proventia Manager

Scan policy Required

Discovery Yes

Assessment Yes

Assessment Credential No

Network Services No

Scan Exclusion No

*You should run a discovery scan policy first (to identify assets on the network) before you run an assessment scan.

4. Click Save Changes to save the scan policy. You are now ready to run an ad

hoc scan using a configured scan policy.

5. Click Scan → Run Scan in the navigation pane. The LMI Scan Control page is

displayed in Proventia Manager.

20 Enterprise Scanner: User Guide

Page 29

Chapter 2. Interpreting scan results in the Proventia Manager

This chapter explains how to monitor and view scan results in the Proventia Manager.

Topics

“Running an ad hoc scan” on page 22

“Monitoring the status of a scan” on page 23

“Viewing the results of an ad hoc scan” on page 24

“Exporting scan results from Proventia Manager” on page 24

“Purging scan data from the database” on page 25

Page 30

Running an ad hoc scan

Use the LMI Scan Control page on the appliance to define and run ad hoc scans for assessment and discovery.

Before you begin

Before you can run a scan, make sure you have configured a scan from the Policy Management page.

Procedure

1. Click Scan → Run Scan in the navigation pane.

2. Depending on what type of scan you are running (discovery or assessment),

provide a name for the scan job in the Discovery Job Name or Assessment Job Name field.

Tip: The scan job name is useful when you want to view the results and status

of the scan.

3. From the fields provided in the LMI Scan area, determine what type of scan

you need to run, and then select a configured scan policy from the list. You can run the following combinations of scans:

v Discovery scan v Discovery and an assessment scan

You cannot run an assessment only scan from the Proventia Manager. Because the appliance does not use a database to store asset information, you must run a discovery scan followed by an assessment scan.

4. Select what network location (or perspective) you need to run the scan policy

against from the Perform scans from this perspective (Network location) list.

5. Click Save Changes to start the ad hoc scan.

22 Enterprise Scanner: User Guide

Page 31

Monitoring the status of a scan

Use the Scan Status page on the appliance to view the status of ad hoc discovery and assessment scans you have initialized from the LMI Scan Control page.

About this task

While Proventia Manager processes the scan, you can perform one of the following actions on the scan:

Table 3. Processing status of a scan

Action Icon Description

Pause

Resume

Cancel

Procedure

1. Click Scan → Scan Status in the navigation pane. The Scan Status page appears with a table displaying the status of the scan.

Use the Pause option only when a job is in the processing status. Pausing a job in any other status might cause problems if you try to resume or rerun the scan.

Resume the scan after you have paused it

Cancel the scan altogether

Note: The results of the scan can take up to a minute to display on this page.

2. Click the link for the scan in the Name column to display the results of the scan on the Scan Results page.

Chapter 2. Interpreting scan results in the Proventia Manager 23

Page 32

Viewing the results of an ad hoc scan

Use the Scan Results page on the appliance to analyze security-related data discovered by an ad hoc scan.

Procedure

1. Click Scan → Scan Results in the navigation pane.

2. Choose the scan date (time stamp) from the List Scans list, and then click Go.

3. Select the scan job from the Scan Type list, and then click Go. The results of

the scan are displayed in the table.

4. Click View/Manage Log Files.

5. Select the scan job in the File Name list. The name of the log file contains the

date the scan was run and uses this format: lmiScans/mmddyyyy_xxxxx.log

6. Click Download to the download the log file for the scan to a directory on your computer. Scan data files are located in the /var/log/esm/lmiScans directory.

Exporting scan results from Proventia Manager

Use the Scan Reports page on the appliance to export scan results to HTML or CSV files from Proventia Manager.

About this task

This feature provides basic reporting for ad hoc scans initialized from Proventia Manager. It is not intended to replace the full analysis and reporting functions of SiteProtector.

Procedure

1. Click Scan → Scan Reports in the navigation pane.

2. Select the discovery or assessment scan that you want to export from the List

Scans list.

3. Select how you want to sort the hosts in the report.

4. Select the Report checks which found no vulnerability check box if you want

to include information about checks that did not find a vulnerability.

5. Depending on the type of report you need to generate, click Generate HTML Report or Generate CSV Files.

6. Save the file to your local system. Enterprise Scanner uses the following file name convention for exported results:

Discovery: DiscoveryResults-<YYYYMMDD>-<HHMMSS><timezone>-<scannername>-<jobname>.csv Assessment: AssessmentResults-<YYYYMMDD>-<HHMMSS><timezone>-<scannername>-<jobname>.csv

Example: A discovery scan that ran on March 30, 2008 at 1:20:39 PM EST with a scanner name of testscan and a job name of testjob would display the following file name: DiscoveryResults-20080330-132039EST-testscan-

testjob.csv

24 Enterprise Scanner: User Guide

Page 33

Purging scan data from the database

Use the Scan Results page on the appliance to schedule the removal of scan data files from the /var/log/esm/lmiScans directory.

Procedure

1. Click Scan → Scan Results in the navigation pane.

2. Click the Purge Scan Data link. The Purge Scan Data window provides the

following information about the current scan data:

Field Description

Number of Scans The number of individual scans, not scan

Disk Space Used by Scans The amount of disk space consumed by the

Total Disk Space Available The amount of available disk space.

Earliest Scan The date of the first scan.

Latest Scan The date of the latest scan.

Purge Scans Older than: Number of Days The number of days in which all scan data

jobs.

scan data.

older than this amount are deleted from the disk. Note: When you purge scan data, that data is also removed from the Scan Status page and the Scan Results page.

3. Click Go.

Chapter 2. Interpreting scan results in the Proventia Manager 25

Page 34

26 Enterprise Scanner: User Guide

Page 35

Part 2. Scanning from the SiteProtector Console

This section explains how to manage scans from the SiteProtector Console for the Enterprise Scanner agent.

Chapters

Chapter 3, “Enterprise Scanner policies,” on page 29

Chapter 4, “Understanding scanning processes in SiteProtector,” on page 67

Chapter 5, “Background scanning in SiteProtector,” on page 79

Chapter 6, “Monitoring scans in SiteProtector,” on page 91

Chapter 7, “Managing scans in SiteProtector,” on page 95

Chapter 8, “Interpreting scan results in SiteProtector,” on page 103

Chapter 9, “Logs and alerts,” on page 121

Chapter 10, “Ticketing and remediation,” on page 133

Page 36

28 Enterprise Scanner: User Guide

Page 37

Chapter 3. Enterprise Scanner policies

This chapter explains how to use Enterprise Scanner policies to customize your scanning processes. The policies belong to meaningful categories based on their scope and impact on scans.

Topics

“Policy inheritance with Enterprise Scanner policies” on page 30

“Deploying an Enterprise Scanner policy from the policy repository” on page 31

“Migrating a locally managed Enterprise Scanner agent into SiteProtector” on page 32

“Viewing asset or agent policies for Enterprise Scanner” on page 33

“Getting vulnerability help for a SiteProtector Console without Internet access” on page 34

“Agent policies for Enterprise Scanner” on page 35

“Asset policies for Enterprise Scanner” on page 45

Page 38

Policy inheritance with Enterprise Scanner policies

The inheritance properties of policies in SiteProtector provide a flexible and efficient method for setting up your scanning environment in a hierarchical group structure.

General inheritance behavior

In general, inheritance works as follows: v When you define a policy for a group in your group structure, the policy

automatically applies to the subgroups for the group unless a subgroup already has its own version of the policy. Then, that subgroup retains its version of the policy.

v You can break the inheritance at any level in the group structure by redefining

(overriding) the policy for a subgroup. When you define a policy for a subgroup, the changes apply to its subgroups.

v If you have defined a policy for a subgroup that you want to apply to groups

above it, you can promote the policy to a higher group.

Inheritance with Enterprise Scanner policies

As you plan your Site grouping structure for vulnerability management, keep these points in mind:

v Most asset policies follow the general rules of inheritance. v Many agent policies apply only to a single agent or scanning network interface. v Some asset and some agent policies have specialized inheritance characteristics.

These differences are described in more detail in the following topics.

Inheritance indicators

When you select a group in the left pane of the SiteProtector Console, policies applicable to the group are displayed in the right pane. The inheritance indicators of the policies are displayed in the Inheriting From column as follows:

Table 4. Policy inheritance indicators

If the Inheriting From Value is... Then...

blank The policy is defined at the group

level/agent selected in the left pane.

UNCONFIGURED You have chosen to override the policy with

one that is defined higher in the group structure, but a higher-level policy is not defined.

a_group_name The policy is inherited from the referenced

group.

Initially blank or unconfigured?

The initial inheritance indicators for agent policies can be blank or unconfigured depending on whether you override SiteProtector group settings when you register your agent with SiteProtector:

v If you override the settings, the settings for the agent are applied to the

SiteProtector policies, so that the Inheriting From column is blank.

30 Enterprise Scanner: User Guide

Page 39

v If you do not override the settings, the column follows the inheritance described

in the table above; however, you must configure those policies.

Deploying an Enterprise Scanner policy from the policy repository

Use the policy repository to create, edit, and deploy Enterprise Scanner policies in SiteProtector. The repository keeps an archive of each saved version of your policies. After creating or editing a policy, you must deploy it to the appropriate Enterprise Scanner agents or groups.

About this task

Each time you edit a policy, SiteProtector saves a new version in the repository. You can deploy any version of a policy to an Enterprise Scanner agent or group on your Site. You can use the default repository in SiteProtector to manage all of your policies, or create additional repositories to separate different types or groups of policies.

Important: You cannot delete a policy from the repository if you have deployed it anywhere in your Site.

Note: Central Responses can only use Network Objects that are in the default repository.

Procedure

1. Choose an option:

v Drag the policy icon from the repository to the Enterprise Scanner group or

agent in the left pane.

v Right-click the policy icon in the repository, and then select Deploy from the

pop-up menu.

2. To deploy additional policies, click the Policies icon, and then click Add to select more policies. The Deploy Policy window displays the policy you chose, and the target(s) it will be deployed to.

3. Click OK.

4. To select a target to deploy the policy to, click the Targets icon, and then select

the Enterprise Scanner groups or agents to deploy this policy to.

5. Click the Schedule icon.

6. To deploy the policy immediately, select Now.

7. To schedule a specific date and time to deploy the policy, select Start Time,

click the list, and then select a date and time for deployment.

8. Click OK.

Chapter 3. Enterprise Scanner policies 31

Page 40

Migrating a locally managed Enterprise Scanner agent into SiteProtector

You must migrate the Enterprise Scanner agent out of the Locally Managed Agents area to take advantage of the policy features available in SiteProtector.

About this task

If the policies for the Enterprise Scanner agent are managed locally (from Proventia Manager), they will be displayed in the Locally Managed Agents node.

The Locally Managed Agents node is designed to be a temporary access point for Enterprise Scanner agents whose local policies have not yet been imported into SiteProtector. You should move these policies into the policy repository to manage them in SiteProtector.

Procedure

1. Select the Policy view, and then select Locally Managed Agents.

2. Select the Enterprise Scanner agent, and then select Migrate to Repository from

the pop-up menu.

3. Type a unique policy name for any policy files that duplicate those already in the repository.

4. Click OK. The policies for the Enterprise Scanner agent are displayed in the Repository and can be deployed to other Enterprise Scanner groups or agents in SiteProtector.

32 Enterprise Scanner: User Guide

Page 41

Viewing asset or agent policies for Enterprise Scanner

In the SiteProtector Console, you can view asset and agent policies together, or you can view them separately. If you view the policies separately, you can use the views and tabs in SiteProtector to easily move back and forth between asset and agent policies.

Procedure

1. From the SiteProtector Console, click a tab with the Policy view.

2. From the left pane, select the asset or agent whose policies you want to view.

3. If you want to see policies from a different repository, select that repository.

4. Select Network Enterprise Scanner from the Agent Type list.

5. Select your version of Enterprise Scanner for the agent from the Version list.

Note: The version can apply to the agent whose properties you are defining or to the agent responsible for scanning the group whose properties you are defining.

Important: Enterprise Scanner policies can apply to one or more versions, as indicated in the policy view. If you use multiple agents at different versions that do not share the same policy, you must define separate policies for each version.

6. Choose an option:

If you want to view... Then...

All policies Select All from the Mode list.

Asset policies Select Asset from the Mode list.

Agent policies Select Agent from the Mode list.

Chapter 3. Enterprise Scanner policies 33

Page 42

Getting vulnerability help for a SiteProtector Console without Internet access

If you use the SiteProtector Console on a computer without an Internet connection, you need to store the vulnerability Help on the computer or one it can access over your company’s network.

Procedure

1. Download the vulnerability Help file (XForceHelpFiles.zip)from http://www.iss.net/security_center/reference/vuln to a directory on your

computer.

2. When the File Download window opens, click Save to store the files on your computer.

Important: Do not click Open.

3. After you download the files, specify the full path, including the final backslash, in the Help HTML Prefix box on the Common Settings panel for Assessment Scans.

Example: c:\data\XF-help-files\

34 Enterprise Scanner: User Guide

Page 43

Agent policies for Enterprise Scanner

Agent policies apply to Enterprise Scanner appliances and describe operational settings for the agents or global settings for all scans. In addition, some agent policies apply to only one agent.

Agent policy descriptions for Enterprise Scanner

Agent policies apply to both ad hoc and background scans.

Contents of an agent policy

The general contents of an agent policy include:

v The passwords to use for local accounts v Scan management (breaking scans down into smaller subtasks per task) v The relative location of the agent on the network, known as its perspective v Updates to the agent v Network configuration settings and DNS servers for the network interfaces v Log file management

Policy inheritance with agent policies

The following rules describe policy inheritance for agent policies: v You must define a unique Access, Networking, Services, and Time policy for

each agent.

v You can set up the Notification and Update policies to inherit their definitions

from policies defined higher in the group structure.

v You can define only one Network Locations policy, to be used for all agents and

assets, at the Site level in your group structure.

In the SiteProtector Console, you select a group in the left pane and the applicable policies are displayed in the right pane. If you expand the group or agent, the policies are also displayed below the group or agent.

Chapter 3. Enterprise Scanner policies 35

Page 44

Network Locations policy

Use the Network Locations policy to define the perspective (network location) of an agent and to define routes for those perspectives.

Note: The Network Locations policy does not automatically import the perspectives you set up in the Network Locations tab in the Proventia Manager (LMI). If you have defined perspectives in the Proventia Manager, you must redefine those perspectives for this policy in SiteProtector.

What is perspective?

A perspective is a name that represents the network location of one or more agents. You associate a perspective with a group to scan in the Scan Control policy. The agent(s) assigned to that perspective in the Networking policy run the scans.

Default perspective

The Network Locations policy contains a default perspective, Global, which you cannot delete. You can use the Global perspective without adding any additional perspectives, or you can use it along with user-defined perspectives.

When to use additional perspectives

Perspective is most important when you have multiple scanners located at different locations on your network. To distinguish among them, you must use more than one perspective.

You can only assign one unique perspective per scanning port. You cannot assign the same perspective to more than one scanning port.

Perspective names

When you choose a perspective name, choose a name that represents the location on the network that the perspective references. Consider that, technically, a perspective represents a set of subnets from which you would expect the same results for scanning and monitoring your network regardless of where you connected your scanners within that set of subnets.

Scanning without full permissions

To perform any Enterprise Scanner scan with SiteProtector SP™6.1 or later, a user must have permission to view the Network Locations policy. This permission is granted for the predefined user groups that provide full Enterprise Scanner permissions. If you define users or user groups with restricted permissions, you must grant this permission explicitly. The way you grant permission is based on the inheritance behavior of your policy:

If you... Then...

Do not change the inheritance behavior of the policy

Change the inheritance behavior of the policy

You can define the permission once at the Site level.

You must grant the permission for the group where you need the permission and for all the groups above it in the hierarchy.

36 Enterprise Scanner: User Guide

Page 45

Important: Users who do not have permission to view the Network Locations

policy, either through group association or by a specific grant, cannot run Enterprise Scanner scans.

Assigning perspective to a scanning interface

Use the Network Locations tab in the Network Locations policy on the SiteProtector Console to assign a perspective (network location) to a scanning interface.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Network Locations

policy for that group.

3. Click the Network Locations tab.

4. Click the Add icon.

5. Type a name for the perspective in the Network Locations Name field, and

then click OK.

Important: You can only assign one unique perspective per scanning port. You

cannot assign the same perspective to more than one scanning port.

Configuring routes for perspective

Use the Routes tab in the Network Locations policy on the SiteProtector Console to configure the appliance to select paths for (routes) traffic.

About this task

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Network Locations

policy for that group.

3. Click the Routes tab, and then click the Add new item to list icon.

4. Complete the following fields:

Option Description

Perspective The perspective for which you are defining a

route.

Destination Network A network segment for which you want to

define a specific route for a perspective.

Gateway The IP address of the router the agent

should use to find IP addresses in the Destination Network. Use the IP address that is on the same network as the agent, not the IP address of the route from inside the target segment.

Chapter 3. Enterprise Scanner policies 37

Page 46

Option Description

Metric If you configure more than one route to the

5. Click OK.

Notification policy

Use the Notification policy to configure responses sent from the Enterprise Scanner appliance to the SiteProtector Console.

Event notification settings for Enterprise Scanner

Use the Event Notification tab in the Notification policy on the SiteProtector Console to Enterprise Scanner enable the agent to send system events to the SiteProtector Console.

About this task

You can configure three types of system events:

v System error events v System warning events v System informative events

same segment for one perspective, a number that indicates the preferred route. The closer to 1, the more preferred the route. Note: The numbers you use do not have to be consecutive.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Notification policy

for that group.

3. Click the Event Notification tab.

4. Select the check boxes for each type of event to enable:

v Alert Logging for System Error Events v Alert Logging for System Warning Events v Alert Logging for System Informative Events

5. Select the Enable Event Delivery to SiteProtector Console check box for each type of event to enable:

v System error notification v System warning notification v System informative event notification

38 Enterprise Scanner: User Guide

Page 47

Configuring advanced parameters for event notification

Use the Advanced Parameters tab in the Notification policy on the SiteProtector Console to provide greater control over the event notification behavior of your appliance.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Notification policy

for that group.

3. Click the Advanced Parameters tab.

4. If the parameter you want to tune is not displayed in the Advanced Parameters

tab, follow these steps:

a. Click the Add icon. b. Type the name of the parameter. c. Type a description of the parameter. d. Specify the value type and value of the parameter.

5. If the parameter you want to tune is already displayed in the Advanced

Parameters tab, click the value or description field and change the setting. Attention: In most cases, it should not be necessary to change advanced

parameters. However, you should not change these parameters unless you are instructed by IBM ISS Technical Support personnel.

6. Click OK.

Access policy

Use the Access policy on the SiteProtector Console to change agent passwords and to enable (require) or disable the bootloader password for backing up or restoring your agents.

Before you begin

To change a password, you must know the current password.

About this task

When you configure the appliance, you must supply passwords for these accounts:

Table 5. Appliance passwords

Account Purpose

root This password accesses the operating system

Admin (agent user) This password accesses the Proventia Setup

Admin (Web user) This password accesses Proventia Manager

of the appliance.

Assistant on the appliance if the Enterprise Scanner agent is not managed by a SiteProtector.

through a Web browser over a network connection.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

Chapter 3. Enterprise Scanner policies 39

Page 48

2. In the navigation pane, select a group, and then open the Access policy for that group.

3. For each password you want to change, complete the following steps: a. Type the current password in the Current Password box. b. Click Enter Password, type the new password in the Password and in the

Confirm password boxes, and then click OK.

4. If you want to require the use of the bootloader password to back up or restore the agent, select the Enable bootloader password check box.

Important: If you enable the bootloader password, you must be connected to the Enterprise Scanner agent with a serial connection and supply a password to backup or to restore the agent.

Networking policy

Use the Networking policy on the SiteProtector Console to reconfigure the network configuration settings for the management and scan interfaces and for the DNS servers and search paths.

Configuring the management network interface

Use the Management Interface tab in the Networking policy on the SiteProtector Console to configure the management interface network settings (ETH0).

About this task

You configured the management interface when you set up the appliance with the Proventia Setup Assistant. Use the procedures in this topic to change those settings.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Networking policy

for that group.

3. Click the Management Interface tab, and then type or change the following information:

Option Description

Host Name The fully qualified domain name for the

Enterprise Scanner agent. Use the format:

gateway1.example.com

Interface The management port used by the

Enterprise Scanner agent.

IP address The IP address for the management network

interface that connects to SiteProtector.

Subnet Mask The subnet mask for the management

network interface that connects to SiteProtector.

Gateway The address of the network gateway.

4. Select the Use Persistent IP if sensor is behind NAT if you want to avoid conflicts with NAT rules, and then provide the IP address.

40 Enterprise Scanner: User Guide

Page 49

Configuring the scanning network interface

Use the Scan Interface tab in the Networking policy on the SiteProtector Console to configure the scanning interface network settings (ETH1 - ETH5).

About this task

You configured the scanning interface when you set up the appliance with the Proventia Setup Assistant. Use the procedures in this topic to change those settings.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Networking policy

for that group.

3. Click the Scan Interface tab, and then type or change the following information:

Option Description

Interface The Ethernet port of the interfaces for the

Enterprise Scanner agent.

IP Address The IP address of the scanning network

interface for the Enterprise Scanner agent.

Subnet Mask The IP address for the scanning network

interface subnet mask of the Enterprise Scanner agent.

Gateway The address of the network gateway.

Maximum IPs per discovery subtask The maximum number of IP addresses to

discover in a subtask (of a task for each scan job). Note: This value applies to all discovery scans that the agent runs.

Maximum assets per assessment subtask The maximum number of assets to scan in a

subtask (of a task for each scan job). Note: This value applies to all assessment scans that the agent runs.

Perspective (network location) The name of the network location to

associate with this scanning port. Values: Global, the default, and any network locations defined in the Network Locations policy.

Chapter 3. Enterprise Scanner policies 41

Page 50

Configuring scanning interface DNS settings

Use the DNS tab in the Networking policy on the SiteProtector Console to configure the DNS settings for the scanning interface.

About this task

You configured these settings when you set up the appliance with the Proventia Setup Assistant. Use the procedures in this topic to change those settings.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Networking policy

for that group.

3. Click the DNS tab.

4. Choose an option:

If you want to... Then...

Specify DNS settings

Add a DNS search path

Edit a DNS search path

Copy and paste a DNS search path

Remove a DNS search path

Change the order of a DNS search path

1. Type the IP addresses for the primary, secondary, and tertiary DNS servers.

2. Click Save Changes.

1. In the DNS Search Path section, click the

Add icon.

2. Type the domain name to add to the search list, and then click OK.

3. Click Save Changes.

1. In the DNS Search Path list, select a

domain name, and then click the Edit icon.

2. Edit the domain name, and then click OK.

3. Click Save Changes.

1. In the DNS Search Path section, select a

domain name, and then click the Copy icon. The agent copies the search path to the clipboard.

2. Click the Paste icon. The agent copies the search path to the end of the list.

3. If necessary, edit the policy, and then click OK.

4. Click Save Changes.

1. In the DNS Search Path section, select a

domain name, and then click the Remove icon.

2. Click Save Changes.

1. In the DNS Search Path section, select a

domain name.

2. Click the Up or Down arrows. Tip: It is more efficient to place the most

likely used search path at the top of the list.

3. Click Save Changes.

42 Enterprise Scanner: User Guide

Page 51

Services policy

Use the Services policy on the SiteProtector Console to enable or disable access to your appliance from SSH (Secure Shell) applications on your network and to enable SNMP to monitor the Enterprise Scanner appliance for conditions that warrant administrative attention.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Services policy for

that group.

3. Choose an option:

If you want to... Then...

Enable SSH Select the Enabled check box to enable SSH;

Enable an SNMP Get

Enable an SNMP Trap

clear the Enabled check box to disable SSH. Note: SSH is enabled and accessible to the

internal and external interfaces by default.

1. Select the SNMP Get Enabled box.

2. Provide a name for the system, a system

location, relevant contact information, and an appropriate community name.

1. Select the SNMP Traps Enabled box.

2. Type the IP address in the Trap Receiver

Address field. Note: This IP address is the server

address where the SNMP Manager is running. The SNMP host must be accessible to the appliance to send e-mail notification.

3. Type the appropriate community name (public or private) in the Trap Community field.

4. Select a trap version from the Trap Version list. The following versions are

available: v V1: Simple Network Management

Protocol version 1

v V2c: Community-Based Simple

Network Management Protocol version 2

4. Click Save Changes.

Chapter 3. Enterprise Scanner policies 43

Page 52

Time policy

Use the Time policy on the SiteProtector Console to change the date and the time of the Enterprise Scanner agent, and to enable the network time protocol (NTP) to synchronize the agent time with a network time server.

About this task

The Time policy always contains the last manually configured values for date and time options, not the actual date and time. When you save the settings, the agent is set to the currently configured values, whether you have changed them or not.

Important: To avoid resetting the time and date to the previously configured values, update the time and date before you save the settings.

Procedure

1. From the SiteProtector Console, create a tab to display agent policies.

2. In the navigation pane, select a group, and then open the Time policy for that

group.

3. Choose an option:

If you want to... Then...

Change the date and time for the agent

Enable the network time protocol (NTP) Note: NTP synchronizes the configuration

1. Click the Date and Time arrow to see the calendar.

2. Select the correct month and date. Tip: Use the arrows at the top to change the month and year in the calendar.

3. Select the hour and minutes in the Time boxes.

4. Click outside the calendar to close it.

5. Click the Time Zone arrow and select

the correct time zone for your region.

6. Click Save Changes.

time with a network time server.

1. In the Network Time Protocol section, select the Enable NTP check box.

2. Type the name of the server in the Server box.

3. Save the Time policy.

4. Change the tab to an Agent view.

5. Right-click the agent or the group of

agents affected by the policy change, and then select Refresh Agent from the pop-up menu. Important: To ensure that the agent starts to use NTP time immediately, you must refresh the agent. If you do not refresh the agent, NTP time does not take effect until the agent sends a heartbeat to SiteProtector. If you cannot save this policy and refresh the agent immediately, set the time as described in the Changing the date and time procedure before you save the policy.

44 Enterprise Scanner: User Guide

Page 53

Update Settings policy

Use the Update Settings policy on the SiteProtector Console to configure how the agent automatically locates, downloads, and installs available updates.

Asset policies for Enterprise Scanner

Asset policies apply to groups of assets and describe the security policy for those assets.

Asset policy descriptions for Enterprise Scanner

Asset policies apply to both discovery scans and assessment scans depending on the policy.

Scope of scanning

The following table identifies which asset policies apply to discovery scans, which apply to assessment scans, and which apply to both:

Table 6. Asset policies

Policy Discovery Assessment

Assessment No Yes

Assessment Credentials Yes Yes

Discovery Yes No

Network Locations Yes Yes

Network Services No Yes

Scan Control Yes Yes

Scan Exclusion No Yes

Scan Window Yes Yes

Contents of an asset policy

The general contents of an asset policy include: v Information about how to run discovery scans, assessment scans, or both types

of scans against the group

v The IP addresses to scan for discovery scans v The checks to run, and other assessment parameters (for assessment scans v The days to run scans and during which hours to run them v Refreshed information from scans about the assets in a group v The assets in the group, if any, that you do not want to scan v The list of accounts and log on credentials to use for assets in a group v The service names associated with TCP and UDP ports

Policy inheritance with asset policies

The following rules describe policy inheritance for agent policies: v You can define only one Network Locations policy, to be used for all agents and

assets, at the Site level in your group structure.

Chapter 3. Enterprise Scanner policies 45

Page 54

v A Discovery policy applies to only the group where you define it. v The remaining policies are inheritable. A subgroup inherits a policy from the

first group higher than itself in the group structure that has a defined policy.

In the SiteProtector Console, you select a group in the left pane and the applicable policies are displayed in the right pane in a Policy tab.

Discovery policy

Use the Discovery policy on the SiteProtector Console to define parameters used to perform discovery on a portion of a network.

Scope

The Discovery policy applies to background discovery scans. An ad hoc scan reads this policy and uses its settings to initialize the ad hoc discovery scan. You can change the settings in the ad hoc scan without changing the background policy.

Policy contents

Each Discovery policy defines the following information: v A range of IP addresses to be scanned (specified as a combination of

dotted-decimal IP addresses and address ranges, and subnetworks specified in CIDR notation).

v Whether to ping each IP address before scanning to exclude unreachable hosts

from the scan.

v Whether newly discovered assets should be added to the associated group. v Whether previously known assets that do not already belong to the associated

group should be added to the group.

46 Enterprise Scanner: User Guide

Page 55

Defining assets to discover

Use the Discovery policy on the SiteProtector Console to define the parameters used to perform a discovery scan on a portion of a network.

Before you begin

About this task

Procedure

1. From the SiteProtector Console, create a tab to display asset policies.

2. In the navigation pane, select a group, and then open the Discovery policy for

that group.

3. Type the IP addresses (in dotted-decimal or CIDR notation) of the assets to discover in the IP range(s) to scan box as in the following examples:

v Type an IP address, and then press ENTER. v Type a range of IP addresses, and then press ENTER.

Example: 172.1.1.100-172.1.1.200

v Type a combination of both choices above, and then press ENTER.

Note: A red box appears around the IP range(s) to scan box until the data is validated.

4. If you want to ping each IP address before scanning to exclude unreachable hosts from the scan, select the Ping hosts in this range, before scanning, to exclude unreachable hosts check box.

5. If you want to add newly discovered assets to the group where you have defined the scan, rather than to the Ungrouped Assets group, select the Add newly discovered assets to group check box.

6. If you want to add previously known assets that are already defined in other groups to the scan group, select the Add previously known assets to group check box.

Chapter 3. Enterprise Scanner policies 47

Page 56

Assessment policy

Use the Assessment policy on the SiteProtector Console to define the checks to run for assessment scans.

The Assessment policy contains the following tabs: v Checks (display checks by groups, display information about checks, select

checks with filters)

v Common Settings

Scope

The Assessment policy applies only to assessment scans that run in the background. Ad hoc scans read this policy and use its settings to initialize the ad hoc Assessment policy. You can change the ad hoc version of the policy without changing the saved background version.

Displaying information about assessment checks

Use the Checks tab in the Assessment policy on the SiteProtector Console to choose how much information to display about each assessment check in the Assessment policy.

Procedure

1. From the SiteProtector Console, create a tab to display asset policies.

2. In the navigation pane, select a group, and then open the Assessment policy for

that group.

3. Choose an option:

If you want to... Then...

Add a single column Right-click a column and then select the

column to add from the pop-up menu.

Note: The column appears at the far right.

Remove a single column Right-click a column and then select the

column to remove.

Note: The column is removed.

Add multiple columns Click Column to display icon, and then

select the check box for each column to add.

Remove multiple columns Click Column to display icon, and then

clear the check box for each column to remove.

48 Enterprise Scanner: User Guide

Page 57

Displaying assessment checks by groups

Use the Checks tab in the Assessment policy on the SiteProtector Console to group checks by any combination of columns that you have chosen to display. For example, you might want to see checks by category, then by severity within that category.

About this task

The current grouping selections are displayed just above the column headers of the checks.

v Assessment checks v If no groups are selected, the following message is displayed on the screen:

Right click on the column header to group by that column.

v If groups are selected, the group names are displayed on in the screen as in the

following example:

Procedure

1. From the SiteProtector Console, create a tab to display asset policies.

2. In the navigation pane, select a group, and then open the Assessment policy for

that group.

3. Click the Checks tab.

4. Choose an option:

If you want to... Then...

Clear groupings Choose an option:

v Right-click any column header, and then

select Clear Groupings from the pop-up menu.

v Click Clear Groupings.

Create groupings interactively

Create groupings from a selection list

1. Right-click a column heading, and then select Group By from the pop-up menu.

2. Repeat the previous step until you have created the groupings that you want.

1. Click the Group By icon. The Group by Columns window

appears.

2. Select a column to group by in the All Columns list, and then click Add.

The column moves to the Group by these Columns list.

3. Repeat the previous step for each column that you want to group by.

4. If you want to remove items from the list, select an item in the Group by these Columns list, and then click Remove.

The item and any items below it move to the All Columns list.

5. Click OK.

Chapter 3. Enterprise Scanner policies 49

Page 58

Selecting assessment checks with filters

Use the Checks tab in the Assessment policy on the SiteProtector Console to provide filtering values on a selected list of assessment checks.

About this task

The following rules apply to using regular expressions: v The match occurs against all columns in the table, whether or not the column is

displayed.

v If you use more than one regular expression, every regular expression must

match for a check to be selected.

Procedure

1. From the SiteProtector Console, create a tab to display asset policies.

2. In the navigation pane, select a group, and then open the Assessment policy for

that group.

3. Click the Checks tab.

4. Select the Filter check box, and then click Filter.

5. To filter with a regular expression, type one or more regular expressions on

separate lines in the Regular Expression box.

Tip: For example, use http.* to match the value in any column that starts with

http; or use .*http.* to match the value in any column that contains http.

6. To filter by one or more of the remaining filter types, select the values to filter by in the filtering boxes.

Tip: You can select ranges of filtering values by holding down the SHIFT key and random filtering values by holding down the CTRL key.

7. Click OK.

50 Enterprise Scanner: User Guide

Page 59

Configuring common assessment settings

Use the Common Settings tab in the Assessment policy on the SiteProtector Console to choose settings that define additional scanning behavior for the checks you have selected to run in an assessment scan.

Procedure

1. From the SiteProtector Console, create a tab to display asset policies.

2. In the navigation pane, select a group, and then open the Assessment policy

for that group.

3. Click the Common Settings tab.

4. Type the URL or file location for the assessment check Help documentation in

the Help HTML Prefix box: v The IBM ISS Web site location of the latest assessment check

documentation.

v The file location of a locally stored version of the documentation.

Note: If you do not have access to the Internet, but you want to view Help for checks in the Assessment policy, you must copy the files to your hard drive. See Getting vulnerability help for a SiteProtector Console without Internet access for details.

5. If you want to run the checks that are enabled by default, including checks added in an X-Press Update (XPU), select a policy in the Compliance Policies section.

6. Configure options for service discovery in the Service Discovery section:

Option Description

Discover and report TCP services Reports active TCP services for which the

Service Scan flag is enabled in the Network Services policy.

Discover and report UDP services Reports active UDP services for which the

Service Scan flag is enabled in the Network Services policy.

7. Configure options for assessment port ranges in the Assessment Port Ranges section:

Option Description

Ports to scan with generic TCP checks The set of TCP ports to scan with generic

TCP checks. You can specify ports using any of the following methods:

v Type a port or range of ports. v Click Well known and select ports from

the list.

v Select All.

Note: A generic TCP check is one whose

target type is tcp.

Chapter 3. Enterprise Scanner policies 51

Page 60

Option Description

Ports to scan with generic UDP checks The set of UDP ports to scan with generic

UDP checks. You can specify ports using any of the following methods:

v Type a port or range of ports. v Click Well known and select ports from

the list.

v Select All.

Note: A generic UDP check is one whose

target type is udp.

8. Configure options for using OS information in the Use of OS Information section:

Option Description

Dynamically determine OS if SiteProtector information is older than

For unverified OS’s: Specify which checks to run if the OS is

The maximum age (in minutes) of usable OS information in SiteProtector.

If the OS information for an asset is older than the time specified, Enterprise Scanner reassesses OSID when it runs an assessment scan. Default: 120

uncertain. v Run all checks (lowest performance): If

Enterprise Scanner is uncertain about the OS of the asset, it runs all assessment checks.

v Run all checks that apply to general OS

(intermediate performance): If Enterprise

v Run only checks that apply to specific

OS (Best performance): If Enterprise

Scanner is uncertain about the OS of the asset, runs only the checks that apply to the exact version of the operating system.

9. Configure options for application fingerprinting in the Use of Application Fingerprinting section:

52 Enterprise Scanner: User Guide

Page 61