Nexpose 5.

7 Users Guide

Copyright 2013 Rapid7, LLC. Boston, Massachusetts, USA. All rights reserved. Rapid7 and Nexpose are trademarks of Rapid7, LLC. Other names appearing in this content may be trademarks of their respective owners.

This documentation is for internal use only.

Revision history
Revision Date
June 15, 2010 August 30, 2010

Description
Created document. Added information about new PCI-mandated report templates to be used by ASVs as of September 1, 2010; clarified how CVSS scores relate to severity rankings. Added more detailed instructions about specifying a directory for stored reports. Added instructions for SSH public key authentication. Added instructions for using Asset Filter search and creating dynamic asset groups. Also added instructions for using new asset search features when creating static asset groups and reports. Added information about new PCI report sections and the PCI Host Details report template. Added information about including organization information in site configuration and managing assets according to host type. Added information about expanded vulnerability exception workflows. Updated information about supported browsers. Updated information about using custom report logos. Added information about viewing and overriding policy results. Added information about downloading scan logs. Nexpose 5.1. Added information about viewing Advanced Policy Engine compliance across your enterprise, using LM/NTLM hash authentication for scans, and exporting malware and exploit information to CSV files. Nexpose 5.2. Added information about drilling down to view Advanced Policy Engine policy compliance results using the Policies dashboard. Corrected the severity ranking values in the Severity column. Updated information about supported browsers. Nexpose 5.3. Added information on scan template configuration, including new discovery performance settings for scan templates; CyberScope XML Export report format; vAsset discovery; appendix on using regular expressions. Nexpose 5.4. Added information vulnerability category filtering in reports and customization of advanced policies. Nexpose 5.5. Added information about working with custom report templates, uploading custom SCAP templates, and working with configuration assessment. Updated workflows for creating, editing and distributing reports. Updated the glossary with new entries for top 10 report templates and shared scan credentials. Nexpose 5.6. Added information about elevating permissions. Updated Web spider scan template settings.

October 25, 2010 December 13, 2010 December 20, 2010

January 31, 2011 March 14, 2011

July 11, 2011 July 25, 2011 September 19, 2011 November 15, 2011 December 5, 2011 January 23, 2012

March 21, 2012

June 6, 2012

August 8, 2012

December 10, 2012

April 24, 2013 May 29, 2013

Nexpose Users Guide

Revision Date
July 17, 2013

Description
Nexpose 5.7. Added information about creating multiple vulnerability exceptions and deleting multiple assets. Added information about Vulnerability Trends Survey report template. Added information about new scan log entries for asset and service discovery phases Deleted references to a deprecated feature. Added information about vulnerability display filters. Added information about validating vulnerabilities.

July 31, 2013 September 18, 2013 November 13, 2013

Nexpose Users Guide

Contents
About this guide ...................................................................................................................................9 A note about documented features .......................................................................................................9 Other documents and Help ....................................................................................................................9 Document conventions .......................................................................................................................10 For technical support ...........................................................................................................................10

Getting Started
Running the application .....................................................................................................................12 Manually starting or stopping in Windows ..........................................................................................12 Changing the configuration for starting automatically as a service .....................................................12 Manually starting or stopping in Linux .................................................................................................13 Working with the daemon ...................................................................................................................13 Using the Web interface .....................................................................................................................14 Performing offline activations and updates .........................................................................................14 Logging on ............................................................................................................................................14 Navigating the Security Console Web interface ...................................................................................18 Using the search feature ......................................................................................................................21 Using configuration panels ...................................................................................................................22 Extending Web interface sessions ........................................................................................................22

Discover
Comparing dynamic and static sites ...................................................................................................24 Configuring a basic static site .............................................................................................................25 Choosing a grouping strategy for a static site ......................................................................................25 Starting a static site configuration .......................................................................................................28 Specifying assets to scan in a static site ...............................................................................................29 Excluding specific assets from scans in all sites ....................................................................................30 Adding users to a site ...........................................................................................................................31 Deleting sites .....................................................................................................................................32 Selecting a Scan Engine for a site ........................................................................................................33 Configuring distributed Scan Engines ..................................................................................................34 Reassigning existing sites to the new Scan Engine ...............................................................................35 Configuring additional site and scan settings ......................................................................................36 Selecting a scan template .....................................................................................................................36 Creating a scan schedule ......................................................................................................................37 Setting up scan alerts ...........................................................................................................................39 Including organization information in a site ........................................................................................41 Configuring scan credentials ...............................................................................................................42 Configuring site-specific scan credentials ............................................................................................42 Performing additional steps for certain credential types .....................................................................46 Configuring scan authentication on target Web applications ..............................................................50

Nexpose Users Guide

Managing dynamic discovery of virtual assets ....................................................................................54 Configuring and performing vAsset discovery .....................................................................................55 Configuring a dynamic site ...................................................................................................................63 Running a manual scan ......................................................................................................................66 Monitoring the progress and status of a scan ......................................................................................67 Pausing, resuming, and stopping a scan ...............................................................................................71 Viewing scan results .............................................................................................................................71 Viewing the scan log .............................................................................................................................71 Viewing history for all scans .................................................................................................................76

Assess
Locating assets ...................................................................................................................................78 Locating assets by sites ........................................................................................................................79 Locating assets by asset groups ...........................................................................................................80 Locating assets by operating system ....................................................................................................80 Locating assets by services ...................................................................................................................80 Locating assets by software .................................................................................................................81 Viewing the details about an asset ......................................................................................................81 Deleting assets .....................................................................................................................................82 Working with vulnerabilities ..............................................................................................................84 Viewing active vulnerabilities ...............................................................................................................84 Filtering your view of vulnerabilities ....................................................................................................87 Viewing vulnerability details ................................................................................................................91 Working with validated vulnerabilities .................................................................................................92 Working with vulnerability exceptions ...............................................................................................94 Understanding cases for excluding vulnerabilities ...............................................................................94 Understanding vulnerability exception permissions ............................................................................95 Understanding vulnerability exception status and work flow .............................................................95 Working with Policy Manager results ...............................................................................................106 Getting an overview of Policy Manager results .................................................................................107 Viewing results for a Policy Manager policy .......................................................................................108 Viewing information about policy rules .............................................................................................109 Overriding rule test results .................................................................................................................111

Act
Working with asset groups ...............................................................................................................120 Comparing dynamic and static asset groups ......................................................................................120 Configuring a static asset group by manually selecting assets ...........................................................122 Performing filtered asset searches ...................................................................................................124 Configuring asset search filters ..........................................................................................................124 Creating a dynamic or static asset group from asset searches ...........................................................136 Changing asset membership in a dynamic asset group .....................................................................138 Working with reports .......................................................................................................................139 Viewing, editing, and running reports ..............................................................................................140 Creating a basic report .....................................................................................................................142

Nexpose Users Guide

Starting a new report configuration ...................................................................................................142 Entering CyberScope information ......................................................................................................145 Configuring an XCCDF report ..............................................................................................................146 Selecting assets to report on ..............................................................................................................146 Filtering report scope with vulnerabilities .........................................................................................148 Configuring report frequency .............................................................................................................152 Saving or running the newly configured report .................................................................................154 Selecting a scan as a baseline .............................................................................................................155 Distributing, sharing, and exporting reports .....................................................................................156 Working with report owners ..............................................................................................................156 Managing the sharing of reports ........................................................................................................157 Granting users the report-sharing permission ...................................................................................159 Restricting report sections .................................................................................................................163 Exporting scan data to external databases ........................................................................................165 Configuring data warehousing settings ..............................................................................................165 For ASVs: Consolidating three report templates into one custom template ......................................166 Configuring custom report templates ...............................................................................................168 Adding a custom logo to your report .................................................................................................171 Working with externally created report templates ...........................................................................172 Working with report formats ...........................................................................................................173 Working with human-readable formats .............................................................................................173 Working with XML formats ................................................................................................................173 Working with CSV export ...................................................................................................................174 How vulnerability exceptions appear in XML and CSV formats .........................................................177 Working with the database export format .........................................................................................178 Understanding report content ..........................................................................................................179 Scan settings can affect report data ...................................................................................................179 Understanding how vulnerabilities are characterized according to certainty ...................................180 Looking beyond vulnerabilities ..........................................................................................................180 Using report data to prioritize remediation .......................................................................................181 Using tickets .....................................................................................................................................182 Viewing tickets ...................................................................................................................................182 Creating and updating tickets ............................................................................................................182

Tune
Working with scan templates and tuning scan performance .............................................................185 Defining your goals for tuning ............................................................................................................186 The primary tuning tool: the scan template .......................................................................................190 Configuring custom scan templates ..................................................................................................192 Starting a new custom scan template ................................................................................................193 Selecting the type of scanning you want to do ..................................................................................193 Configuring asset discovery ..............................................................................................................194 Determining if target assets are live ..................................................................................................194 Fine-tuning scans with verification of live assets ...............................................................................195 Ports used for asset discovery ............................................................................................................195 Configuration steps for verifying live assets .......................................................................................195
Nexpose Users Guide 6

Collecting information about discovered assets ................................................................................196 Finding other assets on the network ..................................................................................................196 Fingerprinting TCP/IP stacks ...............................................................................................................196 Reporting unauthorized MAC addresses ............................................................................................197 Enabling authenticated scans of SNMP services ................................................................................198 Creating a list of authorized MAC addresses ......................................................................................198 Configuring service discovery ...........................................................................................................199 Performance considerations for port scanning ..................................................................................199 Changing discovery performance settings .........................................................................................200 Selecting vulnerability checks ..........................................................................................................203 Configuration steps for vulnerability check settings ..........................................................................204 Selecting Policy Manager checks ......................................................................................................206 Configuring verification of standard policies .....................................................................................207 Configuring Web spidering ...............................................................................................................210 Configuration steps and options for Web spidering ..........................................................................211 Fine-tuning Web spidering .................................................................................................................214 Configuring scans of various types of servers ...................................................................................215 Configuring spam relaying settings ....................................................................................................215 Configuring scans of database servers ...............................................................................................215 Configure scans of Web servers .........................................................................................................216 Configuring scans of mail servers .......................................................................................................217 Configuring scans of CVS servers ........................................................................................................217 Configuring scans of DHCP servers .....................................................................................................217 Configuring scans of Telnet servers ....................................................................................................218 Configuring file searches on target systems ......................................................................................219 Using other tuning options ...............................................................................................................220 Change Scan Engine deployment .......................................................................................................220 Edit site configuration ........................................................................................................................220 Make your environment scan-friendly ............................................................................................220 Open firewalls on Windows scan targets ...........................................................................................221 Creating a custom policy ..................................................................................................................222 Uploading custom SCAP policies .......................................................................................................230 File specifications ...............................................................................................................................230 Version and file name conventions ....................................................................................................231 Uploading SCAP policies .....................................................................................................................231 Troubleshooting upload errors ..........................................................................................................233 Working with risk strategies to analyze threats ................................................................................237 Comparing risk strategies ...................................................................................................................238 Changing your risk strategy and recalculating past scan data ...........................................................241 Using custom risk strategies ...............................................................................................................243 Setting the appearance order for a risk strategy ...............................................................................244 Changing the appearance order of risk strategies .............................................................................245 Understanding how risk scoring works with scans .............................................................................246

Nexpose Users Guide

Resources
Using regular expressions .................................................................................................................248 General notes about creating a regex ................................................................................................248 How the file name search works with regex ......................................................................................249 How to use regular expressions when logging on to a Web site ........................................................250 Using Exploit Exposure .....................................................................................................................251 Why exploit your own vulnerabilities? ...............................................................................................251 Performing configuration assessment ..............................................................................................252 Scan templates ................................................................................................................................254 Report templates and sections .........................................................................................................272 Built-in report templates and included sections ................................................................................272 Document report sections ..................................................................................................................281 Export template attributes .................................................................................................................287 Glossary ...........................................................................................................................................290 Index ................................................................................................................................................303

Nexpose Users Guide

About this guide

This guide helps you to gather and distribute information about your network assets and vulnerabilities using Nexpose. It covers the following activities:

logging onto the Security Console and navigating the Web interface setting up a site running a scan viewing asset and vulnerability data creating remediation tickets creating reports reading and interpreting report data

A note about documented features

All features documented in this guide are available in the Nexpose Enterprise edition. Certain features are not available in other editions. For a comparison of features available in different editions see http://www.rapid7.com/products/nexpose/compare-editions.jsp.

Other documents and Help

Click the Help link on any page of the Security Console Web interface to find information quickly. You can download any of the following documents from the Support page in Help. Administrators guide The administrators guide helps you to ensure that Nexpose works effectively and consistently in support of your organizations security objectives. It provides instruction for doing key administrative tasks:

API guide

configuring host systems for maximum performance planning a deployment, including determining how to distribute scan engines managing users and roles maintenance and troubleshooting

The API guide helps you to automate some Nexpose features and to integrate its functionality with your internal systems.

Nexpose Users Guide

Document conventions
Words in bold are names of hypertext links and controls. Words in italics are document titles, chapter titles, and names of Web interface pages. 1. Steps of procedures are indented and are numbered.

Items in Courier font are commands, command examples, and directory paths. Items in bold Courier font are commands you enter. Variables in command examples are enclosed in box brackets. Example: [installer_file_name] Options in commands are separated by pipes. Example: $ /etc/init.d/[daemon_name] start|stop|restart Keyboard commands are bold and are enclosed in arrow brackets. Example: Press and hold <Ctrl + Delete>
NOTES, TIPS, and WARNINGS appear in the margin.

NOTES contain information that:

enhances a description or a procedure. provides additional details that only apply in certain cases.

TIPS provide hints, best practices, or techniques for completing a task. WARNINGS provide information about how to avoid potential loss of data or damage to data or a loss of system integrity. Throughout this document, Nexpose is referred to as the application.

For technical support

You have several options for technical support:

Send an e-mail to [email protected] (Enterprise and Express Editions only). Click the Support link on the Security Console Web interface. Go to community.rapid7.com.

Nexpose Users Guide

10

Chapter 1 Getting Started

If you havent used the application before, this section helps you to become familiar with the Web interface, which you will need for running scans, creating reports, and performing other important operations.

Running the application on page 12: By default, the application is configured to run automatically in the background. If you need to stop and start it automatically, or manage the application service or daemon, this section shows you how. Using the Web interface on page 14: This section guides you through logging on, navigating the Web interface, using configuration panels, and running searches.

Nexpose Users Guide

11

Running the application

This section includes the following topics to help you get started with the application:

Manually starting or stopping in Windows on page 12 Changing the configuration for starting automatically as a service on page 12 Manually starting or stopping in Linux on page 13 Working with the daemon on page 13

Manually starting or stopping in Windows

Nexpose is configured to start automatically when the host system starts. If you disabled the initialize/ start option as part of the installation, or if you have configured your system to not start automatically as a service when the host system starts, you will need to start it manually. Starting the Security Console for the first time will take 10 to 30 minutes because the database of vulnerabilities has to be initialized. You may log on to the Security Console Web interface immediately after the startup process has completed.

Manually starting or stopping in Windows

If you have disabled automatic startup, use the following procedure to start the application manually: 1. 2. 3. Click the Windows Start button Go to the application folder. Select Start Services.

Use the following procedure to stop the application manually: 1. 2. 3. Click the Windows Start button. Open the application folder. Click the Stop Services icon.

Changing the configuration for starting automatically as a service

By default the application starts automatically as a service when Windows starts. You can disable this feature and control when the application starts and stops. 1. 2. 3. 4. 5. 6. 7. Click the Windows Start button, and select Run... Enter services.msc in the Run dialog box. Click OK. Double-click the icon for the Security Console service in the Services pane. Select Manual from the drop-down list for Startup type: Click OK. Close Services.

Nexpose Users Guide

12

Manually starting or stopping in Linux

If you disabled the initialize/start option as part of the installation, you need to start the application manually. Starting the Security Console for the first time will take 10 to 30 minutes because the database of vulnerabilities is initializing. You can log on to the Security Console Web interface immediately after startup has completed. To start the application from graphical user interface, double-click the Nexpose icon in the Internet folder of the Applications menu. To start the application from the command line, take the following steps: 1. 2. Go to the directory that contains the script that starts the application:
$ cd [installation_directory]/nsc

Run the script:./nsc.sh

Working with the daemon

The installation creates a daemon named nexposeconsole.rc in the /etc/init.d/ directory.
WARNING: Do not use <CTRL+C>, it will stop the application.

To detach from a screen session, press <CTRL +A + D>.

Manually starting, stopping, or restarting the daemon

To manually start, stop, or restart the application as a daemon: 1. 2. Go to the /nsc directory in the installation directory:
cd [installation_directory]/nsc

Run the script to start, stop, or restart the daemon. For the Security Console, the script file name is nscsvc. For a scan engine, the service name is nsesvc: ./[service_name] start|stop

Preventing the daemon from automatically starting with the host system
To prevent the application daemon from automatically starting when the host system starts:
$ update-rc.d [daemon_name] remove

Nexpose Users Guide

13

Using the Web interface

This section includes the following topics to help you access and navigate the Security Console Web interface:

Logging on on page 14 Navigating the Security Console Web interface on page 18 Using the search feature on page 21 Using configuration panels on page 22 Extending Web interface sessions on page 22

Performing offline activations and updates

If your Security Console is not connected to the Internet, you can find directions for performing offline activations and updates in the administrator's guide or in Help.

Logging on
The Security Console Web interface supports the following browsers:

Internet Explorer 7.0.x, 8.0.x, and 9.0 Mozilla Firefox 10.0.x and 17.0.x Google Chrome

If you received a product key, via e-mail use the following steps to log on. You will enter the product key during this procedure. You can copy the key from the e-mail and paste it into the text box; or you can enter it with or without hyphens. Whether you choose to include or omit hyphens, do so consistently for all four sets of numerals. If you do not have a product key, click the link to request one. Doing so will open a page on the Rapid7 Web site, where you can register to receive a key by e-mail. After you receive the product key, log on to the Security Console interface again and follow this procedure. If you are a first-time user and have not yet activated your license, you will need the product key that was sent to you to activate your license after you log on. To log on to the Security Console take the following steps:
TIP: If there is a usage conflict for port 3780, you can specify another available port in the [installation_directory]\nsc\conf \httpd.xml file. You also can switch the port after you log on. See Managing Security Console settings in the administrators guide.

1.

Start a Web browser. If you are running the browser on the same computer as the console, go to the following URL: https://localhost:3780 Indicate HTTPS protocol and to specify port 3780. If you are running the browser on a separate computer, substitute localhost with the correct host name or IP address. Your browser displays the Logon window.

Nexpose Users Guide

14

NOTE: If the logon window indicates that the Security Console is in maintenance mode, then either an error has occurred in the startup process, or a maintenance task is running. See Running in maintenance mode in the administrators guide.

2.

Enter your user name and password that you specified during installation. User names and passwords are case-sensitive and non-recoverable.

Logon window

3.

Click the Logon button. If you are a first-time user and have not yet activated your license, the console displays an activation dialog box. Follow the instructions to enter your product key.

Activate License window

NOTE: If the Security Console displays a warning that authentication services are unavailable, and your network uses an external authentication source, have your Global Administrator verify that the source is online and correctly configured. See Using external sources for user authentication in the administrator's guide.

4. 5. 6.

Click Activate to complete this step. Click the Home link to view the Security Console Home page. Click the Help link on any page of the Web interface for information on how to use the application.

The first time you log on, you will see the News page, which lists all updates and improvements in the installed system, including new vulnerability checks. If you do not wish to see this page every time you log on after an update, clear the check box for automatically displaying this page after every login. You can view the News page by clicking the News link that appears near the top right corner of every page of the console interface.

Nexpose Users Guide

15

Troubleshooting your activation

Your product key is your access to all the features you need to start using the application. Before you can being using the application you must activate your license using the product key you received. Your license must be active so that you can perform operations like running scans and creating reports. If you received an error message when you tried to activate your license you can try the troubleshooting techniques identified below before contacting Technical Support. Product keys are good for one use; if you are performing the installation for a second time or if you receive errors during product activation and these techniques have not worked for you, contact Technical Support. Ensure that you have your proxy server configured correctly, go to the Administration page Security Console Configuration panel Update Proxy Settings section. Try the following techniques to troubleshoot your activation: Did I enter the product key correctly?

Verify that you entered the product key correctly.

Is there an issue with my browser? Confirm the browser you are using is supported. See Logging on on page 14 for a list of supported browsers. Clear the browser cache.

Are my proxy settings correct? If you are using a proxy server, verify that your proxy settings are correct because inaccurate settings can cause your license activation to fail.

Go to the Administration page and click Manage settings for the Security Console to open the Security Console Configuration panel. Select Update Proxy to display the Proxy Settings section ensure that the address, port, domain, User ID, and password are entered correctly. If you are not using a proxy, ensure the Name or address field is specified as updates.rapid7.com. Changing this setting to another server address may cause your activation to fail. Contact Technical Support if you require a different server address and you receive errors during activation.

Are there issues with my network or operating system?

By running diagnostics, you can find operating system and network issues that could be preventing license activation.

Go to the Administration page and click Diagnose and troubleshoot problems with the Security Console. Select the OS Diagnostics and Network Diagnostics checkboxes. Click Perform diagnostics to see the current status of your installation. The results column will provide valuable information such as, if DNS name resolution is successful, if firewalls are enabled, and if the Gateway ping returns a DEAD response.

Nexpose Users Guide

16

Confirm that all traffic is allowed out over port 80 to updates.rapid7.com.

If you are using Linux, open a terminal and enter telnet updates.rapid7.com 80. You will see Connected if traffic is allowed. If you are using Windows, open a browser and enter http://updates.rapid7.com. You should see a blank page. White-list the IP address of the application server on your firewall so that it can send traffic outbound to http://updates.rapid7.com. Make the same rule changes on your proxy server. If you see an error message after adding the IP address to a white-list you will need to determine what is blocking the application.

Are there issues with firewalls in my network?

Confirm that host-based firewall and antivirus detection are disabled on the system you are installing the application on. for more information. Ensure the IP address of the application server is white-listed through firewalls and content filters. This will allow you to reach the update server and pull down any necessary .jar files for activation and updates.

Have I tried everything?

Restart the application, in some cases a browser anomaly can cause an error message that your activation failed. Restarting may be successful in those rare cases.

Nexpose Users Guide

17

Navigating the Security Console Web interface

The Security Console includes a Web-based user interface for configuring and operating the application. Familiarizing yourself with the interface will help you to find and use its features quickly. When you log on to the to the Home page for the first time, you see place holders for information, but no information in them. After installation, the only information in the database is the account of the default Global Administrator and the product license.

The Home page as it appears in a new installation

The Home page as it appears with scan data

The Home page shows sites, asset groups, tickets, and statistics about your network that are based on scan data. If you are a Global Administrator, you can view and edit site and asset group information, and run scans for your entire network on this page.

Nexpose Users Guide

18

On the Site Listing pane, you can click controls to view and edit site information, run scans, and start to create a new site, depending on your role and permissions. Information for any currently running scan appears in the pane labeled Current Scan Listings for All Sites. On the Ticket Listing pane, you can click controls to view information about tickets and assets for which those tickets are assigned. On the Asset Group Listing pane, you can click controls to view and edit information about asset groups, and start to create a new asset group. A row of tabs appears at the top of the Home page, as well as every page of the Security Console. Use these tabs to navigate to the main pages for each area.

Home tab bar

The Assets page links to pages for viewing assets organized by different groupings, such as the sites they belong to or the operating systems running on them. The Vulnerabilities page lists all discovered vulnerabilities. The Policies page lists policy compliance results for all assets that have been tested for compliance. The Reports page lists all generated reports and provides controls for editing and creating report templates. The Tickets page lists remediation tickets and their status. The Administration page is the starting point for all management activities, such as creating and editing user accounts, asset groups, and scan and report templates. Only Global Administrators see this tab.

Nexpose Users Guide

19

Throughout the Web interface, you can use various controls for navigation and administration. Control Description
Minimize any pane so that only its title bar appears.

Control

Description
Initiate vAsset discovery to create a dynamic site.

Expand a minimized pane.

Copy a built-in report template to create a customized version. Edit properties for a site, report, or a user account.

Close a pane.

Click to display a list of closed panes and open any of the listed panes. Reverse the sort order of listed items in a given column. You can also click column headings to produce the same result. Export asset data to a comma-separated value (CSV) file.

View a preview of a report template.

Delete a site, report, or user account.

Exclude a vulnerability from a report.

Start a manual scan.

View Help. View the Support page to search FAQ pages and contact Technical Support. View the News page which lists all updates. Click Home to return to the main dashboard.

Pause a scan.

Resume a scan.

Click to add items to your dashboard.

Stop a scan.

Log Out link

Initiate a filtered search for assets to create a dynamic asset group.

Log out of the Security Console interface. The Logon box appears. For security reasons, the Security Console automatically logs out a user who has been inactive for 10 minutes. This link is the logged-on user name. Click it to open the User Configuration panel where you can edit account information such as the password and view site and asset group access. Only Global Administrators can change roles and permissions.

User: <user name> link

Nexpose Users Guide

20

Using the search feature

With the powerful full-text search feature, you can search the database using a variety of criteria, including full or partial IP addresses. Enter your search criteria in the Search box on any a page of the Security Console interface, and click the magnifying glass icon. For example, if you want to search for discovered instances of the vulnerabilities that affect assets running ActiveX, enter ActiveX or activex in the Search text box. The search is not case-sensitive.

Starting a search

The application displays search results on the Search page, which includes panes for different groupings of results. With the current example, ActiveX, results appear in the Vulnerability Results pane. At the bottom of each category pane, you can view the total number of results and change settings for how results are displayed.

Search results

In the Search Criteria pane, you can refine and repeat the search. You can change the search phrase and select check boxes to allow partial word matches and to specify that all words in the phrase appear in each result. After refining the criteria, click the Search Again button.

Nexpose Users Guide

21

Using configuration panels

Nexpose provides panels for configuration and administration tasks:

creating and editing sites creating and editing user accounts creating and editing asset groups creating and editing scan templates creating and editing reports and report templates configuring Security Console settings troubleshooting and maintenance

All panels have the same navigation scheme. You can either use the Previous and Next buttons at the top of the panel page to progress through each page, or you can click a page link listed on the left column of each panel page to go directly to that page.

Configuration panel navigation and controls

NOTE: Parameters labeled in red denote required parameters on all panel pages.

To save configuration changes, click the Save button that appears on every page. To discard changes, click the Cancel button.

Extending Web interface sessions

NOTE: You can change the length of the Web interface session. See the section Changing Security Console Web server default settings in the administrators guide.

By default, an idle Web interface session times out after 10 minutes. When an idle session expires, the Security Console displays a logon window. To continue the session, simply log on again. You will not lose any unsaved work, such as configuration changes. However, if you choose to log out, you will lose unsaved work. If a communication issue between your browser and the Security Console Web server prevents the session from refreshing, you will see an error message. If you have unsaved work, do not leave the page, refresh the page, or close the browser. Contact your Global Administrator.

Nexpose Users Guide

22

Chapter 2 Discover

To know what your security priorities are, you need to discover what devices are running in your environment and how these assets are vulnerable to attack. You discover this information by running scans. Discover provides guidance on operations that enable you to prepare and run scans.

Configuring a basic static site on page 25: Before you can run a scan, you need to create a site. A site is a collection of assets targeted for scanning. A basic site includes assets, a scan template, a Scan Engine, and users who have access to site data and operations. This section provides steps and best practices for creating a basic static site. Selecting a Scan Engine for a site on page 33: A Scan Engine is a requirement for a site. It is the component that will do the actual scanning of your target assets. By default, a site configuration includes the local Scan Engine that is installed with the Security Console. If you want to use a distributed or hosted Scan Engine for a site, this section guides you through the steps of selecting it. Configuring distributed Scan Engines on page 34: Before you can select a distributed Scan Engine for your site, you need to configure it and pair with the Security Console, so that the two components can communicate. This section shows you how. Configuring additional site and scan settings on page 36: After you configure a basic site, you may want to alter or enhance it by using a scan template other than the default, scheduling scans to run automatically, or receiving alerts related to specific scan events. This section guides you through those procedures. Configuring scan credentials on page 42: To increase the information that scans can collect, you can authenticate them on target assets. Authenticated scans inspect assets for a wider range of vulnerabilities, as well as policy violations and adware or spyware exposures. They also can collect information on files and applications installed on the target systems. This section provides guidance for adding credentials to your site configuration. Configuring scan authentication on target Web applications on page 50: Scanning Web sites at a granular level of detail is especially important, since publicly accessible Internet hosts are attractive targets for attack. Authenticated scans of Web assets can flag critical vulnerabilities such as SQL injection and cross-site scripting. This section provides guidance on authenticating Web scans. Configuring and performing vAsset discovery on page 55: If your environment includes virtual machines, you may find it a challenge to keep track of these assets and their activity. A feature called vAsset discovery allows you find all the virtual assets in your environment and collect up-to-date information about their dynamically changing states. This section guides you through the steps of initiating and maintaining vAsset discovery. Configuring a dynamic site on page 63: After you initiate vAsset discovery, you can create a dynamic site and scan these virtual assets for vulnerabilities. A dynamic sites asset membership changes depending on continuous vAsset discovery results. This section provides guidance for creating and updating dynamic sites. Running a manual scan on page 66: After you create a site, youre ready to run a scan. This section guides you through starting, pausing, resuming, and stopping a scan, as well as viewing the scan log and monitoring scan status. 23

Nexpose Users Guide

Comparing dynamic and static sites

Your first choice in creating a site is whether it will be dynamic or static. The main factor to consider is the fluidity of your scan target environment. A dynamic site is ideal for a highly fluid target environment, such as a deployment of virtualized assets. It is not unusual for virtual machines to undergo continual changes, such as having different operating systems installed, being supported by different resource pools, or being turned on and off. Because asset membership in a dynamic site is based on continual discovery of virtual assets, the asset list in a dynamic site changes as the target environment changes, as reflected in the results of each scan. Dynamic site configuration begins with vAsset discovery. After you set up a discovery connection and initiate discovery, you have the option to create a dynamic site that will automatically be populated with discovered assets. You can change asset membership in a dynamic site by changing the discovery connection or the criteria filters that determine which assets are discovered. See Configuring a dynamic site on page 63. A static site is ideal for a target environment that is less likely to change often, such as one with physical machines. Asset membership in a static site is based on a manual selection process. To keep track of changes in your environment that might warrant changes in a static sites membership, run discovery scans. See Configuring asset discovery on page 194.

Nexpose Users Guide

24

Configuring a basic static site

The basic components of a site include target assets and a scan template. Unlike with a dynamic site, static site creation requires manual selection of assets. The selection can be based on one of several strategies and can have an impact on the quality of scans and reports.

Choosing a grouping strategy for a static site

There are many ways to divide network assets into sites. The most obvious grouping principal is physical location. A company with assets in Philadelphia, Honolulu, Osaka, and Madrid could have four sites, one for each of these cities. Grouping assets in this manner makes sense, especially if each physical location has its own dedicated Scan Engine. Remember, each site is assigned to a specific Scan Engine. With that in mind, you may find it practical simply to base site creation on Scan Engine placement. Scan engines are most effective when they are deployed in areas of separation and connection within your network. See Distribute Scan Engines strategically in the administrators guide. So, for example, you could create sites based on subnetworks. Other useful grouping principles include common asset configurations or functions. You may want have separate sites for all of your workstations and your database servers. Or you may wish to group all your Windows 2008 Servers in one site and all your Debian machines in another. Similar assets are likely to have similar vulnerabilities, or they are likely to present identical logon challenges. If you are performing scans to test assets for compliance with a particular standard or policy, such as Payment Card Industry (PCI) or Federal Desktop Core Configuration (FDCC), you may find it helpful to create a site of assets to be audited for compliance. This method focuses scanning resources on compliance efforts. It also makes it easier to track scan results for these assets and include them in reports and asset groups.

Being flexible with site membership

When selecting assets for sites, flexibility can be advantageous. You can include an asset in more than one site. For example, you may wish to run a monthly scan of all your Windows Vista workstations with the Microsoft hotfix scan template to verify that these assets have the proper Microsoft patches installed. But if your organization is a medical office, some of the assets in your Windows Vista site might also be part of your Patient support site, which you may have to scan annually with the HIPAA compliance template. Another thing to keep in mind is that you combine assets into sites for scanning, but you can arrange them differently for asset groups. You may have fairly broad criteria for creating a site. But once you run a scan, you can parse the asset data into many different views using different report templates. You can then assign different asset group members to read these reports for various purposes. Avoid getting too granular with your site creation. The more sites you have, the more scans you will be compelled to run, which can inflate overhead in time and bandwidth.

Nexpose Users Guide

25

Grouping options for Example, Inc.

Your grouping scheme can be fairly broad or more granular. The following table shows a serviceable high-level site grouping for Example, Inc. The scheme provides a very basic guide for scanning and makes use of the entire network infrastructure. Site name
New York

Address space
10.1.0.0/22 10.1.10.0/23 10.1.20.0/24 172.16.0.0/22 10.2.0.0/22 10.2.10.0/23 10.2.20.0/24 172.16.10.0/24

Number of assets
360

Component
Security Console

New York DMZ Madrid

30

Scan Engine #1

233

Scan Engine #1

Madrid DMZ

15

Scan Engine #1

A potential problem with this grouping is that managing scan data in large chunks is time consuming and difficult. A better configuration groups the elements into smaller scan sites for more refined reporting and asset ownership. In the following configuration, Example, Inc., introduces asset function as a grouping principle. The New York site from the preceding configuration is subdivided into Sales, IT, Administration, Printers, and DMZ. Madrid is subdivided by these criteria as well. Adding more sites reduces scan time and promotes more focused reporting. Site name
New York Sales

Address space
10.1.0.0/22

Number of assets
254

Component
Security Console

New York IT

10.1.10.0/24

25

Security Console

New York Administration New York Printers

10.1.10.1/24

25

Security Console

10.1.20.0/24

56

Security Console

New York DMZ Madrid Sales Madrid Development Madrid Printers Madrid DMZ

172.16.0.0/22 10.2.0.0/22 10.2.10.0/23

30 65 130

Scan Engine 1 Scan Engine 2 Scan Engine 2

10.2.20.0/24 172.16.10.0/24

35 15

Scan Engine2 Scan Engine 3

Nexpose Users Guide

26

An optimal configuration, seen in the following table, incorporates the principal of physical separation. Scan times will be even shorter, and reporting will be even more focused. Site name
New York Sales 1st floor New York Sales 2nd floor New York Sales 3rd floor New York IT New York Administration New York Printers Building 1 New York Printers Building 2 New York DMZ

Address space
10.1.1.0/24

Number of assets
84

Component
Security Console

10.1.2.0/24

85

Security Console

10.1.3.0/24

85

Security Console

10.1.10.0/25 10.1.10.128/25

25 25

Security Console Security Console

10.1.20.0/25

28

Security Console

10.1.20.128/25

28

Security Console

172.16.0.0/22

30

Scan Engine 1

Madrid Sales Office 1 Madrid Sales Office 2

10.2.1.0/24 10.2.2.0/24

31 31

Scan Engine 2 Scan Engine 2

Madrid Sales Office 3

10.2.3.0/24

33

Scan Engine 2

Madrid Development Floor 2 Madrid Development Floor 3 Madrid Printers Building 3 Madrid DMZ

10.2.10.0/24

65

Scan Engine 2

10.2.11.0/24

65

Scan Engine 2

10.2.20.0/24

35

Scan Engine 2

172.16.10.0/24

15

Scan Engine 3

Nexpose Users Guide

27

Starting a static site configuration

To begin setting up a site, take the following steps: 1. Click the New Static Site button on the Home page.

Home pagestarting new a static site

OR Click the Assets tab. On the Assets page, click View next to sites. On the Sites page, click New Site. 2. On the Site Configuration General page, type a name for your site. You may wish to associate the name with the type of scan that you will perform on the site, such as Full Audit, or Denial of Service. 3. 4. Type a brief description for the site. Select a level of importance from the drop-down list.

The Very Low setting reduces a risk index to 1/3 of its initial value. The Low setting reduces the risk index to 2/3 of its initial value. High and Very High settings increase the risk index to twice and 3 times its initial value, respectively. A Normal setting does not change the risk index. The importance level corresponds to a risk factor used to calculate a risk index for each site.

Nexpose Users Guide

28

Specifying assets to scan in a static site

NOTE: Scanning over IPv6 networks is not supported from a Scan Engine installed on Windows 2003.

1. 2.

Go to the Assets page to list assets for your new site. Enter addresses and host names in the text box labeled Assets to scan. You can enter IPv4 and IPv6 addresses in any order. Example:
2001:0:0:0:0:0:0:12001::2 10.1.0.2 server1.example.com 2001:0000:0000:0000:0000:0000:0000:0003 10.0.1.3

You can mix address ranges with individual addresses and host names. Example:
10.2.0.1 2001:0000:0000:0000:0000:0000:0000:0001-2001:0000:0000:0000:0000:0000:0000:FFFF 10.0.0.1 - 10.0.0.254 10.2.0.3 server1.example.com

IPv6 addresses can be fully, partially, or uncompressed. The following are equivalent:
2001:db8::1 == 2001:db8:0:0:0:0:0:1 ==

You can use CIDR notation in IPv4 and IPv6 formats. Examples:
10.0.0.0/24 2001:db8:85a3:0:0:8a2e:370:7330/124

If you use CIDR notation for IPv4 addresses, the network identifier and network broadcast address is ignored, and the entire network is scanned: 10.0.0.0/24 becomes 10.0.0.1 - 10.0.0.254 You also can import a comma- or new-line-delimited ASCII-text file that lists IP address and host names of assets you want to scan. To import an asset list, take the following steps: 1. 2. Click Browse in the Included Assets area. Select the appropriate .txt file from the local computer or shared network drive for which read access is permitted. Each address in the file should appear on its own line. Addresses may incorporate any valid Nexpose convention, including CIDR notation, host name, fully qualified domain name, and range of devices. See the box labeled More Information. (Optional) If you are a Global Administrator, you may edit or delete addresses already listed in the site detail page. You can prevent assets within an IP address range from being scanned, manually enter addresses and host names in the text box labeled Assets to Exclude from scanning; or import a comma- or new-linedelimited ASCII-text file that lists addresses and host names that you dont want to scan.

Nexpose Users Guide

29

To prevent assets within an IP address range from being scanned, take the following steps: 1. 2.
NOTE: Each address in the file should appear on its own line. Addresses may incorporate any valid convention, including CIDR notation, host name, fully qualified domain name, and range of assets.

Click Browse in the Excluded Devices area Select the appropriate .txt file from the local computer or shared network drive for which read access is permitted. If you specify a host name for exclusion, the application will attempt to resolve it to an IP address prior to a scan. If it is initially unable to do so, it will perform one or more phases of a scan on the specified asset, such as pinging or port discovery. In the process, it may be able to determine that the asset has been excluded from the scope of the scan, and it will discontinue scanning it. However, if a determination cannot be made the asset will continue to be scanned.

You also can exclude specific assets from scans in all sites throughout your deployment on the Global Asset Exclusions page.

Excluding specific assets from scans in all sites

You may want to prevent specific assets from being scanned at all, either because they have no security relevance or because scanning them would disrupt business operations. On the Assets page of the Site Configuration panel, you can exclude specific assets from scans in the site you are creating. However, assets can belong to multiple sites. If you are managing many sites, it can be time-consuming to exclude assets from each site. You may want to quickly prevent a particular asset from being scanned under any circumstances. A global configuration feature makes that possible. On the Asset Exclusions page, you can quickly exclude specific assets from scans in all sites throughout your deployment. If you specify a host name for exclusion, the application will attempt to resolve it to an IP address prior to a scan. If it is initially unable to do so, it will perform one or more phases of a scan on the specified asset, such as pinging or port discovery. In the process, the application may be able to determine that the asset has been excluded from the scope of the scan, and it will discontinue scanning it. However, if it is unable to make that determination, it will continue scanning the asset. You must be a Global Administrator to access these settings. To exclude an asset from scans in all possible sites, take the following steps: 1. 2. 3. 4. Go to the Administration page. Click the Manage link for Global Settings The Security Console displays the Global Settings page. In the left navigation pane, click the Asset Exclusions link. The Security Console displays the Asset Exclusions page. Manually enter addresses and host names in the text box. OR To import a comma- or new-line-delimited ASCII-text file that lists addresses and host names that you dont want to scan, click Choose File. Then select the appropriate .txt file from the local computer or shared network drive for which read access is permitted. Each address in the file should appear on its own line. Addresses may incorporate any valid convention, including CIDR notation, host name, fully qualified domain name, and range of devices. 5. Click Save.

Nexpose Users Guide

30

Adding users to a site

You must give users access to a site in order for them to be able view assets or perform asset-related operations, such as scanning or reporting, with assets in that site. To add users to a site, take the following steps: 1. 2. 3. 4. Go to the Access page in the Site Configuration panel. Add users to the site access list. Click Add Users. Select the check box for every user account that you want to add to the access list in the Add Users dialog box. OR 5. 6. 7. Select the check box in the top row to add all users. Click Save. Click Save on any page of the panel to save the site configuration.

Nexpose Users Guide

31

Deleting sites
To manage disk space and ensure data integrity of scan results, administrators can delete unused sites. By removing unused sites, inactive results do not distort scan results and risk posture in reports. In addition, unused sites count against your license and can prevent the addition of new sites. Regular site maintenance helps to manage your license so that you can create new sites.
NOTE: To delete a site, you must have access to the site and have Manage Sites permission. The Delete button is hidden if you do not have permission.

To delete a site: 1. Access the Site Listing panel:

OR

Click the Home tab. Click the Assets tab and then click View assets by the sites they belong to.

Assets tab - clicking View sites.

NOTE: You cannot delete a site that is being scanned. You receive this message Scans are still in progress. If you want to delete this site, stop all scans first.

The Site Listing panel displays the sites that you can access based on your permissions. 2. Click the Delete button to remove a site.

Site Listing panel

All reports, scan templates, and scan engines are disassociated. Scan results are deleted. If the delete process is interrupted then partially deleted sites will be automatically cleared.

Nexpose Users Guide

32

Selecting a Scan Engine for a site

If you have installed distributed Scan Engines or are using Rapid7 hosted Scan Engines, you can select a Scan Engine for this site. Otherwise, your only option for a Scan Engine is the local component that was installed with the Security Console. The local Scan Engine is also the default selection. To change the Scan Engine selection, take the following steps: 1. 2. Go to the Scan Setup page of the Site Configuration panel. Select the desired Scan Engine from the drop-down list. OR Click Browse... to view a window with a table of information about available Scan Engines. This table can be useful in helping you select a Scan Engine. For example, if you see that a particular engine has many sites assigned to it, you may want to consider a different Scan Engine, that doesnt have as much demand load upon it. Click the link for the desired Scan Engine to select it.

Browse Scan Engines window

OR To configure a new Scan Engine, click Create... to configure a new Scan Engine. See Configuring distributed Scan Engines on page 34. After you configure the new Scan Engine, return to the Scan Setup page in the Site Configuration panel and select the engine. 3. Click Save on the Scan Setup page.

Nexpose Users Guide

33

Configuring distributed Scan Engines

If you are working with distributed Scan Engines, having a Scan Engine configured and paired with the Security Console should precede creating a site. This is because each site must be assigned to a Scan Engine in order for scanning to be possible. The Security Console is installed with a local Scan Engine. If you want to assign a site to a distributed Scan Engine, you will need install the distributed Scan Engine first. See the installation guide for instructions.

Configuring the Security Console to work with a new Scan Engine

By default, the Security Console initiates a TCP connection to Scan Engines over port 40814. If a distributed Scan Engine is behind a firewall, make sure that port 40814 is open on the firewall to allow communication between the Security Console and Scan Engine. The first step in integrating the Security Console to work and the new Scan Engine is entering information about the Scan Engine. 1. 2. 3. Start the remote Scan Engine if it is not running. You can only add a new Scan Engine if it is running. Click the Administration tab in Security Console Web interface. The Administration page displays. Click Create to the right of Scan Engines. The Security Console displays the General page of the Scan Engine Configuration panel. Enter the information about the new engine in the displayed fields. For the engine name, you can use any text string that makes it easy to identify. The Engine Address and Port fields refer to the remote computer on which the Scan Engine has been installed. If you have already created sites, you can assign sites to the new Scan Engine by going to the Sites page of this panel. If you have not yet created sites, you can perform this step during site creation. 5. Click Save.

NOTE: The Engine Priority feature is not currently supported.

4.

You can now pair the Security Console with the new Scan Engine by taking the following steps: 1. 2. 3. 4. Click the Administration tab. The Security Console displays the Administration page. Click Manage to the right of Scan Engines. The console displays the Scan Engines page. Locate the Scan Engine you are configuring. Note that the status for the engine is Unknown. Click Refresh. The status changes to Pending. The Security Console then creates the consoles.xml file.

Nexpose Users Guide

34

Edit the consoles.xml file in the following step to pair the Scan Engine with the Security Console. 1. 2. 3. 4. 5. Open the consoles.xml file using a text editing program. Consoles.xml is located in the [installation_directory]/nse/conf directory on the Scan Engine. Locate the line for the console that you want to pair with the engine. The console will be marked by a unique identification number and an IP address. Change the value for the Enabled attribute from 0 to 1. Save and close the file. Restart the Scan Engine, so that the configuration change can take effect.

Verify that the console and engine are now paired. 1. 2. 3. Click the Administration tab in the security console Web interface. The Administration page displays. Click Manage to the right of Scan Engines. The Scan Engines page displays. Locate the Scan Engine for which you entered information in the preceding step. Note that the status for the engine is Unknown. 4. Click the Refresh icon for the engine. The status changes to Active. You can now assign a site to this Scan Engine and run a scan with it. On the Scan Engines page, you can also perform the following tasks:

You can edit the properties of any listed Scan Engine by clicking Edit for that engine. You can delete a Scan Engine by clicking Delete for that engine. You can manually apply an available update to the scan engine by clicking Update for that engine. To perform this task using the command prompt, see Using the command console in the administrators guide.

You can configure certain performance settings for all Scan Engines on the Scan Engines page of the Security Console configuration panel. For more information, see Changing default Scan Engine settings in the administrators guide.

Reassigning existing sites to the new Scan Engine

NOTE: If you ever change the name of the scan engine in the scan engine configuration panel, for example because you have changed its location or target assets, you will have to pair it with the console again. The engine name is critical to the pairing process.

If you have not yet set up sites, see Configuring a basic static site on page 25 before performing the following task. To reassign existing sites to a new Scan Engine: 1. Go to the Sites page of the Scan Engine Configuration panel and click Select Sites The console displays a box listing all the sites in your network. 2. Click the check boxes for sites you wish to assign to the new Scan Engine and click Save. The sites appear on the Sites page of the Scan Engine Configuration panel. 3. Click Save to save the new Scan Engine information.

Nexpose Users Guide

35

Configuring additional site and scan settings

After you configure a basic site, you may want to alter or enhance it by using a scan template other than the default, scheduling scans to run automatically, or receiving alerts related to specific scan events.

Selecting a scan template

A scan template is a predefined set of scan attributes that you can select quickly rather than manually define properties, such as target assets, services, and vulnerabilities. For a list of scan templates, their specifications, and suggestions on when to use them, see Scan templates on page 254. A Global Administrator can customize scan templates for your organizations specific needs. When you modify a template, all sites that use that scan template will use the modified settings. See Configuring custom scan templates on page 192 for more information. You may find it helpful to read the scan template descriptions in Scan templates on page 254. The appendix provides a granular look at the components of a scan template and how they are related to various scan events, such as port discovery, and vulnerability checking. As with all other deployment options, scan templates map directly to your security goals and priorities. If you need to become HIPAA compliant, use the HIPAA Compliance template. If you need to protect your perimeter, use the Internet DMZ audit or Web Audit template. Alternating templates is a good idea, as you may want to look at your assets from different perspectives. The first time you scan a site, you might just do a discovery scan to find out what is running on your network. Then, you could run a vulnerability scan using the Full Audit template, which includes a broad and comprehensive range of checks. If you have assets that are about to go into production, it might be a good time to scan them with a Denial-of-Service template. Exposing them to unsafe checks is a good way to test their stability without affecting workflow in your business environment. Tuning your scans by customizing a template is, of course, an option, but keep in mind that the built-in templates are, themselves, best practices. The design of these templates is intended to balance three critical performance factors: time, accuracy, and resources. If you customize a template to scan more quickly by adding threads, for example, you may pay a price in bandwidth.

Nexpose Users Guide

36

Steps for selecting a scan template

1. 2. 3. Go to the Scan Setup page of the Site Configuration panel. The Site Configuration panel appears. Click the Scan Setup link in the left navigation pane. Select an existing scan template from the drop-down list. OR Click Browse to view a table that lists information about each scan template. Click the link for any Scan Template to select it.

Browse Scan Templates window

4.

Click Save.

To create or edit a scan template, take the following steps: 1. Click Edit for any listed template to change its settings. You can also click Copy to make a copy of a listed template or click Create to create a new custom scan template and then change its settings. The New Scan Template Configuration panel appears. 2. 3. 4. Change the template as desired. See Configuring custom scan templates on page 192 for more information. Return to the Scan Setup page of the Site Configuration panel. Click Save.

Creating a scan schedule

Depending on your security policies and routines, you may schedule certain scans to run on a monthly basissuch as patch verification checks or on an annual basis, such as certain compliance checks. It's a good practice to run discovery scans and vulnerability checks more oftenperhaps every week or two weeks, or even several times a week, depending on the importance or risk level of these assets. Scheduling scans requires care. Generally, its a good idea to scan during off-hours, when more bandwidth is free and work disruption is less likely. On the other hand, your workstations may automatically power down at night, or employees may take laptops home. In this case, you may be compelled to scan those assets during office hours. Make sure to alert staff of an imminent scan, as it may tax network bandwidth or appear as an attack.

Nexpose Users Guide

37

If you plan to run scans at night, find out if backup jobs are running, as these can eat up a lot of bandwidth. Your primary consideration in scheduling a scan is the scan window: How long will the scan take? As noted there, many factors can affect scan times:

A scan with an Exhaustive template will take longer than one with a Full Audit template for the same number of assets. An Exhaustive template includes more ports in the scope of a scan. A scan with a high number of services to be discovered will take additional time. Checking for patch verification or policy compliance is time-intensive because of logon challenges on the target assets. A site with a high number of assets will take longer to scan. A site with more live assets will take longer to scan than a site with fewer live assets. Network latency and loading can lengthen scan times. Scanning Web sites presents a whole subset of variables. A big, complex directory structure or a high number of pages can take a lot of time.

If you schedule a scan to run on a repeating basis, note that a future scheduled scan job will not start until the preceding scheduled scan job has completed. If the preceding job has not completed by the time the next job is scheduled to start, an error message appears in the scan log. To verify that a scan has completed, view its status. See Running a manual scan on page 66.

Steps for scheduling a scan

1. 2. 3. Go to the Site Configuration panel. Click the Scan Setup link in the left navigation pane. The Scan Setup page appears. Select the check box labeled Enable schedule. The Security Console displays options for a start date and time, maximum scan duration in minutes, and frequency of repetition. 4. Enter a start date in mm-dd-yyyy format. OR Click the calendar icon and then click a date to select it. 5. 6. Enter a start time in hh:mm format, and select AM or PM. To make it a recurring scan, select Repeat every. Select a number and time unit. If the scheduled scan runs and exceeds the maximum specified duration, it will pause for an interval that you specify.

Nexpose Users Guide

38

7.

Select an option for what you want the scan to do after the pause interval. If you select the option to continue where the scan left off, the paused scan will continue at the next scheduled start time. If you select the option to restart the paused scan from the beginning, the paused scan will stop and then start from the beginning at the next scheduled start time.

Scheduling a recurring scan

8.

Click Save. The newly scheduled scan will appear in the Next Scan column of the Site Summary pane of the page for the site that you are creating. All scheduled scans appear on the Calendar page, which you can view by clicking Monthly calendar on the Administration page.

Setting up scan alerts

You can set up alerts for certain scan events:

a scan starting a scan stopping a scan failing to conclude successfully a scan discovering a vulnerability that matches specified criteria

When an asset is scanned, a sequence of discoveries is performed for verifying the existence of an asset, port, service, and variety of service (for example, an Apache Web server or an IIS Web server). Then, Nexpose attempts to test the asset for vulnerabilities known to be associated with that asset, based on the information gathered in the discovery phase. You can also filter alerts for vulnerabilities based on the level of certainty that those vulnerabilities exist.

Nexpose Users Guide

39

Steps for setting up alerts

1. 2. 3. 4. Go to the Site Configuration panel. Click the Alerting link in the left navigation pane. Click Add alert. The Security Console displays a New Alert dialog box. The Enable check box is selected by default to ensure that an alert is generated. You can clear the check box at any time to disable the alert if you prefer not to receive that alert temporarily without having to delete it. Enter a name for the alert. Enter a value in the Send at most field if you wish to limit the number of this type of alert that you receive during the scan. Select the check boxes for types of events that you want to generate alerts for. For example, if you select Paused and Resumed, an alert is generated every time the application pauses or resumes a scan. 8. 9. Select a severity level for vulnerabilities that you want to generate alerts for. For information about severity levels, see Viewing active vulnerabilities on page 84. Select the Confirmed, Unconfirmed, and Potential check boxes to receive those alerts. If a vulnerability can be verified, a confirmed vulnerability is reported. If the system is unable to verify a vulnerability known to be associated with that asset, it reports an unconfirmed or potential vulnerability. The difference between these latter two classifications is the level of probability. Unconfirmed vulnerabilities are more likely to exist than potential ones, based on the assets profile. 10. Select a notification method from the drop-down box. Alerts can be sent via SMTP e-mail, SNMP message, or Syslog message. Your selection will control which additional fields appear below this box.

5. 6. 7.

If you select the e-mail method, enter the addresses of your intended recipients. Enter an email address in the From email address field to identify who initiated the alert and where a reply can be directed. If your network restricts outbound SMTP traffic, specify a mail relay server for sending the alert e-mails. If you select the option to send SNMP alerts, enter the name of the SNMP community and the address of the SNMP server to receive alerts. If you select the option to send a Syslog message, enter the address of the Syslog server to receive the messages.

Nexpose Users Guide

40

11. Click the Limit alert text check box to send the alert without a description of the alert or its solution. Limited-text alerts only include the name and severity. This is a security option for alerts sent over the Internet or as text messages to mobile devices.

Configuring an alert

12. Click Save. The new alert appears on the Alert Listing table.

Including organization information in a site

The Organization page in the Site Configuration panel includes optional fields for entering information about your organization, such as its name, Web site URL, primary contact, and business address. The application incorporates this information in PCI reports. To include organization information in a site: 1. 2. 3. 4. 5. Go to the Site Configuration panel. Click the Organization link in the left navigation pane. Enter organization information. Enter any desired information. Filling all fields is not required. Click Save.

If you enter information in the Organization page and you are also using the Site configuration API, make sure to incorporate the Organization element, even though it's optional. Populated organization fields in the site configuration may cause the API to return the Organization element in a response to site configuration request, and if the Option element is not parsed, the API client may generate parsing errors. See the topics about SiteSaveRequest and Site DTD in the API guide.

Nexpose Users Guide

41

Configuring scan credentials

Configuring logon credentials for scans enables you to perform deep checks, inspecting assets for a wider range of vulnerabilities or security policy violations. Additionally, authenticated scans can check for software applications and packages and verify patches. When you configure credentials for a site, target assets in that site authenticate the Scan Engine as they would an authorized user.

Shared credentials vs. site-specific credentials

Two types of scan credentials can be created in the application, depending on the role or permissions of the user creating them:

Shared credentials can be used in multiple sites. Site-specific credentials can only be used in the site for in which they are configured.

The range of actions that a user can perform with each type depends on the users role or permissions, as indicated in the following table: Actions that can be performed by a Global Administrator or user with Manage Site permission
Create, edit, delete, assign to a site, restrict to an asset. Enable or disable the use of the credentials in any site.

Credentials type
shared

How it is created
A Global Administrator or user with the Manage Site permission creates it on the Administration > Shared Scan Credentials page. A Global Administrator or Site Owner creates it in the configuration for a specific site.

Actions that can be performed by a Site Owner

Enable or disable the use of the credentials in sites to which the Site Owner has access.

site-specific

Within a specific site to which the Site Owner has access: Create, edit, delete, enable or disable the use of the credentials in that site.

Within a specific site to which the Site Owner has access: Create, edit, delete, enable or disable the use of the credentials in that site.

Configuring site-specific scan credentials

When configuring scan credentials in a site, you have two options:

Create a new set of credentials. Credentials created within a site are called site-specific credentials and cannot be used in other sites. Enable a set of previously created credentials to be used in the site. This is an option if site-specific credentials have been previously created in your site or if shared credentials have been previously created and then assigned to your site.

To learn about credential types, see Shared credentials vs. site-specific credentials on page 42.

Nexpose Users Guide

42

Enabling a previously created set of credentials for use in a site

1. Click the Credentials link in the Site Configuration panel. The Security Console displays the Credentials configuration panel. It includes a table that lists any site-specific credentials that were created for the site or any shared credentials that were assigned to the site. For more information, see Shared credentials vs. site-specific credentials on page 42. 2. 3. Select the Use in Scans check box for any desired set of credentials. Click Save.

Enabling a set of credentials for a site

NOTE: If you are a Global Administrator, even though you have permission to edit shared credentials, you cannot do so from a site configuration. You can only edit shared credentials in the Shared Scan Credentials Configuration panel, which you can access on the Administration page. See Managing shared scan credentials on page69.

Starting configuration for a new set of site-specific credentials

The first action in creating new site-specific scan credentials is naming and describing them. Think of a name and description that will help you recognize at a glance which assets the credentials will be used for. This will be helpful, especially if you have to manage many sets of credentials. 1. 2. 3. 4. 5. Click the Credentials link in the Site Configuration panel. The Security Console displays the Credentials page. Click the New button. The Security Console displays the Site Credential Configuration panel. Enter a name for new set of credentials. Enter a description for the new set of credentials. Configure any other settings as desired. When you have finished configuring the set of credentials, click Save.

Nexpose Users Guide

43

Configuring the account for authentication

NOTE: All credentials are protected with RSA encryption and triple DES encryption before they are stored in the database.

1. 2. 3.

Go to the Account page of the Site Credential Configuration panel. Select an authentication service or method from the drop-down list. Enter all requested information in the appropriate text fields. If you dont know any of the requested information, consult your network administrator.

Configuring an account for site credentials

4.

Configure any other settings as desired. When you have finished configuring the set of credentials, click Save.

See Performing additional steps for certain credential types on page 46 for more information about the following types:

SSH public keys LM/NTLM hash

Testing the credentials

You can verify that a target asset in your site will authenticate the Scan Engine with the credentials youve entered. It is a quick method to ensure that the credentials are correct before you run the scan. 1. 2. 3. 4. 5. 6. Go to the Account page of the Site Credential Configuration panel. Expand the Test Credentials section. Select the Scan Engine with which you will perform the test. Enter the name or IP address of the authenticating asset. To test authentication on a single port, enter a port number. Click Test credentials. If you are testing Secure Shell (SSH) or Secure Shell (SSH) Public Key credentials and you have assigned elevated permissions, both credentials will be tested. Credentials for authentication on the target are tested first, and a message appears if the credentials failed. Permission elevation failures are reported in a separate message.

Nexpose Users Guide

44

7.

Note the result of the test. If it was not successful, review and change your entries as necessary, and test them again. The Security Console and scan logs contain information about the credential failure when testing or scanning with these credentials. See Working with log files in the administrators guide.

A successful test of site credentials

8.

Configure any other settings as desired. When you have finished configuring the set of credentials, click Save.

Restricting the credentials to a single asset and/or port

If a particular set of credentials is only intended for a specific asset and/or port, you can restrict the use of the credentials accordingly. Doing so can prevent scans from running unnecessarily longer due to authentication attempts on assets that dont recognize the credentials. If you restrict credentials to a specific asset and/or port, they will not be used on other assets or ports. Specifying a port allows you to limit your range of scanned ports in certain situations. For example, you may want to scan Web applications using HTTP credentials. To avoid scanning all Web services within a site, you can specify only those assets with a specific port. 1. 2. Go to the Restrictions page of the Site Credential Configuration panel. Enter the host name or IP address of the asset that you want to restrict the credentials to. OR Enter host name or IP address of the asset and the number of the port that you want to restrict the credentials to. OR Enter the number of the port that you want to restrict the credentials to. 3. Configure any other settings as desired. When you have finished configuring the set of credentials, click Save.

Nexpose Users Guide

45

Editing a previously created set of site credentials

NOTE: You cannot edit shared scan credentials in the Site Configuration panel. To edit shared credentials, go to the Administration page and select the manage link for Shared scan credentials. See Editing shared credentials that were previously created on page72. You must be a Global Administrator or have the Manage Site permission to edit shared scan credentials.

The ability to edit credentials can be very useful, especially if passwords change frequently. You can only edit site-specific credentials in the Site Configuration panel. 1. Click the Credentials link in the Site Configuration panel. The Security Console displays the Site Credential Configuration panel. It includes a table that lists any site-specific credentials that were created for the site or any shared credentials that were assigned to the site. 2. 3. Click the Edit icon for any credentials that you want to edit. Change the configuration as desired. See the following topics for more information:

4.

Starting configuration for a new set of site-specific credentials on page 43 Configuring the account for authentication on page 44 Testing the credentials on page 44 Restricting the credentials to a single asset and/or port on page 45

When you have finished editing the credentials, click Save.

Performing additional steps for certain credential types

Certain credential types require additional steps. See this section for additional steps on configuring the following credential types:

NOTE: You can elevate permissions for both Secure Shell (SSH) and Secure Shell (SSH) Public Key services.

SSH public keys LM/NTLM hash

Using SSH public key authentication

You can use Nexpose to perform credentialed scans on assets that authenticate users with SSH public key authentication. This method, also known as asymmetric key encryption, involves the creation of two related keys, or large, random numbers:

a public key that any entity can use to encrypt authentication information a private key that only trusted entities can use to decrypt the information encrypted by its paired public key

When generating a key pair, keep the following guidelines in mind:

The application supports SSH protocol version 2 RSA and DSA keys. Keys must be OpenSSH-compatible and PEM-encoded. RSA keys can range between 768 and 16384 bits. DSA keys must be 1024 bits.

This topic provides general steps for configuring an asset to accept public key authentication. For specific steps, consult the documentation for the particular system that you are using. The ssh-keygen process will provide the option to enter a pass phrase. It is recommended that you use a pass phrase to protect the key if you plan to use the key elsewhere.

Nexpose Users Guide

46

Elevating permissions
If you are using SSH authentication when scanning, you can elevate Scan Engine permissions to administrative or root access, which is required for obtaining certain data. For example, Unix-based CIS benchmark checks often require administrator-level permissions. Incorporating su (super-user), sudo (super-user do) or a combination of these methods ensures that permission elevation is secure. Permission elevation is an option available with the configuration of SSH credentials. Configuring this option involves selecting a permission elevation method. Using sudo protects your administrator password and the integrity of the server by not requiring an administrative password. Using su requires the administrator password. You can choose to elevate permissions using one of the following options:

su enables you to authenticate remotely using a non-root account without having to configure your systems for remote root access through a service such as SSH. To authenticate using su, enter the password of the user that you are trying to elevate permissions to. For example, if you are trying to elevate permissions to the root user, enter the password for the root user in the password field in Permission Elevation area of the Shared Scan Credential Configuration panel. sudo enables you to authenticate remotely using a non-root account without having to configure your systems for remote root access through a service such as SSH. In addition, it enables system administrators to explicitly control what programs an authenticated user can run using the sudo command. To authenticate using sudo, enter the password of the user that you are trying to elevate permission from. For example, if you are trying to elevate permission to the root user and you logged in as jon_smith, enter the password for jon_smith in the password field in Permission Elevation area of the Shared Scan Credential Configuration panel. sudo+su uses the combination of sudo and su together to gain information that requires privileged access from your target assets. When you log on, the application will use sudo authentication to run commands using su, without having to enter in the root password anywhere. The sudo+su option will not be able to access the required information if access to the su command is restricted.

Using system logs to track permission elevation

Administrators of target assets can control and track the activity of su and sudo users in system logs. When attempts at permission elevation fail, error messages appear in these logs so that administrators can address and correct errors and run the scans again.

Nexpose Users Guide

47

Generating a key pair

1. Run the ssh-keygen command to create the key pair, specifying a secure directory for storing the new file. This example involves a 2048-bit RSA key and incorporates the /tmp directory, but you should use any directory that you trust to protect the file.
ssh-keygen -t rsa -b 2048 -f /tmp/id_rsa

This command generates the private key files, id_rsa, and the public key file, id_rsa.pub. 2. 3. Make the public key available for the application on the target asset. Make sure that the computer with which you are generating the key has a .ssh directory. If not, run the mkdir command to create it:
mkdir /home/[username]/.ssh

4.
NOTE: Some checks require root access.

Copy the contents of the public key that you created by running the command in step 1. The file is in /tmp/id_rsa.pub file. Append the contents on the target asset of the /tmp/id_rsa.pub file to the .ssh/authorized_keys file in the home directory of a user with the appropriate access-level permissions that are required for complete scan coverage.
cat /[directory]/id_rsa.pub >> /home/[username]/.ssh/ authorized_keys

5.

Provide the private key.

After you provide the private key you must provide the application with SSH public key authentication.

Providing SSH public key authentication

1. 2. Edit or create a site that you want to scan with SSH public key authentication. Go to the credentials page of the Site Configuration panel. The console displays the Site Credential Configuration panel.

Site Credential Configuration panel

Nexpose Users Guide

48

3.
NOTE: ssh/authorized_keys is the default file for most OpenSSH- and Drop downbased SSH daemons. Consult the documentation for your Linux distribution to verify the appropriate file.

Select Secure Shell (SSH) Public Key as the from Service drop-down list. This authentication method is different from the method listed in the dropdown as Secure Shell (SSH). This latter method incorporates passwords instead of keys. Enter the appropriate user name. (Optional) Enter the Private key password used when generating the keys. Confirm the private key password. Copy the contents of that file into the PEM-format private key text box. The private key that you created by running the command in step 1. is the /tmp/ id_rsa file on the target asset. (Optional) Elevate the permission type using sudo or su. You can elevate permissions for both Secure Shell (SSH) and Secure Shell (SSH) Public Key services.

4. 5. 6. 7.

8.

9.

(Optional) Enter the user name, which can be empty or root for sudo credentials. If you are using credentials with no user name the credentials will default to root as the user name. If the SSH credential provided is a root credential, user ID =0, the permission elevation credentials will be ignored, even if the root account has been renamed. The application will ignore the permission elevation credentials when any account, root or otherwise named, with user ID 0 is specified.

10. Enter and confirm the password for elevated permissions. 11. Verify the credentials in the Test credentials area. See Testing the credentials on page 44. To restrict credentials see Restricting the credentials to a single asset and/or port on page 45. 12. Click Save to save the new credentials. The new credentials appear on the Credentials page. You can make changes to the credentials by clicking Edit. 13. Click Save if you have no other site configuration tasks to complete.

Using LM/NTLM hash authentication

Nexpose can pass LM and NTLM hashes for authentication on target Windows or Linux CIFS/ SMB services. With this method, known as pass the hash, it is unnecessary to crack the password hash to gain access to the service. Several tools are available for extracting hashes from Windows servers. One solution is Metasploit, which allows automated retrieval of hashes. For information about Metasploit, go to www.rapid7.com. When you have the hashes available, take the following steps: 1. 2. 3. 4. Go to the Credentials page of the Site Configuration panel. Select Microsoft Windows/Samba LM/NTLM Hash (SMB/CIFS) from the Login type drop-down list. (Optional) Enter the appropriate domain. Enter a user name.

Nexpose Users Guide

49

5.

Enter or paste in the LM hash followed by a colon (:) and then the NTLM hash. Make sure there are no spaces in the entry. The following example includes hashes for the password test:
01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A8280797 3B89537

6.

Alternatively, using the NTLM hash alone is acceptable as most servers disregard the LM response:
0CB6948805F797BF2A82807973B89537

7.

Perform additional credential configuration steps as desired. See Restricting the credentials to a single asset and/or port on page 45 and Testing the credentials on page 44. Click Save to save the new credentials. The new credentials appear on the Credentials page. You cannot change credentials that appear on this page. You can only delete credentials or configure new ones.

8.

9.

Click Save if you have no other site configuration tasks to complete. The new credentials appear on the Credentials page. You cannot change credentials that appear on this page. You can only delete credentials or configure new ones.

10. Click Save to save the new credentials

11. Click Save after you finish configuring your site.

Configuring scan authentication on target Web applications

NOTE: For HTTP servers that challenge users with Basic authentication or Integrated Windows authentication (NTLM), configure a set of scan credentials using the method called Web Site HTTP Authentication in the Credentials. See Creating a logon for Web site session authentication with HTTP headers on page52.

Scanning Web sites at a granular level of detail is especially important, since publicly accessible Internet hosts are attractive targets for attack. With authentication, Web assets can be scanned for critical vulnerabilities such as SQL injection and cross-site scripting. Two authentication methods are available for Web applications:

Web site form authentication: Credentials are entered into an HTML authentication form, as a human user would fill out. Many Web authentication applications challenge would-be users with forms. With this method, a form is retrieved from the Web application. You specify credentials for that form that the application will accept. Then, a Scan Engine presents those credentials to a Web site before scanning it. In some cases, it may not be possible to use a form. For example, a form may use a CAPTCHA test or a similar challenge that is designed to prevent logons by computer programs. Or, a form may use JavaScript, which is not supported for security reasons. If these circumstances apply to your Web application, you may be able to authenticate the application with the following method.

Web site session authentication: The Scan Engine sends the target Web server an authentication request that includes an HTTP headerusually the session cookie headerfrom the logon page.

The authentication method you use depends on the Web server and authentication application you are using. It may involve some trial and error to determine which method works better. It is advisable to consult the developer of the Web site before using this feature.

Nexpose Users Guide

50

Creating a logon for Web site form authentication

1. 2. Go to the Web Applications page of the configuration panel for the site that you are creating or editing. Click Add HTML form. The Security Console displays the General page for Web Application Configuration panel. 3. 4.
TIP: If you do not know any of the required information for configuring a Web form logon, consult the developer of the target Web site.

Enter a name for the new HTML form logon settings. Click the Configuration link in the left navigation area of the panel. The Security Console displays a configuration page for the Web form logon. In the Base URL text box, enter the main address from which all paths in the target Web site begin. The credentials you enter for logging on to the site will apply to any page on the site, starting with the base URL. You must include the protocol with the address. Examples: http://example.com or https://example.com

5.

6.

Enter the logon page URL for the actual page in which users log on to the site. It should also include the protocol. Examples: http://example.com/logon.html Click Next to expand the section labeled Step 2: Configure form fields. The application contacts the Web server to retrieve any available forms. If it fails to make contact or retrieve any forms, it displays a failure notification.

7.

If you do not see a failure notification, continue with verifying and customizing (if necessary) the logon form: 1. Select from the drop-down list the form with which the Scan Engine will log onto the Web application. Based on your selection, the Security Console displays a table of fields for that particular form. 2. Click Edit for any field value that you want to edit. The Security Console displays a pop-up window for editing the field value. If the value was provided by the Web server, you must select the option button to customize a new value. Only change the value to match what the server will accept from the Scan Engine when it logs on to the site. If you are not certain of what value to use, contact your Web administrator. 3. Click Save. The Security Console displays the field table with any changed values according to your edits. Repeat the editing steps for any other values that you want to change.

Nexpose Users Guide

51

When all the fields are configured according to your preferences, continue with creating a regular expression for logon failure and testing the logon: 1. Click Next to expand the section labeled Step 3: Test logon failure regular expression. The Security Console displays a text field for a regular expression (regex) with a default value in it. 2. Change the regex if you want to use one that is different from the default value. The default value works in most logon cases. If you are unsure of what regular expression to use, consult the Web administrator. For more information, see Using regular expressions on page 248. 3. Click Test logon to make sure that the Scan Engine can successfully log on to the Web application. If the Security Console displays a success notification, click Save and proceed with any other site configuration actions. If logon failure occurs, change any settings as necessary and try again.

Creating a logon for Web site session authentication with HTTP headers
When using HTTP headers to authenticate the Scan Engine, make sure that the session ID header is valid between the time you save this ID for the site and when you start the scan. For more information about the session ID header, consult your Web administrator. 1. 2. Go to the Web Applications page of the configuration panel for the site that you are creating or editing. Click Add HTTP Header Configuration. The Security Console displays the General page for Web Application Configuration panel. 3. 4.
TIP: If you do not know any of the required information for configuring a Web form logon, consult the developer of the target Web site.

Enter a name for the new server header configuration settings. Click the Configuration link in the left navigation area of the panel. The console displays a text field for the base URL Enter the base URL, which is the main address from which all paths in the target site begin. You must include the protocol with the address. Examples: http://example.com or https://example.com.

5.

Nexpose Users Guide

52

Continue with adding a header: 1. Click Next to expand the section labeled Step 2: Define HTTP header values. The Security Console displays an empty table that will list the headers that you add in the following steps. 2. Click Add Header. The Security Console displays a pop-up window for entering an HTTP header. Every header consists of two elements, which are referred to jointly as a name/value pair.

Name corresponds to a specific data type, such as the Web host name, Web server type, session identifier, or supported languages. Value corresponds to the actual value string that the console sends to the server for that data type. For example, the value for a session ID (SID) might be a uniform resource identifier (URI).

If you are not sure what header to use, consult your Web administrator. 3. Enter the desired name/value pair, and click Save. The name/value pair appear in the header table. Continue with creating a regular expression for logon failure and testing the logon: 1. Click Next to expand the section labeled Step 3: Test logon failure regular expression. The Security Console displays a text field for a regular expression (regex) with a default value in it. 2. Change the regex if you want to use one that is different from the default value. The default value works in most logon cases. If you are unsure of what regular expression to use, consult the Web administrator. For more information, See Using regular expressions on page 248. 3. Click Test logon to make sure that the Scan Engine can successfully log on to the Web application. If the Security Console displays a success notification, click Save and proceed with any other site configuration actions. If logon failure occurs, change any settings as necessary and try again.

Nexpose Users Guide

53

Managing dynamic discovery of virtual assets

It may not be unusual for your organizations assets to fluctuate in number, type, and state, on a fairly regular basis. As staff numbers grow or recede, so does the number of workstations. Servers go on line and out of commission. Employees who are travelling or working from home plug into the network at various times using virtual private networks (VPNs). This fluidity underscores the importance of having a dynamic asset inventory. Relying on a manually maintained spreadsheet is risky. There will always be assets on the network that are not on the list. And, if theyre not on the list, they're not being managed. Result: added risk. According to a paper by the technology research and advisory company, Gartner, Inc., an up-to-date asset inventory is as essential to vulnerability management as the scanning technology itself. In fact, the two must work in tandem: The network discovery process is continuous, while the vulnerability assessment scanning cycles through the environment during a period of weeks. (Source: A Vulnerability management Success Story published by Gartner, Inc.) The paper further states that an asset inventory is a foundation that enables other vulnerability technologies and with which remediation becomes a targeted exercise. The application provides two methods for tracking assets:

You can perform discovery scans on a regular basis. See Configuring and performing vAsset discovery on page 55. The benefit of scans is that they provide a snapshot of your asset inventory as of the time of the scan. You can initiate vAsset discovery, in which the application discovers assets in a target environment without running a scan. This approach has several benefits:

You can concentrate scanning resources for vulnerability checks instead of running discovery scans. As long as discovery connection is active, the application continuously discovers assets in the background, without manual intervention on your part. You can create dynamic sites and have them update automatically based on vAsset discovery. See Configuring a dynamic site on page 63.

Nexpose Users Guide

54

Configuring and performing vAsset discovery

An environment with virtual assets presents special security-related challenges. An increasing number of high-severity vulnerabilities affect virtual targets and devices that support them, such as the following:

management consoles management servers administrative virtual machines guest virtual machines hypervisors

Merely keeping track of virtual assets and their various states and classifications is a challenge in itself. To manage their security effectively you need to keep track of important details: For example, which virtual machines have Windows operating systems? Which ones belong to a particular resource pool? Which ones are currently running? Having this information available keeps you in synch with the continual changes in your virtual asset environment, which also helps you to manage scanning resources more efficiently. If you know what scan targets you have at any given time, you know what and how to scan. In response to these challenges the application supports dynamic discovery of virtual assets. The feature, known as vAsset discovery involves four major actions:

Preparing the target environment for vAsset discovery on page 55 Creating and managing vAsset discovery connections on page 57 Initiating vAsset discovery on page 58 Using filters to refine vAsset discovery on page 59

Once you initiate vAsset discovery it continues automatically as long as the discovery connection is active.

Preparing the target environment for vAsset discovery

To perform vAsset discovery, Nexpose can connect to either a vCenter server or directly to standalone ESX(i) hosts. The application supports direct connections to the following vCenter versions for vAsset discovery:

vCenter 4.1 vCenter 4.1, Update 1 vCenter 5.0

The application supports direct connections to the following ESX(i) versions for vAsset discovery: ESX 4.1 ESX 4.1, Update 1 ESXi 4.1 ESXi 4.1, Update 1 ESXi 5.0

Nexpose Users Guide

55

The preceding list of supported ESX(i) versions is for direct connections to standalone hosts. To determine if the application supports a connection to an ESX(i) host that is managed by vCenter, consult VMwares interoperability matrix at http://partnerweb.vmware.com/comp_guide2/sim/ interop_matrix.php. To ensure optimal results with the vAsset discovery process make sure your license enables vAsset discovery. To verify your license enables vAsset discovery: 1. 2. 3. 4. Click the Administration tab. The console displays the Administration page. Click the Manage link for Security Console. The console displays the Security Console Configuration panel. Click the Licensing link. The console displays the Licensing page. Note if the Virtualization feature is checked. If so, your license enables vAsset discovery.

You must configure your vSphere deployment to communicate through HTTPS. To perform vAsset discovery, the Security Console initiates vConnections to the vSphere application program interface (API) via HTTPS. If Nexpose and your target vCenter or virtual asset host are in different subnetworks that are separated by a device such as a firewall, you will need to make arrangements with your network administrator to enable communication, so that the application can perform vAsset discovery. Make sure that port 443 is open on the vCenter or virtual machine host because the application needs to contact the target in order to initiate the connection. When creating a discovery connection, you will need to specify account credentials so that the application can connect to vCenter or the ESX/ESXi host. Make sure that the account has permissions at the root server level to ensure all target virtual assets are discoverable. If you assign permissions on a folder in the target environment, you will not see the contained assets unless permissions are also defined on the parent resource pool. As a best practice, it is recommended that the account have readonly access. Make sure that virtual machines in the target environment have VMware Tools installed on them. Assets can be discovered and will appear in discovery results if they do not have VMware Tools installed. However, with VMware Tools, these target assets can be included in dynamic sites. This has significant advantages for scanning. See Configuring a dynamic site on page 63.

Nexpose Users Guide

56

Creating and managing vAsset discovery connections

This action provides Nexpose the information it needs to contact a vCenter server or virtual machine host. You must have Global Administrator permissions to create or manage vAsset Discovery connections. See Managing users and authentication in the administrators guide. To create a connection, take the following steps: Go to the Asset Discovery Connection panel in the Security Console Web interface. 1. Click the vAsset Discovery icon that appears in the upper-right corner of the Security Console Web interface. The console displays the Filtered asset discovery page. 2. Click Create for connections. The console displays Asset Discovery Connection panel. OR 1. 2. Click the Administration tab. The Administration page displays. Click Create for Discovery Connections. The console displays Asset Discovery Connection panel. Enter the information for a new connection. 1. 2. 3. 4. Enter a unique name for the new connection on the General page. Enter a fully qualified domain name for the server that the application will contact in order to discover assets. Click Credentials. The console displays the Credentials page. Enter a user name and password with which the application will use log on to the server. Make sure that the account has access to any virtual machine that you want to discover. Click Save.

5.

To view available connections or change a connection configuration take the following steps: 1. 2. 3. 4. 5. 1. Go to the Administration page. Click manage for Discovery Connections. The console displays the Discovery Connections page. Click Edit for a connection that you wish to change. Enter information in the Asset Discovery Connection panel. Click Save. OR Click the vAsset Discovery link that appears in the upper-right corner of the Security Console Web interface, below the user name. The console displays the Filtered asset discovery page. 2. 3. 4. Click the Manage for connections. The console displays the Asset Discovery Connection panel Enter the information in the appropriate fields. Click Save.

Nexpose Users Guide

57

On the Discovery Connections page, you can also delete connections or export connection information to a CSV file, which you can view in a spreadsheet for internal purposes. You cannot delete a connection that has a dynamic site or an in-progress scan associated with it. Also, changing connection settings may affect asset membership of a dynamic site. See Configuring a dynamic site on page 63. You can determine which dynamic sites are associated with any connection by going to the Discovery Management page. See Monitoring vAsset discovery on page 63. If you change a connection by using a different account, it may affect your discovery results depending which virtual machines the new account has access to. For example: You first create a connection with an account that only has access to all of the advertising departments virtual machines. You then initiate discovery and create a dynamic site. Later, you update the connection configuration with credentials for an account that only has access to the human resources departments virtual machines. Your dynamic site and discovery results will still include the advertising departments virtual machines; however, information about those machines will no longer be dynamically updated. Information is only dynamically updated for machines to which the connecting account has access.

Initiating vAsset discovery

This action involves having Nexpose contact a vCenter server or virtual machine host and begin discovering virtual assets. After the application performs initial discovery and returns a list of discovered assets, you can refine the list based on criteria filters, as described in the following topic. To perform vAsset discovery, you must have the Manage sites permission. See Configuring roles and permissions in the administrators guide To initiate vAsset discovery: 1. Click the vAsset Discovery icon that appears in the upper-right corner of the Security Console Web interface. OR Click the New Dynamic Site button on the Home page. The console displays the Filtered asset discovery page. 2. 3.
NOTE: With new, changed, or reactivated discovery connections, the discovery process must complete before new discovery results become available. There may be a slight delay before new results appear in the Web interface.

Select the appropriate discovery connection name from the drop-down list labeled vConnection. Click Discover Assets.

Nexpose contacts the server that manages the virtual assets and performs discovery. A table appears and lists the following information about each discovered asset:

the assets name the assets IP address the VMware datacenter in which the asset is managed the assets host computer the cluster to which the asset belongs the resource pool path that supports the asset the assets operating system the assets power status

After performing the initial discovery, the application continues to discover assets as long as the discovery connection remains active. The console displays a notification of any inactive vConnections in the bar at the top of the Security Console Web interface. You can also check the status of all vConnections on the Discovery Connections page. See Creating and managing vAsset discovery connections on page 57.

Nexpose Users Guide

58

If you create a vAsset discovery connection but dont initiate vAsset discovery with that connection, or if you initiate a vAsset discovery but the connection becomes inactive, you will see an advisory icon in the top, left corner of the Web interface page. Roll over the icon to see a message about inactive connections. The message includes a link that you can click to initiate discovery.

Using filters to refine vAsset discovery

You can use filters to refine vAsset discovery results based on specific discovery criteria. For example, you can limit discovery to assets that are managed by a specific resource pool or those with a specific operating system.
NOTE: If a set of filters is associated with a dynamic site, and if you change filters to include more assets than the maximum number of scan targets in your license, you will see an error message instructing you to change your filter criteria to reduce the number of discovered assets.

Using filters has a number of benefits. You can limit the sheer number of assets that appear in the discovery results table. This can be useful in an environment with a high number of virtual assets. Also, filters can help you discover very specific assets. You can discover all assets within an IP address range, all assets that belong to a particular resource pool, or all assets that are powered on or off. You can combine filters to produce more granular results. For example, you can discover all of Windows 7 virtual assets on a particular host that are powered on. You can create dynamic sites based on different sets of discovery results and track the security issues related to these types of assets by running scans and reports. See Configuring a dynamic site on page 63.

Selecting filters and operators

For every filter that you select, you also select an operator that determines how that filter is applied. Then, depending on the filter and operator, you enter a string or select a value for that operator to apply. Eight filters are available.

Cluster

Cluster Datacenter Guest OS family Host IP address range Power state Resource pool path Virtual machine name

With the Cluster filter, you can discover assets that belong, or dont belong, to specific clusters. This filter works with the following operators:

is returns all assets that belong to clusters whose names match an entered string exactly. is not returns all assets that belong to clusters whose names do not match an entered string. contains returns all assets that belong to clusters whose names contain an entered string. does not contain returns all assets that belong to clusters whose names do not contain an entered string. starts with returns all assets that belong to clusters whose names begin with the same characters as an entered string.

Nexpose Users Guide

59

Datacenter With the Datacenter filter, you can discover assets that are managed, or are not managed, by specific datacenters. This filter works with the following operators:

Guest OS family

is returns all assets that are managed by datacenters whose names match an entered string exactly. is not returns all assets that are managed by datacenters whose names do not match an entered string.

With the Guest OS family filter, you can discover assets that have, or do not have, specific operating systems. This filter works with the following operators:

Host

contains returns all assets that have operating systems whose names contain an entered string. does not contain returns all assets that have operating systems whose names do not contain an entered string.

With the Host filter, you can discover assets that are guests, or are not guests, of specific host systems. This filter works with the following operators:

IP address range

is returns all assets that are guests of hosts whose names match an entered string exactly. is not returns all assets that are guests of hosts whose names do not match an entered string. contains returns all assets that are guests of hosts whose names contain an entered string. does not contain returns all assets that are guests of hosts whose names do not contain an entered string. starts with returns all assets that are guests of hosts whose names begin with the same characters as an entered string.

With the IP address range filter, you can discover assets that have IP addresses, or do not have IP addresses, within a specific range. This filter works with the following operators:

is returns all assets with IP addresses that falls within the entered IP address range. is not returns all assets whose IP addresses do not fall into the entered IP address range.

When you select the IP address range filter, you will see two blank fields separated by the word to. Enter the start of the range in the left field, and end of the range in the right field. The format for the IP addresses is a dotted quad. Example: 192.168.2.1 to 192.168.2.254

Nexpose Users Guide

60

Power state With the Power state filter, you can discover assets that are in, or are not in, a specific power state. This filter works with the following operators:

is returns all assets that are in a power state selected from a drop-down list. is not returns all assets that are not in a power state selected from a drop-down list.

Power states include on, off, or suspended. Resource pool path With the Resource pool path filter, you can discover assets that belong, or do not belong, to specific resource pool paths. This filter works with the following operators:

contains returns all assets that are supported by resource pool paths whose names contain an entered string. does not contain returns all assets that are supported by resource pool paths whose names do not contain an entered string.

You can specify any level of a path, or you can specify multiple levels, each separated by a hyphen and right arrow: ->. This is helpful if you have resource pool path levels with identical names. For example, you may have two resource pool paths with the following levels: Human Resources Management Workstations Advertising Management Workstations The virtual machines that belong to the Management and Workstations levels are different in each path. If you only specify Management in your filter, the application will discover all virtual machines that belong to the Management and Workstations levels in both resource pool paths. However, if you specify Advertising -> Management -> Workstations, the application will only discover virtual assets that belong to the Workstations pool in the path with Advertising as the highest level. Virtual machine name With the Virtual machine name filter, you can discover assets that have, or do not have, a specific name. This filter works with the following operators:

is returns all assets whose names match an entered string exactly. is not returns all assets whose names do not match an entered string. contains returns all assets whose names contain an entered string. does not contain returns all assets whose names do not contain an entered string. starts with returns all assets whose names begin with the same characters as an entered string.

Combining discovery filters If you use multiple filters, you can have the application discover assets that match all the criteria specified in the filters, or assets that match any of the criteria specified in the filters.

Nexpose Users Guide

61

The difference between these options is that the all setting only returns assets that match the discovery criteria in all of the filters, whereas the any setting returns assets that match any given filter. For this reason, a search with all selected typically returns fewer results than any. For example, a target environment includes 10 assets. Five of the assets run Ubuntu, and their names are Ubuntu01, Ubuntu02, Ubuntu03, Ubuntu04, and Ubuntu05. The other five run Windows, and their names are Win01, Win02, Win03, Win04, and Win05. Suppose you create two filters. The first discovery filter is an operating system filter, and it returns a list of assets that run Windows. The second filter is an asset filter, and it returns a list of assets that have Ubuntu in their names. If you discover assets with the two filters using the all setting, the application discovers assets that run Windows and have Ubuntu in their asset names. Since no such assets exist, no assets will be discovered. However, if you use the same filters with the any setting, the application discovers assets that run Windows or have Ubuntu in their names. Five of the assets run Windows, and the other five assets have Ubuntu in their names. Therefore, the result set contains all of the assets.

Configuring and applying filters

NOTE: If a virtual asset doesnt have an IP address, it can only be discovered and identified by its host name. It will appear in the discovery results, but it will not be added to a dynamic site. Assets without IP addresses cannot be scanned.

After you initiate vAsset discovery as described in the preceding section, and Nexpose displays the results table, take the following steps to configure and apply filters: Configure the filters. 1. 2. 3. 4. 5. Click Add Filters. A filter row appears. Select a filter type from the left drop-down list. Select an operator from the right drop-down list. Enter or select a value in the field to the right of the drop-down lists. To add a new filter, click the + icon. A new filter row appears. Set up the new filter as described in the preceding step. 6. Add more filters as desired. To delete any filter, click the appropriate - icon. After you configure the filters, you can apply them to the discovery results. Or, click Reset to clear all filters and start again. Apply the filters. 1. 2. Select the option to match any or all of the filters from the drop-down list below the filters. Click Filter.

The discovery results table now displays assets based on filtered discovery. Click Create Dynamic Site to create a dynamic site based on the discovery results. See Configuring a dynamic site on page 63.

Nexpose Users Guide

62

Monitoring vAsset discovery

Since vAsset discovery is an ongoing process as long as the vConnection is active, you may find it useful to monitor events related to discovery. The Discovery Statistics page includes several informative tables:

vAssets lists the number of currently discovered virtual machines, hosts, data centers, and vConnections. It also indicates how many virtual machines are online and offline. Dynamic Site Statistics lists each dynamic site, the number of assets it contains, the number of scanned assets, and the vConnection through which vAsset discovery is initiated for the sites assets. vEvents lists every relevant change in the target discovery environment, such as virtual machines being powered on or off, renamed, or being added to or deleted from hosts.

vAsset discovery is not meant to enumerate the host types of virtual assets. The application categorizes each asset it discovers as a host type and uses this categorization as a filter in searches for creating dynamic asset groups. See Performing filtered asset searches on page 124. Possible host types include Virtual machine and Hypervisor. The only way to determine the host type of an asset is by performing a credentialed scan. So, any asset that you discover through vAsset discovery and do not scan with credentials will have an Unknown host type, as displayed on the scan results page for that asset. vAsset discovery only finds virtual assets, so dynamic sites will only contain virtual assets.
NOTE: Listings in the vEvents table reflect discovery over the preceding 30 days.

To monitor vAsset discovery, take the following steps: 1. 2. 3. Go to the Discovery Statistics page in the Security Console Web interface. Click the Administration tab. The Administration page appears. Click the View link for Discovery Statistics.

Configuring a dynamic site

To create a dynamic site you must meet the following prerequisites:
NOTE: When you create a dynamic site, all assets that meet the sites filter criteria will not be correlated to assets that are part of existing sites. An asset that is listed in two sites is essentially regarded as two assets from a license perspective.

You must have a live vAsset discovery connection. You must initiate vAsset discovery. See Initiating vAsset discovery on page 58. If you attempt to create a dynamic site based on a number of discovered assets that exceeds the maximum number of scan targets in your license, you will see an error message instructing you to change your filter criteria to reduce the number of discovered assets. See Using filters to refine vAsset discovery on page 59.

To create a dynamic site take the following steps: 1. 2. 3. Initiate vAsset discovery as instructed in Initiating vAsset discovery on page 58. The results table appears. Click the Create Dynamic Site button on the vAsset Discovery page. The Security Console displays the Site Configuration panel. Enter a name and brief description for your site in the configuration fields that appear.

Nexpose Users Guide

63

4.

Select a level of importance from the drop-down list.

The Very Low setting reduces a risk index to 1/3 of its initial value. The Low setting reduces the risk index to 2/3 of its initial value. High and Very High settings increase the risk index to twice and 3 times its initial value, respectively. A Normal setting does not change the risk index. The importance level corresponds to a risk factor that the application uses as part of the Weighted risk strategy calculation for the assets in the site. See Weighted strategy on page 241.

5.

Click Save.

The Site Configuration panel appears for the new dynamic site. Use this panel to configure other aspects of the site and its scans. See the following topics:

Selecting a Scan Engine for a site on page 33 Selecting a scan template on page 36 Creating a scan schedule on page 37 Setting up scan alerts on page 39 Configuring scan credentials on page 42 Including organization information in a site on page 41

Managing assets in a dynamic site

As long as the connection for an initiated vAsset discovery is active, asset membership in a dynamic site is subject to change whenever changes occur in the target environment. You can also change asset membership by changing the discovery connection or filters. See Using filters to refine vAsset discovery on page 59. To view and change asset membership: 1. 2. Go to the Assets page of the configuration panel for the dynamic site. View the list of assets to be scanned. If you want to exclude any of those from the scan, enter their names or IP addresses in Excluded Assets text box. 3. Click the Change Connections/Filters button to change asset membership. The Filtered asset discovery page for the dynamic site appears. Change the discovery connection or filters as described in Configuring and performing vAsset discovery on page 55. 4. 5. Change the discovery connection or filters. See Using filters to refine vAsset discovery on page 59. Click Save on the Filtered asset discovery page for the dynamic site.

Whenever a change occurs in the target discovery environment, such as new virtual machines being added or removed, that change is reflected in the dynamic site asset list. This keeps your visibility into your target environment current.

Nexpose Users Guide

64

Another benefit is that if the number of discovered assets in the dynamic site list exceeds the number of maximum scan targets in your license, you will see a warning to that effect before running a scan. This ensures that you do not run a scan and exclude certain assets. If you run a scan without adjusting the asset count, the scan will target assets that were previously discovered. You can adjust the asset count by refining the discovery filters for your site. If you change the discovery connection or discovery filter criteria for a dynamic site that has been scanned, asset membership will be affected in the following ways: All assets that have not been scanned and no longer meet new discovery filter criteria, will be deleted from the site list. All assets that have been scanned and have scan data associated with them will remain on the site list whether or not they meet new filter discovery criteria. All newly discovered assets that meet new filter criteria will be added to the dynamic site list.

Nexpose Users Guide

65

Running a manual scan

To start a scan manually at any time, click the Scan icon for a given site in the Site Listing pane of the Home page.

Starting a manual scan

Or, you can click the Scan button on the Sites page or on the page for a specific site. The Security Console displays the Start New Scan dialog box, which lists all the assets that you specified in the site configuration to scan, or to exclude from the scan.
NOTE: You can start as many manual scans as you require. However, if you have manually started a scan of all assets in a site, or if a full site scan has been automatically started by the scheduler, the application will not permit you to run another full site scan.

In the Manual Scan Targets area, select either the option to scan all assets within the scope of a site, or to specify certain target assets. Specifying the latter is useful if you want to scan a particular asset as soon as possible, for example, to check for critical vulnerabilities or verify a patch installation. If you select the option to scan specific assets, enter their IP addresses or host names in the text box. Refer to the lists of included and excluded assets for the IP addresses and host names. You can copy and paste the addresses.

Nexpose Users Guide

66

Click the Start Now button to begin the scan immediately.

The Start New Scan window

When the scan starts, the Security Console displays a status page for the scan, which will display more information as the scan continues.

The status page for a newly started scan

Monitoring the progress and status of a scan

Viewing scan progress
When a scan starts, you can keep track of how long it has been running and the estimated time remaining for it to complete. You can even see how long it takes for the scan to complete on an individual asset. These metrics can be useful to help you anticipate whether a scan is likely to complete within an allotted window.

Nexpose Users Guide

67

You also can view the assets and vulnerabilities that the in-progress scan is discovering if you are scanning with any of the following configurations:

Hosted Scan Engines distributed Scan Engines (if the Security Console is configured to retrieve incremental scan results) the local Scan Engine (which is bundled with the Security Console)

Viewing these discovery results can be helpful in monitoring the security of critical assets or determining if, for example, an asset has a zero-day vulnerability. To view the progress of a scan: 1. 2. 3. 1. 2. 3. Locate the Site Listing table on the Home page. In the table, locate the site that is being scanned. In the Status column, click the Scan in progress link. OR Locate the Current Scan Listing for All Sites table on the Home page. In the table, locate the site that is being scanned. In the Progress column, click the In Progress link.

The progress links for scans that are currently running

You will also find progress links in the Site Listing table on the Sites page or the Current Scan Listing table on the page for the site that is being scanned. When you click the progress link in any of these locations, the Security Console displays a progress page for the scan.

Nexpose Users Guide

68

The Scan Progress table shows the scans current status, start date and time, elapsed time, estimated remaining time to complete, and total discovered vulnerabilities. It lists the number of assets that have been discovered, as well as the following asset information: The Active column lists the number of assets that are currently being scanned for vulnerabilities. The Completed column lists the number of assets that have been scanned for vulnerabilities. The Pending column lists the number of assets that have been discovered, but not yet scanned for vulnerabilities. You can click the icon for the scan log to view detailed information about scan events. For more information, see Viewing the scan log on page 71. The Discovered Assets table lists every asset discovered during the scan, its fingerprinted operating system (if available), the number of vulnerabilities discovered on it, and its scan duration and status. You can click the address or name for any asset to view more details about, such as all the specific vulnerabilities discovered on it.

NOTE: Remember to use bread crumb links to go back and forth between the Home, Sites, and specific site and scan pages.

A scan progress page

Understanding different scan states

It is helpful to know the meaning of the various scan states listed in the Status column of the Scan Progress table. While some of these states are fairly routine, others may point to problems that you can troubleshoot to ensure better performance and results for future scans. It is also helpful to know how certain states affect scan data integration or the ability to resume a scan. In the Status column, a scan may appear to be in any one of the following states: In progress A scan is gathering information on a target asset. The Security Console is importing data from the Scan Engine and performing data integration operations such as correlating assets or applying vulnerability exceptions. In certain instances, if a scans status remains In progress for an unusually long period of time, it may indicate a problem. See Determining if scans with normal states are having problems on page 70. Completed successfully The Scan Engine has finished scanning the targets in the site, and the Security Console has finished processing the scan results. If a scan has this state but there are no scan results displayed, see Determining if scans with normal states are having problems on page 70 to diagnose this issue.

Nexpose Users Guide

69

Stopped A user has manually stopped the scan before the Security Console could finish importing data from the Scan Engine. The data that the Security Console had imported before the stop is integrated into the scan database. You cannot resume a stopped scan. You will need to run a new scan. Paused One of the following events occurred: A scan was manually paused by a user. A scan has exceeded its scheduled duration window. If it is a recurring scan, it will resume where it paused instead of restarting at its next start date/time. A scan has exceeded the Security Consoles memory threshold before the Security Console could finish importing data from the Scan Engine In all cases, the Security Console processes results for targets that have a status of Completed Successfully at the time the scan is paused. You can resume a paused scan manually. Failed A scan has been disrupted due to an unexpected event. It cannot be resumed. An explanatory message will appear with the Failed status. You can use this information to troubleshoot the issue with Technical Support. One cause of failure can be the Security Console or Scan Engine going out of service. In this case, the Security Console cannot recover the data from the scan that preceded the disruption. Another cause could be a communication issue between the Security Console and Scan Engine. The Security Console typically can recover scan data that preceded the disruption. You can determine if this has occurred by one of the following methods:

Aborted

Check the connection between your Security Console and Scan Engine with an ICMP (ping) request. Click the Administration tab and then go to the Scan Engines page. Click on the Refresh icon for the Scan Engine associated with the failed scan. If there is a communication issue, you will see an error message. Open the nsc.log file located in the \nsc directory of the Security Console and look for error-level messages for the Scan Engine associated with the failure.

A scan has been interrupted due to system disruption or other unexpected events. The data that the Security Console had imported before the scan was aborted is integrated into the scan database. You cannot resume an aborted scan. You will need to run a new scan.

Determining if scans with normal states are having problems

If a scan has an In progress status for an unusually long time, this may indicate that the Security Console cannot determine the actual state of the scan due to a communication failure with the Scan Engine. To test whether this is the case, try to stop the scan. If a communication failure has occurred, the Security Console will display a message indicating that no scan with a given ID exists. If a scan has a Completed successfully status, but no data is visible for that scan, this may indicate that the Scan Engine has stopped associating with the scan job. To test whether this is the case, try starting the scan again manually. If this issue has occurred, the Security Console will display a message that a scan is already running with a given ID. In either of these cases, contact Technical Support.

Nexpose Users Guide

70

Pausing, resuming, and stopping a scan

If you are a user with appropriate site permissions, you can pause, resume or stop manual scans and scans that have been started automatically by the application scheduler.
NOTE: Remember to use bread crumb links to go back and forth between the Home, site, and scan pages.

You can pause, resume, or stop scans in several areas:

the Home page the Sites page the page for the site that is being scanned the page for the actual scan

To pause a scan, click the Pause icon for the scan on the Home, Sites, or specific site page; or click the Pause Scan button on the specific scan page. A message displays asking you to confirm that you want to pause the scan. Click OK. To resume a paused scan, click the Resume icon for the scan on the Home, Sites, or specific site page; or click the Resume Scan button on the specific scan page. The console displays a message, asking you to confirm that you want to resume the scan. Click OK. To stop a scan, click the Stop icon for the scan on the Home, Sites, or specific site page; or click the Stop Scan button on the specific scan page. The console displays a message, asking you to confirm that you want to stop the scan. Click OK. The stop operation may take 30 seconds or more to complete pending any in-progress scan activity.

Viewing scan results

The Security Console lists scan results by ascending or descending order for any category, depending on your sorting preference. In the Asset Listing table, click the desired category column heading, such as Address or Vulnerabilities, to sort results by that category. Two columns in the Asset Listing table show the numbers of known exposures for each asset. The column with the TM icon enumerates the number of vulnerability exploits known to exist for each asset. The number may include exploits available in Metasploit and/or the Exploit Database. The column with the icon enumerates the number of malware kits that can be used to exploit the vulnerabilities detected on each asset. Click the link for an asset name or address to view scan-related, and other, information about that asset. Remember that the application scans sites, not asset groups, but asset groups can include assets that also are included in sites. To view the results of a scan, click the link for a sites name on the Home page. Click the site name link to view assets in the site, along with pertinent information about the scan results. On this page, you also can view information about any asset within the site by clicking the link for its name or address.

Viewing the scan log

To troubleshoot problems related to scans or to monitor certain scan events, you can download and view the log for any scan that is in progress or complete.

Nexpose Users Guide

71

Understand scan log file names

Scan log files have a .log extension and can be opened in any text editing program. A scan logs file name consists of three fields separated by hyphens: the respective site name, the scans start date, and scans start time in military format. Example: localsite-20111122-1514.log. If the site name includes spaces or characters not supported by the name format, these characters are converted to hexadecimal equivalents. For example, the site name my site would be rendered as my_20site in the scan log file name. The following characters are supported by the scan log file format:

numerals letters hyphens (-) underscores (_)

The file name format supports a maximum of 64 characters for the site name field. If a site name contains more than 64 characters, the file name only includes the first 64 characters. You can change the log file name after you download it. Or, if your browser is configured to prompt you to specify the name and location of download files, you can change the file name as you save it to your hard drive.

Finding the scan log

You can find and download scan logs wherever you find information about scans in the Web interface. You can only download scan logs for sites to which you have access, subject to your permissions.

On the Home page, in the Site Listing table, click any link in the Scan Status column for in-progress or most recent scan of any site. Doing so opens the summary page for that scan. In the Scan Progress table, find the Scan Log column. On any site page, click the View scan history button in the Site Summary table. Doing so opens the Scans page for that site. In the Scan History table, find the Scan Log column. The Scan History page lists all scans that have been run in your deployment. On any page of the Web interface, click the Administration tab. On the Administration page, click the view link for Scan History. In the Scan History table, find the Scan Log column.

Downloading the scan log

To download a scan log click the Download icon for a scan log. A pop-up window displays the option to open the file or save it to your hard drive. You may select either option. If you do not see an option to open the file, change your browser configuration to include a default program for opening a .log file. Any text editing program, such as Notepad or gedit, can open a .log file. Consult the documentation for your browser to find out how to select a default program. To ensure that you have a permanent copy of the scan log, choose the option to save it. This is recommended in case the scan information is ever deleted from the scan database.

Nexpose Users Guide

72

Downloading the scan log

Tracking scan events in logs

While the Web interface provides useful information about scan progress, you can use scan logs to learn more details about the scan and track individual scan events. This is especially helpful if, for example, certain phases of the scan are taking a long time. You may want to verify that the prolonged scan is running normally and isn't hanging. You may also want to use certain log information to troubleshoot the scan. This section provides common scan log entries and explains their meaning. Each entry is preceded with a time and date stamp; a severity level (DEBUG, INFO, WARN, ERROR); and information that identifies the scan thread and site.

The beginning and completion of a scan phase

2013-06-26T15:02:59 [INFO] [Thread: Scan default:1] [Site: Chicago_servers] Nmap phase started. The Nmap (Network Mapper) phase of a scan includes asset discovery and port-scanning of those assets. Also, if enabled in the scan template, this phase includes IP stack fingerprinting. 2013-06-26T15:25:32 [INFO] [Thread: Scan default:1] [Site: Chicago_servers] Nmap phase complete. The Nmap phase has completed, which means the scan will proceed to vulnerability or policy checks.

Information about scan threads

2013-06-26T15:02:59 [INFO] [Thread: Scan default:1] [Site: Chicago_servers] Nmap will scan 1024 IP addresses at a time. This entry states the maximum number of IP addresses each individual Nmap process will scan before that Nmap process exits and a new Nmap process is spawned. These are the work units assigned to each Nmap process. Only 1 Nmap process exists per scan. 2013-06-26T15:04:12 [INFO] [Thread: Scan default:1] [Site: Chicago_servers] Nmap scan of 1024 IP addresses starting. This entry states the number of IP addresses that the current Nmap process for this scan is scanning. At a maximum, this number can be equal to the maximum listed in the preceding entry. If this number is less than the maximum in the preceding entry, that means the number of IP addresses remaining to be scanned in the site is less than the maximum. Therefore, the process reflected in this entry is the last process used in the scan.

Nexpose Users Guide

73

Information about scan tasks within a scan phase

2013-06-26T15:04:13 [INFO] [Thread: Scan default:1:nmap:stdin] [Site: Chicago_servers] Nmap task Ping Scan started. A specific task in the Nmap scan phase has started. Some common tasks include the following:

Ping Scan: Asset discovery SYN Stealth Scan: TCP port scan using the SYN Stealth Scan method (as configured in the scan template) Connect Scan:TCP port scan using the Connect Scan method (as configured in the scan template) UDP Scan: UDP port scan

2013-06-26T15:04:44 [INFO] [Thread: Scan default:1:nmap:stdin] [Site: Chicago_servers] Nmap task Ping Scan is an estimated 25.06% complete with an estimated 93 second(s) remaining. This is a sample progress entry for an Nmap task.

Discovery and port scan status

2013-06-26T15:06:04 [INFO] [Thread: Scan default:1:nmap:stdin] [Site: Chicago_servers] [10.0.0.1] DEAD (reason=no-response) The scan reports the targeted IP address as DEAD because the host did not respond to pings. 2013-06-26T15:06:04 [INFO] [Thread: Scan default:1:nmap:stdin] [Site: Chicago_servers] [10.0.0.2] DEAD (reason=host-unreach) The scan reports the targeted IP address as DEAD because it received an ICMP host unreachable response. Other ICMP responses include network unreachable, protocol unreachable, administratively prohibited. See the RFC4443 and RFC 792 specifications for more information. 2013-06-26T15:07:45 [INFO] [Thread: Scan default:1:nmap:stdin] [Site: Chicago_servers] [10.0.0.3:3389/TCP] OPEN (reason=syn-ack:TTL=124) 2013-06-26T15:07:45 [INFO] [Thread: Scan default:1:nmap:stdin] [Site: Chicago_servers] [10.0.0.4:137/UDP] OPEN (reason=udp-response:TTL=124) The preceding two entries provide status of a scanned port and the reason for that status. SYN-ACK reflects a SYN-ACK response to a SYN request. Regarding TTL references, if two open ports have different TTLs, it could mean that a man-in-the-middle device between the Scan Engine and the scan target is affecting the scan. 2013-06-26T15:07:45 [INFO] [Thread: Scan default:1:nmap:stdin] [Site: Chicago_servers] [10.0.0.5] ALIVE (reason=echo-reply:latency=85ms:variance=13ms:timeout=138ms) This entry provides information on the reason that the scan reported the host as ALIVE, as well as the quality of the network the host is on; the latency between the Scan Engine and the host; the variance in that latency; and the timeout Nmap selected when waiting for responses from the target. This type of entry is typically used by Technical Support to troubleshoot unexpected scan behavior. For example, a host is reported ALIVE, but does not reply to ping requests. This entry indicates that the scan found the host through a TCP response.

Nexpose Users Guide

74

The following list indicates the most common reasons for discovery and port scan results as reported by the scan:

conn-refused: The target refused the connection request. reset: The scan received an RST (reset) response to a TCP packet. syn-ack: The scan received a SYN|ACK response to a TCP SYN packet. udp-response: The scan received a UDP response to a UDP probe. perm-denied: The Scan Engine operating system denied a request sent by the scan.This can occur in a full-connect TCP scan. For example, the firewall on the Scan Engine host is enabled and prevents Nmap from sending the request. net-unreach: This is an ICMP response indicating that the target asset's network was unreachable. See the RFC4443 and RFC 792 specifications for more information. host-unreach: This is an ICMP response indicating that the target asset was unreachable. See the RFC4443 and RFC 792 specifications for more information. port-unreach: This is an ICMP response indicating that the target port was unreachable. See the RFC4443 and RFC 792 specifications for more information. admin-prohibited: This is an ICMP response indicating that the target asset would not allow ICMP echo requests to be accepted. See the RFC4443 and RFC 792 specifications for more information. echo-reply: This is an ICMP echo response to an echo request.It occurs during the asset discovery phase. arp-response: The scan received an ARP response.This occurs during the asset discovery phase on the local network segment. no-response: The scan received no response, as in the case of a filtered port or dead host. localhost-response: The scan received a response from the local host. In other words, the local host has a Scan Engine installed, and it is scanning itself. user-set: As specified by the user in the scan template configuration, host discovery was disabled. In this case, the scan does not verify that target hosts are alive; it assumes that the targets are alive.

Nexpose Users Guide

75

Viewing history for all scans

You can quickly browse the scan history for your entire deployment by seeing the Scan History page. On any page of the Web interface, click the Administration tab. On the Administration page, click the view link for Scan History. The interface displays the Scan History page, which lists all scans, plus the total number of scanned assets, discovered vulnerabilities, and other information pertaining to each scan. You can click the date link in the Completed column to view details about any scan. You can download the log for any scan as discussed in the preceding topic.

Scan History page

Nexpose Users Guide

76

Chapter 3 Assess
After you discover all the assets and vulnerabilities in your environment, it is important to parse this information to determine what the major security threats are, such as high-risk assets, vulnerabilities, potential malware exposures, or policy violations. Assess gives you guidance on viewing and sorting your scan results to determine your security priorities. It includes the following sections:

Locating assets on page 78: There are several ways to drill down through scan results to find specific assets. For example, you can find all assets that run a particular operating system or that belong to a certain site. This section covers these different paths. It also discusses how to sort asset data by different security metrics and how to look at the detailed information about each asset. Working with vulnerabilities on page 84: Depending on your environment, your scans may discover thousands of vulnerabilities. This section shows you how to sort vulnerabilities based on various security metrics, affected assets, and other criteria, so that you can find the threats that require immediate attention. The section also covers how to exclude vulnerabilities from reports and risk score calculations. Working with Policy Manager results on page 106: If you work for a U.S. government agency or a vendor that transacts business with the government, you may be running scans to verify that your assets comply with United States Government Configuration Baseline (USGCB) or Federal Desktop Core Configuration (FDCC) policies. Or you may be testing assets for compliance with customized policies based on USGCB or FDCC policies. This section shows you how to track your overall compliance, view scan results for policies and the specific rules that make up those policies, and override rule results.

Nexpose Users Guide

77

Locating assets
By viewing and sorting asset information based on scans, you can perform quick assessments of your environment and any security issues affecting it.
TIP: While it is easy to view information about scanned assets, it is a best practice to create asset groups to control which users can see which asset information in your organization. See Using asset groups to your advantage on page 120.

You can view assets by various categories:

sites to which they are assigned asset groups to which they are assigned operating systems that they are running services that they are running software that they are running

You can view all discovered assets that you have access to by simply clicking the Assets tab and viewing the Asset Listing table on the Assets page. The number of all discovered assets to which you have access appears at the top of the page, as well as the number of sites and asset groups to which you have access. You can sort assets in the Asset Listing table by clicking a row heading for any of the columns. For example, click the top row of the Risk column to sort numerically by the total risk score for all vulnerabilities discovered on each asset. You can generate a comma-separated values (CSV) file of the asset kit list to share with others in your organization. Click the Export to CSV icon ( ). Depending on your browser settings, you will see a pop-up window with options to save the file or open it in a compatible program.

Nexpose Users Guide

78

You can control the number of assets that appear in the table by selecting a value in the Rows per page dropdown list in the bottom, right frame of the table. Use the navigation options in that area to view more asset records.

The Assets page (with some rows removed for display purposes)

Locating assets by sites

To view assets by sites to which they have been assigned, click the hyperlinked number of sites displayed at the top of the Assets page. The Security Console displays the Sites page. Charts and graphs at the top of the Sites page provide a statistical overview of sites, including risks and vulnerabilities. From this page you can create a new site. If a scan is in progress for any site, a column labeled Scan Status appears in the table. To view information about that scan, click the Scan in progress link. If no scans are in progress, a column labeled Last

Nexpose Users Guide

79

Scan appears in the table. Click the date link in the Last Scan column for any site to view information about the most recently completed scan for that site. Click the link for any site in the Site Listing pane to view its assets.The Security Console displays a page for that site, including recent scan information, statistical charts and graphs. The Asset Listing table shows the name and IP address of every scanned asset. If your site includes IPv4 and IPv6 addresses, the Address column groups these addresses separately. You can change the order of appearance for these address groups by clicking the sorting icon in the Address column.

In the Asset Listing table, you can view important security-related information about each asset to help you prioritize remediation projects: the number of available exploits, the number of vulnerabilities, and the risk score. You will see an exploit count of 0 for assets that were scanned prior to the January 29, 2010, release, which includes the Exploit Exposure feature. This does not necessarily mean that these assets do not have any available exploits. It means that they were scanned before the feature was available. For more information, see Using Exploit Exposure on page 251. From the details page of an asset, you can manage site assets and create site-level reports. You also can start a scan for that asset. To view information about an asset listed in the Asset Listing table, click the link for that asset. See Viewing the details about an asset on page 81.

Locating assets by asset groups

To view assets by asset groups to which they have been assigned, click the hyperlinked number of sites displayed at the top of the Assets page. The Security Console displays the Asset Groups page. Charts and graphs at the top of the Asset Groups page provide a statistical overview of asset groups, including risks and vulnerabilities. From this page you can create a new asset group. See Using asset groups to your advantage on page 120. Click the link for any group in the Asset Group Listing pane to view its assets. The console displays a page for that asset group, including statistical charts and graphs and a list of assets. In the Asset Listing pane, you can view the scan, risk, and vulnerability information about any asset. You can click a link for the site to which the asset belongs to view information about the site. You also can click the link for any asset address to view information about it. See Viewing the details about an asset on page 81.

Locating assets by operating system

To view assets by the operating systems running on them, see the Operating System Listing table on the Assets page. The table lists all the operating systems running in your network and the number of instances of each operating system. Click the link for an operating system to view the assets that are running it. The console displays a page that lists all the assets running that operating system. You can view scan, risk, and vulnerability information about any asset. You can click a link for the site to which the asset belongs to view information about the site. You also can click the link for any asset address to view information about it. See Viewing the details about an asset on page 81.

Locating assets by services

To view assets by the services running on them, see the Services Listing table on the Assets page. The table lists all the services running in your network and the number of instances of each service. Click the link for a service to view the assets that are running it.

Nexpose Users Guide

80

The console displays a page for that service. A description of the service appears in the top pane of the page. In the Discovered Instances pane, you can view a list of addresses, names, and ports for assets running the service, as well as products that are using them. You also can click the link for any asset address or name to view information about it. See Viewing the details about an asset on page 81.

Locating assets by software

To view assets by the software running on them, see the Software Listing table on the Assets page. The table lists any software that the application found running in your network, the number of instances of program, and the type of program. The application only lists software for which it has credentials to scan. An exception to this would be when it discovers a vulnerability that permits root/admin access. Click the link for a program to view the assets that are running it. The Security Console displays a page that lists all the assets running that program. You can view scan, risk, and vulnerability information about any asset. You can click a link for the site to which the asset belongs to view information about the site. You also can click the link for any asset address or name to view information about it. See Viewing the details about an asset on page 81.

Viewing the details about an asset

The Security Console displays a page for each discovered asset. On this page, you can view any reported vulnerabilities and any vulnerabilities excluded from reports. The page lists any exploits or malware kits associated with vulnerabilities to help you prioritize remediation based on these exposures. Additionally, the table displays a special icon for any vulnerability that has been validated with an exploit. If a vulnerability has been validated with an exploit via a Metasploit module, the column displays the icon. If a vulnerability has been validated with an exploit published in the Exploit Dataicon. For more information, see Working with validated base, the column displays the vulnerabilities on page 92.

You can also view information about software, services, policy listings, databases, files, and directories on that asset as discovered by the application. You can view any users or groups associated with the asset. The Addresses field in the Asset Properties pane displays all addresses (separated by commas) that have been discovered for the asset. This may include addresses that have not been scanned. For example: A given asset may have an IPv4 address and an IPv6 address. When configuring scan targets for your site, you may have only been aware of the IPv4 address, so you included only that address to be scanned in the site configuration. Viewing the discovered IPv6 address on the asset page allows you to include it for future scans, increasing your security coverage. You can view any asset fingerprints. Fingerprinting is a set of methods by which the application identifies as many details about the asset as possible. By inspecting properties such as the specific bit settings in reserved areas of a buffer, the timing of a response, or a unique acknowledgement interchange, it can identify indicators about the assets hardware and operating system. In the Asset Properties table, you can run a scan or create a report for the asset. In the Vulnerability Listing table, you can open a ticket for tracking the remediation of the vulnerabilities. See Using tickets on page 182. For more information about the Vulnerabilities Listing table and how you can use it, see Viewing active vulnerabilities on page 84 and Working with vulnerability exceptions on page 94. The table lists different security metrics, such as CVSS rating, risk score, vulnerability publication date, and severity rating. You can sort vulnerabilities according to any of these metrics

Nexpose Users Guide

81

by clicking the column headings. Doing so allows you to order vulnerabilities according to these different metrics and get a quick view of your security posture and priorities. If you have scanned the asset with Policy Manager Checks, you can view the results of those checks in the Policy Listing table. If you click the name of any listed policy, you can view more information about it, such as other assets that were tested against that policy or the results of compliance checks for individual rules that make up the policy. For more information, see Working with Policy Manager results. If you have scanned the asset with standard policy checks, such as for Oracle or Lotus Domino, you can review the results of those checks in the Standard Policy Listing table.

The page for a specific asset

Deleting assets
You may want to delete assets for one of several reasons:

Assets may no longer be active in your network. Assets may have dynamic IP addresses that are constantly changing. If a scan on a particular date "rediscovered" these assets, you may want to delete assets scanned on that date. Network misconfigurations result in higher asset counts. If results from a scan on a particular date reflect misconfigurations, you may want to delete assets scanned on that date.

If any of the preceding situations apply to your environment, a best practice is to create a dynamic asset group based on a scan date. See Working with asset groups on page 120. Then you can locate the assets in that group using the steps described in Locating assets on page 78. Using the bulk asset deletion feature described in this topic, you can delete multiple inactive assets in one step.
NOTE: Deleting an asset from an asset group is different from removing an asset from an asset group. The latter is performed in asset group management. See Working with asset groups.

If you delete an asset from a site, it will no longer be included in the site or any asset groups in which it was previously included. If you delete an asset from an asset group, it will also be deleted from the site that contained it, as well as any other asset groups in which it was previously included. The deleted asset will no longer appear in the Web interface or reports other than historical reports, such as trend reports. If the asset is rediscovered in a future scan it will be regarded in the Web interface and future reports as a new asset.

Nexpose Users Guide

82

You can only delete assets in sites or asset groups to which you have access.
NOTE: This procedure deletes only the assets displayed in the table, not all the assets in the site or asset group. For example, if a site contains 100 assets, but your table is configured to display 25, you can only select those 25 at one time. You will need repeat this procedure or increase the number of assets that the table displays to select all assets. The Total Assets Selected field on the right side of the table indicates how many assets are contained in the site or asset group.

To delete individual assets that you locate by using the site or asset group drill-down described in Locating assets on page 78, take the following steps: 1. 2. After locating assets you want to delete, select the row for each asset in the Asset Listing table. Click Delete Assets.

To delete all the displayed assets that you locate by using the site or asset group drill-down, take the following steps: 1. 2. 3. After locating assets you want to delete, click the top row in the Asset Listing table. Click Select Visible in the pop-up that appears. This step selects all of the assets currently displayed in the table. Click Delete Assets.

To cancel your selection, click the top row in the Asset Listing table. Then click Clear All in the popup that appears.

Deleting multiple assets in one step

NOTE: Bulk asset deletion is not currently available for Asset Listing tables that you locate using operating system, software, service, or all-assets drill-downs.

To delete assets that you locate by using the Asset, Operating System, Software, or Service listing table as described in the preceding section, take the following step. 1. After locating assets you want to delete, click the Delete icon for each asset. top row in the Asset Listing table.

Deleting assets located via the operating system drill-down

Nexpose Users Guide

83

Working with vulnerabilities

Analyzing the vulnerabilities discovered in scans is a critical step in improving your security posture. By examining the frequency, affected assets, risk level, exploitability and other characteristics of a vulnerability, you can prioritize its remediation and manage your security resources effectively. Every vulnerability that Nexpose discovers in the scanning process is added to vulnerability database. This extensive, full-text, searchable database also stores information on patches, downloadable fixes, and reference content about security weaknesses. The application keeps the database current through a subscription service that maintains and updates vulnerability definitions and links. It contacts this service for new information every six hours. The database has been certified to be compatible with the MITRE Corporations Common Vulnerabilities and Exposures (CVE) index, which standardizes the names of vulnerabilities across diverse security products and vendors. The index rates vulnerabilities according to MITREs Common Vulnerabilities Scoring System (CVSS) Version 2. An application algorithm computes the CVSS score based on ease of exploit, remote execution capability, credentialed access requirement, and other criteria. The score, which ranges from 1.0 to 10.0, is used in Payment Card Industry (PCI) compliance testing. For more information about CVSS scoring, go to the FIRST Web site (http://www.first.org/cvss/cvss-guide.html).

Viewing active vulnerabilities

Viewing vulnerabilities and their risk scores helps you to prioritize remediation projects. You also can find out which vulnerabilities have exploits available, enabling you to verify those vulnerabilities. See Using Exploit Exposure on page 251. Click the Vulnerabilities tab that appears on every page of the console interface. The Security Console displays the Vulnerabilities page, which lists all the vulnerabilities for assets that the currently logged-on user is authorized to see, depending on that users permissions. Since Global Administrators have access to all assets in your organization, they will see all the vulnerabilities in the database.

Nexpose Users Guide

84

The Vulnerabilities page

You can change the sorting criteria by clicking any of the column headings in the Vulnerability Listing table. The Title column lists the name of each vulnerability. Two columns indicate whether each vulnerability exposes your assets to malware attacks or exploits. Sorting entries according to either of these criteria helps you to determine at a glance which vulnerabilities may require immediate attention because they increase the likelihood of compromise. For each discovered vulnerability that has at least one malware kit (also known as an exploit kit) associated with it, the console displays a malware exposure icon . If you click the icon, the console displays the Threat Listing pop-up window that lists all the malware kits that attackers can use to write and deploy malicious code for attacking your environment through the vulnerability. You can generate a comma-separated values (CSV) file of the malware kit list to share with others in your organization. Click the Export to CSV icon . Depending on your browser settings, you will see a pop-up window with options to save the file or open it in a compatible program. You can also click the Exploits tab in the pop-up window to view published exploits for the vulnerability. In the context of the application a published exploit is one that has been developed in Metasploit or listed in the Exploit Database. For each discovered vulnerability with an associated exploit the console displays a exploit icon. If you click this icon the console displays the Threat Listing pop-up window that lists descriptions about all available exploits, their required skill levels, and their online sources. The Exploit Database is an archive of exploits and vulnerable software. If a Metasploit exploit is available, the console displays the icon and a link to a Metasploit module that provides detailed exploit information and resources.

Nexpose Users Guide

85

There are three levels of exploit skill: Novice, Intermediate, and Expert. These map to Metasploit's seven-level exploit ranking. For more information, see the Metasploit Framework page (http:// www.metasploit.com/redmine/projects/framework/wiki/Exploit_Ranking).

Novice maps to Great through Excellent. Intermediate maps to Normal through Good. Expert maps to Manual through Low through Average.

You can generate a comma-separated values (CSV) file of the exploit list and related data to share with others in your organization. Click the Export to CSV icon . Depending on your browser settings, you will see a pop-up window with options to save the file or open it in a compatible program. You can also click the Malware tab in the pop-up window to view any malware kits that attackers can use to write and deploy malicious code for attacking your environment through the vulnerability. The CVSS Score column lists the score for each vulnerability. The Published On column lists the date when information about each vulnerability became available. The Risk column lists the risk score that the application calculates, indicating the potential danger that each vulnerability poses to an attacker exploits it. The application provides two risk scoring models, which you can configure. See Selecting a model for calculating risk scores in the administrator's guide. The risk model you select controls the scores that appear in the Risk column. To learn more about risk scores and how they are calculated, see the PCI, CVSS, and risk scoring FAQs, which you can access in the Support page. The application assigns each vulnerability a severity level, which is listed in the Severity column. The three severity levelsCritical, Severe, and Moderatereflect how much risk a given vulnerability poses to your network security. The application uses various factors to rate severity, including CVSS scores, vulnerability age and prevalence, and whether exploits are available. See the PCI, CVSS, and risk scoring FAQs, which you can access in the Support page.
NOTE: The severity ranking in the Severity column is not related to the severity score in PCI reports.

1 to 3 = Moderate 4 to 7 = Severe 8 to 10 = Critical The Instances column lists the total number of instances of that vulnerability in your site. If you click the link for the vulnerability name, you can view which specific assets are affected by the vulnerability. See Viewing vulnerability details on page 91. You can click the icon in the Exclude column for any listed vulnerability to exclude that vulnerability from a report. An administrative change to your network, such as new credentials, may change the level of access that an asset permits during its next scan. If the application previously discovered certain vulnerabilities because an asset permitted greater access, that vulnerability data will no longer be available due to diminished access. This may result in a lower number of reported vulnerabilities, even if no remediation has occurred. Using baseline comparison reports to list differences between scans may yield incorrect results or provide more information than necessary because of these changes. Make sure that your assets permit the highest level of access required for the scans you are running to prevent these problems. The Vulnerability Categories and Vulnerability Check Types tables list all categories and check types that the Application can scan for. Your scan template configuration settings determine which categories or check types the application will scan for. To determine if your environment has a vulnerability belonging to one of the listed checks or types, click the appropriate link. The Security Console displays a page listing all pertinent vulnerabilities. Click the link for any vulnerability to see its detail page, which lists any affected assets.

Nexpose Users Guide

86

Your scans may discover hundreds, or even thousands, of vulnerabilities, depending on the size of your scan environment. A high number of vulnerabilities displayed in the Vulnerability Listing table may make it difficult to assess and prioritize security issues. By filtering your view of vulnerabilities, you can reduce the sheer number of those displayed, and restrict the view to vulnerabilities that affect certain assets. For example, a Security Manager may only want to see vulnerabilities that affect assets in sites or asset groups that he or she manages. Or you can restrict the view to vulnerabilities that pose a greater threat to your organization, such as those with higher risk scores or CVSS rankings.

Filtering your view of vulnerabilities

Your scans may discover hundreds, or even thousands, of vulnerabilities, depending on the size of your scan environment. A high number of vulnerabilities displayed in the Vulnerability Listing table may make it difficult to assess and prioritize security issues. By filtering your view of vulnerabilities, you can reduce the sheer number of those displayed, and restrict the view to vulnerabilities that affect certain assets. For example, a Security Manager may only want to see vulnerabilities that affect assets in sites or asset groups that he or she manages. Or you can restrict the view to vulnerabilities that pose a greater threat to your organization, such as those with higher risk scores or CVSS rankings.

Working with filters and operators in vulnerability displays

Filtering your view of vulnerabilities involves selecting one or more filters, which are criteria for displaying specific vulnerabilities. For each filter you then select an operator, which controls how the filter is applied. Site name is a filter for vulnerabilities that affect assets in specific sites. It works with the following operators:

The is operator displays a drop-down list of site names. Click a name to display vulnerabilities that affect assets in that site. Using the SHIFT key, you can select multiple names. The is not operator displays a drop-down list of site names. Click a name to filter out vulnerabilities that affect assets in that site, so that they are not displayed. Using the SHIFT key, you can select multiple names.

Asset group name is a filter for vulnerabilities that affect assets in specific asset groups. It works with the following operators:

The is operator displays a drop-down list of asset group names. Click a name to display vulnerabilities that affect assets in that asset group. Using the SHIFT key, you can select multiple names. The is not operator displays a drop-down list of asset group names. Click a name to filter out vulnerabilities that affect assets in that asset group, so that they are not displayed. Using the SHIFT key, you can select multiple names.

Nexpose Users Guide

87

CVSS score is a filter for vulnerabilities with specific CVSS rankings. It works with the following operators:

The is operator displays all vulnerabilities that have a specified CVSS score. The is not operator displays all vulnerabilities that do not have a specified CVSS score. The is in the range of operator displays all vulnerabilities that fall within the range of two specified CVSS scores and include the high and low scores in the range. The is higher than operator displays all vulnerabilities that have a CVSS score higher than a specified score. The is lower than operator displays all vulnerabilities that have a CVSS score lower than a specified score.

After you select an operator, enter a score in the blank field. If you select the range operator, you would enter a low score and a high score to create the range. Acceptable values include any numeral from 0.0 to 10. You can only enter one digit to the right of the decimal. If you enter more than one digit, the score is automatically rounded up. For example, if you enter a score of 2.25, the score is automatically rounded up to 2.3.

Nexpose Users Guide

88

Risk score is a filter for vulnerabilities with certain risk scores. It works with the following operators: The is operator displays all vulnerabilities that have a specified risk score. The is not operator displays all vulnerabilities that do not have a specified risk score. The is in the range of operator displays all vulnerabilities that fall within the range of two specified risk scores and include the high and low scores in the range. The is higher than operator displays all vulnerabilities that have a risk score higher than a specified score. The is lower than operator displays all vulnerabilities that have a risk score lower than a specified score. After you select an operator, enter a score in the blank field. If you select the range operator, you would type a low score and a high score to create the range. Keep in mind your currently selected risk strategy when searching for assets based on risk scores. For example, if the currently selected strategy is Real Risk, you will not find assets with scores higher than 1,000. Learn about different risk score strategies. Refer to the risk scores in your vulnerability and asset tables for guidance.

NOTE: You can only use each filter once. For example, you cannot select the Site name filter twice. If you want to specify more than one site name or asset name in the display criteria, use the SHIFT key to select multiple names when configuring the filter.

Applying vulnerability display filters

To apply vulnerability display filters, take the following steps: 1. 2. 3. 4. 5. 6. 7. Click the Vulnerabilities tab of the Security Console Web interface. The Security Console displays the Vulnerabilities page. In the Vulnerability Listing table, expand the section to Apply Filters. Select a filter from the drop-down list. Select an operator for the filter. Enter or select a value based on the operator. Use the + button to add filters. Repeat the steps for selecting the filter, operator, and value. Use the - button to remove filters. Click Filter. The Security Console displays vulnerabilities that meet all filter criteria in the table. Currently, filters do not change the number of displayed instances for each vulnerability.

TIP: You can export the filtered view of vulnerabilities as a comma-separated values (CSV) file to share with members of your security team. To do so, click the Export to CSV link at the bottom of the Vulnerability Listing table.

Nexpose Users Guide

89

Filtering the display of vulnerabilities

Nexpose Users Guide

90

Viewing vulnerability details

Click the link for any vulnerability listed on the Vulnerabilities page to view information about it. The Security Console displays a page for that vulnerability.

The page for a specific vulnerability

At the top of the page is a description of the vulnerability, its severity level and CVSS rating, the date that information about the vulnerability was made publicly available, and the most recent date that Rapid7 modified information about the vulnerability, such as its remediation steps. Below these items is a table listing each affected asset, port, and the site on which a scan reported the vulnerability. You can click on the link for the device name or address to view all of its vulnerabilities. On the device page, you can create a ticket for remediation. See Using tickets on page 182. You also can click the site link to view information about the site. The Port column in the Affected Assets table lists the port that the application used to contact the affected service or software during the scan. The Status column lists a Vulnerable status for an asset if the application confirmed the vulnerability. It lists a Vulnerable Version status if the application only detected that the asset is running a version of a particular program that is known to have the vulnerability.

Nexpose Users Guide

91

The Proof column lists the method that the application used to detect the vulnerability on each asset. It uses exploitation methods typically associated with hackers, inspecting registry keys, banners, software version numbers, and other indicators of susceptibility. The Exploits table lists descriptions of available exploits and their online sources. The Exploit Database is an archive of exploits and vulnerable software. If a Metasploit exploit is available, the console displays the icon and a link to a Metasploit module that provides detailed exploit information and resources. The Malware table lists any malware kit that attackers can use to write and deploy malicious code for attacking your environment through the vulnerability. The References table, which appears below the Affected Assets pane, lists links to Web sites that provide comprehensive information about the vulnerability. At the very bottom of the page is the Solution pane, which lists remediation steps and links for downloading patches and fixes. If you wish to query the database for a specific vulnerability, and you know its name, type all or part of the name in the Search box that appears on every page of the console interface, and click the magnifying glass icon. The console displays a page of search results organized by different categories, including vulnerabilities.

Working with validated vulnerabilities

There are many ways to sort and prioritize vulnerabilities for remediation. One way is to give higher priority to vulnerabilities that have been validated, or proven to exist. The application uses a number of methods to flag vulnerabilities during scans, such as fingerprinting software versions known to be vulnerable. These methods provide varying degrees of certainty that a vulnerability exists. You can increase your certainty that a vulnerability exists by exploiting it, which involves deploying code that penetrates your network or gains access to a computer through that specific vulnerability. As discussed in the topic Viewing active vulnerabilities on page 84, any vulnerability that has a published exploit associated with it is marked with a Metasploit or Exploit Database icon. You can integrate Rapid7 Metasploit as a tool for validating vulnerabilities discovered in Nexpose scans and then have Nexpose indicate that these vulnerabilities have been validated on specific assets.
NOTE: Metasploit is the only exploit application that the vulnerability validation feature supports. See a tutorial (https:// community.rapid7.com/docs/ DOC-2554) for performing vulnerability validation with Metasploit.

To work in Nexpose with vulnerabilities that have been validated with Metasploit, take the following steps: 1. 2. 3. 4. 5. After performing exploits in Metasploit, click the Assets tab of the Nexpose Security Console Web interface. Locate an asset that you would like to see validated vulnerabilities for. See Locating assets on page 78. Double-click the asset's name or IP address. The Security Console displays the details page for the asset. View the Exploits column ( the column displays the ) in the Vulnerability Listing table. If a vulnerability has been validated with an exploit via a Metasploit module, icon. icon. If a vulnerability has been validated with an exploit published in the Exploit Database, the column displays the 6. To sort the vulnerabilities according to whether they have been validated, click the title row in the Exploits column.

Nexpose Users Guide

92

As seen in the following screen shot, the descending sort order for this column is 1) vulnerabilities that have been validated with a Metasploit exploit, 2) vulnerabilities that can be validated with a Metasploit exploit, 3) vulnerabilities that have been validated with an Exploit database exploit, 4) vulnerabilities that can be validated with an Exploit database exploit.

The asset details page with the Exposures legend highlighted

Nexpose Users Guide

93

Working with vulnerability exceptions

All discovered vulnerabilities appear in Vulnerabilities Listing table of the security console web interface. Your organization can exclude certain vulnerabilities from appearing in reports or affecting risk scores.

Understanding cases for excluding vulnerabilities

There are several possible reasons for excluding vulnerabilities from reports. Compensating controls: Network managers may mitigate the security risks of certain vulnerabilities, which, technically, could prevent their organization from being PCI compliant. It may be acceptable to exclude these vulnerabilities from the report under certain circumstances. For example, the application may discover a vulnerable service on an asset behind a firewall because it has credentialed access through the firewall. While this vulnerability could result in the asset or site failing the audit, the merchant could argue that the firewall reduces any real risk under normal circumstances. Additionally, the network may have host- or network-based intrusion prevention systems in place, further reducing risk. Acceptable use: Organizations may have legitimate uses for certain practices that the application would interpret as vulnerabilities. For example, anonymous FTP access may be a deliberate practice and not a vulnerability. Acceptable risk: In certain situations, it may be preferable not to remediate a vulnerability if the vulnerability poses a low security risk and if remediation would be too expensive or require too much effort. For example, applying a specific patch for a vulnerability may prevent an application from functioning. Re-engineering the application to work on the patched system may require too much time, money, or other resources to be justified, especially if the vulnerability poses minimal risk. False positives: According to PCI criteria, a merchant should be able to report a false positive, which can then be verified and accepted by a Qualified Security Assessor (QSA) or Approved Scanning Vendor (ASV) in a PCI audit. Below are scenarios in which it would be appropriate to exclude a false positive from an audit report. In all cases, a QSA or ASV would need to approve the exception.

Backporting may cause false positives. For example, an Apache update installed on an older Red Hat server may produce vulnerabilities that should be excluded as false positives. If an exploit reports false positives on one or more assets, it would be appropriate to exclude these results.

Nexpose Users Guide

94

NOTE: In order to comply with federal regulations, such as the Sarbanes-Oxley Act (SOX), it is often critically important to document the details of a vulnerability exception, such as the personnel involved in requesting and approving the exception, relevant dates, and information about the exception.

Understanding vulnerability exception permissions

Your ability to work with vulnerability exceptions depends on your permissions. If you do now know what your permissions are, consult your system administrator. Three permissions are associated with the vulnerability exception workflow:

Submit Vulnerability Exceptions: A user with this permission can submit requests to exclude vulnerabilities from reports. Review Vulnerability Exceptions: A user with this permission can approve or reject requests to exclude vulnerabilities from reports. Delete Vulnerability Exceptions: A user with this permission can delete vulnerability exceptions and exception requests. This permission is significant in that it is the only way to overturn a vulnerability request approval. In that sense, a user with this permission can wield a check and balance against users who have permission to review requests.

Understanding vulnerability exception status and work flow

Every vulnerability has an exception status, including vulnerabilities that have never been considered for exception. The range of actions you can take with respect to exceptions depends on the exception status, as well as your permissions, as indicated in the following table: If the vulnerability has the following exception status...
never been submitted for an exception previously approved and later deleted or expired under review (submitted, but not approved or rejected) excluded for another instance, asset, or site under review (and submitted by you) under review (submitted, but not approved or rejected) approved Delete Vulnerability Exceptions

...and you have the following permission...

Submit Exception Request

...you can take the following action:

submit an exception request

Submit Exception Request

submit an exception request

Review Vulnerability Exceptions

approve or reject the request

Submit Exception Request

submit an exception request

recall the exception

delete the request

Review Vulnerability Exceptions

view and change the details of the approval, but not overturn the approval submit another exception request delete the exception, thus overturing the approval

rejected approved or rejected

Submit Exception Request Delete Vulnerability Exceptions

Nexpose Users Guide

95

Understanding different options for exception scope

A vulnerability may be discovered once or multiple times on a certain asset. The vulnerability may also be discovered on hundreds of assets. Before you submit a request for a vulnerability exception, review how many instances of the vulnerability have been discovered and how many assets are affected. Its also important to understand the circumstances surrounding each affected asset. You can control the scope of the exception by using one of the following options when submitting a request:

You can create an exception for all instances of a vulnerability on all affected assets. For example, you may have many instances of a vulnerability related to an open SSH port. However, if in all instances a compensating control is in place, such as a firewall, you may want to exclude that vulnerability globally. You can create an exception for all instances of a vulnerability in a site. As with global exceptions, a typical reason for a site-specific exclusion is a compensating control, such as all of a sites assets being located behind a firewall. You can create an exception for all instances of a vulnerability on a single asset. For example one of the assets affected by a particular vulnerability may be located in a DMZ. Or perhaps it only runs for very limited periods of time for a specific purpose, making it less sensitive. You can create an exception for a single instance of a vulnerability. For example, a vulnerability may be discovered on each of several ports on a server. However, one of those ports is behind a firewall. You may want to exclude the vulnerability instance that affects that protected port.

Submitting or re-submitting a request for a global vulnerability exception

A global vulnerability exception means that the application will not report the vulnerability on any asset in your environment that has that vulnerability. Only a Global Administrator can submit requests for global exceptions. Locate the vulnerability for which you want to request an exception. There are several ways to locate to a vulnerability. The following way is easiest for a global exception. 1. 2. 3. 4. Click the Vulnerabilities tab of the Security Console Web interface. The console displays the Vulnerabilities page. Locate the vulnerability in the Vulnerability Listing table. Create and submit the exception request. Look at the Exceptions column for the located vulnerability. This column displays one of several possible actions. If an exception request has not previously been submitted for that vulnerability, the column displays an Exclude icon. If it was submitted and then rejected, the column displays a Resubmit icon. 5.
TIP: If a vulnerability has an action icon other than Exclude, see Understanding cases for excluding vulnerabilities on page 94.

Click the icon. A Vulnerability Exception dialog box appears. If an exception request was previously submitted and then rejected, read the displayed reasons for the rejection and the user name of the reviewer. This is helpful for tracking previous decisions about the handling of this vulnerability. Select All instances if it is not already displayed from the Scope drop-down list. Select a reason for the exception from the drop-down list. For information about exception reasons, see Understanding cases for excluding vulnerabilities on page 94.

6. 7.

Nexpose Users Guide

96

8.

Enter additional comments. These are especially helpful for a reviewer to understand your reasons for the request. Click Submit & Approve to have the exception take effect.

NOTE: If you select Other as a reason from the drop-down list, additional comments are required. NOTE: Only a Global Administrator can submit and approve a vulnerability exception.

9.

10. (Optional) Click Submit to place the exception under review and have another individual in your organization review it. 11. Verify the exception (if you submitted and approved it). After you approve an exception, the vulnerability no longer appears in the list on the Vulnerabilities page. 12. Click the Administration tab. The console displays the Administration page. 13. Click the Manage link for Vulnerability Exceptions. 14. Locate the exception in the Vulnerability Exception Listing table.

Submitting or re-submitting an exception request for all instances of a vulnerability on a specific site
Locate the vulnerability for which you want to request an exception. There are several ways to locate to a vulnerability. The following ways are easiest for a site-specific exception: 1. 2. 3. 4. 5. Click the Vulnerabilities tab of the Security Console Web interface. The console displays the Vulnerabilities page. Locate the vulnerability in the Vulnerability Listing table, and click the link for it. Find an asset in a particular site for which you want to exclude vulnerability instances in the Affects table of the vulnerability details page. (Optional) Click the Assets tab and use the Sites option to find a vulnerability on an asset in a specific site. See Locating assets by sites on page 79. Locate the vulnerability in the Vulnerability Listing table, and click the link for it.

Create and submit an individual exception request. 1. Look at the Exceptions column for the located vulnerability. If an exception request has not previously been submitted for that vulnerability, the column displays an Exclude icon. If it was submitted and then rejected, the column displays a Resubmit icon. Click the icon. A Vulnerability Exception dialog box appears. If an exception request was previously submitted and then rejected, read the displayed reasons for the rejection and the user name of the reviewer. This is helpful for tracking previous decisions about the handling of this vulnerability. Select All instances in this site from the Scope drop-down list. Select a reason for the exception from the drop-down list. For information about exception reasons, see Understanding cases for excluding vulnerabilities on page 94. 5. Enter additional comments. These are especially helpful for a reviewer to understand your reasons for the request. If you select Other as a reason from the drop-down list, additional comments are required.

2.
NOTE: If a vulnerability has an action link other than Exclude, see Understanding cases for excluding vulnerabilities on page 94.

3. 4.

Nexpose Users Guide

97

6. 7.

Click Submit & Approve to have the exception take effect. Click Submit to place the exception under review and have another individual in your organization review it.

Create and submit multiple, simultaneous exception requests. This procedure is useful if you want to exclude a large number of vulnerabilities because, for example, they all have the same compensating control.
NOTE: If you select all listed vulnerabilities for exclusion, it will only apply to vulnerabilities that have not been excluded. For example, if the Vulnerabilities Listing table includes vulnerabilities that are under review or rejected, the global exclusion will not apply to them. The same applies for global resubmission: It will only apply to listed vulnerabilities that have been rejected for exclusion.

1.

After going to the Vulnerability Listing table as described in the preceding section, select the row for each vulnerability that you want to exclude. OR To select all the vulnerabilities displayed in the table, click the check box in the top row. Then select the pop-up option Select Visible. Click Exclude for vulnerabilities that have not been submitted for exception, or click Resubmit for vulnerabilities that have been rejected for exception. Proceed with the vulnerability exception workflow as described in the preceding section. If you've selected multiple vulnerabilities but then want to cancel the selection, click the top row. Then select the pop-up option Clear All.

2. 3. 4.

Selecting multiple vulnerabilities

Verify the exception (if you submitted and approved it). 1. 2. 3. 4. After you approve an exception, the vulnerability no longer appears in the list on the Vulnerabilities page. Click the Administration tab. The console displays the Administration page. Click the Manage link for Vulnerability Exceptions. Locate the exception in the Vulnerability Exception Listing table.

Submitting or re-submitting an exception request for all instances of a vulnerability on a specific asset
Locate the vulnerability for which you want to request an exception. There are several ways to locate to a vulnerability. The following ways are easiest for an asset-specific exception. 1. 2. Click the Vulnerabilities tab of the security console Web interface. The console displays the Vulnerabilities page. Locate the vulnerability in the Vulnerability Listing table, and click the link for it.

Nexpose Users Guide

98

3. 4. 5. 6.

Click the link for the asset that includes the instances of the vulnerability that you want to have excluded in the Affects table of the vulnerability details page. On the details page of the affected asset, locate the vulnerability in the Vulnerability Listing table. (Optional) Click the Assets tab and use one of the displayed options to find a vulnerability on an asset. See Locating assets on page 78. Locate the vulnerability in the Vulnerability Listing table on the asset page, and click the link for it. Look at the Exceptions column for the located vulnerability. This column displays one of several possible actions. If an exception request has not previously been submitted for that vulnerability, the column displays an Exclude icon. If it was submitted and then rejected, the column displays a Resubmit icon. Click the icon. A Vulnerability Exception dialog box appears. If an exception request was previously submitted and then rejected, read the displayed reasons for the rejection and the user name of the reviewer. This is helpful for tracking previous decisions about the handling of this vulnerability.

Create and submit an individual exception request.

NOTE: If a vulnerability has an action link other than Exclude, see Understanding cases for excluding vulnerabilities on page 94.

1.

2.

NOTE: If you select Other as a reason from the drop-down list, additional comments are required.

3. 4.

Select All instances on this asset from the Scope drop-down list. Enter additional comments. These are especially helpful for a reviewer to understand your reasons for the request.

5. 6.

Click Submit & Approve to have the exception take effect. (Optional) Click Submit to place the exception under review and have another individual in your organization review it.

Create and submit multiple, simultaneous exception requests. This procedure is useful if you want to exclude a large number of vulnerabilities because, for example, they all have the same compensating control.
NOTE: If you select all listed vulnerabilities for exclusion, it will only apply to vulnerabilities that have not been excluded. For example, if the Vulnerabilities Listing table includes vulnerabilities that are under review or rejected, the global exclusion will not apply to them. The same applies for global resubmission: It will only apply to listed vulnerabilities that have been rejected for exclusion.

1.

After going to the Vulnerability Listing table as described in the preceding section, select the row for each vulnerability that you want to exclude. OR To select all the vulnerabilities displayed in the table, click the check box in the top row. Then select the pop-up option Select Visible. Click Exclude for vulnerabilities that have not been submitted for exception, or click Resubmit for vulnerabilities that have been rejected for exception. Proceed with the vulnerability exception workflow as described in the preceding section. If you've selected multiple vulnerabilities but then want to cancel the selection, click the top row. Then select the pop-up option Clear All.

2. 3. 4.

5.

Verify the exception (if you submitted and approved it). After you approve an exception, the vulnerability no longer appears in the list on the Vulnerabilities page. Click the Administration tab. The console displays the Administration page. Click the Manage link for Vulnerability Exceptions. Locate the exception in the Vulnerability Exception Listing table.

6. 7. 8.

Nexpose Users Guide

99

Submitting or re-submitting an exception request for a single instance of a vulnerability

When you create an exception for a single instance of a vulnerability, the application will not report the vulnerability against the asset if the device, port, and additional data match. Locate the instance of the vulnerability for which you want to request an exception. There are several ways to locate to a vulnerability. The following way is easiest for a site-specific exception. 1. 2. 3. 4. 5. Click the Vulnerabilities tab of the security console Web interface. Locate the vulnerability in the Vulnerability Listing table on the Vulnerabilities page, and click the link for it. Locate the affected asset in the in the Affects table on the details page for the vulnerability. (Optional) Click the Assets tab and use one of the displayed options to find a vulnerability on an asset. See Locating assets on page 78. Locate the vulnerability in the Vulnerability Listing table on the asset page, and click the link for it. Look at the Exceptions column for the located vulnerability. This column displays one of several possible actions. If an exception request has not previously been submitted for that vulnerability, the column displays an Exclude icon. If it was submitted and then rejected, the column displays a Resubmit icon. Click the icon. A Vulnerability Exception dialog box appears. If an exception request was previously submitted and then rejected, you can view the reasons for the rejection and the user name of the reviewer in a note at the top of the box. Select a reason for requesting the exception from the drop-down list. For information about exception reasons, see Understanding cases for excluding vulnerabilities on page 94. 3. Select Specific instance on this asset from the Scope drop-down list. If you select Other as a reason from the drop-down list, additional comments are required. 4. 5. 6. Enter additional comments. These are especially helpful for a reviewer to understand your reasons for the request. Click Submit & Approve to have the exception take effect. (Optional) Click Submit to place the exception under review and have another individual in your organization review it.

Create and submit an individual exception request.

NOTE: If a vulnerability has an action link other than Exclude, see Understanding cases for excluding vulnerabilities on page 94.

1.

2.

Nexpose Users Guide

100

Create and submit multiple, simultaneous exception requests. This procedure is useful if you want to exclude a large number of vulnerabilities because, for example, they all have the same compensating control.
NOTE: If you select all listed vulnerabilities for exclusion, it will only apply to vulnerabilities that have not been excluded. For example, if the Vulnerabilities Listing table includes vulnerabilities that are under review or rejected, the global exclusion will not apply to them. The same applies for global resubmission: It will only apply to listed vulnerabilities that have been rejected for exclusion.

1.

After going to the Vulnerability Listing table as described in the preceding section, select the row for each vulnerability that you want to exclude. OR To select all the vulnerabilities displayed in the table, click the check box in the top row. Then select the pop-up option Select Visible. Click Exclude for vulnerabilities that have not been submitted for exception, or click Resubmit for vulnerabilities that have been rejected for exception. Proceed with the vulnerability exception workflow as described in the preceding section. If you've selected multiple vulnerabilities but then want to cancel the selection, click the top row. Then select the pop-up option Clear All.

2. 3. 4. 5.

Verify the exception (if you submitted and approved it). 1. 2. 3. 4. After you approve an exception, the vulnerability no longer appears in the list on the Vulnerabilities page. Click the Administration tab. The console displays the Administration page. Click the Manage link for Vulnerability Exceptions. Locate the exception in the Vulnerability Exception Listing table.

Recalling an exception request that you submitted

You can recall, or cancel, a vulnerability exception request that you submitted if its status remains under review. Locate the exception request, and verify that it is still under review. The location depends on the scope of the exception. For example, if the exception is for all instances of the vulnerability on a single asset, locate that asset in the Affects table on the details page for the vulnerability. If the link in the Exceptions column is Under review, you can recall it. Recall an individual vulnerability exception request. 1. 2. Click the Under Review link. Click Recall in the Vulnerability Exception dialog box. The link in the Exceptions column changes to Exclude.

Nexpose Users Guide

101

Recall multiple, simultaneous exception requests. This procedure is useful if you want to recall a large number of requests because, for example, you've learned that since you submitted them it has become necessary to include them in a report.
NOTE: If you select all listed vulnerabilities for recall, it will only apply to vulnerabilities that are under review. For example, if the Vulnerabilities Listing table includes vulnerabilities that have not been excluded, or have been rejected for exclusion, the global recall will not apply to them.

1.

After locating the exception request as described in the preceding section, select the row for each vulnerability that you want to exclude. OR To select all the vulnerabilities displayed in the table, click the check box in the top row. Then select the pop-up option Select Visible.

2. 3.

Click Recall. Proceed with the recall workflow as described in the preceding section. If you've selected multiple vulnerabilities but then want to cancel the selection, click the top row. Then select the pop-up option Clear All.

Reviewing an exception request

Upon reviewing a vulnerability exception request, you can either approve or reject it. Locate the exception request. 1. 2. 3. Click the Administration tab of the security console Web interface. On the Administration page, click the Manage link next to Vulnerability Exceptions. Locate the request in the Vulnerability Exception Listing table. To select multiple requests for review, select each desired row. OR, to select all requests for review, select the top row. Selecting multiple requests is useful if you know, for example, that you want to accept or reject multiple requests for the same reason. Review the request(s). 1. 2. 3. 4. Click the Under review link in the Review Status column. Read the comments by the user who submitted the request and decide whether to approve or reject the request. Enter comments in the Reviewers Comments text box. Doing so may be helpful for the submitter. If you want to select an expiration date for the review decision, click the calendar icon and select a date. For example, you may want the exception to be in effect only until a PCI audit is complete. Click Approve or Reject, depending on your decision. The result of the review appears in the Review Status column.

5.

Nexpose Users Guide

102

Selecting multiple requests for review

Deleting a vulnerability exception or exception request

Deleting an exception is the only way to override an approved request. Locate the exception or exception request. 1. Click the Administration tab of the Security Console Web interface. The Security Console displays the Administration page. 2. 3. 4. Click the Manage link next to Vulnerability Exceptions. Locate the request in the Vulnerability Exception Listing table. To select multiple requests for deletion, select each desired row. OR, to select all requests for deletion, select the top row. Delete the request(s). 1. Click the Delete icon. The entry(ies) no longer appear in the Vulnerability Exception Listing table. The affected vulnerability(ies) appear in the appropriate vulnerability listing with an Exclude icon, which means that a user with appropriate permission can submit an exception request for it.

Viewing vulnerability exceptions in the Report Card report

When you generate a report based on the default Report Card template, each vulnerability exception appears on the vulnerability list with the reason for its exception.

Nexpose Users Guide

103

How vulnerability exceptions appear in XML and CSV formats

Vulnerability exceptions can be important for the prioritization of remediation projects and for compliance audits. Report templates include a section dedicated to exceptions. See Vulnerability Exceptions on page 286. In XML and CSV reports, exception information is also available. XML: The vulnerability test status attribute is set to one of the following values for vulnerabilities suppressed due to an exception:
exception-vulnerable-exploited - Exception suppressed exploited vulnerability exception-vulnerable-version - Exception suppressed version-checked vulnerability exception-vulnerable-potential - Exception suppressed potential vulnerability

CSV: The vulnerability result-code column will be set to one of the following values for vulnerabilities suppressed due to an exception. Each code corresponds to results of a vulnerability check:

Nexpose Users Guide

104

Each code corresponds to results of a vulnerability check:

ds (skipped, disabled): A check was not performed because it was disabled in the scan template. ee (excluded, exploited): A check for an exploitable vulnerability was excluded. ep (excluded, potential): A check for a potential vulnerability was excluded. er (error during check): An error occurred during the vulnerability check. ev (excluded, version check): A check was excluded. It is for a vulnerability that can be identified because the version of the scanned service or application is associated with known vulnerabilities. nt (no tests): There were no checks to perform. nv (not vulnerable): The check was negative. ov (overridden, version check): A check for a vulnerability that would ordinarily be positive because the version of the target service or application is associated with known vulnerabilities was negative due to information from other checks. sd (skipped because of DoS settings): sd (skipped because of DOS settings)If unsafe checks were not enabled in the scan template, the application skipped the check because of the risk of causing denial of service (DOS). See Configuration steps for vulnerability check settings on page 204. sv (skipped because of inapplicable version): the application did not perform a check because the version of the scanned item is not in the list of checks. uk (unknown): An internal issue prevented the application from reporting a scan result. ve (vulnerable, exploited): The check was positive. An exploit verified the vulnerability. vp (vulnerable, potential): The check for a potential vulnerability was positive. vv (vulnerable, version check): The check was positive. The version of the scanned service or software is associated with known vulnerabilities.

Nexpose Users Guide

105

Working with Policy Manager results

If you work for a U.S. government agency, a vendor that transacts business with the government, or a company with strict configuration security policies, you may be running scans to verify that your assets comply with United States Government Configuration Baseline (USGCB) policies, Center for Internet Security (CIS) benchmarks, or Federal Desktop Core Configuration (FDCC). Or you may be testing assets for compliance with customized policies based on these standards. After running Policy Manager scans, you can view information that answers the following questions:

What is the overall rate of compliance for assets in my environment? Which policies are my assets compliant with? Which policies are my assets not compliant with? If my assets have failed compliance with a given policy, which specific policy rules are they not compliant with? Can I change the results of a specific rule compliance test?

Viewing the results of configuration assessment scans enables you to quickly determine the policy compliance status of your environment. You can also view test results of individual policies and rules to determine where specific remediation efforts are required so that you can make assets compliant.

Distinguishing between Policy Manager and standard policies

NOTE: You can only view policy test results for assets to which you have access. This is true for Policy Manager and standard policies.

This section specifically addresses Policy Manager results. The Policy Manager is a license-enabled feature that includes the following policy checks:

USGCB 2.0 policies (only available with a license that enables USGCB scanning) USGCB 1.0 policies (only available with a license that enables USGCB scanning) Center for Internet Security (CIS) benchmarks (only available with a license that enables CIS scanning) FDCC policies (only available with a license that enables FDCC scanning) Custom policies that are based on USGCB or FDCC policies or CIS benchmarks (only available with a license that enables custom policy scanning)

You can view the results of Policy Manager checks on the Policies page or on a page for a specific asset that has been scanned with Policy Manager checks. Standard policies are available with all licenses and include the following:

Oracle policy Lotus Domino policy Windows Group policy AS/400 policy CIFS/SMB Account policy

You can view the results of standard policy checks on a page for a specific asset that has been scanned with one of these checks. Standard policies are not covered in this section.

Nexpose Users Guide

106

Getting an overview of Policy Manager results

If you want to get a quick overview of all the policies for which youve run Policy Manager checks, go to the Policies page by clicking the Policies tab on any page of the Web interface. The page lists tested policies for all assets to which you have access.

Home tool bar Policies tab

At the top of the page, a pie chart shows the ratio of passed and failed policy checks. A line graph shows compliance trends for the most tested policies over time. The y-axis shows the percentage of assets that comply with each listed policy. You can use these statistics to gauge your overall compliance status and identify compliance issues.

Statistical graphics on the Policies pages

The Policy Listing table shows the number of assets that passed and failed compliance checks for each policy. It also includes the following columns:

Each policy is grouped in a category within the application, depending on its source, purpose, or other criteria. The category for any USGCB 2.0 or USGCB 1.0 policy is listed as USGCB. Another example of a category might be Custom, which would include custom policies based on built-in Policy Manager policies. Categories are listed under the Category heading. The Asset Compliance column shows the percentage of tested assets that comply with each policy. The table also includes a Rule Compliance column. Each policy consists of specific rules, and checks are run for each rule. The Rule Compliance column shows the percentage of rules with which assets comply for each policy. Any percentage below 100 indicates failure to comply with the policy The Policy Listing table also includes columns for copying, editing, and deleting policies. For more information about these options, See Creating a custom policy on page 222.

Nexpose Users Guide

107

Viewing results for a Policy Manager policy

After assessing your overall compliance on the Policies page, you may want to view more specific information about a policy. For example, a particular policy shows less than 100 percent rule compliance (which indicates failure to comply with the policy) or less than 100 percent asset compliance . You may want to learn why assets failed to comply or which specific rule tests resulted in failure.
TIP: You can also view results of Policy Manager checks for a specific asset on the page for that asset. See Viewing the details about an asset on page 81.

On the Policies page, you can view details about a policy in the Policy Listing table by clicking the name of that policy.

Clicking a policy name to view information about it

The Security Console displays a page about the policy. At the top of the page, a pie chart shows the ratio of assets that passed the policy check to those that failed. Two line graphs show the five most and least compliant assets. An Overview table lists general information about how the policy is identified. The benchmark ID refers to an exhaustive collection of rules, some of which are included in the policy. The table also lists general asset and rule compliance statistics for the policy. The Tested Assets table lists each asset that was tested against the policy and the results of each test, and general information about each asset. The Asset Compliance column lists each assets percentage of compliance with all the rules that make up the policy. Assets with lower compliance percentages may require more remediation work than other assets. You can click the link for any listed asset to view more details about it. The Policy Rule Compliance Listing table lists every rule that is included in the policy, the number of assets that passed compliance tests, and the number of assets that failed. The table also includes an Override column. For information about overrides, see Overriding rule test results on page 111.

Understanding results for policies and rules

A Pass result means that the asset complies with all the rules that make up the policy. A Fail result means that the asset does not comply with at least one of the rules that makes up the policy. The Policy Compliance column indicates the percentage of policy rules with which the asset does comply. A Not Applicable result means that the policy compliance test doesnt apply to the asset. For example, a check for compliance with Windows Vista configuration policies would not apply to a Windows XP asset.

Nexpose Users Guide

108

Viewing information about policy rules

Every policy is made up of individual configuration rules. When performing a Policy Manager check, the application tests an asset for compliance with each of the rules of the policy. By viewing results for each rule test, you can isolate the configuration issues that are preventing your assets from being policy-compliant.

Viewing a rules results for all tested assets

By viewing the test results for all assets against a rule, you can quickly determine which assets require remediation work in order to become compliant. 1. 2. Click the Policies tab. The Security Console displays the Policies page. In the Policy Listing table, click the name of a policy for which you want to view rule details. The Security Console displays the page for the policy. In the Policy Rule Compliance Listing table, click the link for any rule that you want to view details for. The Security Console displays the page for the rule. The Overview table displays general information that identifies the rule, including its name and category, as well as the name and benchmark ID for the policy that the rule is a part of. The Tested Assets table lists each asset that was tested for compliance with the rule and the result of the result of each test. The table also lists the date of the most recent scan for each rule test. This information can be useful if some remediation work has been done on the asset since the scan date, which might warrant overriding a Fail result or rescanning.

TIP: Mouse over a rule name to view a description of the rule.

3.

Policy Rule Compliance Listing table on a policy page

Nexpose Users Guide

109

Viewing CCE data for a rule

Every rule has a Common Configuration Enumerator (CCE) identifier. CCE is a standard for identifying and correlating configuration data, allowing this data to be shared by multiple information sources and tools. You may find it useful to analyze a policy rules CCE data. The information may help you understand the rule better or to remediate the configuration issue that caused an asset to fail the test. Or, it may be simply useful to have the data available for reference. 1. 2. Click the Policies tab. The Security Console displays the Policies page. In the Policy Listing table, click the name of a policy for which you want to view rule details. The Security Console displays the page for the policy. 3. In the Tested Assets table, click the IP address or name of an asset that has been tested against the policy. The Security Console displays the page for the asset. 4. In the Configuration Policy Rules table, click the name of the rule for which you want to view CCE data. The Security Console displays the page for the rule. In the Configuration Policy Rule CCE Data table, view the rules CCE identifier, description, affected platform, and most recent date that the rule was modified in the National Vulnerability Database. The Security Console displays the page for the rule. 6. Click the link for the rules CCE identifier. The Security Console displays the CCE data page. The page provides the following information:

NOTE: The application applies any current CCE updates with its automatic content updates.

5.

The Overview table displays the rule Common Configuration Enumerator (CCE) identifier, the specific platform to which the rule applies, and the most recent date that the rule was updated in the National Vulnerability Database. The application applies any current CCE updates with its automatic content updates. The Parameters table lists the parameters required to implement the rule on each tested asset. The Technical Mechanisms table lists the methods used to test compliance with the rule. The References table lists documentation sources to which the rule refers for detailed source information as well as values that indicate the specific information in the documentation source. The Configuration Policy Rules table lists the policy and the policy rule name for every imported policy in the application.

Nexpose Users Guide

110

Overriding rule test results

You may want to override, or change, a test result for a particular rule on a particular asset for any of several reasons:

You disagree with the result. You have remediated the configuration issue that produced a Fail result. The rule does not apply to the tested asset.

When overriding a result, you will be required to enter your reason for doing so. Another user can also override your override. Yet another user can perform another override, and so on. For this reason, you can track all the overrides for a rule test back to the original result in the Security Console Web interface. The most recent override for any rule is also identified in the XCCDF Results XML Report format. Overrides are not identified as such in the XCCDF Human Readable CSV Report format. The CSV format displays each current test result as of the most recent override. See Working with report formats on page 173. All overrides and their reasons are incorporated, along with the policy check results, into the documentation that the U.S. government reviews in the certification process.

Understanding Policy Manager override permissions

Your ability to work with overrides depends on your permissions. If you do not know what your permissions are, consult your Global Administrator. These permissions apply specifically to Policy Manager policies.
NOTE: These permissions also include access to activities related to vulnerability exceptions. See Managing users and authentication in the administrators guide.

Three permissions are associated with policy override workflow:

Submit Vulnerability Exceptions and Policy Overrides: A user with this permission can submit requests to override policy test results. Review Vulnerability Exceptions and Policy Overrides: A user with this permission can approve or reject requests to override policy rule results. Delete Vulnerability Exceptions and Policy Overrides: A user with this permission can delete policy test result overrides and override requests.

Understanding override scope options

When overriding a rule result, you will have a number of options for the scope of the override: Global: You can override a rule for all assets in all sites. This scope is useful if assets are failing a policy that includes a rule that isnt relevant to your organization. For example, an FDCC policy includes a rule for disabling remote desktop access. This rule does not make sense for your organization if your IT department administers all workstations via remote desktop access. This override will apply to all future scans, unless you override it again. All assets in a specific site: This scope is useful if a policy includes a rule that isnt relevant to a division within your organization and that division is encompassed in a site. For example, your organization disables remote desktop administration except for the engineering department. If all of the engineering departments assets are contained within a site, you can override a Fail result for the remote desktop rule in that site. This override will apply to all future scans, unless you override it again.

Nexpose Users Guide

111

All scan results for a single asset: This scope is useful if a policy includes a rule that isnt relevant for small number of assets. For example, your organization disables remote desktop administration except for three workstations. You can override a Fail result for the remote desktop rule for each of those three specific assets. This override will apply to all future scans, unless you override it again. A specific scan result on a single asset: This scope is useful if a policy includes a rule that wasnt relevant at a particular point in time but will be relevant in the future. For example, your organization disables remote desktop administration. However, unusual circumstances required the feature to be enabled temporarily on an asset so that a remote IT engineer could troubleshoot it. During that time window, a policy scan was run, and the asset failed the test for the remote desktop rule. You can override the Fail result for that specific scan, and it will not apply to future scans.

Viewing a rules override history

It may be helpful to review the overrides of previous users to give you additional context about the rule or a tested asset. 1. 2. 3. 4. Click the Policies tab. The Security Console displays the Policies page. Select the policy you want to review. Click the name or IP address of an asset in the Tested Assets table. The Security Console displays the page for the asset. Select the rule you want to view the override history of in the Configuration Policy Rules table. The Security Console displays the page for the rule. 5. See the rules Override History table, which lists each override for the rule, the date it occurred, and the result after the override. The Override Status column lists whether the override has been submitted, approved, rejected, or expired.

A rules override history

Nexpose Users Guide

112

Submitting an override of a rule for all assets in all sites

1. 2. Click the Policies tab. The Security Console displays the Policies page. In the Policy Listing table, click the name of the policy that includes the rule for which you want to override the result. The Security Console displays the page for the policy. 3. In the Policy Rule Compliance Listing table, click the Override icon for the rule that you want to override. The Security Console displays a Create Policy Override pop-up window. 4. Select an override type from the drop-down list:

5. 6.

Pass indicates that you consider an asset to be compliant with the rule. Fail indicates that you consider an asset to be non-compliant with the rule. Fixed indicates that the issue that caused a Fail result has been remediated. A Fixed override will cause the result to appear as a Pass in reports and result listings. Not Applicable indicate that the rule does not apply to the asset.

Enter your reason for requesting the override. A reason is required. If you only have override request permission, click Submit to place the override under review and have another individual in your organization review it. The override request appears in the Override History table of the rule page. OR If you have override approval permission, click Submit and approve.

Nexpose Users Guide

113

Submitting an override of a rule for all assets in a site

1. 2. Click the Policies tab. The Security Console displays the Policies page. In the Policy Listing table, click the name of the policy that includes the rule for which you want to override the result. The Security Console displays the page for the policy. 3. In the Tested Assets table, click the name or IP address of an asset. The Security Console displays the page for the asset. Note that the navigation bread crumb for the page includes the site that contains the asset.

The page for an asset selected from a policy page

4.

In the Configuration Policy Rules table, click the Override icon for the rule that you want to override. The Security Console displays a Create Policy Override pop-up window. Select All assets from the Scope drop-down list. Select an override type from the drop-down list:

5. 6.

Pass indicates that you consider an asset to be compliant with the rule. Fail indicates that you consider an asset to be non-compliant with the rule. Fixed indicates that the issue that caused a Fail result has been remediated. A Fixed override will cause the result to appear as a Pass in reports and result listings. Not Applicable indicate that the rule does not apply to the asset.

Nexpose Users Guide

114

7.

Enter your reason for requesting the override. A reason is required.

Submitting a site-specific override

8.

If you only have override request permission, click Submit to place the override under review and have another individual in your organization review it. The override request appears in the Override History table of the rule page. OR If you have override approval permission, click Submit and approve.

Submitting an override of a rule for all scans on a specific asset

1. 2. Click the Policies tab. The Security Console displays the Policies page. In the Policy Listing table, click the name of the policy that includes the rule for which you want to override the result. The Security Console displays the page for the policy. 3. 4. In the Tested Assets table, click the name or IP address of an asset. The Security Console displays the page for the asset. Note that the navigation bread crumb for the page includes the site that contains the asset. In the Configuration Policy Rules table, click the Override icon for the rule that you want to override. The Security Console displays a Create Policy Override pop-up window. 5. 6. Select This asset only from the Scope drop-down list. Select an override type from the drop-down list:

Pass indicates that you consider an asset to be compliant with the rule. Fail indicates that you consider an asset to be non-compliant with the rule. Fixed indicates that the issue that caused a Fail result has been remediated. A Fixed override will cause the result to appear as a Pass in reports and result listings. Not Applicable indicate that the rule does not apply to the asset.

Nexpose Users Guide

115

7.

Enter your reason for requesting the override. A reason is required.

Submitting an asset-specific override

8.

If you only have override request permission, click Submit to place the override under review and have another individual in your organization review it. The override request appears in the Override History table of the rule page. OR If you have override approval permission, click Submit and approve.

Submitting an override of a rule for a specific scan on a single asset

1. 2. Click the Policies tab. The Security Console displays the Policies page. In the Policy Listing table, click the name of the policy that includes the rule for which you want to override the result. The Security Console displays the page for the policy. 3. 4. In the Tested Assets table, click the name or IP address of an asset. The Security Console displays the page for the asset. Note that the navigation bread crumb for the page includes the site that contains the asset. In the Configuration Policy Rules table, click the Override icon for the rule that you want to override. The Security Console displays a Create Policy Override pop-up window. 5. 6. Select This rule on this asset only from the Scope drop-down list. Select an override type from the drop-down list:

Pass indicates that you consider an asset to be compliant with the rule. Fail indicates that you consider an asset to be non-compliant with the rule. Fixed indicates that the issue that caused a Fail result has been remediated. A Fixed override will cause the result to appear as a Pass in reports and result listings. Not Applicable indicate that the rule does not apply to the asset.

Nexpose Users Guide

116

7.

Enter your reason for requesting the override. A reason is required.

Submitting an asset-specific override

8.

If you only have override request permission, click Submit to place the override under review and have another individual in your organization review it. The override request appears in the Override History table of the rule page. OR If you have override approval permission, click Submit and approve.

Reviewing an override request

Upon reviewing an override request, you can either approve or reject it. 1. 2. 3. 4. 5. 6. Click the Administration tab of the Security Console Web interface. On the Administration page, click the Manage link next to Exceptions and Overrides. Locate the request in the Configuration Policy Override Listing table. To select multiple requests for review, select each desired row. OR, to select all requests for review, select the top row. Click the Under review link in the Review Status column. In the Review Status dialog box, read the comments by the user who submitted the request and decide whether to approve or reject the request.

Selecting an override request to review

7. 8.

Enter comments in the Reviewers Comments text box. Doing so may be helpful for the submitter. If you want to select an expiration date for override, click the calendar icon and select a date.

Nexpose Users Guide

117

9.

Click Approve or Reject, depending on your decision.

Approving an override request

The result of the review appears in the Review Status column. Also, if the rule has never been previously overridden and the override request has been approved, its entry will switch to Yes in the Active Overrides column in the Configuration Policy Rules table of the page. The override will also be noted in the Override History table of the rule page.

Deleting an override or override request

You can delete old override exception requests. 1. 2.
TIP: You also can click the top row check box to select all requests and then delete them all in one step.

Click the Administration tab of the Security Console Web interface. On the Administration page, click the Manage link next to Exceptions and Overrides. In the Configuration Policy Override Listing table, select the check box next to the rule override that you want to delete. Click the Delete icon. The entry no longer appears in the Configuration Policy Override Listing table.

3. 4.

Nexpose Users Guide

118

Chapter 4 Act
After you discover what is running in your environment and assess your security threats, you can initiate actions to remediate these threats. Act provides guidance on making stakeholders in your organization aware of security priorities in your environment so that they can take action. Working with asset groups on page 120: Asset groups allow you to control what asset information different stakeholders in your organization see. By creating asset groups effectively, you can disseminate the exact information that different executives or security teams need. For this reason, asset groups can be especially helpful in creating reports.This section guides you in creating static and dynamic asset groups. Working with reports on page 139: With reports, you share critical security information with different stakeholders in your organization. This section guides you through creating and customizing reports and understanding the information they contain. Using tickets on page 182: This section shows you how to use the ticketing system to manage the remediation work flow and delegate remediation tasks.

Nexpose Users Guide

119

Working with asset groups

Asset groups provide different ways for members of your organization to grant access to, view, and report on, asset information. You can use the same grouping principles that you use for sites, create subsets of sites, or create groups that include assets from any number of different sites.

Using asset groups to your advantage

Asset groups also have a useful security function in that they limit what member users can see, and dictate what non-member users cannot see. The asset groups that you create will influence the types of roles and permissions you assign to users, and vice-versa. One use case illustrates how asset groups can spin off organically from sites. A bank purchases Nexpose with a fixed-number IP address license. The network topology includes one head office and 15 branches, all with similar cookie-cutter IP address schemes. The IP addresses in the first branch are all 10.1.1.x.; the addresses in the second branch are 10.1.2.x; and so on. For each branch, whatever integer equals .x is a certain type of asset. For example .5 is always a server. The security team scans each site and then chunks the information in various ways by creating reports for specific asset groups. It creates one set of asset groups based on locations so that branch managers can view vulnerability trends and high-level data. The team creates another set of asset groups based on that last integer in the IP address. The users in charge of remediating server vulnerabilities will only see .5 assets. If the x integer is subject to more granular divisions, the security team can create more finally specialized asset groups. For example .51 may correspond to file servers, and .52 may correspond to database servers. Another approach to creating asset groups is categorizing them according to membership. For example, you can have an Executive asset group for senior company officers who see high-level businesssensitive reports about all the assets within your enterprise. You can have more technical asset groups for different members of your security team, who are responsible for remediating vulnerabilities on specific types of assets, such as databases, workstations, or Web servers.

Comparing dynamic and static asset groups

One way to think of an asset group is as a snapshot of your environment. This snapshot provides important information about your assets and the security issues affecting them:

their network location the operating systems running on them the number of vulnerabilities discovered on them whether exploits exist for any of the vulnerabilities their risk scores

With Nexpose, you can create two different kinds of snapshots. The dynamic asset group is a snapshot that potentially changes with every scan; and the static asset group is an unchanging snapshot. Each type of asset group can be useful depending on your needs.

Nexpose Users Guide

120

Using dynamic asset groups

A dynamic asset group contains scanned assets that meet a specific set of search criteria. You define these criteria with asset search filters, such as IP address range or hosted operating systems. The list of assets in a dynamic group is subject to change with every scan. In this regard, a dynamic asset group differs from a static asset group. See Comparing dynamic and static sites on page 24. Assets that no longer meet the groups Asset Filter criteria after a scan will be removed from the list. Newly discovered assets that meet the criteria will be added to the list. Note that the list does not change immediately, but after the application completes a scan and integrates the new asset information in the database. An ever-evolving snapshot of your environment, a dynamic asset group allows you to track changes to your live asset inventory and security posture at a quick glance, and to create reports based on the most current data. For example, you can create a dynamic asset group of assets with a vulnerability that was included in a Patch Tuesday bulletin. Then, after applying the patch for the vulnerability, you can run a scan and view the dynamic asset group to determine if any assets still have this vulnerability. If the patch application was successful, the group theoretically should not include any assets. You can create dynamic asset groups using the filtered asset search. See Performing filtered asset searches on page 124. You grant user access to dynamic asset groups through the User Configuration panel. A user with access to a dynamic asset group will have access to newly discovered assets that meet group criteria regardless of whether or not those assets belong to a site to which the user does not have access. For example, you have created a dynamic asset group of Windows XP workstations. You grant two users, Joe and Beth, access to this dynamic asset group. You scan a site to which Beth has access and Joe does not. The scan discovers 50 new Windows XP workstations. Joe and Beth will both be able to see the 50 new Windows XP workstations in the dynamic asset group list and include them in reports, even though Joe does not have access to the site that contains these same assets. When managing user access to dynamic asset groups, you need to assess how these groups will affect site permissions. To ensure that a dynamic asset group does not include any assets from a given site, use the site filter. See Locating assets by sites on page 79.

Using static asset groups

A static asset group contains assets that meet a set of criteria that you define according to your organizations needs. Unlike with a dynamic asset group, the list of assets in a static group does not change unless you alter it manually. Static asset groups provide useful time-frozen views of your environment that you can use for reference or comparison. For example, you may find it useful to create a static asset group of Windows servers and create a report to capture all of their vulnerabilities. Then, after applying patches and running a scan for patch verification, you can create a baseline report to compare vulnerabilities on those same assets before and after the scan. You can create static asset groups using either of two options:

the Group Configuration panel; see Configuring a static asset group by manually selecting assets on page 122 the filtered asset search; see Performing filtered asset searches on page 124

Nexpose Users Guide

121

Configuring a static asset group by manually selecting assets

NOTE: Only Global Administrators can create asset groups.

Manually selecting assets is one of two ways to create a static asset group. This manual method is ideal for environments that have small numbers of assets. For an approach that is ideal for large numbers of assets, see Creating a dynamic or static asset group from asset searches on page 136. Start a static asset group configuration: 1. Go to the Assets :: Asset Groups page by one of the following routes: Click the Assets tab to go to the Assets page, and then click view next to Asset groups. OR Click the Administration tab to go to the Administration page, and then click manage next to Asset Groups.

Home tool bar Administration tab

2. 3.

Click New Static Asset Group to create a new static asset group. Click Edit to change any group listed with a static asset group icon. The Asset Group Configuration panel appears.

NOTE: You can only create an asset group after running an initial scan of assets that you wish to include in that group.

4.

Click New Static Asset Group.

Creating a new static asset group

OR Click Create next to Asset Groups on the Administration page. The console displays the General page of the Asset Group Configuration panel. 5. Type a group name and description in the appropriate fields.

Nexpose Users Guide

122

Adding assets to the static asset group: 1. 2. Go to the Assets page of the Asset Group Configuration panel. The console displays a page with search filters. Use any of these filters to find assets that meet certain criteria, then click Display matching assets to run the search. For example, you can select all of the assets within an IP address range that run on a particular operating system.

Selecting assets for a static asset group

OR 3.
NOTE: There may be a delay if the search returns a very large number of assets.

4. 5.

Click Display all assets, which is convenient if your database contains a small number of assets. Select the assets you wish to add to the asset group. To include all assets, select the check box in the header row. Click Save. The assets appear on the Assets page. When you use this asset selection feature to create a new asset group, you will not see any assets displayed. When you use this asset selection feature to edit an existing report, you will see the list of assets that you selected when you created, or most recently edited, the report.

6.

Click Save to save the new asset group information.

You can repeat the asset search to include multiple sets of search results in an asset group. You will need to save a set of results before proceeding to the next results. If you do not save a set of selected search results, the next search will clear that set.

Nexpose Users Guide

123

Performing filtered asset searches

When dealing with networks of large numbers of assets, you may find it necessary or helpful to concentrate on a specific subset. The filtered asset search feature allows you to search for assets based on criteria that can include IP address, site, operating system, software, services, vulnerabilities, and asset name. You can then save the results as a dynamic asset group for tracking and reporting purposes. See Using the search feature on page 21. Using search filters, you can find assets of immediate interest to you. This helps you to focus your remediation efforts and to manage the sheer quantity of assets running on a large network. To start a filtered asset search: 1. Click the Asset Filter icon Web interface. OR 2. Click the Administration tab to go to the Administration page, and then click the dynamic link next to Asset Groups. OR Click New Dynamic Asset Group if you are on the Asset Groups page. , which appears next to the Search box in the

The Filtered asset search page appears.

NOTE: Performing a filtered asset search is the first step in creating a dynamic asset group

3.

Configuring asset search filters

A search filter allows you to choose the attributes of the assets that you are interested in. You can add multiple filters for more precise searches. For example, you could create filters for a given IP address range, a particular operating system, and a particular site, and then combine these filters to return a list of all the assets that simultaneously meet all the specified criteria. Using fewer filters typically increases the number of search results. You can combine filters so that the search result set contains only the assets that meet all of the criteria in all of the filters (leading to a smaller result set). Or you can combine filters so that the search result set contains any asset that meets all of the criteria in any given filter (leading to a larger result set). See Combining filters on page 135.

Nexpose Users Guide

124

The following asset search filters are available:

Asset name (page 126) Host type (page 126) IP address range (page 127) IP address type (page 126) Last scan date (page 127) Other IP address (page 128) Operating system name (page 129) PCI compliance status (page 129) Presence of validated vulnerabilities (page 130) Service name (page 129) Site name (page 129) Software name (page 130) vAsset cluster (page 130) vAsset datacenter (page 131) vAsset host (page 131) vAsset power state (page 131) vAsset resource pool path (page 132) Vulnerability CVSS risk vectors (page 132) Vulnerability CVSS score (page 133) Vulnerability exposure (page 134) Vulnerability risk score (page 134) Vulnerability title (page 135)

To select filters in the Filtered asset search panel take the following steps: 1. Use the first drop-down list. When you select a filter, the configuration options, operators, for that filter dynamically become available. 2. 3. 4. 5. Select the appropriate operator. Use the + button to add filters. Use the - button to remove filters. Click Reset to remove all filters.

Asset search filters

Nexpose Users Guide

125

Filtering by asset name

The asset name filter lets you search for assets based on the asset name. The filter applies a search string to the asset names, so that the search returns assets that meet the specified criteria. It works with the following operators:

is returns all assets whose names match the search string exactly. is not returns all assets whose names do not match the search string. starts with returns all assets whose names begin with the same characters as the search string. ends with returns all assets whose names end with the same characters as the search string. contains returns all assets whose names contain the search string anywhere in the name. does not contain returns all assets whose names do not contain the search string.

After you select an operator, you type a search string for the asset name in the blank field.

Filtering by host type

The Host type filter lets you search for assets based on the type of host system, where assets can be any one or more of the following types:

Bare metal is physical hardware. Hypervisor is a host of one or more virtual machines. Virtual machine is an all-software guest of another computer. Unknown is a host of an indeterminate type.

You can use this filter to track, and report on, security issues that are specific to host types. For example, a hypervisor may be considered especially sensitive because if it is compromised then any guest of that hypervisor is also at risk. The filter applies a search string to host types, so that the search returns a list of assets that either match, or do not match, the selected host types. It works with the following operators: is returns all assets that match the host type that you select from the adjacent drop-down list. is not returns all assets that do not match the host type that you select from the adjacent drop-down list. You can combine multiple host types in your criteria to search for assets that meet multiple criteria. For example, you can create a filter for is Hypervisor and another for is virtual machine to find allsoftware hypervisors.

Filtering by IP address type

If your environment includes IPv4 and IPv6 addresses, you can find assets with either address format. This allows you to track and report on specific security issues in these different segments of your network. The IP address type filter works with the following operators:

is returns all assets that have the specified address format. is not returns all assets that do not have the specified address formats.

After selecting the filter and desired operator, select the desired format: IPv4 or IPv6.

Nexpose Users Guide

126

Filtering by IP address range

The IP address range filter lets you specify a range of IP addresses, so that the search returns a list of assets that are either in the IP range, or not in the IP range. It works with the following operators:

is returns all assets with an IP address that falls within the IP address range. is not returns all assets whose IP addresses do not fall into the IP address range.

When you select the IP address range filter, you will see two blank fields separated by the word to. You use the left field to enter the start of the IP address range, and use the right to enter the end of the range. The format for IPv4 addresses is a dotted quad. Example:
192.168.2.1 to 192.168.2.254

Filtering by last scan date

The last scan date filter lets you search for assets based on when they were last scanned. You may want, for example, to run a report on the most recently scanned assets. Or, you may want to find assets that have not been scanned in a long time and then delete them from the database because they are no longer be considered important for tracking purposes. The filter works with the following operators:

on or before returns all assets that were last scanned on or before a particular date. After selecting this operator, click the calendar icon to select the date. on or after returns all assets that were last scanned on or after a particular date. After selecting this operator, click the calendar icon to select the date. between and including returns all assets that were last scanned between, and including, two dates. After selecting this operator, click the calendar icon next to the left field to select the first date in the range. Then click the calendar icon next to the right field to select the last date in the range. earlier than returns all assets that were last scanned earlier than a specified number of days preceding the date on which you initiate the search. After selecting this operator, enter a number in the days ago field. The starting point of the search is midnight of the day that the search is performed. For example, you initiate a search at 3 p.m. on January 23. You select this operator and enter 3 in the days ago field. The search returns all assets that were last scanned prior to midnight on January 20. within the last returns all assets that were last scanned within a specified number of preceding days. After selecting this operator, enter a number in the days field. The starting point of the search is midnight of the day that the search is performed. For example: You initiate the search at 3 p.m. on January 23. You select this operator and enter 1 in the days field. The search returns all assets that were last scanned since midnight on January 22.

Nexpose Users Guide

127

Keep several things in mind when using this filter:

The search only returns last scan dates. If an asset was scanned within the time frame specified in the filter, and if that scan was not the most recent scan, it will not appear in the search results. Dynamic asset group membership can change as new scans are run. Dynamic asset group membership is recalculated daily at midnight. If you create a dynamic asset group based on searches with the relative-day operators (earlier than or within the last), the asset membership will change accordingly.

Filtering by operating system name

The operating system name filter lets you search for assets based on their hosted operating systems. Depending on the search, you choose from a list of operating systems, or enter a search string. The filter returns a list of assets that meet the specified criteria. It works with the following operators:

contains returns all assets running on the operating system whose name contains the characters specified in the search string. You enter the search string in the adjacent field. You can use an asterisk (*) as a wildcard character. does not contain returns all assets running on the operating system whose name does not contain the characters specified in the search string. You enter the search string in the adjacent field. You can use an asterisk (*) as a wildcard character. is empty returns all assets that do not have an operating system identified in their scan results. If an operating system is not listed for a scanned asset in the Web interface or reports, this means that the asset may not have been fingerprinted. If the asset was scanned with credentials, failure to fingerprint indicates that the credentials were not authenticated on the target asset. Therefore, this operator is useful for finding assets that were scanned with failed credentials or without credentials. is not empty returns all assets that have an operating system identified in their scan results. This operator is useful for finding assets that were scanned with authenticated credentials and fingerprinted.

Filtering by other IP address type

This filter allows you to find assets that have other IPv4 or IPv6 addresses in addition to the address(es) that you are aware of. When the application scans an IP address that has been included in a site configuration, it discovers any other addresses for that asset. This may include addresses that have not been scanned. For example: A given asset may have an IPv4 address and an IPv6 address. When configuring scan targets for your site, you may have only been aware of the IPv4 address, so you included only that address to be scanned in the site configuration. When you run the scan, the application discovers the IPv6 address. By using this asset search filter, you can search for all assets to which this scenario applies. You can add the discovered address to a site for a future scan to increase your security coverage. After you select the filter and operators, you select either IPv4 or IPv6 from the drop-down list. The filter works with one operator:

is returns all assets that have other IP addresses that are either IPv4 or IPv6.

Nexpose Users Guide

128

Filtering by PCI compliance status

The PCI status filter lets you search for assets based on whether they return Pass or Fail results when scanned with the PCI audit template. Finding assets that fail compliance scans can help you determine at a glance which require remediation in advance of an official PCI audit. It works with two operators:

is returns all assets that have a Pass or Fail status. is not returns all assets that do not have a Pass or Fail status.

After you select an operator, select the Pass or Fail option from the drop-down list.

Filtering by service name

The service name filter lets you search for assets based on the services running on them. The filter applies a search string to service names, so that the search returns a list of assets that either have or do not have the specified service. It works with the following operators:

contains returns all assets running a service whose name contains the search string. You can use an asterisk (*) as a wildcard character. does not contain returns all assets that do not run a service whose name contains the search string. You can use an asterisk (*) as a wildcard character.

After you select an operator, you type a search string for the service name in the blank field.

Filtering by site name

The site name filter lets you search for assets based on the name of the site to which the assets belong. This is an important filter to use if you want to control users access to newly discovered assets in sites to which users do not have access. See the note in Using dynamic asset groups on page 121. The filter applies a search string to site names, so that the search returns a list of assets that either belong to, or do not belong to, the specified sites. It works with the following operators:

is returns all assets that belong to the selected sites. You select one or more sites from the adjacent list. is not returns all assets that do not belong to the selected sites. You select one or more sites from the adjacent list.

Nexpose Users Guide

129

Filtering by software name

The software name filter lets you search for assets based on software installed on them. The filter applies a search string to software names, so that the search returns a list of assets that either runs or does not run the specified software. It works with the following operators:

contains returns all assets with software installed so that the search returns the softwares name contains the search string. You can use an asterisk (*) as a wildcard character. does not contain returns all assets that do not have software installed so that the search returns the softwares name contains the search string. You can use an asterisk (*) as a wildcard character.

After you select an operator, you enter the search string for the software name in the blank field.

Filtering by presence of validated vulnerabilities

The Validated vulnerabilities filter lets you search for assets with vulnerabilities that have been validated with exploits through Rapid7 Metasploit integration. By using this filter, you can isolate assets with vulnerabilities that have been proven to exist with a high degree of certainty. For more information, see Working with validated vulnerabilities on page 92. The filter works with one operator:

The are operator, combined with the present drop-down list option, returns all assets with validated vulnerabilities. The are operator, combined with the not present drop-down list option, returns all assets without validated vulnerabilities.

Using vAsset filters

The following vAsset filters let you search for virtual assets that you track with vAsset discovery. Creating dynamic asset groups for virtual assets based on specific criteria can be useful for analyzing different segments of your virtual environment. For example, you may want to run reports or assess risk for virtual assets used by your accounting department, and they are supported by a one resource pool. For information about vAsset discovery, see Configuring and performing vAsset discovery on page 55.

Filtering by vAsset cluster

The vAsset cluster filter lets you search for virtual assets that belong, or dont belong, to specific clusters. This filter works with the following operators:

is returns all assets that belong to clusters whose names match an entered string exactly. is not returns all assets that belong to clusters whose names do not match an entered string. contains returns all assets that belong to clusters whose names contain an entered string. does not contain returns all assets that belong to clusters whose names do not contain an entered string. starts with returns all assets that belong to clusters whose names begin with the same characters as an entered string.

After you select an operator, you enter the search string for the cluster in the blank field.

Nexpose Users Guide

130

Filtering by vAsset datacenter

The vAsset datacenter filter lets you search for assets that are managed, or are not managed, by specific datacenters. This filter works with the following operators:

is returns all assets that are managed by datacenters whose names match an entered string exactly. is not returns all assets that are managed by datacenters whose names do not match an entered string.

After you select an operator, you enter the search string for the datacenter name in the blank field.

Filtering by vAsset host

The vAsset host filter lets you search for assets that are guests, or are not guests, of specific host systems. This filter works with the following operators:

is returns all assets that are guests of hosts whose names match an entered string exactly. is not returns all assets that are guests of hosts whose names do not match an entered string. contains returns all assets that are guests of hosts whose names contain an entered string. does not contain returns all assets that are guests of hosts whose names do not contain an entered string. starts with returns all assets that are guests of hosts whose names begin with the same characters as an entered string.

After you select an operator, you enter the search string for the host name in the blank field.

Filtering by vAsset power state

The vAsset power state filter lets you search for assets that are in, or are not in, a specific power state. This filter works with the following operators:

is returns all assets that are in a power state selected from a drop-down list. is not returns all assets that not are in a power state selected from a drop-down list.

After you select an operator, you select a power state from the drop-down list. Power states include on, off, or suspended.

Nexpose Users Guide

131

Filtering by vAsset resource pool path

The vAsset resource pool path filter lets you discover assets that belong, or do not belong, to specific resource pool paths. This filter works with the following operators:

contains returns all assets that are supported by resource pool paths whose names contain an entered string. does not contain returns all assets that are supported by resource pool paths whose names do not contain an entered string.

You can specify any level of a path, or you can specify multiple levels, each separated by a hyphen and right arrow: ->. This is helpful if you have resource pool path levels with identical names. For example, you may have two resource pool paths with the following levels: Human Resources Management Workstations Advertising Management Workstations The virtual machines that belong to the Management and Workstations levels are different in each path. If you only specify Management in your filter, the search will return all virtual machines that belong to the Management and Workstations levels in both resource pool paths. However, if you specify Advertising -> Management -> Workstations, the search will only return virtual assets that belong to the Workstations pool in the path with Advertising as the highest level. After you select an operator, you enter the search string for the resource pool path in the blank field.

Filtering by CVSS risk vectors

The filters for the following Common Vulnerability Scoring System (CVSS) risk vectors let you search for assets based on vulnerabilities that pose different types or levels of risk to your organizations security:

CVSS Access Complexity (AC) CVSS Access Vector (AV) CVSS Authentication Required (Au) CVSS Availability Impact (A) CVSS Confidentiality Impact (C) CVSS Integrity Impact (I)

These filters refer to the industry-standard vectors used in calculating CVSS scores and PCI severity levels. They are also used in risk strategy calculations for risk scores. For detailed information about CVSS vectors, go to the National Vulnerability Database Web site at nvd.nist.gov/cvss.cfm.

Nexpose Users Guide

132

Using these filters, you can find assets based on different exploitability attributes of the vulnerabilities found on them, or based on the different types and degrees of impact to the asset in the event of compromise through the vulnerabilities found on them. Isolating these assets can help you to make more informed decisions on remediation priorities or to prepare for a PCI audit. All six filters work with two operators:

is returns all assets that match a specific risk level or attribute associated with the CVSS vector. is not returns all assets that do not match a specific risk level or attribute associated with the CVSS vector.

After you select a filter and an operator, select the desired impact level or likelihood attribute from the drop-down list:

For each of the three impact vectors (Confidentiality, Integrity, and Availability), the options are Complete, Partial, or None. For CVSS Access Vector, the options are Local (L), Adjacent (A), or Network (N). For CVSS Access Complexity, the options are Low, Medium, or High. For CVSS Authentication Required, the options are None, Single, or Multiple.

Filtering by vulnerability CVSS score

The vulnerability CVSS score filter lets you search for assets with vulnerabilities that have a specific CVSS score or fall within a range of scores. You may find it helpful to create asset groups according to CVSS score ranges that correspond to PCI severity levels: low (0.0-3.9), medium (4.0-6.9), and high (7.0-10). Doing so can help you prioritize assets for remediation. The filter works with the following operators:

is returns all assets with vulnerabilities that have a specified CVSS score. is not returns all assets with vulnerabilities that do not have a specified CVSS score. is in the range of returns all assets with vulnerabilities that fall within the range of two specified CVSS scores and include the high and low scores in the range. is higher than returns all assets with vulnerabilities that have a CVSS score higher than a specified score. is lower than returns all assets with vulnerabilities that have a CVSS score lower than a specified score.

After you select an operator, type a score in the blank field. If you select the range operator, you would type a low score and a high score to create the range. Acceptable values include any numeral from 0.0 to 10. You can only enter one digit to the right of the decimal. If you enter more than one digit, the score is automatically rounded up. For example, if you enter a score of 2.25, the score is automatically rounded up to 2.3.

Nexpose Users Guide

133

Filtering by vulnerability exposures

The vulnerability exposures filter lets you search for assets based on the following types of exposures known to be associated with vulnerabilities discovered on those assets:

Malware kit exploits Metasploit exploits Exploit Database exploits

This is a useful filter for isolating and prioritizing assets that have a higher likelihood of compromise due to these exposures. The filter applies a search string to one or more of the vulnerability exposure types, so that the search returns a list of assets that either have or do not have vulnerabilities associated with the specified exposure types. It works with the following operators:

includes returns all assets that have vulnerabilities associated with specified exposure types. does not include returns all assets that do not have vulnerabilities associated with specified exposure types.

After you select an operator, select one or more exposure types in the drop-down list. To select multiple types, hold down the <Ctrl> key and click all desired types.

Filtering by vulnerability risk scores

The vulnerability risk score filter lets you search for assets with vulnerabilities that have a specific risk score or fall within a range of scores. Isolating and tracking assets with higher risk scores, for example, can help you prioritize remediation for those assets. The filter works with the following operators:

is in the range of returns all assets with vulnerabilities that fall within the range of two specified risk scores and include the high and low scores in the range. is higher than returns all assets with vulnerabilities that have a risk score higher than a specified score. is lower than returns all assets with vulnerabilities that have a risk score lower than a specified score.

After you select an operator, enter a score in the blank field. If you select the range operator, you would type a low score and a high score to create the range. Keep in mind your currently selected risk strategy when searching for assets based on risk scores. For example, if the currently selected strategy is Real Risk, you will not find assets with scores higher than 1,000. Refer to the risk scores in your vulnerability and asset tables for guidance.

Nexpose Users Guide

134

Filtering by vulnerability title

The vulnerability title filter lets you search for assets based on the vulnerabilities that have been flagged on them during scans. This is a useful filter to use for verifying patch applications, or finding out at a quick glance how many, and which, assets have a particular high-risk vulnerability. The filter applies a search string to vulnerability titles, so that the search returns a list of assets that either have or do not have the specified service. It works with the following operators:

contains returns all assets with a vulnerability whose name contains the search string. You can use an asterisk (*) as a wildcard character. does not contain returns all assets that do not have a vulnerability whose name contains the search string. You can use an asterisk (*) as a wildcard character.

After you select an operator, you type a search string for the vulnerability name in the blank field.

Combining filters
If you create multiple filters, you can have Nexpose return a list of assets that match all the criteria specified in the filters, or a list of assets that match any of the criteria specified in the filters. You can make this selection in a drop-down list at the bottom of the Search Criteria panel. The difference between All and Any is that the All setting will only return assets that match the search criteria in all of the filters, whereas the Any setting will return assets that match any given filter. For this reason, a search with All selected typically returns fewer results than Any. For example, suppose you are scanning a site with 10 assets. Five of the assets run Linux, and their names are linux01, linux02, linux03, linux04, and linux05. The other five run Windows, and their names are win01, win02, win03, win04, and win05. Suppose you create two filters. The first filter is an operating system filter, and it returns a list of assets that run Windows. The second filter is an asset filter, and it returns a list of assets that have linux in their names. If you perform a filtered asset search with the two filters using the All setting, the search will return a list of assets that run Windows and have linux in their asset names. Since no such assets exist, there will be no search results. However, if you use the same filters with the Any setting, the search will return a list of assets that run Windows or have linux in their names. Five of the assets run Windows, and the other five assets have linux in their names. Therefore, the result set will contain all of the assets.

Nexpose Users Guide

135

Creating a dynamic or static asset group from asset searches

NOTE: If you have permission to create asset groups, you can save asset search results as an asset group.

After you configure asset search filters as described in the preceding section, you can create an asset group based on the search results. Using the assets search is the only way to create a dynamic asset group. It is one of two ways to create a static asset group and is more ideal for environments with large numbers of assets. For a different approach, which involves manually selecting assets, see Configuring a static asset group by manually selecting assets on page 122. 1. After you configure asset search filters, click Search. A table of assets that meet the filter criteria appears.

Asset search results

NOTE: Only Global Administrators or users with the Manage Group Assets permission can create asset groups, so only these users can save Asset Filter search results.

2. 3.

(Optional) Click the Export to CSV link at the bottom of the table to export the results to a comma-separated values (CSV) file that you can view and manipulate in a spreadsheet program. Click Create Asset Group. Controls for creating an asset group appear. Select either the Dynamic or Static option, depending on what kind of asset group you want to create. See Comparing dynamic and static asset groups on page 120. If you create a dynamic asset group, the asset list is subject to change with every scan. See Using dynamic asset groups on page 121.

Nexpose Users Guide

136

4.

Enter a unique asset group name and description. You must give users access to an asset group for them to be able view assets or perform asset-related operations, such as reporting, with assets in that group.

Creating a new dynamic asset group

NOTE: You must be a Global Administrator or have Manage Asset Group Access permission to add users to an asset group.

5. 6. 7. 8.

Click Add Users. The Add Users dialog box appears. Select the check box for every user account that you want to add to the access list or select the check box in the top row to add all users. Click OK. Click Save in the bottom-right corner of the Asset Group configuration area. The new group will include the assets listed in the search results table. All asset groups appear in the Asset Group Listing table on the Assets :: Asset Groups page.

Nexpose Users Guide

137

Changing asset membership in a dynamic asset group

You can change search criteria for membership in a dynamic asset group at any time. To change criteria for a dynamic asset group: 1. Go to the Assets :: Asset Groups page by one of the following routes: Click the Administration tab to go to the Administration page, and then click the manage link next to Asset Groups. OR Click the Assets tab to go to the Assets page, and then click view next to Asset Groups.

Home tool bar Assets tab

2.

Click Edit to find a dynamic asset group that you want to modify. OR Click the link for the name of the desired asset group.

Starting to edit a dynamic asset group

The console displays the page for that group. 3. Click Edit Asset Group or click View Asset Filter to review a summary of filter criteria. Any of these approaches causes the application to display the Filtered asset search panel with the filters set for the most recent asset search. 4. 5. Change the filters according to your preferences, and run a search. See Configuring asset search filters on page 124. Click Save.

Nexpose Users Guide

138

Working with reports

You may want any number of people in your organization to view asset and vulnerability data without actually logging on to the Security Console. For example, a chief information security officer (CISO) may need to see statistics about your overall risk trends over time. Or members of your security team may need to see the most critical vulnerabilities for sensitive assets so that they can prioritize remediation projects. It may be unnecessary or undesirable for these stakeholders to access the application itself. By generating reports, you can distribute critical information to the people who need it via email or integration of exported formats such as XML, CSV, or database formats. Reports provide many, varied ways to look at scan data, from business-centric perspectives to detailed technical assessments. You can learn everything you need to know about vulnerabilities and how to remediate them, or you can just list the services are running on your network assets. You can create a report on a site, but reports are not tied to sites. You can parse assets in a report any number of ways, including all of your scanned enterprise assets, or just one.
NOTE: For information about other tools related to compliance with Policy Manager policies, see What are you compliance requirements in the administrators guide., which you can download from the Support page in Help.

If you are verifying compliance with PCI, you will use the following report templates in the audit process:

Attestation of Compliance PCI Executive Summary Vulnerability Details

If you are verifying compliance with United States Government Configuration Baseline (USGCB) or Federal Desktop Core Configuration (FDCC) policies, you can use the following report formats to capture results data:

NOTE: You also can click the top row check box to select all requests and then approve or reject them in one step.

XCCDF Human Readable CSV Report XCCDF Results XML Report

You can also generate an XML export reports that can be consumed by the CyberScope application to fulfill the U.S. Governments Federal Information Security Management Act (FISMA) reporting requirements. Reports are primarily how your asset group members view asset data. Therefore, its a best practice to organize reports according to the needs of asset group members. If you have an asset group for Windows 2008 servers, create a report that only lists those assets, and include a section on policy compliance. Creating reports is very similar to creating scan jobs. Its a simple process involving a configuration panel. You select or customize a report template, select an output format, and choose assets for inclusion. You also have to decide what information to include about these assets, when to run the reports, and how to distribute them. All panels have the same navigation scheme. You can either use the navigation buttons in the upperright corner of each panel page to progress through each page of the panel, or you can click a page link listed on the left column of each panel page to go directly to that page.

NOTE: Parameters labeled in red denote required parameters on all panel pages.

To save configuration changes, click Save that appears on every page. To discard changes, click Cancel.

Nexpose Users Guide

139

Viewing, editing, and running reports

You may need to view, edit, or run existing report configurations for various reasons:

On occasion, you may need to run an automatically recurring report immediately. For example, you have configured a recurring report on Microsoft Windows vulnerabilities. Microsoft releases an unscheduled security bulletin about an Internet Explorer vulnerability. You apply the patch for that flaw and run a verification scan. You will want to run the report to demonstrate that the vulnerability has been resolved by the patch. You may need to change a report configuration. For example, you may need add assets to your report scope as new workstations come online.

The application lists all report configurations in a table, where you can view run or edit them, or view the histories of when they were run in the past.
NOTE: On the View Reports panel, you can start a new report configuration by clicking the New button.

To view existing report configurations, take the following steps. 1. Click the Reports tab.

Home toolbar Reports tab

The Security Console displays the Reports page. 2. Click the View reports panel to see all the reports of which you have ownership. A Global Administrator can see all reports. A table list reports by name and most recent report generation date. You can sort reports by either criteria by clicking the column heading. Report names are unique in the application.

The View Reports panel

Nexpose Users Guide

140

To edit or run a listed report, hover over the row for that report, and click the tool icon that appears.

Accessing report tools

To run a report, click Run. Every time the application writes a new instance of a report, it changes the date in the Most Recent Report column. You can click the link for that date to view the most recent instance of the report.

You also change a report configuration. Copying a template allows you to create a modified version that incorporates some the original templates attributes. It is a quick way to create a new report configuration that will have properties similar to those of another. For example, you may have a report that only includes Windows vulnerabilities for a given set of assets. You may still want to create another report for those assets, focusing only on Adobe vulnerabilities. Copying the report configuration would make the most sense if no other attributes are to be changed. Whether you click Edit or Copy, the Security Console displays the Configure a Report panel for that configuration. See Creating a basic report on page 142.

To view all instances of a report that have been run, click History in the tools drop-down menu for that report. You can also see the history for a report that has previously run at least once by clicking the report name, which is a hyperlink. If a report name is not a hyperlink, it is because an instance of the report has not yet run successfully. By reviewing the history, you can see any instances of the report that failed. Clicking Delete will remove the report configuration and all generated instances from the application database.

Nexpose Users Guide

141

Creating a basic report

Creating a basic report involves the following steps:

Selecting a report template and format (see Starting a new report configuration) Selecting assets to report on on page 146 Filtering report scope with vulnerabilities on page 148 (optional) Configuring report frequency on page 152 (optional)

There are additional configuration steps for the following types of reports: CyberScope XML Export (see Entering CyberScope information on page 145 XCCDF reports see Configuring an XCCDF report on page 146 Database Export see Distributing, sharing, and exporting reports on page 1 Baseline reports see Selecting a scan as a baseline on page 155 Risk trend reports see Working with risk trends in reports on page 12

After you complete a basic report configuration, you will have the option to configure additional properties, such as those for distributing the report. If you configure the report to run in the future, you will be able to save it when you have completed the configuration. If you want to run the report immediately on a one-time basis, the Security Console will automatically save the report configuration for future use. See Viewing, editing, and running reports on page 140.

Starting a new report configuration

1. Click the Reports tab. The Security Console displays the Create a report panel.

The Create a report panel

Nexpose Users Guide

142

2. 3. 4.

Enter a name for the new report. The name must be unique in the application. Select a time zone for the report. This setting defaults to the local Security Console time zone, but allows for the time localization of generated reports. (Optional) Enter a search term, or a few letters of the template you are looking for, in the Search templates field to see all available templates that contain that keyword or phrase. For example, enter pci and the display will change to display only PCI templates. Search results are dependent on the template type, either Document or Export templates. If you are unsure which template type you require, make sure you select All to search all available templates.

Search report templates

NOTE: Resetting the Search templates field by clicking the close X displays all templates in alphabetical order.

5.

Select a template type:

Document templates are designed for section-based, human-readable reports that contain asset and vulnerability information. Some of the formats available for this template typeText, PDF, RTF, and HTMLare convenient for sharing information to be read by stakeholders in your organization, such as executives or security team members tasked with performing remediation. Export templates are designed for integrating scan information into external systems. The formats available for this type include various XML formats, Database Export, and CSV. For more information, see Working with report formats on page 173.

6.

Click Close on the Search templates field to reset the search or enter a new term. The Security Console displays template thumbnail images that you can browse, depending on the template type you selected. If you selected the All option, you will be able to browse all available templates. Click the scroll arrows on the left and the right to browse the templates. You can roll over the name of any template to view a description.

Nexpose Users Guide

143

Selecting a report template

You also can click the Preview icon in the lower right corner of any thumbnail (highlighted in the preceding screen shot) to enlarge and click through a preview of template. This can be helpful to see what kind of sections or information the template provides. When you see the see the desired template, click the thumbnail. It becomes highlighted and displays a Selected label in the top, right corner. 7. Select a format for the report. Formats not only affect how reports appear and are consumed, but they also can have some influence on what information appears in reports. For more information, see Working with report formats on page 173. If you are using the PCI Attestation of Compliance or PCI Executive Summary template, or a custom template made with sections from either of these templates, you can only use the RTF format. These two templates require ASVs to fill in certain sections manually.

TIP: For descriptions of all available report template see Report templates and sections on page 272 to help you select the best template for your needs.

Nexpose Users Guide

144

8.

If you are using the CyberScope XML Export format, enter the names for the component, bureau, and enclave in the appropriate fields. For more information see Entering CyberScope information on page 145. Otherwise, continue with specifying the scope of your report.

Configuring a CyberScope XML Export report

Entering CyberScope information

When configuring a CyberScope XML Export report, you must enter additional information, as indicated in the CyberScope Automated Data Feeds Submission Manual published by the U.S. Office of Management and Budget. The information identifies the entity submitting the data:

Component refers to a reporting component such as Department of Justice, Department of Transportation, or National Institute of Standards and Technology. Bureau refers to a component-bureau, an individual Federal Information Security Management Act (FISMA) reporting entity under the component. For example, a bureau under Department of Justice might be Justice Management Division or Federal Bureau of Investigation. Enclave refers to an enclave under the component or bureau. For example, an enclave under Department of Justice might be United States Mint. Agency administrators and agency points of contact are responsible for creating enclaves within CyberScope.

Consult the CyberScope Automated Data Feeds Submission Manual for more information. You must enter information in all three fields.

Nexpose Users Guide

145

Configuring an XCCDF report

If you are creating one of the XCCDF reports, and you have selected one of the XCCDF formatted templates on the Create a report panel take the following steps:
NOTE: You cannot filter vulnerabilities by category if you are creating an XCCDF or CyberScope XML report.

1.

Select an XCCDF report template on the Create a report panel.

Select an XCCDF formatted report template

2.

Select the policy results to include from the drop-down list. The Policies option only appears when you select one of the XCCDF formats in the Template section of the Create a report panel.

3. 4.

Enter a name in the Organization field. Proceed with asset selection. Asset selection is only available with the XCCDF Human Readable CSV Export.

Selecting assets to report on

1. 2. Click Select sites, assets, or asset groups in the Scope section of the Create a report panel. To use only the most recent scan data in your report, select Use the last scan data only check box. Otherwise, the report will include all historical scan data in the report.

Nexpose Users Guide

146

Select Report Scope panel

TIP: The asset selection options are not mutually exclusive. You can combine selections of sites, asset groups, and individual assets.

3. 4.

Select Sites, Asset Groups, or Assets from drop-down list. If you selected Sites or Asset Groups, click the check box for any displayed site or asset group to select it. You also can click the check box in the top row to select all options. If you selected Assets, the Security Console displays search filters. Select a filter, an operator, and then a value. For example, if you want to report on assets running Windows operating systems, select the operating system filter and the contains operator. Then enter Windows in the text field. To add more filters to the search, click the + icon and configure your new filter. Select an option to match any or all of the specified filters. Matching any filters typically returns a larger set of results. Matching all filters typically returns a smaller set of results because multiple criteria make the search more specific. Click the check box for any displayed asset to select it. You also can click the check box in the top row to select all options.

Selecting assets to report on

5.

Click OK to save your settings and return the Create a report panel. The selections are referenced in the Scope section.

The Scope section

Nexpose Users Guide

147

Filtering report scope with vulnerabilities

Filtering vulnerabilities means including or excluding specific vulnerabilities in a report. Doing so makes the report scope more focused, allowing stakeholders in your organization to see securityrelated information that is most important to them. For example, a chief security officer may only want to see critical vulnerabilities when assessing risk. Or you may want to filter out potential vulnerabilities from a CSV export report that you deliver to your remediation team. You can also filter vulnerabilities based on category to improve your organizations remediation process. A security administrator can filter vulnerabilities to make a report specific to a team or to a risk that requires attention. The security administrator can create reports that contain information about a specific type of vulnerability or vulnerabilities in a specific list of categories. Reports can also be created to exclude a type of vulnerability or a list of categories. For example, if there is an Adobe Acrobat vulnerability in your environment that is addressed with a scheduled patching process, you can run a report that contains all vulnerabilities except those Adobe Acrobat vulnerabilities. This provides a report that is easier to read as unnecessary information has been filtered out.
NOTE: You can manage vulnerability filters through the API. See the API guide for more information.

Organizations that have distributed IT departments may need to disseminate vulnerability reports to multiple teams or departments. For the information in those reports to be the most effective, the information should be specific for the team receiving it. For example, a security administrator can produce remediation reports for the Oracle database team that only include vulnerabilities that affect the Oracle database. These streamlined reports will enable the team to more effectively prioritize their remediation efforts. A security administrator can filter by vulnerability category to create reports that indicate how widespread a vulnerability is in an environment, or which assets have vulnerabilities that are not being addressed during patching. The security administrator can also include a list of historical vulnerabilities on an asset after a scan template has been edited. These reports can be used to monitor compliance status and to ensure that remediation efforts are effective. The following report sections can include filtered vulnerability information:

Discovered Vulnerabilities Discovered Services Index of Vulnerabilities Remediation Plan Vulnerability Exceptions Vulnerability Report Card Across Network Vulnerability Report Card by Node Vulnerability Test Errors

Therefore, report templates that contain these sections can include filtered vulnerability information. See Fine-tuning information with custom report templates on page 168. Vulnerability filtering is not supported in the following report templates:

Cyberscope XML Export XCCDF XML XCCDF CSV Database Export

Nexpose Users Guide

148

To filter vulnerability information, take the following steps: 1. Click Filter by Vulnerabilities on the Scope section of the Create a report panel. Options appear for vulnerability filters.

Select Vulnerability Filters section

Certain templates allow you to include only validated vulnerabilities in reports: Basic Vulnerability Check Results (CSV), XML Export, XML Export 2.0, Top 10 Assets by Vulnerabilities, Top 10 Assets by Vulnerability Risk, Top Remediations, Top Remediations with Details, and Vulnerability Trends. To learn more, see Working with validated vulnerabilities on page 92.

Select Vulnerability Filters section with option to include only validated vulnerabilities

2.

To filter vulnerabilities by severity level, select the Critical vulnerabilities or Critical and severe vulnerabilities option. Otherwise, select All severities. These are not PCI severity levels or CVSS scores. They map to numeric severity rankings that are assigned by the application and displayed in the Vulnerability Listing table of the Vulnerabilities page. Scores range from 1 to 10: 1-3=Moderate; 4-7=Severe; and 8-10=Critical.

Nexpose Users Guide

149

3.

If you selected a CSV report template, you have the option to filter vulnerability result types. To include all vulnerability check results (positive and negative), select the Vulnerable and non-vulnerable option next to Results. If you want to include only positive check results, select the Vulnerable option. You can filter positive results based on how they were determined by selecting any of the check boxes for result types:

Vulnerabilities found: Vulnerabilities were flagged because asset-specific vulnerability tests produced positive results. Vulnerabilities with this result type appear with the ve (vulnerable exploited) result code in CSV reports. Vulnerable versions found: Vulnerabilities were flagged because versions of the scanned services or software are known to be vulnerable.

TIP: Categories that are named for manufacturers, such as Microsoft, can serve as supersets of categories that are named for their products. For example, if you filter by the Microsoft category, you inherently include all Microsoft product categories, such as Microsoft Path and Microsoft Windows. This applies to other "company" categories, such as Adobe, Apple, and Mozilla. To view the vulnerabilities in a category see Configuration steps for vulnerability check settings on page 204.

4.

Potential vulnerabilities found: Vulnerabilities were flagged because checks for potential vulnerabilities were positive. If you want to include or exclude specific vulnerability categories, select the appropriate option button in the Categories section. If you choose to include all categories, skip the following step. If you choose to include or exclude specific categories, the Security Console displays a text box containing the words Select categories. You can select categories with two different methods:

5.

Click the text box to display a window that lists all available categories. Scroll down the list and select the check box for each desired category. Each selection appears in a text field a the bottom of the window.

Selecting vulnerability categories by clicking check boxes

Click the text box to display a window that lists all available categories. Enter part or all a category name in the Filter: text box, and select the categories from the list that appears. If you enter a name that applies to multiple categories, all those categories appear. For example, you type Adobe or ado, several Adobe categories appear. As you select categories, they appear in the text field at the bottom of the window.

Nexpose Users Guide

150

Filter by category list

If you use either or both methods, all your selections appear in a field at the bottom of the selection window. When the list includes all desired categories, click outside of the window to return to the Scope page. The selected categories appear in the text box.

Selected vulnerability categories appear in the Scope section

NOTE: Existing reports will include all vulnerabilities unless you edit them to filter by vulnerability category.

6.

Click OK to save scope selections.

Nexpose Users Guide

151

Configuring report frequency

You can run the completed report immediately on a one-time basis, configure it to run after every scan, or schedule it to run on a repeating basis. The third option is useful if you have an asset group containing assets that are assigned to many different sites, each with a different scan template. Since these assets will be scanned frequently, it makes sense to run recurring reports automatically. To configure report frequency, take the following steps: 1. 2. 3. 4. Go to the Create a report panel. Click Configure advanced settings... Click Frequency. Select a frequency option from the drop-down list:

Select Run a one-time report now to generate a report immediately, on a one-time basis. Select Run a recurring report after each scan to generate a report every time a scan is completed on the assets defined in the report scope. Select Run a recurring report on a repeated schedule if you wish to schedule reports for regular time intervals.

If you selected either of the first two options, ignore the following steps. If you selected the scheduling option, the Security Console displays controls for configuring a schedule. 5. Enter a start date using the mm/dd/yyyy format. OR Click the calendar icon to select a start date. 6. 7. Enter an hour and minute for the start time, and click the Up or Down arrow to select AM or PM. Enter a value in the field labeled Repeat every, and select a time unit from the drop-down list.to set a time interval for repeating the report. If you select months on the specified date, the report will run every month on the selected calendar date. For example, if you schedule a report to run on October 15, the report will run on October 15 every month.

Nexpose Users Guide

152

If you select months on the specified day of the month, the report will run every month on the same ordinal weekday. For example, if you schedule the first report to run on October 15, which is the third Monday of the month, the report will run every third Monday of the month. To run a report only once on the scheduled date and time, enter 0 in the field labeled Repeat every.

Creating a report schedule

Best practices for scheduling reports

The frequency with which you schedule and distribute reports depends your business needs and security policies. You may want to run quarterly executive reports. You may want to run monthly vulnerability reports to anticipate the release of Microsoft hotfix patches. Compliance programs, such as PCI, impose their own schedules. The amount of time required to generate a report depends on the number of included live IP addresses the number of included vulnerabilitiesif vulnerabilities are being includedand the level of details in the report template. Generating a PDF report for 100-plus hosts with 2500-plus vulnerabilities takes fewer than 10 seconds. The application can generate reports simultaneously, with each report request spawning a new thread. Technically, there is no limit on the number supported concurrent reports. This means that you can schedule reports to run simultaneously as needed. Note that generating a large number of concurrent reports20 or morecan take significantly more time than usual.

Best practices for using remediation plan templates

The remediation plan templates provide information for assessing the highest impact remediation solutions. You can use the Remediation Display settings to specify the number of solutions you want to see in a report. The default is 25 solutions, but you can set the number from 1 to 1000 as you require. Keep in mind that if the number is too high you may have a report with an unwieldy level of data and too low you may miss some important solutions for your assets. You can also specify the criteria for sorting data in your report. Solutions can be sorted by Affected asset, Risk score, Remediated vulnerabilities, Remediated vulnerabilities with known exploits, and Remediated vulnerabilities with malware kits.

Remediation display settings

Nexpose Users Guide

153

Best practices for using the Vulnerability Trends report template

The Vulnerability Trends template provides information about how vulnerabilities in your environment have changed have changed over time. You can configure the time range for the report to see if you are improving your security posture and where you can make improvements. To ensure readability of the report and clarity of the charts there is a limit of 15 data points that can be included in the report. The time range you set controls the number of data points that appear in the report. For example, you can set your date range for a weekly interval for a two-month period, and you will have eight data points in your report.
NOTE: Ensure you schedule adequate time to run this report template because of the large amount of data that it aggregates. Each data point is the equivalent of a complete report. It may take a long time to complete.

To configure the time range of the report, use the following procedure: 1. 2. 3. Click Configure advanced settings... Select Vulnerability Trend Date Range. Select from pre-set ranges of Past 1 year, Past 6 months, Past 3 months, or Custom range. To set a custom range, enter a start date, end date, and specify the interval, either days, months, or years.

Vulnerability trend data range

4. 5.

Configure other settings that you require for the report. Click Run the report.

Saving or running the newly configured report

After you complete a basic report configuration, you will have the option to configure additional properties, such as those for distributing the report. You can access those properties by clicking Configure advanced settings... If you have configured the report to run in the future, either by selecting Run a recurring report after every scan or Run a recurring report in a schedule in the Frequency section (see Configuring report frequency on page 152), you can save the report configuration by clicking Save the report. Even if you configure the report to run automatically with one of the frequency settings, you can run the report manually any time you want if the need arises. See Viewing, editing, and running reports on page 140. If you configured the report to run immediately on a one-time basis, you will see a button for running the report. When you click it, the Security Console will automatically save the report configuration for future use. See Viewing, editing, and running reports on page 140.

Running a one-time report immediately

Nexpose Users Guide

154

Selecting a scan as a baseline

Designating an earlier scan as a baseline for comparison against future scans allows you to track changes in your network. Possible changes between scans include newly discovered assets, services and vulnerabilities; assets and services that are no longer available; and vulnerabilities that were mitigated or remediated. You must select the Baseline Comparison report template in order to be able to define a baseline. See Starting a new report configuration on page 142. 1. 2. 3. Go to the Create a report panel. Click Configure advanced settings... Click Baseline Scan selection.

Baseline scan selection

4. 5. 6.

Click Use first scan, Use previous scan, or Use scan from a specific date to specify which scan to use as the baseline scan. Click the calendar icon to select a date if you chose Use scan from a specific date. Click Save the report when you are finished configuring the report template.

Nexpose Users Guide

155

Distributing, sharing, and exporting reports

When configuring a report, you have a number of options related to how the information will be consumed and by whom. You can restrict report access to one user or a group of users. You can restrict sections of reports that contain sensitive information so that only specific users see these sections. You can control how reports are distributed to users, whether they are sent in e-mails or stored in certain directories. If you are exporting report information to external databases, you can certain properties related to the data export. See the following sections for more information:

Working with report owners on page 156 Managing the sharing of reports on page 157 Granting users the report-sharing permission on page 159 Restricting report sections on page 163 Exporting scan data to external databases on page 165 Configuring data warehousing settings on page 165

Working with report owners

After a report is generated, only a Global Administrator and the designated report owner can see that report on the Reports page. You also can have a copy of the report stored in the report owners directory. See Storing reports in report owner directories on page 156. If you are a Global Administrator, you can assign ownership of the report one of a list of users. If you are not a Global Administrator, you will automatically become the report owner.

Storing reports in report owner directories

When the application generates a report, it stores it in the reports directory on the Security Console host:
[installation_directory]/nsc/reports/[user_name]/

You can configure the application to also store a copy of the report in a user directory for the report owner.It is a subdirectory of the reports folder, and it is given the report owner's user name. 1. 2. Click Configure advanced settings... on the Create a report panel. Click Report File Storage.

Report File Storage

3.

Enter the report owners name in the directory field $(install_dir)/nsc/ reports/$(user). Replace (user) with the report owners name.

Nexpose Users Guide

156

You can use string literals, variables, or a combination of these to create a directory path. Available variables include:

$(date): the date that the report is created; format is yyyy-MM-dd $(time): the time that the report is created; format is HH-mm-ss $(user): the report owners user name $(report_name): the name of the report, which was created on the General

section of the Create a Report panel After you create the path and run the report, the application creates the report owners user directory and the subdirectory path that you specified on the Output page. Within this subdirectory will be another directory with a hexadecimal identifier containing the report copy. For example, if you specify the path windows_scans/$(date), you can access the newly created report at:
reports/[report_owner]/windows_scans/$(date)/[hex_number]/ [report_file_name]

Consider designing a path naming convention that will be useful for classifying and organizing reports. This will become especially useful if you store copies of many reports. Another option for sharing reports is to distribute them via e-mail. Click the Distribution link in the left navigation column to go the Distribution page. See Managing the sharing of reports on page 157.

Managing the sharing of reports

Every report has a designated owner. When a Global Administrator creates a report, he or she can select a report owner. When any other user creates a report, he or she automatically becomes the owner of the new report. In the console Web interface, a report and any generated instance of that report, is visible only to the report owner or a Global Administrator. However, it is possible to give a report owner the ability to share instances of a report with other individuals via e-mail or a distributed URL. This expands a report owners ability to provide important security-related updates to a targeted group of stakeholders. For example, a report owner may want members of an internal IT department to view vulnerability data about a specific set of servers in order to prioritize and then verify remediation tasks.
NOTE: The granting of this report-sharing permission potentially means that individuals will be able to view asset data to which they would otherwise not have access. NOTE: If a report owner creates an access list for a report and then copies that report, the copy will not retain the access list of the original report. The owner would need to create a new access list for the copied report.

Administering the sharing of reports involves two procedures for administrators:

configuring the application to redirect users who click the distributed report URL link to the appropriate portal granting users the report-sharing permission

Report owners who have been granted report-sharing permission can then create a report access list of recipients and configure report-sharing settings.

Nexpose Users Guide

157

Configuring URL redirection

By default, URLs of shared reports are directed to the Security Console. To redirect users who click the distributed report URL link to the appropriate portal, you have to add an element to the oem.xml configuration file. The element reportLinkURL includes an attribute called altURL, with which you can specify the redirect destination. To specify a redirected URL: 1. Open the oem.xml file, which is located in [product_installation-directory]/nsc/ conf. If the file does not exist, you can create the file. See the branding guide, which you can request from Technical Support. Add or edit the reports sub-element to include the reportLinkURL element with the altURL attribute set to the appropriate destination, as in the following example:
<reports> <reportEmail> <reportSender>[email protected]</reportSender> <reportSubject>Nexpose: ${report-name} </reportSubject> <reportMessage type="link">Your report (${report-name}) was generated on ${report-date}: ${report-url} </reportMessage> <reportMessage type="file">Your report (${report-name}) was generated on ${report-date}. See attached files. </reportMessage> <reportMessage type="zip">Your Nexpose (${report-name}) was generated on ${report-date}. See attached zip file. </reportMessage> </reportEmail> <reportLinkURL altURL="base_url.net/directory_path${variable}?loginRedir="/> </reports>

2.

3. 4.

Save and close the oem.xml file. Restart the application.

Nexpose Users Guide

158

Granting users the report-sharing permission

Global Administrators automatically have permission to share reports. They can also assign this permission to others users or roles. Assigning the permission to a new user involves the following steps. 1. 2. 3. 4. 5. 6. Go to the Administration page, and click the Create link next to Users. (Optional) Go to the Users page and click New user. Configure the new users account settings as desired. Click the Roles link in the User Configuration panel. Select the Custom role from the drop-down list on the Roles page. Select the permission Add Users to Report. Select any other permissions as desired. Click Save when you have finished configuring the account settings.

To assign the permission to an existing user use the following procedure: 1. Go to the Administration page, and click the manage link next to Users. (Optional) Go to the Users page and click the Edit icon for one of the listed accounts. 2. 3. 4.
NOTE: You also can grant this permission by making the user a Global Administrator.

Click the Roles link in the User Configuration panel. Select the Custom role from the drop-down list on the Roles page. Select the check box labeled Add Users to Report. Select any other permissions as desired. Click Save when you have finished configuring the account settings.

5.

Creating a report access list

If you are a Global Administrator, or if you have been granted permission to share reports, you can create an access list of users when configuring a report. These users will only be able to view the report. They will not be able to edit or copy it.

Nexpose Users Guide

159

Using the Web-based interface to create a report access list

To create a report access list with the Web-based interface, take the following steps: 1. 2. Click Configure advanced settings... on the Create a report panel. Click Access. If you are a Global Administrator or have Super-User permissions, you can select a report owner. Otherwise, you are automatically the report owner.

Report Access

3. 4. 5.
NOTE: Adding a user to a report access list potentially means that individuals will be able to view asset data to which they would otherwise not have access. NOTE: Before you distribute the URL, you must configure URL redirection.

Click Add User to select users for the report access list. A list of user accounts appears. Select the check box for each desired user, or select the check box in the top row to select all users. Click Done. The selected users appear in the report access list. Click Run the report when you have finished configuring the report, including the settings for sharing it.

6.

Using the Web-based interface to configure report-sharing settings

You can share a report with your access list either by sending it in an e-mail or by distributing a URL for viewing it. To share a report, use the following procedure: 1. 2. Click Configure advanced settings... on the Create a report panel. Click Distribution.

Report Distribution

Nexpose Users Guide

160

3.

Enter the senders e-mail address and SMTP relay server. For example, E-mail sender address: [email protected] and SMTP relay server: mail.server.com. You may require an SMTP relay server for one of several reasons. For example, a firewall may prevent the application from accessing your networks mail server. If you leave the SMTP relay server field blank, the application searches for a suitable mail server for sending reports. If no SMTP server is available, the Security Console does not send the e-mails and will report an error in the log files.

4. 5. 6. 7.

Select the check box to send the report to the report owner. Select the check box to send the report to users on a report access list. Select the method to send the report as: URL, File, or Zip Archive. (Optional) Select the check box to send the report to users that are not part of an access list.

Additional Report Recipients

8.

(Optional) Select the check box to send the report to all users with access to assets in the report. Adding a user to a report access list potentially means that individuals will be able to view asset data to which they would otherwise not have access.

9.
NOTE: You cannot distribute a URL to users who are not on the report access list.

Enter the recipients e-mail addresses in the Other recipients field.

10. Select the method to send the report as: File or Zip Archive. 11. Click Run the report when you have finished configuring the report, including the settings for sharing it.

Creating a report access list and configuring report-sharing settings with the API
NOTE: This topic identifies the API elements that are relevant to creating report access lists and configuring report sharing. For specific instructions on using API v1.1 and Extended API v1.2, see the API guide, which you can download from the Support page in Help.

The elements for creating an access list are part of the ReportSave API, which is part of the API v1.1:

With the Users sub-element of ReportConfig, you can specify the IDs of the users whom you want add to the report access list. Enter the addresses of e-mail recipients, one per line. With the Delivery sub-element of ReportConfig, you can use the sendToAclAs attribute to specify how to distribute reports to your selected users. Possible values include file, zip, or url.

Nexpose Users Guide

161

To create a report access list:

NOTE: To obtain a list of users and their IDs, use the MultiTenantUserListing API, which is part of the Extended API v1.2.

1.

Log on to the application. For general information on accessing the API and a sample LoginRequest, see the section API overview in the API guide, which you can download from the Support page in Help.

2.

Specify the user IDs you want to add to the report access list and the manner of report distribution using the ReportSave API, as in the following XML example:

<ReportSaveRequest generate-now="1" sync-id="String" session-id="48D86A19D786361DE4B862C69EE0768BCC69396B"> <ReportConfig name="r6" timezone="" owner="15" template-id="baseline-comparison" id="11" format="pdf"> <description> <a href="String"> <p>text</p> </a> </description> <Filters> <filter id="1" type="site"> </filter> </Filters> <Users> <user id="16"/> <user id="17"/> </Users> <Baseline compareTo=""/> <Delivery> <Storage storeOnServer="1"> </Storage>

3.

If you have no other tasks to perform, log off.

For a LogoutRequest example, see the API guide. For additional, detailed information about the ReportSave API, see the API guide.

Nexpose Users Guide

162

Restricting report sections

Every Nexpose report is based on a template, whether it is one of the preset templates that ship with the product or a customized template created by a user in your organization. A template consists of one or more sections. Each section contains a subset of information, allowing you to look at scan data in a specific way. Security policies in your organization may make it necessary to control which users can view certain report sections, or which users can create reports with certain sections. For example, if your company is an Approved Scanning Vendor (ASV), you may only want a designated group of users to be able to create reports with sections that capture Payment Card Industry (PCI)-related scan data. Restricting report sections involves two procedures:

NOTE: Only a Global Administrator can perform these procedures.

setting the restriction in the API granting users access to restricted sections

Setting the restriction for a report section in the API

The sub-element RestrictedReportSections is part of the SiloProfileCreate API for new silos and SiloProfileUpdate API for existing silos. It contains the sub-element RestrictedReportSection for which the value string is the name of the report section that you want to restrict. In the following example, the Baseline Comparison report section will become restricted. 1. Log on to the application. For general information on accessing the API and a sample LoginRequest, see the section API overview in the API v1.1 guide, which you can download from the Support page in Help. 2. Identify the report section you want to restrict. This XML example of SiloProfileUpdateRequest includes the RestrictedReportSections element.

<SiloProfileUpdateRequest session-id="E6B508C469F4EE1988985C49BE36D1CD0FACAEE6" sync-id="SILO-PROFILE-CREATE-0001-004"> <SiloProfileConfig all-global-report-templates="1" all-global-engines="1" all-global-scan-templates="1" all-licensed-modules="1" description="silo profile description" id="myprofile-10" name="My SiloProfile Name 10"> <RestrictedReportSections> <RestrictedReportSection name="BaselineComparison"/> </RestrictedReportSections> </SiloProfileConfig> </SiloProfileUpdateRequest>

3.

If you have no other tasks to perform, log off.

Nexpose Users Guide

163

NOTE: To verify restricted report sections, use the SiloProfileConfig API. See the API guide.

For a LogoutRequest example, see the API guide. The Baseline Comparison section is now restricted. This has the following implications for users who have permission to generate reports with restricted sections:

They can see Baseline Comparison as one of the sections they can include when creating custom report templates. They can generate reports that include the Baseline Comparison section.

The restriction has the following implications for users who do not have permission to generate reports with restricted sections:

These users will not see Baseline Comparison as one of the sections they can include when creating custom report templates. If these users attempt to generate reports that include the Baseline Comparison section, they will see an error message indicating that they do not have permission to do so.

For additional, detailed information about the SiloProfile API, see API guide.

Permitting users to generate restricted reports

Global Administrators automatically have permission to generate restricted reports. They can also assign this permission to others users. To assign the permission to a new user: 1. 2. 3. 4. 5. 6. 7.
NOTE: You also can grant this permission by making the user a Global Administrator.

Go to the Administration page, and click the Create link next to Users. (Optional) Go to the Users page and click New user. Configure the new users account settings as desired. Click Roles in the User Configuration panel. The console displays the Roles page. Select the Custom role from the drop-down list. Select the check box labeled Generate Restricted Reports. Select any other permissions as desired. Click Save when you have finished configuring the account settings.

Assigning the permission to an existing user involves the following steps. 1. 2. 3. 4. 5. 6. 7. Go to the Administration page, and click the manage link next to Users. OR (Optional) Go to the Users page and click the Edit icon for one of the listed accounts. Click the Roles link in the User Configuration panel. The console displays the Roles page. Select the Custom role from the drop-down list. Select the check box labeled Generate Restricted Reports. Select any other permissions as desired. Click Save when you have finished configuring the account settings.

Nexpose Users Guide

164

Exporting scan data to external databases

If you selected Database Export as your report format, the Report ConfigurationOutput page contains fields specifically for transferring scan data to a database. Before you type information in these fields, you must set up a JDBC-compliant database. In Oracle, MySQL, or Microsoft SQL Server, create a new database called nexpose with administrative rights. 1. 2. 3. 4. 5. 6. 7. Go to the Database Configuration section that appears when you select the Database Export template on the Create a Report panel. Enter the IP address and port of the database server. Enter the IP address of the database server. Enter a server port if you want to specify one other than the default. Enter a name for the database. Enter the administrative user ID and password for logging on to that database. Check the database to make sure that the scan data has populated the tables after the application completes a scan.

Configuring data warehousing settings

NOTE: Currently, this warehousing feature only supports PostgreSQL databases. NOTE: Due to the amount of data that can be exported, the warehousing process may take a long time to complete.

You can configure warehousing settings to store scan data or to export it to a PostgreSQL database. You can use this feature to obtain a richer set of scan data for integration with your own internal reporting systems. This is a technology preview of a feature that is undergoing expansion. To configure data warehouse settings: 1. 2. 3. 4. 5. 6. Click manage next to Data Warehousing on the Administration page. Enter database server settings on the Database page. Go to the Schedule page, and select the check box to enable data export. You can also disable this feature at any time. Select a date and time to start automatic exports. Select an interval to repeat exports. Click Save.

Nexpose Users Guide

165

For ASVs: Consolidating three report templates into one custom template
If you are an approved scan vendor (ASV), you must use the following PCI-mandated report templates for PCI scans as of September 1, 2010:

Attestation of Compliance PCI Executive Summary Vulnerability Details

You may find it useful and convenient to combine multiple reports into one template. For example you can create a template that combines sections from the Executive Summary, Vulnerability Details, and Host Details templates into one report that you can present to the customer for the initial review. Afterward, when the post-scan phase is completed, you can create another template that includes the PCI Attestation of Compliance with the other two templates for final delivery of the complete report set.
NOTE: PCI Attestation of Scan Compliance is one self-contained section.

PCI Executive Summary includes the following sections:

1. 2.

Cover Page Payment Card Industry (PCI) Scan Information Payment Card Industry (PCI) Component Compliance Summary Payment Card Industry (PCI) Vulnerabilities Noted Payment Card Industry (PCI) Special Notes

PCI Vulnerability Details includes the following sections: Cover Page Table of Contents Payment Card Industry (PCI) Scan Information Payment Card Industry (PCI) Vulnerability Details

PCI Host Detail contains the following sections: Table of Contents Payment Card Industry (PCI) Scan Information Payment Card Industry (PCI) Host Details

To consolidate reports into one custom template:

NOTE: Due to PCI Council restrictions, section numbers of PCI reports are static and cannot change to reflect the section structure of a customized report. Therefore, a customized report that mixes PCI report sections with non-PCI report sections may have section numbers that appear out of sequence.

Select the Manage report templates tab on the Reports page. Click New to create a new report template. The console displays the Create a New Report Template panel.

Nexpose Users Guide

166

Consolidated report template for ASVs.

3. 4. 5. 6. 7. 8.

Enter a name and description for your custom report on the View Reports page. The report name is unique. Select the document template type from the drop-down list. Select a level of vulnerability detail to be included in the report from the dropdown list. Specify if you want to display IP addresses or asset names and IP addresses on the template. Locate the PCI report sections and click Add>. Click Save. The Security Console displays the Manage report templates page with the new report template.

REMEMBER: Do not use sections related to legacy reports. These are deprecated and no longer sanctioned by PCI as of September 1, 2010. REMEMBER: If you use sections from PCI Executive Summary or PCI Attestation of Compliance templates, you will only be able to use the RTF format. If you attempt to select a different format, an error message is displayed.

Nexpose Users Guide

167

Configuring custom report templates

The application includes a variety of built-in templates for creating reports. These templates organize and emphasize asset and vulnerability data in different ways to provide multiple looks at the state of your environments security. Each template includes a specific set of information sections. If you are new to the application, you will find built-in templates especially convenient for creating reports. To learn about built-in report templates and the information they include, see Report templates and sections on page 272. As you become more experienced with the application and want to tailor reports to your unique informational needs, you may find it useful to create or upload custom report templates.

Fine-tuning information with custom report templates

Creating custom report templates enables you to include as much, or as little, scan information in your reports as your needs dictate. For example, if you want a report that lists assets organized by risk level, a custom report might be the best solution. This template would include only the Discovered System Information section. Or, if you want a report that only lists vulnerabilities, you may create a document template with the Discovered Vulnerabilities section or create a data export template with vulnerability-related attributes. You can also upload a custom report template that has been created by Rapid7 at your request to suit your specific needs. For example, custom report templates can be designed to provide high-level information presented in a dashboard format with charts for quick reference that include asset or vulnerability information that can be tailored to your requirements.Contact your account representative for information about having custom report templates designed for your needs. Templates that have been created for you will be provided to you. Otherwise, you can download additional report templates in the Rapid7 Community Web site https://community.rapid7.com/. After you create or upload a custom report template, it appears in the list of available templates on the Template section of the Create a report panel. See Working with externally created report templates on page 172.

Nexpose Users Guide

168

You must have permission to create a custom report template. To find out if you do, consult your Global Administrator. To create a custom report template, take the following steps: 1. 2. 3. Click the Reports tab. Click Manage report templates. The Manage report templates panel appears. Click New. The Security Console displays the Create a New Report panel.

The Create a New Report Template panel

Start to create a new report template. 1.

TIP: If you are a Global Administrator, you can find out if your license enables a specific feature. Click the Administration tab and then the Manage link for the Security Console. In the Security Console Configuration panel, click the Licensing link.

2.

Enter a name and description for the new template on the General section of the Create a New Report Template panel. Select the template type from the Template type drop-down list:

With a Document template you will generate section-based, human-readable reports that contain asset and vulnerability information. Some of the formats available for this template typeText, PDF, RTF, and HTML are convenient for sharing information to be read by stakeholders in your organization, such as executives or security team members tasked with performing remediation. With an export template, the format is identified in the template name, either comma-separated-value (CSV) or XML files. CSV format is useful for integrating check results into spreadsheets, that you can share with stakeholders in your organization. Because the output is CSV, you can further manipulate the data using pivot tables or other spreadsheet features. See Using Excel pivot tables to create custom reports from a CSV file on page 174. To use this template type, you must have the Customizable CSV export featured enabled. If it is not, contact your account representative for license options. With the Upload a template file option you can select a template file from a library. You will select the file to upload in the Content section of the Create a New Report Template panel. See Working with externally created report templates on page 172.

Nexpose Users Guide

169

NOTE: The Vulnerability details setting only affects document report templates. It does not affect data export templates.

3.

Select a level of vulnerability details from the drop-down list in the Content section of the Create a New Report Template panel. Vulnerability details filter the amount of information included in document report templates:

4.

None excludes all vulnerability-related data. Minimal (title and risk metrics) excludes vulnerability solutions. Complete except for solutions includes basic information about vulnerabilities, such as title, severity level, CVSS score, and date published. Complete includes all vulnerability-related data. Display asset names only Display asset names and IP addresses

Select your display preference:

5.

Select the sections to include in your template and click Add>. See Report templates and sections on page 272. Set the order for the sections to appear by clicking the up or down arrows. (Optional) Click <Remove to take sections out of the report. (Optional) Add the Cover Page section to include a cover page, logo, scan date, report date, and headers and footers. See Adding a custom logo to your report on page 171 for information on file formats and directory location for adding a custom logo. (Optional) Clear the check boxes to Include scan data and Include report date if you do not want the information in your report. (Optional) Add the Baseline Comparison section to select the scan date to use as a baseline. See Selecting a scan as a baseline on page 155 for information about designating a scan as a baseline.

6. 7.

8. 9.

10. (Optional) Add the Executive Summary section to enter an introduction to begin the report. 11. Click Save.

Nexpose Users Guide

170

Adding a custom logo to your report

By default, a document report cover page includes a generic title, the name of the report, the date of the scan that provided the data for the report, and the date that the report was generated. It also may include the Rapid7 logo or no logo at all, depending on the report template. See Cover Page on page 282. You can easily customize a cover page to include your own title and logo.
NOTE: Logos can be JPEG and PNG logo formats.

To display your own logo on the cover page: 1. Copy the logo file to the designated directory of your installation.

2. 3.

In Windows: C:\Program Files\[installation_directory]\shared\reportImages\custom\silo\default. In Linux: /opt/[installation_directory]/shared/reportImages/custom/silo/ default.

Go to the Cover Page Settings section of the Create a New Report Template panel. Enter the name of the file for your own logo, preceded by the word image: in the Add logo field. Example: image:file_name.png. Do not insert a space between the word image: and the file name.

4. 5. 6.

Enter a title in the Add title field. Click Save. Restart the Security Console.

Nexpose Users Guide

171

Working with externally created report templates

NOTES: Your license must enable custom reporting for the template upload option to be available. Also, externally created custom template files must be approved by Rapid7 and archived in the .JAR format.

The application provides built-in report templates and the ability to create custom templates based on those built-in templates. Beyond these options, you may want to use compatible templates that have been created outside of the application for your specific business needs. These templates may have been provided directly to your organization or they may have been posted in the Rapid7 Community at https://community.rapid7.com/community/nexpose/report-templates. See Fine-tuning information with custom report templates on page 168 for information about requesting custom report templates. Making one of these externally created templates available in the Security Console involves two actions: 1. 2. downloading the template to the workstation that you use to access the Security Console uploading the template to the Security Console using the Reports configuration panel

After you have downloaded a template archive, take the following steps: 1. 2. 3. 4. 5. Click the Reports tab in the Web interface. Click Manage report templates. The Manage report templates panel appears. Click New. The Security Console displays the Create a New Report Template panel. Enter a name and description for the new template on the General section of the Create a New Report Template panel. Select Upload a template file from the Template type drop-down list.

Upload a report template file

6. 7.
NOTE: Contact Technical Support if you see errors during the upload process.

Click Browse in the Select file field to display a directory for you to search for custom templates. Select the report template file and click Open. The report template file appears in the Select file field in the Content section. Click Save. The custom report template file will now appear in the list of available report templates on the Manage report templates panel.

8.

Nexpose Users Guide

172

Working with report formats

The choice of a format is important in report creation. Formats not only affect how reports appear and are consumed, but they also can have some influence on what information appears in reports.

Working with human-readable formats

Several formats make report data easy to distribute, open, and read immediately:

NOTE: If you wish to generate PDF reports with Asian-language characters, make sure that UTF-8 fonts are properly installed on your host computer. PDF reports with UTF-8 fonts tend to be slightly larger in file size. TIP: For information about XML export attributes, see Export template attributes on page 287. That section describes similar attributes in the CSV export template, some of which have slightly different names.

PDF can be opened and viewed in Adobe Reader. HTML can be opened and viewed in a Web browser. RTF can be opened, viewed, and edited in Microsoft Word. This format is preferable if you need to edit or annotate the report. Text can be opened, viewed, and edited in any text editing program.

If you are using one of the three report templates mandated for PCI scans as of September 1, 2010 (Attestation of Compliance, PCI Executive Summary, or Vulnerability Details), or a custom template made with sections from these templates, you can only use the RTF format. These three templates require ASVs to fill in certain sections manually.

Working with XML formats

Various XML formats make it possible to integrate reports with third-party systems.

Asset Risk

XML Export, also known as raw XML, contains a comprehensive set of scan data with minimal structure. Its contents must be parsed so that other systems can use its information. XML Export 2.0 is similar to XML Export, but contains additional attributes:

Exploit Title Malware Kit Name(s) PCI Compliance Status Scan ID Scan Template

Site Name Site Importance Vulnerability Risk Vulnerability Since

Exploit IDs Exploit Skill Needed Exploit Source Link Exploit Type

NexposeTM Simple XML is also a raw XML format. It is ideal for integration of scan data with the Metasploit vulnerability exploit framework. It contains a subset of the data available in the XML Export format:

hosts scanned vulnerabilities found on those hosts services scanned vulnerabilities found in those services

Nexpose Users Guide

173

SCAP Compatible XML is also a raw XML format that includes Common Platform Enumeration (CPE) names for fingerprinted platforms. This format supports compliance with Security Content Automation Protocol (SCAP) criteria for an Unauthenticated Scanner product. XML arranges data in clearly organized, human-readable XML and is ideal for exporting to other document formats. XCCDF Results XML Report provides information about compliance tests for individual USGCB or FDCC configuration policy rules. Each report is dedicated to one rule. The XML output includes details about the rule itself followed by data about the scan results. If any results were overridden, the output identifies the most recent override as of the time the report was run. See Overriding rule test results on page 111. CyberScope XML Export organizes scan data for submission to the CyberScope application. Certain entities are required by the U.S. Office of Management and Budget to submit CyberScope-formatted data as part of a monthly program of reporting threats. Qualys* XML Export is intended for integration with the Qualys reporting framework. *Qualys is a trademark of Qualys, Inc.

XML Export 2.0 contains the most information. In fact, it contains all the information captured during a scan. Its schema can be downloaded from the Support page in Help. Use it to help you understand how the data is organized and how you can customize it for your own needs.

Working with CSV export

You can open a CSV (comma separated value) report in Microsoft Excel. It is a powerful and versatile format. Not only does it contain a significantly greater amount of scan information than is available in report templates, but you can easily use macros and other Excel tools to manipulate this data and provide multiple views of it. Two CSV formats are available:

CSV Export includes comprehensive scan data XCCDF Human Readable CSV Report provides test results on individual assets for compliance with individual USGCB or FDCC configuration policy rules. If any results were overridden, the output lists results based on the most recent overrides as of the time the output was generated. However, the output does not identify overrides as such or include the override history. See Overriding rule test results on page 111.

The CSV Export format works only with the Basic Vulnerability Check Results template and any Data-type custom templates. See Fine-tuning information with custom report templates on page 168.

Using Excel pivot tables to create custom reports from a CSV file
The pivot table feature in Microsoft Excel allows you to process report data in many different ways, essentially creating multiple reports one exported CSV file. Following are instructions for using pivot tables. These instructions reflect Excel 2007. Other versions of Excel provide similar workflows. If you have Microsoft Excel installed on the computer with which you are connecting to the Security Console, click the link for the CSV file on the Reports page. This will start Microsoft Excel and open the file. If you do not have Excel installed on the computer with which you are connecting to the console, download the CSV file from the Reports page, and transfer it to a computer that has Excel installed. Then, use the following procedure.

Nexpose Users Guide

174

To create a custom report from a CSV file: 1. 2. 3. 4. Start the process for creating a pivot table. Select all the data. Click the Insert tab, and then select the PivotTable icon. The Create Pivot Table dialog box, appears. Click OK to accept the default settings. Excel opens a new, blank sheet. To the right of this sheet is a bar with the title PivotTable Field List, which you will use to create reports. In the top pane of this bar is a list of fields that you can add to a report. Most of these fields re self-explanatory. The result-code field provides the results of vulnerability checks. See How vulnerability exceptions appear in XML and CSV formats on page 177 for a list of result codes and their descriptions. The severity field provides numeric severity ratings. The application assigns each vulnerability a severity level, which is listed in the Severity column. The three severity levelsCritical, Severe, and Moderatereflect how much risk a given vulnerability poses to your network security. The application uses various factors to rate severity, including CVSS scores, vulnerability age and prevalence, and whether exploits are available.
NOTE: The severity field is not related to the severity score in PCI reports.

8 to 10 = Critical 4 to 7 = Severe 1 to 3 = Moderate

The next steps involve choosing fields for the type of report that you want to create, as in the three following examples. Example 1: Creating a report that lists the five most numerous exploited vulnerabilities 1. 2. 3. 4. 5. 6. 7. 8. 9. Drag result-code to the Report Filter pane. Click drop-down arrow in column B to display result codes that you can include in the report. Select the option for multiple items. Select ve for exploited vulnerabilities. Click OK. Drag vuln-id to the Row Labels pane. Row labels appear in column A. Drag vuln-id to the Values pane. A count of vulnerability IDs appears in column B. Click the drop-down arrow in column A to change the number of listed vulnerabilities to five. Select Value Filters, and then Top 10...

10. Enter 5 in the Top 10 Filter dialog box and click OK. The resulting report lists the five most numerous exploited vulnerabilities.

Nexpose Users Guide

175

Example 2: Creating a report that lists required Microsoft hot-fixes for each asset 1. 2. 3. 4. 5. 6. 7. 8. 9. Drag result-code to the Report Filter pane. Click the drop-down arrow in column B of the sheet it to display result codes that you can include in the report. Select the option for multiple items. Select ve for exploited vulnerabilities and vv for vulnerable versions. Click OK. Drag host to the Row Labels pane. Drag vuln-id to the Row Labels pane. Click vuln-id once in the pane for choosing fields in the PivotTable Field List bar. Click the drop-down arrow that appears next to it and select Label Filters.

10. Select Contains... in the Label Filter dialog box. 11. Enter the value windows-hotfix. 12. Click OK. The resulting report lists required Microsoft hot-fixes for each asset. Example 3: Creating a report that lists the most critical vulnerabilities and the systems that are at risk 1. 2. 3. 4. 5. 6. 7. 8. 9. Drag result-code to the Report Filter pane. Click the drop-down arrow that appears in column B to display result codes that you can include in the report. Select the option for multiple items. Select ve for exploited vulnerabilities. Click OK. Drag severity to the Report Filter pane. Another of the sheet. Click the drop-down arrow appears that column B to display ratings that you can include in the report. Select the option for multiple items. Select 8, 9, and 10, for critical vulnerabilities.

10. Click OK. 11. Drag vuln-titles to the Row Labels pane. 12. Drag vuln-titles to the Values pane. 13. Click the drop-down arrow that appears in column A and select Value Filters. 14. Select Top 10... in the Top 10 Filter dialog box, confirm that the value is 10. 15. Click OK. 16. Drag host to the Column Labels pane. 17. Another of the sheet. 18. Click the drop-down arrow appears in column B and select Label Filters. 19. Select Greater Than... in the Label Filter dialog box, enter a value of 1. 20. Click OK. The resulting report lists the most critical vulnerabilities and the assets that are at risk.

Nexpose Users Guide

176

How vulnerability exceptions appear in XML and CSV formats

Vulnerability exceptions can be important for the prioritization of remediation projects and for compliance audits. Report templates include a section dedicated to exceptions. See Vulnerability Exceptions on page 286. In XML and CSV reports, exception information is also available. XML: The vulnerability test status attribute will be set to one of the following values for vulnerabilities suppressed due to an exception:
exception-vulnerable-exploited - Exception suppressed exploited vulnerability exception-vulnerable-version - Exception suppressed version-checked vulnerability exception-vulnerable-potential - Exception suppressed potential vulnerability

CSV: The vulnerability result-code column will be set to one of the following values for vulnerabilities suppressed due to an exception.

Vulnerability result codes

Each code corresponds to results of a vulnerability check:

ds (skipped, disabled): A check was not performed because it was disabled in the scan template. ee (excluded, exploited): A check for an exploitable vulnerability was excluded. ep (excluded, potential): A check for a potential vulnerability was excluded. er (error during check): An error occurred during the vulnerability check. ev (excluded, version check): A check was excluded. It is for a vulnerability that can be identified because the version of the scanned service or application is associated with known vulnerabilities. nt (no tests): There were no checks to perform. nv (not vulnerable): The check was negative. ov (overridden, version check): A check for a vulnerability that would ordinarily be positive because the version of the target service or application is associated with known vulnerabilities was negative due to information from other checks. sd (skipped because of DoS settings): sd (skipped because of DOS settings)If unsafe checks were not enabled in the scan template, the application skipped the check because of the risk of causing denial of service (DOS). See Configuration steps for vulnerability check settings on page 204. sv (skipped because of inapplicable version): the application did not perform a check because the version of the scanned item is not included in the list of checks. uk (unknown): An internal issue prevented the application from reporting a scan result. ve (vulnerable, exploited): The check was positive as indicated by asset-specific vulnerability tests. Vulnerabilities with this result appear in the CSV report if the Vulnerabilities found result type was selected in the report configuration. See Filtering report scope with vulnerabilities on page 148. vp (vulnerable, potential): The check for a potential vulnerability was positive. vv (vulnerable, version check): The check was positive. The version of the scanned service or software is associated with known vulnerabilities.

Nexpose Users Guide

177

Working with the database export format

You can output the Database Export report format to Oracle, MySQL, and Microsoft SQL Server. Like CSV and the XML formats, the Database Export format is fairly comprehensive in terms of the data it contains. It is not possible to configure what information is included in, or excluded from, the database export. Consider CSV or one of the XML formats as alternatives. Nexpose provides a schema to help you understand what data is included in the report and how the data is arranged, which is helpful in helping you understand how to you can work with the data. You can request the database export schema from Technical Support.

Nexpose Users Guide

178

Understanding report content

Reports contain a great deal of information. Its important to study them carefully for better understanding, so that they can help you make more informed security-related decisions. The data in a report is a static snapshot in time. The data displayed in the Web interface changes with every scan. Variance between the two, such as in the number of discovered assets or vulnerabilities, is most likely attributable to changes in your environment since the last report. For stakeholders in your organization who need fresh data but dont have access to the Web interface, run reports more frequently. Or use the report scheduling feature to automatically synchronize report schedules with scan schedules. In environments that are constantly changing, Baseline Comparison reports an be very useful. If your report data turns out to be much different from what you expected, consider several factors that may have skewed the data.

Scan settings can affect report data

Scan settings affect report data in several ways:

Lack of credentials: If certain information is missing from a report, such as discovered files, spidered Web sites, or policy evaluations, check to see if the scan was configured with proper logon information. The application cannot perform many checks without being able to log onto target systems as a normal user would. Policy checks not enabled: Another reason that policy settings may not appear in a report is that policy checks were not enabled in the scan template. Discovery-only templates: If no vulnerability data appears in a report, check to see if the scan was preformed with a discovery-only scan template, which does not check for vulnerabilities. Certain vulnerability checks enabled or disabled: If your report shows vulnerabilities than you expected, check the scan template to see which checks have been enabled or disabled. Unsafe checks not enabled: If a report shows indicates that a check was skipped because of Denial of Service (DOS) settings, as with the sd result code in CSV reports, then unsafe checks were not enabled in the scan template. Manual scans: A manual scan performed under unusual conditions for a site can affect reports. For example, an automatically scheduled report that only includes recent scan data is related to a specific, multiple-asset site that has automatically scheduled scans. A user runs a manual scan of a single asset to verify a patch update. The report may include that scan data, showing only one asset, because it is from the most recent scan.

Different report formats can influence report data

If you are disseminating reports using multiple formats, keep in mind that different formats affect not only how data is presented, but what data is presented. The human-readable formats, such as PDF and HTML, are intended to display data that is organized by the document report templates. These templates are more selective about data to include. On the other hand, XML Export, XML Export 2.0, CSV, and export templates essentially include all possible data from scans.

Nexpose Users Guide

179

Understanding how vulnerabilities are characterized according to certainty

Remediating confirmed vulnerabilities is a high security priority, so its important to look for confirmed vulnerabilities in reports. However, dont get thrown off by listings of potential or unconfirmed vulnerabilities. And dont dismiss these as false positives. The application will flag a vulnerability if it discovers certain conditions that make it probable that the vulnerability exists. If, for any reason, it cannot absolutely verify that the vulnerability is there, it will list the vulnerability as potential or unconfirmed. Or it may indicate that the version of the scanned operating system or application is vulnerable. The fact that a vulnerability is a potential vulnerability or otherwise not officially confirmed does not diminish the probability that it exists or that some related security issue requires your attention. You can confirm a vulnerability by running an exploit if one is available. See Working with vulnerabilities on page 84. You also can examine the scan log for the certainty with which a potentially vulnerable item was fingerprinted. A high level of fingerprinting certainty may indicate a greater likelihood of vulnerability.

How to find out the certainty characteristics of a vulnerability

You can find out the certainty level of a reported vulnerability in different areas:

The PCI Audit report includes a table that lists the status of each vulnerability. Status refers to the certainty characteristic, such as Exploited, Potential, or Vulnerable Version. The Report Card report includes a similar status column in one of its tables, which also lists information about the test that the application performed for each vulnerability on each asset. The XML Export and XML Export 2.0 reports include an attribute called test status, which includes certainty characteristics, such as vulnerable-exploited, and not-vulnerable. The CSV report includes result codes related to certainty characteristics. If you have access to the Web interface, you can view the certainty characteristics of a vulnerability on the page that lists details about the vulnerability.

Note that the Discovered and Potential Vulnerabilities section, which appears in the Audit report, potential and confirmed vulnerabilities are not differentiated.

Looking beyond vulnerabilities

When reviewing reports, look beyond vulnerabilities for other signs that may put your network at risk. For example, the application may discover a telnet service and list it in a report. A telnet service is not a vulnerability. However, telnet is an unencrypted protocol. If a server on your network is using this protocol to exchange information with a remote computer, it's easy for an uninvited party to monitor the transmission. You may want to consider using SSH instead. In another example, it may discover a Cisco device that permits Web requests to go to an HTTP server, instead of redirecting them to an HTTPS server. Again, this is not technically a vulnerability, but this practice may be exposing sensitive data. Study reports to help you manage risk proactively.

Nexpose Users Guide

180

Using report data to prioritize remediation

A long list of vulnerabilities in a report can be a daunting sight, and you may wonder which problem to tackle first. The vulnerability database contains checks for over 12,000 vulnerabilities, and your scans may reveal more vulnerabilities than you have time to correct. One effective way to prioritize vulnerabilities is to note which have real exploits associated with them. A vulnerability with known exploits poses a very concrete risk to your network. The Exploit ExposureTM feature flags vulnerabilities that have known exploits and provides exploit information links to Metasploit modules and the Exploit Database. It also uses the exploit ranking data from the Metasploit team to rank the skill level required for a given exploit. This information appears in vulnerability listings right in the Security Console Web interface, so you can see right away Since you cant predict the skill level of an attacker, it is a strongly recommend best practice to immediately remediate any vulnerability that has a live exploit, regardless of the skill level required for an exploit or the number of known exploits.

Report creation settings can affect report data

Report settings can affect report data in various ways:

Using most recent scan data: If old assets that are no longer in use still appear in your reports, and if this is not desirable, make sure to enable the check box labeled Use the last scan data only. Report schedule out of sync with scan schedule: If a report is showing no change in the number of vulnerabilities despite the fact that you have performed substantial remediation since the last report was generated, check the report schedule against the scan schedule. Make sure that reports are automatically generated to follow scans if they are intended to show patch verification. Assets not included: If a report is not showing expected asset data, check the report configuration to see which sites and assets have been included and omitted. Vulnerabilities not included: If a report is not showing an expected vulnerability, check the report configuration to vulnerabilities that have been filtered from the report. On the Scope section of the Create a report panel, click Filter report scope based on vulnerabilities and verify the filters are set appropriately to include the categories and severity level you need.

Prioritize according to risk score

Another way to prioritize vulnerabilities is according to their risk scores. A higher score warrants higher priority. The application calculates risk scores for every asset and vulnerability that it finds during a scan. The scores indicate the potential danger that the vulnerability poses to network and business security based on impact and likelihood of exploit. Risk scores are calculated according to different risk strategies. See Working with risk strategies to analyze threats on page 237.

Nexpose Users Guide

181

Using tickets
You can use the ticketing system to manage the remediation work flow and delegate remediation tasks. Each ticket is associated with an asset and contains information about one or more vulnerabilities discovered during the scanning process.

Viewing tickets
Click the Tickets tab to view all active tickets. The console displays the Tickets page. Click a link for a ticket name to view or update the ticket. See the following section for details about editing tickets. From the Tickets page, you also can click the link for an asset's address to view information about that asset, and open a new ticket.

Creating and updating tickets

The process of creating a new ticket for an asset starts on the Security Console page that lists details about that asset. You can get to that page by selecting a view option on the Assets page and following the sequence of console pages that ends with asset. See Locating assets on page 78.

Opening a ticket
When you want to create a ticket for a vulnerability, click the Open a ticket button, which appears at the bottom of the Vulnerability Listings pane on the detail page for each asset. See Locating assets by sites on page 79. The console displays the General page of the Ticket Configuration panel. On the Ticket ConfigurationGeneral page, type name for the new ticket. These names are not unique. They appear in ticket notifications, reports, and the list of tickets on the Tickets page. The status of the ticket appears in the Ticket State field. You cannot modify this field in the panel. The state changes as the ticket issue is addressed.
NOTE: If you need to assign the ticket to a user who does not appear on the drop down list, you must first add that user to the associated asset group.

Assign a priority to the ticket, ranging from Critical to Low, depending on factors such as the vulnerability level. The priority of a ticket is often associated with external ticketing systems. Assign the ticket to a user who will be responsible for overseeing the remediation work flow. To do so, select a user name from the drop down list labeled Assigned To. Only accounts that have access to the affected asset appear in the list. You can close the ticket to stop any further remediation action on the related issue. To do so, click the Close Ticket button on this page. The console displays a box with a drop down list of reasons for closing the ticket. Options include Problem fixed, Problem not reproducible, and Problem not considered an issue (policy reasons). Add any other relevant information in the dialog box and click the Save button.

Adding vulnerabilities
Go to the Ticket ConfigurationVulnerabilities page. Click the Select Vulnerabilities... button. The console displays a box that lists all reported vulnerabilities for the asset. You can click the link for any vulnerability to view details about it, including remediation guidance. Select the check boxes for all the vulnerabilities you wish to include in the ticket, and click the Save button. The selected vulnerabilities appear on the Vulnerabilities page.

Nexpose Users Guide

182

Updating ticket history

You can update coworkers on the status of a remediation project, or note impediments, questions, or other issues, by annotating the ticket history. As Nexpose users and administrators add comments related to the work flow, you can track the remediation progress. 1. 2. 3. Go to the Ticket ConfigurationHistory page. Click the Add Comments... button. The console displays a box, where you can type a comment. Click Save. The console displays all comments on the History page.

Nexpose Users Guide

183

Chapter 5 Tune
As you use the application to gather, view, and share security information, you may want to adjust settings of features that these operations. Tune provides guidance on adjusting or customizing settings for scans, risk calculation, and configuration assessment.

Working with scan templates and tuning scan performance on page 185: After familiarizing yourself with different built-in scan templates, you may want to customize your own scan templates for maximum speed or accuracy in your network environment. This section provides best practices for scan tuning and guides you through the steps of creating a custom scan template. Working with risk strategies to analyze threats on page 237: The application provides several strategies for calculating risk. This section explains how each strategy emphasizes certain characteristics, allowing you to analyze risk according to your organizations unique security needs or objectives. It also provides guidance for changing risk strategies and supporting custom strategies. Creating a custom policy on page 222: You can create custom configuration policies based an USGCB and FDCC policies, allowing you to check your environment for compliance with your organizations unique configuration policies. This section guides you through configuration steps.

Nexpose Users Guide

184

Working with scan templates and tuning scan performance

You may want to improve scan performance. You may want to make scans faster or more accurate. Or you may want scans to use fewer network resources. The following section provides best practices for scan tuning and instructions for working with scan templates. Tuning scans is a sensitive process. If you change one setting to attain a certain performance boost, you may find another aspect of performance diminished. Before you tweak any scan templates, it is important for you to know two things:

What your goals or priorities for tuning scans? What aspects of scan performance are you willing to compromise on?

Identify your goals and how theyre related to the performance triangle. See Keep the triangle in mind when you tune on page 187. Doing so will help you look at scan template configuration in the more meaningful context of your environment. Make sure to familiarize yourself with scan template elements before changing any settings. Also, keep in mind that tuning scan performance requires some experimentation, finesse, and familiarity with how the application works. Most importantly, you need to understand your unique network environment. This introductory section talks about why you would tune scan performance and how different builtin scan templates address different scanning needs:

Defining your goals for tuning on page 186 The primary tuning tool: the scan template on page 190

See also the appendix that compares all of our built-in scan templates and their use cases: Scan templates on page 254

Familiarizing yourself with built-in templates is helpful for customizing your own templates. You can create a custom template that incorporates many of the desirable settings of a built-in template and just customize a few settings vs. creating a new template from scratch. To create a custom scan template, go to the following section:

Configuring custom scan templates on page 192

Nexpose Users Guide

185

Defining your goals for tuning

Before you tune scan performance, make sure you know why youre doing it. What do you want to change? What do you need it to do better? Do you need scans to run more quickly? Do you need scans to be more accurate? Do you want to reduce resource overhead? The following sections address these questions in detail.

You need to finish scanning more quickly

Your goal may be to increase overall scan speed, as in the following scenarios:

NOTE: If a scan is taking an extraordinarily long time to finish, terminate the scan and contact Technical Support.

Actual scan-time windows are widening and conflicting with your scan blackout periods. Your organization may schedule scans for non-business hours, but scans may still be in progress when employees in your organization need to use workstations, servers, or other network resources. A particular type of scan, such as for a site with 300 Windows workstations, is taking an especially long time with no end in sight. This could be a scan hang issue rather than simply a slow scan. You need to able to schedule more scans within the same time window. Policy or compliance rules have become more stringent for your organization, requiring you to perform deeper authenticated scans, but you don't have additional time to do this. You have to scan more assets in the same amount of time. You have to scan the same number of assets in less time. You have to scan more assets in less time.

You need to reduce consumption of network or system resources

Your goal may be to lower the hit on resources, as in the following scenarios:

Your scans are taking up too much bandwidth and interfering with network performance for other important business processes. The computers that host your Scan Engines are maxing out their memory if they scan a certain number of ports. The security console runs out of memory if you perform too many simultaneous scans.

You need more accurate scan data

Scans may not be giving you enough information, as in the following scenarios:

Scans are missing assets. Scans are missing services. The application is reporting too many false positives or false negatives. Vulnerability checks are not occurring at a sufficient depth.

Nexpose Users Guide

186

Keep the triangle in mind when you tune

Any tuning adjustment that you make to scan settings will affect one or more main performance categories. These categories reflect the general goals for tuning discussed in the preceding section:

accuracy resources time

These three performance categories are interdependent. It is helpful to visualize them as a triangle.

If you lengthen one side of the trianglethat is, if you favor one performance categoryyou will shorten at least one of the other two sides. It is unrealistic to expect a tuning adjustment to lengthen all three sides of the triangle. However, you often can lengthen two of the three sides.

Increasing time availability

Providing more time to run scans typically means making scans run faster. One use case is that of a company that holds auctions in various locations around the world. Its asset inventory is slightly over 1,000. This company cannot run scans while auctions are in progress because time-sensitive data must traverse the network at these times without interruptions. The fact that the company holds auctions in various time zones complicates scan scheduling. Scan windows are extremely tight. The company's best solution is to use a lot of bandwidth so that scan can finish as quickly as possible. In this case its possible to reduce scan time without sacrificing accuracy. However, a high workload may tap resources to the point that the scanning mechanisms could become unstable. In this case, it may be necessary to reduce the level of accuracy by, for example, turning off credentialed scanning.

Nexpose Users Guide

187

There are many various ways to increase scan speeds, including the following:

NOTE: Deploying additional Scan Engines may lower bandwidth availability.

Increase the number of assets that are scanned simultaneously. Be aware that this will tax RAM on Scan Engines and the Security Console. Allocate more scan threads. Doing so will impact network bandwidth. Use a less exhaustive scan template. Again, this will diminish the accuracy of the scan. Add Scan Engines, or position them in the network strategically. If you have one hour to scan 200 assets over low bandwidth, placing a Scan Engine on the same side of the firewall as those assets can speed up the process. When deploying a Scan Engine relative to target assets, choose a location that maximizes bandwidth and minimizes latency. For more information on Scan Engine placement, refer to the administrators guide.

Increasing accuracy
Making scans more accurate means finding more security-related information. There are many ways to this, each with its own cost according to the performance triangle: Increase the number of discovered assets, services, or vulnerability checks. This will take more time. Deepen scans with checks for policy compliance and hotfixes. These types of checks require credentials and can take considerably more time. Scan assets more frequently. For example, peripheral network assets, such as Web servers or Virtual Private Network (VPN) concentrators, are more susceptible to attack because they are exposed to the Internet. Its advisable to scan them often. Doing so will either require more bandwidth or more time. The time issue especially applies to Web sites, which can have deep file structures. Be aware of license limits when scanning network services. When the application attempts to connect to a service, it appears to that service as another client, or user. The service may have a defined limit for how many simultaneous client connections it can support. If service has reached that client capacity when the application attempts a connection, the service will reject the attempt. This is often the case with telnet-based services. If the application cannot connect to a service to scan it, that service wont be included in the scan data, which means lower scan accuracy.

Increasing resource availability

Making more resources available primarily means reducing how much bandwidth a scan consumes. It can also involve lowering RAM use, especially on 32-bit operating systems. Consider bandwidth availability in four major areas of your environment. Any one of or more of these can become bottlenecks:

The computer that hosts the application can get bogged down processing responses from target assets. The network infrastructure that the application runs on, including firewalls and routers, can get bogged down with traffic. The network on which target assets run, including firewalls and routers, can get bogged down with traffic. The target assets can get bogged down processing requests from the application.

Nexpose Users Guide

188

Of particular concern is the network on which target assets run, simply because some portion of total bandwidth is always in use for business purposes. This is especially true if you schedule scans to run during business hours, when workstations are running and laptops are plugged into the network. Bandwidth sharing also can be an issue during off hours, when backup processes are in progress. Two related bandwidth metrics to keep an eye on are the number of data packets exchanged during the scan, and the correlating firewall states. If the application sends too many packets per second (pps), especially during the service discovery and vulnerability check phases of a scan, it can exceed a firewalls capacity to track connection states. The danger here is that the firewall will start dropping request packets, or the response packets from target assets, resulting in false negatives. So, taxing bandwidth can trigger a drop in accuracy. There is no formula to determine how much bandwidth should be used. You have to know how much bandwidth your enterprise uses on average, as well as the maximum amount of bandwidth it can handle. You also have to monitor how much bandwidth the application consumes and then adjust the level accordingly. For example, if your network can handle a maximum of 10,000 pps without service disruptions, and your normal business processes average about 3,000 pps at any given time, your goal is to have the application work within a window of 7,000 pps. The primary scan template settings for controlling bandwidth are scan threads and maximum simultaneous ports scanned. The cost of conserving bandwidth typically is time. For example, a company operates full-service truck stops in one region of the United States. Its security team scans multiple remote locations from a central office. Bandwidth is considerably low due to the types of network connections. Because the number of assets in each location is lower than 25, adding remote Scan Engines is not a very efficient solution. A viable solution in this situation is to reduce the number of scan threads to between two and five, which is well below the default value of 10. There are various other ways to increase resource availability, including the following:

Reduce the number of target assets, services, or vulnerability checks. The cost is accuracy. Reduce the number of assets that are scanned simultaneously. The cost is time. Perform less exhaustive scans. Doing so primarily reduces scan times, but it also frees up threads.

Nexpose Users Guide

189

The primary tuning tool: the scan template

Scan templates contain a variety of parameters for defining how assets are scanned. Most tuning procedures involve editing scan template settings. The built-in scan templates are designed for different use cases, such as PCI compliance, Microsoft Hotfix patch verification, Supervisory Control And Data Acquisition (SCADA) equipment audits, and Web site scans. You can find detailed information about scan templates in the section titled Scan templates on page 254. This section includes use cases and settings for each scan template.

Templates are best practices

NOTE: Until you are familiar with technical concepts related to scanning, such as port discovery and packet delays, it is recommended that you use built-in templates.

You can use built-in templates without altering them, or create custom templates based on built-in templates. You also can create new custom templates. If you opt for customization, keep in mind that built-in scan templates are themselves best practices. Not only do built-in templates address specific use cases, but they also reflect the delicate balance of factors in the performance triangle: time, resources, and accuracy. You will notice that if you select the option to create a new template, many basic configuration settings have built-in values. It is recommended that you do not change these values unless you have a thorough working knowledge of what they are for. Use particular caution when changing any of these built-in values. If you customize a template based on a built-in template, you may not need to change every single scan setting. You may, for example, only need to change a thread number or a range of ports and leave all other settings untouched. For these reasons, its a good idea to perform any customizations based on built-in templates. Start by familiarizing yourself with built-in scan templates and understanding what they have in common and how they differ. The following section is a comparison of four sample templates.

Understanding configurable phases of scanning

Understanding the phases of scanning is helpful in understanding how scan templates are structured. Each scan occurs in three phases:

NOTE: The discovery phase in scanning is a different concept than that of asset discovery, which is a method for finding potential scan targets in your environment.

asset discovery service discovery vulnerability checks

During the asset discovery phase, a Scan Engine sends out simple packets at high speed to target IP addresses in order to verify that network assets are live. You can configure timing intervals for these communication attempts, as well as other parameters, on the Asset Discovery and Discovery Performance pages of the Scan Template Configuration panel. Upon locating the asset, the Scan Engine begins the service discovery phase, attempting to connect to various ports and to verify services for establishing valid connections. Because the application scans Web applications, databases, operating systems and network hardware, it has many opportunities for attempting access. You can configure attributes related to this phase on the Service Discovery and Discovery Performance pages of the Scan Template Configuration panel. During the third phase, known as the vulnerability check phase, the application attempts to confirm vulnerabilities listed in the scan template. You can select which vulnerabilities to scan for in Vulnerability Checking page of the Scan Template Configuration panel. Other configuration options include limiting the types of services that are scanned, searching for specific vulnerabilities, and adjusting network bandwidth usage.

Nexpose Users Guide

190

In every phase of scanning, the application identifies as many details about the asset as possible through a set of methods called fingerprinting. By inspecting properties such as the specific bit settings in reserved areas of a buffer, the timing of a response, or a unique acknowledgement interchange, the application can identify indicators about the asset's hardware, operating system, and, perhaps, applications running under the system. A well-protected asset can mask its existence, its identity, and its components from a network scanner.

Do you need to alter templates or just alter-nate them?

When you become familiar with the built-in scan templates, you may find that they meet different performance needs at different times.
TIP: Use your variety of report templates to parse your scan results in many useful ways. Scans are a resource investment, especially deeper scans. Reports help you to reap the biggest possible returns from that investment. NOTE: If you change templates regularly, you will sacrifice the conveniences of scheduling scans to run at automatic intervals with the same template.

You could, for example, schedule a Web audit to run on a weekly basis, or even more frequently, to monitor your Internet-facing assets. This is a faster scan and less of a drain on resources. You could also schedule a Microsoft hotfix scan on a monthly basis for patch verification. This scan requires credentials, so it takes longer. But the trade-off is that it doesn't have to occur as frequently. Finally, you could schedule an exhaustive scan on a quarterly basis do get a detailed, all-encompassing view of your environment. It will take time and bandwidth but, again, it's a less frequent scan that you can plan for in advance Another way to maximize time and resources without compromising on accuracy is to alternate target assets. For example, instead of scanning all your workstations on a nightly basis, scan a third of them and then scan the other two thirds over the next 48 hours. Or, you could alternate target ports in a similar fashion.

Quick tuning: What can you turn off?

Sometimes, tuning scan performance is a simple matter of turning off one or two settings in a template. The fewer things you check for, the less time or bandwidth you'll need to complete a scan. However, your scan will be less comprehensive, and so, less accurate.
NOTE: Credentialed checks are critical for accuracy, as they make it possible to perform deep system scans. Be absolutely certain that you don't need credentialed checks before you turn them off.

If the scope of your scan does not include Web assets, turn off Web spidering, and disable Webrelated vulnerability checks. If you don't have to verify hotfix patches, disable any hotfix checks. Turn off credentialed checks if you are not interested in running them. If you do run credentialed checks, make sure you are only running necessary ones. An important note here is that you need to know exactly what's running on your network in order to know what to turn off. This is where discovery scans become so valuable. They provide you with a reliable, dynamic asset inventory. For example, if you learn, from a discovery scan, that you have no servers running Lotus Notes/Domino, you can exclude those policy checks from the scan.

Nexpose Users Guide

191

Configuring custom scan templates

To begin modifying a default template go to the Administration page, and click manage for Scan Templates. The console displays the Scan Templates pages. You cannot directly edit a built-in template. Instead, make a copy of the template and edit that copy. When you click Copy for any default template listed on the page, the console displays the Scan Template Configuration panel. To create a custom scan template from scratch, go to the Administration page, and click create for Scan Templates.
NOTE: The PCI-related scanning and reporting templates are packaged with the application, but they require purchase of a license in order to be visible and available for use. The FDCC template is only available with a license that enables FDCC policy scanning.

The console displays the Scan Template Configuration panel. All attribute fields are blank.

Fine-tuning: What can you turn up or down?

Configuring templates to fine-tune scan performance involves trial and error and may include unexpected results at first. You can prevent some of these by knowing your network topology, your asset inventory, and your organizations schedule and business practices. And always keep the triangle in mind. For example, dont increase thread allocation dramatically if you know that backup operations are in progress. The usage spike might impact bandwidth. Familiarize yourself with built-in scan templates and how they work before changing any settings or customizing templates from scratch. See Scan templates on page 254.

Default and customized credential checking

Many products provide default login user IDs and passwords upon installation. Oracle ships with over 160 default user IDs. Windows users may not disable the guest account in their system. If you dont disable the default account vulnerability check type when creating a scan template, the application can perform checks for these items. See Configuration steps for vulnerability check settings on page 204 for information on enabling and disabling vulnerability check types. The application performs checks against databases, applications, operating systems, and network hardware using the following protocols:

CVS Sybase AS/400 DB2 SSH Oracle Telnet CIFS (Windows File Sharing) FTP POP HTTP SNMP SQL/Server SMTP

Nexpose Users Guide

192

To specify users IDs and passwords for logon, you must enter appropriate credentials during site configuration. See Configuring scan credentials on page 42. If a specific asset is not chosen to restrict credential attempts then the application will attempt to use these credentials on all assets. If a specific service is not selected then it will attempt to use the supplied credentials to access all services.

Starting a new custom scan template

If you are creating a new scan template from scratch, start with the following steps: 1. On the Administration page, click the Create link for Scan templates. OR If you are in the Browse Scan Templates window for a site configuration, click Create. 2. 3. On the Scan Template ConfigurationGeneral page, enter a name and description for the new template. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Selecting the type of scanning you want to do

You can configure your template to include all available types of scanning, or you can limit the scope of the scan to focus resources on specific security needs. To select the type of scanning you want to do, take the following steps. 1. 2. Go to the Scan Template ConfigurationGeneral page. Select one or more of the following options:

Asset DiscoveryAsset discovery occurs with every scan, so this option is always selected. If you select only Asset Discovery, the template will not include any vulnerability or policy checks. By default, all other options are selected, so you need to clear the other option check boxes to select asset discovery only. VulnerabilitiesSelect this option if you want the scan to include vulnerability checks. To select or exclude specific checks, click the Vulnerability Checks link in the left navigation pane of the configuration panel. See Configuration steps for vulnerability check settings on page 204 Web SpideringSelect this option if you want the scan to include checks that are performed in the process of Web spidering. If you want to perform Web spidering checks only, you will need to click the Vulnerability Checks link in the left navigation pane of the configuration panel and disable non-Web spidering checks. See See Configuration steps for vulnerability check settings on page 204. You must select the vulnerabilities option first in order to select Web spidering. PoliciesSelect this option if you want the scan to include policy checks, including Policy Manager. You will need to select individual checks and configure other settings, depending on the policy. See Selecting Policy Manager checks on page 206, Configuring verification of standard policies on page 207 and Performing configuration assessment on page 252.

3.

Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Nexpose Users Guide

193

Configuring asset discovery

Asset discovery configuration involves three options:

determining if target assets are live collecting information about discovered assets reporting any assets with unauthorized MAC addresses

If you choose not to configure asset discovery in a custom scan template, the scan will begin with service discovery.

Determining if target assets are live

Determining whether target assets are live can be useful in environments that contain large numbers of assets, which can be difficult to keep track of. Filtering out dead assets from the scan job helps reduce scan time and resource consumption. Three methods are available to contact assets:

ICMP echo requests (also known as pings) TCP packets UDP packets

The potential downside is that firewalls or other protective devices may block discovery connection requests, causing target assets to appear dead even if they are live. If a firewall is on the network, it may block the requests, either because it is configured to block network access for any packets that meet certain criteria, or because it regards any scan as a potential attack. In either case, the application reports the asset to be DEAD in the scan log. This can reduce the overall accuracy of your scans. Be mindful of where you deploy Scan Engines and how Scan Engines interact with firewalls. See Make your environment scan-friendly on page 220. Using more than one discovery method promotes more accurate results. If the application cannot verify that an asset is live with one method, it will revert to another.
Note: The Web audit and Internet DMZ audit templates do not include any of these discovery methods.

Peripheral networks usually have very aggressive firewall rules in place, which blunts the effectiveness of asset discovery. So for these types of scans, its more efficient to have the application assume that a target asset is live and proceed to the next phase of a scan, service discovery. This method costs time, because the application checks ports on all target assets, whether or not they are live. The benefit is accuracy, since it is checking all possible targets. By default, the Scan Engine uses ICMP protocol, which includes a message type called ECHO REQUEST, also known as a ping, to seek out an asset during device discovery. A firewall may discard the pings, either because it is configured to block network access for any packets that meet certain criteria, or because it regards any scan as a potential attack. In either case, the application infers that the device is not present, and reports it as DEAD in the scan log.

NOTE: Selecting both TCP and UDP for device discovery causes the application to send out more packets than with one protocol, which uses up more network bandwidth.

You can select TCP and/or UDP as additional or alternate options for locating lives hosts. With these protocols, the application attempts to verify the presence of assets online by opening connections. Firewalls are often configured to allow traffic on port 80, since it is the default HTTP port, which supports Web services. If nothing is registered on port 80, the target asset will send a port closed response, or no response, to the Scan Engine. This at least establishes that the asset is online and that port scans can occur. In this case, the application reports the asset to be ALIVE in scan logs.

Nexpose Users Guide

194

If you select TCP or UDP for device discovery, make sure to designate ports in addition to 80, depending on the services and operating systems running on the target assets. You can view TCP and UDP port settings on default scan templates, such as Discovery scan and Discovery scan (aggressive) to get an idea of commonly used port numbers. TCP is more reliable than UDP for obtaining responses from target assets. It is also used by more services than UDP. You may wish to use UDP as a supplemental protocol, as target devices are also more likely to block the more common TCP and ICMP packets. If a scan target is listed as a host name in the site configuration, the application attempts DNS resolution. If the host name does not resolve, it is considered UNRESOLVED, which, for the purposes of scanning, is the equivalent of DEAD. UDP is a less reliable protocol for asset discovery since it doesnt incorporate TCPs handshake method for guaranteeing data integrity and ordering. Unlike TCP, if a UDP port doesnt respond to a communication attempt, it is usually regarded as being open.

Fine-tuning scans with verification of live assets

Asset discovery can be an efficient accuracy boost. Also, disabling asset discovery can actually bump up scan times. The application only scans an asset if it verifies that the asset is live. Otherwise, it moves on. For example, if it can first verify that 50 hosts are live on a sparse class C network, it can eliminate unnecessary port scans. It is a good idea to enable ICMP and to configure intervening firewalls to permit the exchange of ICMP echo requests and reply packets between the application and the target network. Make sure that TCP is also enabled for asset discovery, especially if you have strict firewall rules in your internal networks. Enabling UDP may be excessive, given the dependability issues of UDP ports. To make the judgment call with UDP ports, weigh the value of thoroughness (accuracy) against that of time. If you do not select any discovery methods, scans assume that all target assets are live, and immediately begin service discovery.

Ports used for asset discovery

If the application uses TCP or UDP methods for asset discovery, it sends request packets to specific ports. If the application contacts a port and receives a response that the port is open, it reports the host to be live and proceeds to scan it. The PCI audit template includes extra TCP ports for discovery. With PCI scans, its critical not to miss any live assets.

Configuration steps for verifying live assets

1. 2. 3. 4. Go to the Scan Template ConfigurationAsset Discovery page. Select one or more of the displayed methods to locate live hosts. If you select TCP or UDP, enter one or more port numbers for each selection. The application will send the TCP or UDP packets to these ports. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Nexpose Users Guide

195

Collecting information about discovered assets

You can collect certain information about discovered assets and the scanned network before performing vulnerability checks. All of these discovery settings are optional.

Finding other assets on the network

The application can query DNS and WINS servers to find other network assets that may be scanned. Microsoft developed Windows Internet Name Service (WINS) for name resolution in the LAN manager environment of NT3.5. The application can interrogate this broadcast protocol to locate the names of Windows workstations and servers. WINS usually is not required. It was developed originally as a system database application to support conversion of NETBIOS names to IP addresses. If you enable the option to discover other network assets, the application will discover and interrogate DNS and WINS servers for the IP addresses of all supported assets. It will include those assets in the list of scanned systems.

Collecting Whois information

NOTE: Whois does not work with internal RFC1918 addresses.

Whois is an Internet service that obtains information about IP addresses, such as the name of the entity that owns it. You can improve Scan Engine performance by not requiring interrogation of a Whois server for every discovered asset if a Whois server is unavailable in the network.

Fingerprinting TCP/IP stacks

The application identifies as many details about discovered assets as possible through a set of methods called IP fingerprinting. By scanning an assets IP stack, it can identify indicators about the assets hardware, operating system, and, perhaps, applications running on the system. Settings for IP fingerprinting affect the accuracy side of the performance triangle. The retries setting defines how many times the application will repeat the attempt to fingerprint the IP stack. The default retry value is 0. IP fingerprinting takes up to a minute per asset. If it cant fingerprint the IP stack the first time, it may not be worth additional time make a second attempt. However, you can set it to retry IP fingerprinting any number of times. Whether or not you do enable IP fingerprinting, the application uses other fingerprinting methods, such as analyzing service data from port scans. For example, by discovering Internet Information Services (IIS) on a target asset, it can determine that the asset is a Windows Web server. The certainty value, which ranges between 0.0 and 1.0 reflects the degree of certainty with which and asset is fingerprinted. If a particular fingerprint is below the minimum certainty value, the application discards the IP fingerprinting information for that asset. As with the performance settings related to asset discovery, these settings were carefully defined with best practices in mind, which is why they are identical.

Nexpose Users Guide

196

Configuration steps for collecting information about discovered assets: 1. 2. 3. 4. 5. 6. Go to the Scan Template ConfigurationAsset Discovery page. If desired, select the check box to discover other assets on the network, and include them in the scan. If desired, select the option to collect Whois information. If desired, select the option to fingerprint TCP/IP stacks. If you enabled the fingerprinting option, enter a retry value, which is the number of repeated attempts to fingerprint IP stacks if first attempts fail. If you enabled the fingerprinting option, enter a minimum certainty level. If a particular fingerprint is below the minimum certainty level, it is discarded from the scan results. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

7.

Reporting unauthorized MAC addresses

You can configure scans to report unauthorized MAC addresses as vulnerabilities. The Media Access Control (MAC) address is a hardware address that uniquely identifies each node in a network. In IEEE 802 networks, the Data Link Control (DLC) layer of the OSI Reference Model is divided into two sub layers: the Logical Link Control (LLC) layer and the Media Access Control (MAC) layer.The MAC layer interfaces directly with the network media. Each different type of network media requires a different MAC layer. On networks that do not conform to the IEEE 802 standards but do conform to the OSI Reference Model, the node address is called the Data Link Control (DLC) address. In secure environments it may be necessary to ensure that only certain machines can connect to the network. Also, certain conditions must be present for the successful detection of unauthorized MAC addresses:

SNMP must be enabled on the router or switch managing the appropriate network segment. The application must be able to perform authenticated scans on the SNMP service for the router or switch that is controlling the appropriate network segment. See Enabling authenticated scans of SNMP services on page 198. The application must have a list of trusted MAC address against which to check the set of assets located during a scan. See Creating a list of authorized MAC addresses on page 198. The scan template must have MAC address reporting enabled. See Enabling reporting of MAC addresses in the scan template on page 198. The Scan Engine performing the scan must reside on the same segment as the systems being scanned.

Nexpose Users Guide

197

Enabling authenticated scans of SNMP services

To enable the application to perform authenticated scans to obtain the MAC address, take the following steps: 1. Click Edit of the site for which you are creating the new scan template on the Home page of the console interface. The console displays the Site Configuration panel for that site. 2. 3. Go to the Credentials page and click Add credentials. The console displays a New Login box. Enter logon information for the SNMP service for the router or switch that is controlling the appropriate network segment. This will allow the application to retrieve the MAC addresses from the router using ARP requests. Test the credential if desired. For detailed information about configuring credentials, see Configuring scan credentials on page 42. 5. 6. Click Save. The new logon information appears on the Credentials page. Click the Save tab to save the change to the site configuration.

4.

Creating a list of authorized MAC addresses

To create a list of trusted MAC addresses, take the following steps: 1. Using a text editor, create a file listing trusted MAC addresses. The application will not report these addresses as violating the trusted MAC address vulnerability. You can give the file any valid name. Save the file in the application directory on the host computer for the Security Console. The default path in a Windows installation is: C:Program Files\[installation_directory]\plugins\java\1\NetworkScanners\1\[file_name] The default location under Linux is: /opt/[installation_directory]/java/1/NetworkScanners/1/[filename]

2.

Enabling reporting of MAC addresses in the scan template

To enable reporting of unauthorized MAC addresses in the scan template, take the following steps: 1. 2. 3. 4. Go to the Scan Template ConfigurationAsset Discovery page. Select the option to report unauthorized MAC addresses. Enter the full directory path location and file name of the file listing trusted Mac addresses. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

With the trusted MAC file in place and the scanner value set, the application will perform trusted MAC vulnerability testing. To do this it first makes a direct ARP request to the target asset to pick up its MAC address. It also retrieves the ARP table from the router or switch controlling the segment. Then, it uses SNMP to retrieve the MAC address from the asset and interrogates the asset using its NetBIOS name to retrieve its MAC address.

Nexpose Users Guide

198

Configuring service discovery

Once the application verifies that a host is live, or running, it begins to scan ports to collect information about services running on the computer. The target range for service discovery can include TCP and UDP ports. TCP ports (RFC 793) are the endpoints of logical connections through which networked computers carry on conversations. Well Known ports are those most commonly found to be open on the Internet. The range of ports may be extended beyond Well Known Port range. Each vulnerability check may add a set of ports to be scanned. Various back doors, trojan horses, viruses, and other worms create ports after they have installed themselves on computers. Rogue programs and hackers use these ports to access the compromised computers. These ports are not predefined, and they may change over time. Output reports will show which ports were scanned during vulnerability testing, including maliciously created ports. Various types of port scan methods are available as custom options. Most built-in scan templates incorporate the Stealth scan (SYN) method, in which the port scanner process sends TCP packets with the SYN (synchronize) flag. This is the most reliable method. It's also fast. In fact, a SYN port scan is approximately 20 times faster than a scan with the full-connect method, which is one of the other options for the TCP port scan method. The exhaustive template and penetration tests are exceptions in that they allow the application to determine the optimal scan method. This option makes it possible to scan through firewalls in some cases; however, it is somewhat less reliable. Although most templates include UDP ports in the scope of a scan, they limit UDP ports to wellknown numbers. Services that run on UDP ports include DNS, TFTP, and DHCP. If you want to be absolutely thorough in your scanning, you can include more UDP ports, but doing so will increase scan time.

Performance considerations for port scanning

Scanning all possible ports takes a lot of time. If the scan occurs through a firewall, and the firewall has been set up to drop packets sent to non-authorized devices, than a full-port scan may span several hours to several days. If you configure the application to scan all ports, it may be necessary to change additional parameters. Service discovery is the most resource-sensitive phase of scanning. The application sends out hundreds of thousands of packets to scan ports on a mere handful of assets. The more ports you scan, the longer the scan will take. And scanning the maximum number of ports is not necessarily more accurate. It is a best practice select target ports based on discovery data. If you simply are not sure of which ports to scan, use well known numbers. Be aware, though, that attackers may avoid these ports on purpose or probe additional ports for service attack opportunities.
NOTE: The application relies on network devices to return ICMP port unreachable packets for closed UDP ports.

If you want to be a little more thorough, use the target list of TCP ports from more aggressive templates, such as the exhaustive or penetration test template. If you plan to scan UDP ports, keep in mind that aside from the reliability issues discussed earlier, scanning UDP ports can take a significant amount of time. By default, the application will only send two UDP packets per second to avoid triggering the ICMP rate-limiting mechanisms that are built into TCP/IP stacks for most network devices. Sending more packets could result in packet loss. A full UDP port scan can take up to nine hours, depending on bandwidth and the number of target assets.

Nexpose Users Guide

199

To reduce scan time, do not run full UDP port scans unless it is necessary. UDP port scanning generally takes longer than TCP port scanning because UDP is a connectionless protocol. In a UDP scan, the application interprets non-response from the asset as an indication that a port is open or filtered, which slows the process. When configured to perform UDP scanning, the application matches the packet exchange pace of the target asset. Oracle Solaris only responds to 2 UDP packet failures per second as a rate limiting feature, so this scanning in this environment can be very slow in some cases.

Configuration steps for service discovery

TIP: You can achieve the most stealthy scan by running a vulnerability test with port scanning disabled. However, if you do so, the application will be unable to discover services, which will hamper fingerprinting and vulnerability discovery.

1. 2. 3.

Go to the Scan Template ConfigurationService Discovery page. Select a TCP port scan method from the drop-down list. Select which TCP ports you wish to scan from the drop-down list. If you want to scan additional TCP ports, enter the numbers or range in the Additional ports text box.

4.

Select which UDP ports you want to scan from the drop-down list. If you want to scan additional UDP ports, enter the desired range in the Additional ports text box. If you want to change the service names file, enter the new file name in the text box. This properties file lists each port and the service that commonly runs on it. If scans cannot identify actual services on ports, service names will be derived from this file in scan results. The default file, default-services.properties, is located in the following directory: <installation_directory/plugins/java/1/NetworkScanners/1. You can replace the file with a custom version that lists your own port/service mappings.

NOTE: Consult Technical Support to change the default service file setting.

5.

6.

Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Changing discovery performance settings

You can change default scan settings to maximize speed and resource usage during asset and service discovery. If you do not change any of these discovery performance settings, scans will auto-adjust based on network conditions. Changing packet-related settings can affect the triangle. See Keep the triangle in mind when you tune on page 187. Shortening send-delay intervals theoretically increases scan speeds, but it also can lead to network congestion depending on bandwidth. Lengthening send-delay intervals increases accuracy. Also, longer delays may be necessary to avoid blacklisting by firewalls or IDS devices.

Nexpose Users Guide

200

How ports are scanned

In the following explanation of how ports are scanned, the numbers indicated are default settings and can be changed. The application sends a block of 10 packets to a target port, waits 10 milliseconds, sends another 10 packets, and continues this process for each port in the range. At the end of the scan, it sends another round of packets and waits 10 milliseconds for each block of packets that have not received a response. The application repeats these attempts for each port five times. If the application receives a response within the defined number of retries, it will proceed with the next phase of scanning: service discovery. If it does not receive a response after exhausting all discovery methods defined in the template, it reports the asset as being DEAD in the scan log. When the target asset is on a local system segment (not behind a firewall), the scan occurs more rapidly because the asset will respond that ports are closed. The difficulty occurs when the device is behind a firewall, which consumes packets so that they do not return to the Scan Engine. In this case the application will wait the maximum time between port scans. TCP port scanning can exceed five hours, especially if it includes full-port scans of 65K ports. Try to scan the asset on the local segment inside the firewall. Try not to perform full TCP port scans outside a device that will drop the packets like a firewall unless necessary. You can change the following performance settings:
NOTE: For minimum retries, packet-per-second rate, and simultaneous connection requests, the default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Maximum retries
This is the maximum number of attempts to contact target assets. If the limit is exceeded with no response, the given asset is not scanned. The default number of UDP retries is 5, which is high for a scan through a firewall. If UDP scanning is taking longer than expected, try reducing the retry value to 2 or 3. You may be able speed up the scanning process by reducing the maximum retry count from the default of 4. Lowering the number of retries for sending packets is a good accuracy adjustment in a network with high-traffic or strict firewall rules. In an environment like this, its easier to lose packets. Consider setting the retry value at 3. Note that the scan will take longer.

Timeout interval
Set the number of milliseconds to wait between retries. You can set an initial timeout interval, which is the first setting that the scan will use. You also can set a range. For maximum timeout interval, any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. The discovery may auto-adjust interval settings based on varying network conditions.

Scan delay
This is the number of milliseconds to wait between sending packets to each target host.
NOTE: Reducing these settings may cause scan results to become inaccurate.

Increasing the delay interval for sending TCP packets will prevent scans from overloading routers, triggering firewalls, or becoming blacklisted by Intrusion Detection Systems (IDS). Increasing the delay interval for sending packets is another measure that increases accuracy at the expense of time. You can increase the accuracy of port scans by slowing them down with 10- to 25-millisecond delays.

Nexpose Users Guide

201

Packet-per-second rate
This is the number of packets to send each second during discovery attempts. Increasing this rate can increase scan speed. However, more packets are likely to be dropped in congestion-heavy networks, which can skew scan results.
NOTE: To enable the defeat rate limit, you must have the Stealth (SYN) scan method selected. See Scan templates on page 254.

An additional control, called Defeat Rate Limit (also known as defeat-rst-rate limit), enforces the minimum packet-per-second rate. This may improve scan speed when a target host limits its rate of RST (reset) responses to a port scan. However, enforcing the packet setting under these circumstances may cause the scan to miss ports, which lowers scan accuracy. Disabling the defeat rate limit may cause the minimum packet setting to be ignored when a target host limits its rate of RST (reset) responses to a port scan. This can increase scan accuracy.

Parallelism (simultaneous connection requests)

This is the number of discovery connection requests to be sent to target hosts simultaneously. More simultaneous requests can mean faster scans, subject to network bandwidth. This setting has no effect if values have been set for scan delay.

Configuration steps for tuning discovery performance

1. 2. 3. 4. 5. 6. 7. 8. Go to the Scan Template ConfigurationDiscovery Performance page. For Maximum retries, drag the slider to the left or right to adjust the value if desired. For Timeout interval, drag the sliders to the left or right to adjust the Initial, Minimum, and Maximum values if desired. For Scan Delay, drag the sliders to the left or right to adjust the values if desired. For Packet-per-second rate, drag the sliders to the left or right to adjust the Minimum and Maximum values if desired. Select the Defeat Rate Limit checkbox to enforce the minimum packet-persecond rate if desired. For Parallelism, drag the sliders to the left or right to adjust the Minimum and Maximum values if desired. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Nexpose Users Guide

202

Selecting vulnerability checks

When the application fingerprints an asset during the discovery phases of a scan, it automatically determines which vulnerability checks to perform, based on the fingerprint. On the Vulnerability Checks page of the Scan Template Configuration panel, you can manually configure scans to include more checks than those indicated by the fingerprint. You also can disable checks. Unsafe checks include buffer overflow tests against applications like IIS, Apache, services like FTP and SSH. Others include protocol errors in some database clients that trigger system failures. Unsafe scans may crash a system or leave a system in an indeterminate state, even though it appears to be operating normally. Scans will most likely not do any permanent damage to the target system. However, if processes running in the system might cause data corruption in the event of a system failure, unintended side effects may occur. The benefit of unsafe checks is that they can verify vulnerabilities that threaten denial of service attacks, which render a system unavailable by crashing it, terminating a service, or consuming services to such an extent that the system using them cannot do any work. You should run scheduled unsafe checks against target assets outside of business hours and then restart those assets after scanning. It is also a good idea to run unsafe checks in a pre-production environment to test the resistance of assets to denial-of-service conditions. If you want to perform checks for potential vulnerabilities, select the appropriate check box. For information about potential vulnerabilities, see Setting up scan alerts on page 39. If you want to correlate reliable checks with regular checks, select the appropriate check box. With this setting enabled, the application puts more trust in operating system patch checks to attempt to override the results of other checks that could be less reliable. Operating system patch checks are more reliable than regular vulnerability checks because they can confirm that a target asset is at a patch level that is known to be not vulnerable to a given attack. For example, if a vulnerability check is positive for an Apache Web server based on inspection the HTTP banner, but an operating system patch check determines that the Apache package has been patched for this specific vulnerability, it will not report a vulnerability. Enabling reliable check correlation is a best practice that reduces false positives. The application performs operating-system-level patch verification checks on the following targets:

NOTE: To use check correlation, you must use a scan template that includes patch verification checks, and you must typically include logon credentials in your site configuration. See Configuring scan credentials on page 42.

Microsoft Windows Red Hat CentOS Solaris VMware

A scan template may specify certain vulnerability checks to be enabled, which means that the application will scan only for those vulnerability check types or categories with that template. If you do not specifically enable any vulnerability checks, then you are essentially enabling all of them, except for those that you specifically disable. A scan template may specify certain checks as being disabled, which means that the application will scan for all vulnerabilities except for those vulnerability check types or categories with that template. In other words, if no checks are disabled, it will scan for all vulnerabilities. While the exhaustive template includes all possible vulnerability checks, the full audit and PCI audit templates exclude policy checks, which are more time consuming. The Web audit template appropriately only scans for Web-related vulnerabilities.

Nexpose Users Guide

203

Configuration steps for vulnerability check settings

1. Go to the Vulnerability Checks page. Note the order of precedence for modifying vulnerability check settings, which is described at the top of the page. 2. Click the appropriate check box to perform unsafe checks. A safe vulnerability check will not alter data, crash a system, or cause a system outage during its validation routines. Click Add categories.... The console displays a box listing vulnerability categories. 4.
NOTE: If you enable any specific vulnerability categories, you are implicitly disabling all other categories. Therefore, by not enabling specific categories, you are enabling all categories

TIP: To see which vulnerabilities are included in a category, click the category name.

3.

Click the check boxes for those categories you wish to scan for, and click Save. The console lists the selected categories on the Vulnerability Checks page. Click Remove categories... to prevent the application from scanning for vulnerability categories listed on the Vulnerability Checks page. Click the check boxes for those categories you wish to exclude from the scan, and click Save. The console displays Vulnerability Checks page with those categories removed.

5. 6.

To select types for scanning, take the following steps:

TIP: To see which vulnerabilities are included in a check type, click the check type name.

1. 2.

Click Add check types.... The console displays a box listing vulnerability types. Click the check boxes for those categories you wish to scan for, and click Save. The console lists the selected types on Vulnerability Checks page.

To avoid scanning for vulnerability types listed on the Vulnerability Checks page, click types listed on the Vulnerability Checks page: 1. 2. Click Remove check types.... Click the check boxes for those categories you wish to exclude from the scan, and click Save. The console displays Vulnerability Checks page with those types removed. The following table lists current vulnerability types and the number of vulnerability checks that are performed for each type. The list is subject to change, but it is current at the time of this guides publication. Vulnerability types
Default account Local Microsoft hotfix Patch Policy RPM

Vulnerability types
Safe Sun patch Unsafe Version Windows registry

Nexpose Users Guide

204

To select specific vulnerability checks, take the following steps: 1. Click Enable vulnerability checks... The console displays a box where you can search for specific vulnerabilities in the database. 2.
NOTE: The application only checks vulnerabilities relevant to the systems that it scans. It will not perform a check against a non-compatible system even if you specifically selected that check.

Type a vulnerability name, or a part of it, in the search box. Click check boxes to modify search settings as desired. Click Search. The box displays a table of vulnerability names that match your search criteria. Click the check boxes for vulnerabilities that you wish to include in the scan, and click Save. The selected vulnerabilities appear on the Vulnerability Checks page. Click Disable vulnerability checks... to exclude specific vulnerabilities from the scan. Search for the names of vulnerabilities you wish to exclude. The console displays the search results. Click the check boxes for vulnerabilities that you wish to exclude from the scan, and click Save. The selected vulnerabilities appear on the Vulnerability Checks page. A specific vulnerability check may be included in more than one type. If you enable two vulnerability types that include the same check, it will only run that check once.

3. 4. 5.

6. 7. 8.

9.

Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Fine-tuning vulnerability checks

The fewer the vulnerabilities included in the scan template, the sooner the scan completes. It is difficult to gauge how long exploit test actually take. Certain checks may require more time than others. Following are a few examples:

The Microsoft IIS directory traversal check tests 500 URL combinations. This can take several minutes against a busy Web server. Unsafe, denial-of-service checks take a particularly long time, since they involve large amounts of data or multiple requests to target systems. Cross-site scripting (CSS/XSS) tests may take a long time on Web applications with many forms.

Be careful not to sacrifice accuracy by disabling too many checksor essential checks. Choose vulnerability checks in a focused way whenever possible. If you are only scanning Web assets, enable Webrelated vulnerability checks. If you are performing a patch verification scan, enable hotfix checks. The application is designed to minimize scan times by grouping related checks in one scan pass. This limits the number of open connections and time interval that connections remain open. For checks relying solely on software version numbers, the application requires no further communication with the target system once it extracts the version information.

Nexpose Users Guide

205

Selecting Policy Manager checks

If you work for a U.S. government agency, a vendor that transacts business with the government or for a company with strict configuration security policies, you may be running scans to verify that your assets comply with United States Government Configuration Baseline (USGCB) policies, Center for Internet Security (CIS) benchmarks, or Federal Desktop Core Configuration (FDCC). Or you may be testing assets for compliance with customized policies based on these standards. The built-in USGCB, CIS, and FDCC scan templates include checks for compliance with these standards. See Scan templates on page 254. These templates do not include vulnerability checks, so if you want to run vulnerability checks with the policy checks, create a custom version of a scan template using one of the following methods:

Add vulnerability checks to a customized copy of USGCB, CIS, or FDCC template. Add USGCB, CIS, or FDCC checks to one of the other templates that includes the vulnerability checks that you want to run. Create a scan template and add USGCB, CIS, or FDCC checks and vulnerability checks to it.

To use the second or third method, you will need to select USGCB, CIS, or FDCC checks by taking the following steps. You must have a license that enables the Policy Manager and FDCC scanning. 1. 2. 3. 4. 5. 6. Select Policies in the General page of the Scan Template Configuration panel. Go to the Policy Manager page of the Scan Template Configuration panel. Select a policy. Review the name, affected platform, and description for each policy. Select the check box for any policy that you want to include in the scan. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

For information about verifying USGCB, CIS, or FDCC compliance, see Working with Policy Manager results on page 106.

Nexpose Users Guide

206

Configuring verification of standard policies

Configuring testing for Oracle policy compliance
To configure the application to test for Oracle policy compliance you must edit the default XML policy template for Oracle (oracle.xml), which is located in [installation_directory]/plugins/java/1/OraclePolicyScanner/1. To configure the application to test for Oracle policy compliance: 1. 2. 3. Copy the default template to a new file name. Edit the policy elements within the XML tags. Move the new template file back into the [installation_directory]/plugins/java/ 1/OraclePolicyScanner/1 directory.

To add credentials for Oracle Database policy compliance scanning: 1. 2. 3. 4. Go to the Credentials page for the site that will incorporate the new scan template. Select Oracle as the login service domain. Type a user name and password for an Oracle account with DBA access. See Configuring scan credentials on page 42. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Configure testing for Lotus Domino policy compliance

To configure the application to test for Lotus Domino policy compliance you must edit the default XML policy template for Lotus Domino (domino.xml), which is located in [installation_directory]/ plugins/java/1/NotesPolicyScanner/1. To configure the application to test for Lotus Domino policy compliance: 1. 2. 3. 4. Copy the default template to a new file name. Edit the policy elements within the XML tags. Move the new template file back into the [installation_directory]/plugins/java/ 1/NotesPolicyScanner/1. Go to the Lotus Domino Policy page and enter the new policy file name in the text field.

Nexpose Users Guide

207

To add credentials for Lotus Domino policy compliance scanning, 1. 2. 3. Go to the Credentials page for the site that will incorporate the new scan template. Select Lotus Notes/Domino as the login service domain. Type a Notes ID password in the text field. See Configuring scan credentials on page 42. For Lotus Notes/Domino policy compliance scanning, you must install a Notes client on the same host computer that is running the Security Console. 4. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Configure testing for Windows Group Policy compliance

You can configure Nexpose to verify whether assets running with Windows operating systems are compliant with Microsoft security standards. The installation package includes three different policy templates that list security criteria against that you can use to check settings on assets. These templates are the same as those associated with Windows Policy Editor and Active Directory Group Policy. Each template contains all of the policy elements for one of the three types of Windows target assets: workstation, general server, and domain controller. A target asset must meet all the criteria listed in the respective template for the application to regard it as compliant with Windows Group Policy. To view the results of a policy scan, create a report based on the Audit or Policy Evaluation report template. Or, you can create a custom report template that includes the Policy Evaluation section. See Fine-tuning information with custom report templates on page 168. The templates are .inf files located in the plugins/java/1/WindowsPolicyScanner/1 path relative to the application base installation directory:

NOTE: Use caution when running the same scan more than once with less than the lockout policy time delay between scans. Doing so could also trigger account lockout.

The basicwk.inf template is for workstations. The basicsv.inf template is for general servers. The basicdc.inf template is for domain controllers.

You also can import template files using the Security Templates Snap-In in the Microsoft Group Policy management Console, and then saving each as an .inf file with a specific name corresponding to the type of target asset. You must provide the application with proper credentials to perform Windows policy scanning. See Configuring scan credentials on page 42. Go to the Windows Group Policy page, and enter the .inf file names for workstation, general server, and domain controller policy names in the appropriate text fields. To save the new scan template, click Save.

Nexpose Users Guide

208

Configure testing for CIFS/SMB account policy compliance

Nexpose can test account policies on systems supporting CIFS/SMB, such as Microsoft Windows, Samba, and IBM AS/400: 1. 2. Go to the CIFS/SMB Account Policy page. Type an account lockout threshold value in the appropriate text field. This the maximum number of failed logins a user is permitted before the asset locks out the account. 3. 4. Type a minimum password length in the appropriate text field. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Configure testing for AS/400 policy compliance

To configure Nexpose to test for AS/400 policy compliance: 1. 2. Go to the AS/400 Policy page. Type an account lockout threshold value in the appropriate text field. This the maximum number of failed logins a user is permitted before the asset locks out the account. The number corresponds to the QMAXSIGN system value. 3. Type a minimum password length in the appropriate text field. This number corresponds to the QPWDMINLEN system value and specifies the minimum length of the password field required. 4. Select a minimum security level from the drop-down list. This level corresponds to the minimum value that the QSECURITY system value should be set to. The level values range from Password security (20) to Advanced integrity protection (50). 5. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Configure testing for UNIX policy compliance

To configure Nexpose to test for UNIX policy compliance: 1. 2. Go to the Unix Policy page. Type a number in the text field labeled Minimum account umask value. This setting controls the permissions that the target system grants to any new files created on it. If the application detects broader permissions than those specified by this value, it will report a policy violation. 3. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Nexpose Users Guide

209

Configuring Web spidering

Nexpose can spider Web sites to discover their directory structures, default directories, the files and applications on their servers, broken links, inaccessible links, and other information. The application then analyzes this data for evidence of security flaws, such as SQL injection, crosssite scripting (CSS/XSS), backup script files, readable CGI scripts, insecure password use, and other issues resulting from software defects or configuration errors. Some built-in scan templates use the Web spider by default:

Web audit HIPAA compliance Internet DMZ audit Payment Card Industry (PCI) audit Full audit

You can adjust the settings in these templates. You can also configure Web spidering settings in a custom template. The spider examines links within each Web page to determine which pages have been scanned. In many Web sites, pages that are yet to be scanned will show a base URL, followed by a parameter directed-link, in the address bar. For example, in the address www.exampleinc.com/index.html?id=6, the ?id=6 parameter probably refers to the content that should be delivered to the browser. If you enable the setting to include query strings, the spider will check the full string www.exampleinc.com/index.html?id=6 against all URL pages that have been already retrieved to see whether this page has been analyzed. If you do not enable the setting, the spider will only check the base URL without the ?id=6 parameter. To gain access to a Web site for scanning, the application makes itself appear to the Web server application as a popular Web browser. It does this by sending the server a Web page request as a browser would. The request includes pieces of information called headers. One of the headers, called UserAgent, defines the characteristics of a users browser, such as its version number and the Web application technologies it supports. User-Agent represents the application to the Web site as a specific browser, because some Web sites will refuse HTTP requests from browsers that they do not support. The default User-Agent string represents the application to the target Web site as Internet Explorer 7.

Nexpose Users Guide

210

Configuration steps and options for Web spidering

Configure general Web spider settings: 1.
NOTE: Including query strings with Web spidering check box causes the spider to make many more requests to the Web server. This will increase overall scan time and possibly affect the Web server's performance for legitimate users. NOTE: Changing the default user agent setting may alter the content that the application receives from the Web site.

Go to the Web Spidering page of the Scan Template Configuration panel. Select the check box to enable Web spidering. Select the appropriate check box to include query strings when spidering if desired. If you want the spider to test for persistent cross-site scripting during a single scan, select the check box for that option. This test helps to reduce the risk of dangerous attacks via malicious code stored on Web servers. Enabling it may increase Web spider scan times.

2. 3. 4.

5.

If you want to change the default value in the Browser ID (User-Agent) field enter a new value. If you are unsure of what to enter for the User-Agent string, consult your Web site developer.

6.

Select the option to check the use of common user names and passwords if desired. The application reports the use of these credentials as a vulnerability. It is an insecure practice because attackers can easily guess them. With this setting enabled, the application attempts to log onto Web applications by submitting common user names and passwords to discovered authentication forms. Multiple logon attempts may cause authentication services to lock out accounts with these credentials.

(Optional) Enable the Web spider to check for the use of weak credentials:
NOTE: This check may cause authentication services with certain security policies to lock out accounts with these commonly used credentials.

As the Web spider discovers logon forms during a scan, it can determine if any of these forms accept commonly used user names or passwords, which would make them vulnerable to automated attacks that exploit this practice. To perform the check, the Web spider attempts to log on through these forms with commonly used credentials. Any successful attempt counts as a vulnerability. 1. Go the Weak Credential Checking area on the Web spidering configuration page, and select the check box labeled Check use of common user names and passwords.

Configure Web spider performance settings: 1. Enter a maximum number of foreign hosts to resolve, or leave the default value of 100. This option sets the maximum number of unique host names that the spider may resolve. This function adds substantial time to the spidering process, especially with large Web sites, because of frequent cross-link checking involved. The acceptable host range is 1 to 500. 2. To delay the spiders requests to Web servers, enter a number of milliseconds in the appropriate field. Web servers with sensitive firewalls may require a delay before fulfilling spider requests. The acceptable range is 1-60000 milliseconds. 3. Enter the amount of time, in milliseconds, in the Spider response timeout field to wait for a response from a Web server. You can enter a value from 1 to 3600000 ms (1 hour). The default value is 120000 ms (2 minutes). The Web spider will retry the request based on the value specified in the Maximum retries for spider requests field.

Nexpose Users Guide

211

4.

Enter a number in the field labeled Maximum directory levels to spider to set a directory depth limit for Web spidering. Limiting directory depth can save significant time, especially with large sites. For unlimited directory traversal, type 0 in the field. The default value is 6. Enter a number in the field to set a maximum number of minutes for scanning each Web site. A time limit prevents scans from taking longer than allotted time windows for scan jobs, especially with large target Web sites. If you leave the default value of 0, no time limit is applied. The acceptable range is 1 to 500.

NOTE: If you run recurring scheduled scans with a time limit, portions of the target site may remain unscanned at the end of the time limit. Subsequent scans will not resume where the Web spider left off, so it is possible that the target Web site may never be scanned in its entirety.

5.

6.

Enter a number in the field to limit the number of pages that the spider requests. This is a time-saving measure for large sites. The acceptable range is 1 to 1,000,000 pages.

7.

NOTE: If you set both a time limit and a page limit, the Web spider will stop scanning the target Web site when the first limit is reached.

8.

Enter the number of time to retry a request after a failure in the Maximum retries for spider requests field. Enter a value from 0 to 100. A value of 0 means do not retry a failed request. The default value is 2 retries. Enter in the field the maximum number of spider threads that the application will deploy per Web server, or leave the default value of 3. Increasing the number of threads can speed up the scan. A significant increase in threads may affect another scan that is occurring simultaneously. The acceptable range is 1 to 999.

9.

Enter the names of any HTTP daemons that you would like the spider to bypass. Separate each name with a comma (,). If you leave the field blank, the application avoids the following daemons by default:

Virata-EmWeb Allegro-Software-RomPager JetDirect HP JetDirect HP Web Jetadmin HP-ChaiSOE HP-ChaiServer CUPS DigitalV6-HTTPD Rapid Logic Agranat-EmWeb cisco-IOS RAC_ONE_HTTP RMC Webserver EWS-NIC3 EMWHTTPD IOS

Nexpose Users Guide

212

10. Enter a number in the field to set a maximum link depth, or leave the default value of 6. This setting controls how many hyperlinks the spider will follow as it crawls through a site. Reducing the depth reduces coverage but speeds up the scan. The acceptable range is 1 to 100. 11. (Optional): To avoid scanning Web-connected printers, print servers, or multiuse devices such as a printer/scanner/fax machine, select the appropriate check box in the Restrictions section. Enforcing this restriction can reduce scan times. Also, scanning these devices can disrupt their operations. For example, scanning a printer may actually cause it to print unexpectedly. Configure Web spider settings related to regular expressions: 1. Enter a regular expression for sensitive data field names, or leave the default string. The application reports field names that are designated to be sensitive as vulnerabilities: Form action submits sensitive data in the clear. Any matches to the regular expression will be considered sensitive data field names. 2. Enter a regular expression for sensitive content. The application reports as vulnerabilities strings that are designated to be sensitive. If you leave the field blank, it does not search for sensitive strings.

Configure Web spider settings related to directory paths: 1. Select the check box to instruct the spider to adhere to standards set forth in the robots.txt protocol. Robots.txt is a convention that prevents spiders and other Web robots from accessing all or part of Web site that are otherwise publicly viewable. Enter the base URL paths for applications that are not linked from the main Web site URLs in the Bootstrap paths field if you want the spider to include those URLS. Example: /myapp. Separate multiple entries with commas. If you leave the field blank, the spider does not include bootstrap paths in the scan. 3. Enter the base URL paths to exclude in the Excluded paths field. Separate multiple entries with commas. If you specify excluded paths, the application does not attempt to spider those URLs or discovery any vulnerabilities or files associated with them. If you leave the field blank, the spider does not exclude any paths from the scan. Configure any other scan template settings as desired. When you have finished configuring the scan template, click Save.

NOTE: Scan coverage of any included bootstrap paths is subject to time and page limits that you set in the Web spider configuration. If the scan reaches your specified time or page limit before scanning bootstrap paths, it will not scan those paths.

2.

Nexpose Users Guide

213

Fine-tuning Web spidering

The Web spider crawls Web servers to determine the complete layout of Web sites. It is a thorough process, which makes it valuable for protecting Web sites. Most Web application vulnerability tests are dependent on Web spidering. Nexpose uses spider data evaluate custom Web applications for common problems such as SQL injection, cross-site scripting (CSS/XSS), backup script files, readable CGI scripts, insecure use of passwords, and many other issues resulting from custom software defects or incorrect configurations. By default, the Web spider crawls a site using three threads and a per-request delay of 20 ms. The amount of traffic that this generates depends on the amount of discovered, linked site content. If youre running the application on a multiple-processor system, increase the number of spider threads to three per processor. On an under-utilized network, you can safely increase the scan speed by lowering the delay to 0. Don't change the default delay setting on high-traffic networks. A complete Web spider scan will take slightly less than 90 seconds against a responsive server hosting 500 pages, assuming the target asset can serve one page on average per 150 ms with a default delay of 20ms per request. With no delay the spidering would take 75 seconds. A scan against the same server hosting 10,000 pages would take approximately 28 minutes, or 25 minutes with no delay. When you configure a scan template for Web spidering, enter the maximum number of directories, or depth, as well as the maximum number of pages to crawl per Web site. These values can limit the amount of time that Web spidering takes. By default, the spider ignores cross-site links and stays only on the end point it is scanning. If your asset inventory doesnt include Web sites, be sure to turn this feature off. It can be very time consuming.

Nexpose Users Guide

214

Configuring scans of various types of servers

Configuring spam relaying settings
Mail relay is a feature that allows SMTP servers to act as open gateways through which mail applications can send e-mail. Commercial operators, who send millions of unwanted spam e-mails, often target mail relay for exploitation. Most organizations now restrict mail relay services to specific domain users. To configure spam relay settings: 1. 2. Go to the Spam Relaying page: Type an e-mail address in the appropriate text field. This e-mail address should be external to your organization, such as a Yahoo! or Hotmail address. The application will attempt to send e-mail from this account to itself using any mail services and mail scripts that it discovers during the scan. If the application receives the e-mail, this indicates that the servers are vulnerable. 3. Type a URL in the HTTP_REFERRER to use field. This is typically a Web form that spammers might use to generate Spam emails. 4. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Configuring scans of database servers

Nexpose performs several classes of vulnerability and policy checks against a number of databases, including:

MS SQL/Server versions 6, 7, 2000, 2005, 2008 Oracle versions 6 through 10 Sybase Adaptive Server Enterprise (ASE) versions 9, 10 and 11 DB2 AS/400 PostgreSQL versions 6, 7, 8 MySQL

For all databases, the application discovers tables and checks system access, default credentials, and default scripts. Additionally, it tests table access, stored procedure access, and decompilation.

Nexpose Users Guide

215

To configure to scan database servers: 1. 2. 3. Go to the Database Servers page. Enter the name of a DB2 database in the appropriate text field that the database can connect to. Enter the name of a Postgres database in the appropriate text field that the application can connect to. Nexpose attempts to verify an SID on a target asset through various methods, such as discovering common configuration errors and default guesses. You can now specify additional SIDs for verification. 4. 5. Enter the names of Oracle SIDs in the appropriate text field, to which it can connect. Separate multiple SIDs with commas. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Configure scans of Web servers

Web designers and programmers may obscure site banners to help prevent attacks by outsiders against known or unknown vulnerabilities in the Web servers. Nexpose alternately detects Web servers by using behavioral analysis in addition to banner checking. You can configure the application to fingerprint Web servers. Doing so enables it to test for a series of known and unknown vulnerabilities, and error types as defined by the universal specification for Web servers. As specifications for Web services have changed over time, so the responses of Web servers has changed to keep track of those protocols. Early versions of Apache provide different responses to non-existent URLs than later versions, for example.
NOTE: The application will use the fingerprinting mechanism instead of the banner checker when you enable this setting. It will only use the banner checker if the behavioral engine is unable to detect the appropriate Web server version.

The application tracks various versions of Apache, Tomcat, JBOSS, Resin, Websphere and IIS to detect these behavioral adaptations to detect the Web server type. To configure scanning Web servers: 1. 2. 3. Go to the Web Servers page. Click the check box labeled Enable adaptive HTTP fingerprinting. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Fine-tuning Web site scanning

Adaptive HTTP fingerprinting can be useful method for gathering security-related information about a Web server. Nexpose identifies the type of server targeted by how the server behaves if its header information is missing or inaccurate. Note that this process can be slow, and has been known to crash poorly developed HTTP servers. You should disable this option if Web servers in your environment return reliable server banners.

Nexpose Users Guide

216

Configuring scans of mail servers

You can configure Nexpose to scan mail servers. To configure to scan mail servers: 1. 2. Go to the Mail Servers page. Type a read timeout value in the appropriate text field. This setting is the interval at which the application retries accessing the mail server. The default value is 30 seconds. 3. Type an inaccurate time difference value in the appropriate text field. This setting is a threshold outside of which the application will report inaccurate time readings by system clocks. The inaccuracy will be reported in the system log. 4. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Configuring scans of CVS servers

Nexpose tests a number of vulnerabilities in the Concurrent Versions System (CVS) code repository. For example, in versions prior to v1.11.11 of the official CVS server, it is possible for an attacker with write access to the CVSROOT/passwd file to execute arbitrary code as the cvsd process owner, which usually is root. To configure scanning CVS servers: 1. 2. 3. Go to the CVS Servers page. Enter the name of the CVS repository root directory in the text box. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Configuring scans of DHCP servers

DHCP Servers provide Border Gateway Protocol (BGP) information, domain naming help, and Address Resolution Protocol (ARP) table information, which may be used to reach hosts that are otherwise unknown. Hackers exploit vulnerabilities in these servers for address information. To configure Nexpose to scan DHCP servers: 1. 2. 3. Go to the DHCP servers page. Type a DHCP address range in the text field. The application will then target those specific servers for DHCP interrogation. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Nexpose Users Guide

217

Configuring scans of Telnet servers

Telnet is an unstructured protocol, with many varying implementations. This renders Telnet servers prone to yielding inaccurate scan results. You can improve scan accuracy by providing Nexpose with regular expressions. To configure scanning of Telnet servers: 1. 2. 3. 4. 5. 6. 7. Go to the Telnet Servers page. Type a character set in the appropriate text field. Type a regex for a logon prompt in the appropriate text field. Type a regex for a password prompt in the appropriate text field. Type a regex for failed logon attempts in the appropriate text field. Type a regex for questionable logon attempts in the appropriate text field. For more information, see Using regular expressions on page 248. Configure any other template settings as desired. When you have finished configuring the scan template, click Save.

Nexpose Users Guide

218

Configuring file searches on target systems

If Nexpose gains access to an assets file system by performing an exploit or a credentialed scan, it can search for the names of files in that system. File name searching is useful for finding software programs that are not detected by fingerprinting. It also is a good way to verify compliance with policies in corporate environments that don't permit storage of certain types of files on workstation drives:

copyrighted content confidential information, such as patient file data in the case of HIPAA compliance unauthorized software

The application reads the contents of these files, and it does not retrieve them. You can view the names of scanned file names in the File and Directory Listing pane of a scan results page.

Nexpose Users Guide

219

Using other tuning options

Beyond customizing scan templates, you can do other things to improve scan performance.

Change Scan Engine deployment

Depending on bandwidth availability, adding Scan Engines can reduce scan time over all, and it can improve accuracy. Where you put Scan Engines is as important as how many you have. Its helpful to place Scan Engines on both sides of network dividing points, such as firewalls. See the topic Distribute Scan Engines strategically in the administrator's guide.

Edit site configuration

Tailor your site configuration to support your performance goals. Try increasing the number of sites and making sites smaller. Try pairing sites with different scan templates. Adjust your scan schedule to avoid bandwidth conflicts.

Increase resources
Resources fall into two main categories:

Network bandwidth RAM and CPU capacity of hosts

If your organization has the means and ability, enhance network bandwidth. If not, find ways to reduce bandwidth conflicts when running scans. Increasing the capacity of host computers is a little more straightforward. The installation guide lists minimum system requirements for installation. Your system may meet those requirements, but if you want to bump up maximum number of scan threads, you may find your host system slowing down or becoming unstable. This usually indicates memory problems. If increasing scan threads is critical to meeting your performance goals, consider installing the 64-bit version of Nexpose. A Scan Engine running on a 64-bit operating system can use as much RAM as the operating system supports, as opposed to a maximum of approximately 4 GB on 32-bit systems. The vertical scalability of 64-bit Scan Engines significantly increases the potential number simultaneous scans that Nexpose can run. Always keep in mind that best practices for Scan Engine placement. See the topic Distribute Scan Engines strategically in the administrator's guide. Bandwidth is also important to consider.

Make your environment scan-friendly

Any well constructed network will have effective security mechanisms in place, such as firewalls. These devices will regard Nexpose as a hostile entity and attempt to prevent it from communicating with assets that they are designed to attack. If you can find ways to make it easier for the application to coexist with your security infrastructure without exposing your network to risk or violating security policiesyou can enhance scan speed and accuracy.

Nexpose Users Guide

220

For example, when scanning Windows XP workstations, you can take a few simple measures to improve performance:

Make the application a part of the local domain. Give the application the proper domain credentials. Configure the XP firewall to allow it to connect to Windows and perform patch-checking Edit the domain policy to give the application communication access to the workstations.

Open firewalls on Windows scan targets

You can open firewalls on Windows assets to allow Nexpose to perform deep scans on those targets within your network. By default, Microsoft Windows XP SP2, Vista, Server 2003, and Server 2008 enable firewalls to block incoming TCP/IP packets. Maintaining this setting is generally a smart security practice. However, a closed firewall limits the application to discovering network assets during a scan. Opening a firewall gives it access to critical, security-related data as required for patch or compliance checks. To find out how to open a firewall without disabling it on a Windows platform, see Microsofts documentation for that platform. Typically, a Windows domain administrator would perform this procedure.

Nexpose Users Guide

221

Creating a custom policy

NOTE: To edit policies you must have the Policy Editor license. Contact your account representative if you want to add this feature.

You create a custom policy by editing copies of built-in configuration policies or other custom policies. A policy consists of rules that may be organized within groups or sub-groups. You edit a custom policy to fit the requirements of your environment by changing the values required for compliance. You can create a custom policy and then periodically check the settings to improve scan results or adapt to changing organizational requirements. For example, you need a different way to present vulnerability data to show compliance percentages to your auditors. You create a custom policy to track one vulnerability to measure the risks over time and show improvements. Or you show what percentage of computers are compliant for a specific vulnerability. There are two policy types:

Built-in policies are installed with the application (Policy Manager configuration policies based on USGCB, FDCC, or CIS). These policies are not editable. Policy Manager is a license-enabled scanning feature that performs checks for compliance with United States Government Configuration Baseline (USGCB) policies, Center for Internet Security (CIS) benchmarks, and Federal Desktop Core Configuration (FDCC) policies.

Custom policies are editable copies of built-in policies. You can make copies of a custom policy if you need custom policies with similar changes, such as policies for different locations.

You can determine which policies are editable (custom) on the Policy Listing table. The Source column displays which policies are built-in and custom. The Copy, Edit and Delete buttons display for only custom policies for users with Manage Policies permission.

Policy viewing the policy source column

Editing policies during a scan

You can edit policies during a scan without affecting your results. While you modify policies, manual or scheduled scans that are in process or paused scans that are resumed use the policy configuration settings in effect when the scan initially launched. Changes saved to a custom policy are applied during the next scheduled scan or a subsequent manual scan. If your session times out when you try to save a policy, reestablish a session and then save your changes to the policy.

Nexpose Users Guide

222

Editing a policy
NOTE: To edit policies, you need Manage Policies permissions. Contact your administrator about your user permissions.

The following section demonstrates how to edit the different items in a custom policy. You can edit the following items:

custom policycustomize name and description groupscustomize name and description rulescustomize name and description and modify the values for checks

To create an editable policy, complete these steps: 1. Click Copy next to a built-in or custom policy.

Policy copying a built-in policy

The application creates a copy of the policy. 2. You can modify the Name to identify which policies are customized for your organization. For example, add your organization name or abbreviation, such as XYZ Org -USGCB 1.2.1.0 - Windows 7 Firewall.

Policy creating a custom policy

A unique ID (UID) is assigned to built-in and saved custom policies. If you use the same name for multiple policies then a UID icon ( ) displays when you save the custom policy. When you are adding policies to a scan template, refer to the UID if there are multiple policies with the same name. This helps you select the correct policy for the scan template.

Nexpose Users Guide

223

Policy viewing the UID for policies with duplicate names

Hover over the UID icon to display the unique ID for the policy. 3. (Optional) You can modify the Description to explain what settings are applied in the custom policy using this policy.

Policy Editor editing custom policy name and description

4.

Click Save.

Viewing policy hierarchy

The Policy Configuration panel displays the groups and rules in item order for the selected policy. By opening the groups, you drill down to an individual group or rule in a policy.

Policy viewing the policy hierarchy

Nexpose Users Guide

224

To view policy hierarchy for password rules, complete these steps: 1. Click View on the Policy Listing table to display the policy configuration.

Policy clicking View to display the policy

2.

Click the icon to expand groups or rules to display details on the Policy Configuration panel. Use the policy Find box to locate a specific rule. See Using policy find on page 226.

Policy viewing the policy hierarchy

3.

Select an item (rule or group) in the policy tree (hierarchy) to display the detail in the right panel. For example, your organization has specific requirements for password compliance. Select the Password Complexity rule to view the checks used during a scan to verify password compliance. If your organization policy does not enforce strong passwords then you can change the value to Disabled.

Nexpose Users Guide

225

Using policy find

Use the policy find to quickly locate the policy item that you want to modify.

Policy typing search criteria

For example, type IPv6 to locate all policy items with that criteria. Click the Up ( ( ) arrows to display the next or previous instance of IPv6 found by the policy find. To find an item in a policy, complete these steps: 1. Type a word or phrase in the policy Find box. For example, type password.

) and Down

As you type, the application searches then highlights all matches in the policy hierarchy.

Policy browsing find results

2. 3. 4.

Click the Up ( ) and Down ( ) arrows to move to the next or previous items that match the find criteria. (Optional) Refine your criteria if you receive too many results. For example, replace password with password age. To clear the find results, click Clear ( ).

Nexpose Users Guide

226

Editing policy groups

You modify the group Name and Description to change the description of items that you customized. The policy find uses this text to locate items in the policy hierarchy. See Using policy find on page 226.

Policy editing group name or description

You select a group in the policy hierarchy to display the details. You can modify this text to identify which groups contain modified (custom) rules and add a description of what type of changes.

Editing policy rules

You can modify policy rules to get different scan results. You select a rule in the Policy Configuration hierarchy to see the list of editable checks and values related to that rule. To edit a rule value, complete these steps: 1. Select a rule in the policy hierarchy. The rule details display.

Policy selecting a rule

Nexpose Users Guide

227

(Optional) Customize the Name and Description for your organization. Text in the Name is used by policy find. See Using policy find on page 226.

Policy modifying rule values

2.

Modify the checks for the rule using the fields displayed. Refer to the guidelines about what value to apply to get the correct result. For example, disable the Use FIPS compliant algorithms for encryption, hashing and signing rule by typing 0 in the text box.

Policy disabling a rule

For example, change the Behavior of the elevation prompt for administrators in Admin Approval Mode check by typing a value for the total seconds. The guidelines list the options for each value.

Policy entering the value for a check option.

3. 4.

Repeat these steps to edit other rules in the policy. Click Save.

Deleting a policy
NOTE: To delete policies, you need Manage Policies permissions. Contact your administrator about your user permissions.

You can remove custom policies that you no longer use. When you delete a policy, all scan data related to the policy is removed. The policy must be removed from scan templates and report configurations before deleting. Click Delete for the custom policy that you want to remove. If you try to delete a policy while running a scan, then a warning message displays indicating that the policy can not be deleted.

Nexpose Users Guide

228

Adding Custom Policies in Scan Templates

NOTE: To perform policy checks in scans, make sure that your Scan Engines are updated to the August 8, 2012 release.

You add custom policies to the scan templates to apply your modifications across your sites. The Policy Manager list contains the custom policies.

Policy enabling a custom policy in the scan template

Click Custom Policies to display the custom policies. Select the custom policies to add. See Working with scan templates and tuning scan performance on page 185 for more detail about fine tuning scan templates.

Nexpose Users Guide

229

Uploading custom SCAP policies

NOTE: To upload policies you must have the Policy Editor capability enabled in your license. Contact your account representative if you want to update your license.

There is no one-size-fits-all solution for managing configuration security. The application provides policies that you can apply to scan your environments. However, you may create custom scripts to verify items specific to your company, such as health check scripts that prioritize security settings. You can create policies from scratch, upload your custom content to use in policy scans, and run it with your other policy and vulnerability checks. You must log on as Global Administrator to upload policies.

File specifications
Policy files must be compressed to an archive (ZIP or JAR file format) with no folder structure. The archive can contain only XML or TXT files. If the archive contains other file types, such as CSV, then the application does not upload the policy. The archive file must contain the following XML files:

XCCDF fileThis file contains the structure of the policy. It must have a unique name (title) and ID (benchmark ID). This file is required. The SCAP XCCDF benchmark file name must end with -xccdf.xml (For example, XYZ-xccdf.xml). OVAL fileThese files contain policy checks. These file names must end with -oval.xml (For example, XYZ-oval.xml). If unsupported OVAL check types are in the policy, the policy fails to upload. The policy files must contain supported OVAL check types, such as:

accesstoken_test auditeventpolicysubcategories_test auditeventpolicy_test family_test fileeffectiverights53_test lockoutpolicy_test passwordpolicy_test registry_test sid_test unknown_test user_test variable_test

Nexpose Users Guide

230

The following XML files can be included in the archive file to define specific policy information. These files are not required for a successful upload.

CPE filesThese files contain the Uniform Resource Identifiers (URI) that correspond to fingerprinted platforms and applications. The file must begin with cpe: and includes segments for the hardware facet, the operating system facet, and the application environment facet of the fingerprinted item (For example, cpe:/o:microsoft:windows_xp:-:sp3:professional). CCE filesThese files contain CCE identifiers for known system configurations to facilitate fast and accurate correlation of configuration data across multiple information sources and tools. CVE filesThese files contain CVE (Common Vulnerabilities and Exposures) identifiers to known vulnerabilities and exposures.

Version and file name conventions

NOTE: The application does not upload custom policies with the same name and benchmark ID as an existing policy.

You can name your custom policies to meet your companys needs. The application identifies policies by the benchmark ID and title. You must create unique names and IDs in your benchmark file to upload them successfully. The application verifies that the benchmark version to identifies a benchmark (v1.2.1.0) that is supported.

Uploading SCAP policies

NOTE: Custom policies uploaded to the application can be edited using the Policy Manager. See Creating a custom policy on page 222.

To upload a policy, complete the following steps: 1. 2. Click the Policies tab. Click the Upload Policy button. If you cannot see this button then you must log on as Global Administrator.

Clicking the Upload Policy button

The system displays the Upload a policy panel.

Nexpose Users Guide

231

Entering SCAP policy file information

3.

Enter a name to identify the policy. This is a required field. To identify which policies are customized for your organization you can devise a file naming convention. For example, add your organization name or abbreviation, such as XYZ Org -USGCB 1.2.1.0 - Windows 7 Firewall.

4. 5. 6.

Enter a description that explains what settings are applied in the custom policy. Click the Browse button to locate the archive file. Click the Upload button to upload the policy.

If the policy uploads successfully, go to step 7. If you receive an error message the policy is not loaded. You must resolve the issue noted in the error message then repeat these steps until the policy loads successfully. For more information about errors, see Troubleshooting upload errors on page 233.

7.

You must restart the application to complete the upload and apply your uploaded policies. After restarting, your custom policies appear in the Policy Listing panel on the Policies page. You can edit these policies using the Policy Manager. See Creating a custom policy on page 222.

8.

Add your custom policies to the scan templates to apply to future scans. See Adding Custom Policies in Scan Templates on page 229.

Nexpose Users Guide

232

Troubleshooting upload errors

Policies are not uploaded to the application unless certain criteria are met. Error messages identify the criteria that have not been met. You must resolve the issues and upload the policy successfully to apply your custom SCAP policy to scans. This table lists common errors and resolutions. Error
The SCAP XCCDF Benchmark file [value] cannot be parsed. Content is not allowed in prolog.

Resolution
The following list describes some issues to verify in the SCAP XCCDF benchmark file: The SCAP XCCDF benchmark file is not an XML file. There are characters positioned before the first bracket (<). For example: abc<?xml version="1.0" encoding="UTF-8"> There are hidden characters at the beginning of the SCAP XCCDF benchmark file. The following items are hidden characters: - White space - Byte Order Mark character in UTF8 encoded XML file, that is caused by text editors like Microsoft Notepad. - Any other type of invisible characters. Use a hex editor to remove the hidden characters. There is a mismatch in the encoding declaration and the SCAP XCCDF benchmark file. For example, there is a UTF8 declaration for a UTF16 XML file. The SCAP XCCDF benchmark file contains unsupported character encoding. If the XML encoding declaration is missing then it will default to the servers default encoding. If the XML content contains characters that are not supported by the default character encoding then the SCAP XCCDF benchmark file cannot be parsed. Add a UTF8 declaration to the SCAP XCCDF benchmark file. The application cannot find the SCAP XCCDF benchmark file in the archive. The SCAP XCCDF benchmark file name must end with -xccdf.xml (For example, XYZ-xccdf.xml). The archive (ZIP or JAR) cannot have a folder structure. Verify that the SCAP XCCDF benchmark file exists in the archive using the required naming convention.

The SCAP XCCDF Benchmark file cannot be found. Verify that the SCAP XCCDF benchmark file name ends in -xccdf.xml and is not under a folder in the archive.

The SCAP XCCDF Benchmark version could not be found in [value].

The SCAP XCCDF benchmark file must contain a valid schema version. Add the schema version (SCAP policy) to the SCAP XCCDF benchmark file.

The SCAP XCCDF Benchmark version [value] is unsupported.

The SCAP XCCDF benchmark file must contain a version in supported format (for example, 1.1.4). The application currently supports version 1.1.4 or earlier. Replace the version number using a valid format. Verify that there are no blank spaces.

The SCAP XCCDF Benchmark file must contain an ID for the Benchmark to be uploaded.

The SCAP XCCDF benchmark file must contain a benchmark ID. Add a benchmark ID to the SCAP XCCDF benchmark file.

NOTE: In this table, [value] is a placeholder for a specific reference in the error message. (Sheet 1 of 4)

Nexpose Users Guide

233

Error
The SCAP XCCDF Benchmark file [value] contains a Benchmark ID that contains an invalid character: [value]. The Benchmark cannot be uploaded. The SCAP XCCDF Benchmark file [value] contains a reference to an OVAL definition file [value] that is not included in the archive. The SCAP XCCDF Benchmark file [value] contains a test [value] that is not supported within the product. The test must be removed for the policy to be uploaded. The uploaded archive is not a valid zip or jar archive.

Resolution
The benchmark ID has an invalid character, such as a blank space. Replace the benchmark ID using a valid format.

Verify that the archive file contains all policy definition files referenced in the SCAP XCCDF benchmark file. Or remove the reference to the missing definition file.

The SCAP XCCDF benchmark file includes a test that the application does not support. Remove the test from the SCAP XCCDF benchmark file .

The format of the archive is invalid. The archive (ZIP or JAR) cannot have a folder structure. Compress your policy files to an archive (ZIP or JAR) with no folder structure.

The SCAP XCCDF Benchmark file contains a rule [value] that refers to a check system that is not supported. Please only use OVAL check systems. The item [value] is not a XCCDF Benchmark or Group. Only XCCDF Benchmarks or Groups can contain other items. The SCAP XCCDF item [value] requires a group or rule [value] to be enabled that is not present in the Benchmark and cannot be uploaded. The SCAP XCCDF item [value] requires a group or rule [value] to not be enabled that is not present in the Benchmark and cannot be uploaded. The SCAP XCCDF item [value] requires a group or rule [value] to not be enabled, but the item reference is neither a group or rule. The Benchmark cannot be uploaded The SCAP XCCDF Benchmark contains two profiles with the same Profile ID [value]. This is illegal and the Benchmark cannot be uploaded.

There are unsupported items (such as OVAL check types). Remove the unsupported items from the SCAP XCCDF benchmark file.

Revise the SCAP XCCDF benchmark file. so only benchmarks or groups contain other benchmark items.

A requirement in the SCAP XCCDF benchmark file is missing a reference to a group or rule. Review the requirement specified in the error message to determine what group or rule to add. A conflict in the SCAP XCCDF benchmark file is referencing an item that is not recognized or is the wrong item. Review the conflict specified in the error message to determine which item to replace. A conflict in the SCAP XCCDF benchmark file is missing a reference to a group or rule. Review the conflict specified in the error message to determine what group or rule to add.

There are two profiles in the SCAP XCCDF benchmark file that have the same ID. Revise the SCAP XCCDF benchmark file so that each <profile> has a unique ID.

NOTE: In this table, [value] is a placeholder for a specific reference in the error message. (Sheet 2 of 4)

Nexpose Users Guide

234

Error
The SCAP XCCDF Benchmark contains a value [value] that does not have a default value set. The value [value] must have a default value defined if there is no selector tag. The Benchmark failed to upload. The SCAP XCCDF Benchmark [value] contains reference to a CPE platform [value] that is not referenced in the CPE Dictionary. The SCAP XCCDF Benchmark cannot be uploaded. The SCAP XCCDF Benchmark file [value] contains an infinite loop and is illegal. The Benchmark cannot be uploaded. The SCAP XCCDF Benchmark file [value] contains an item that attempts to extend another item that does not exist, or is an illegal extension. The Benchmark cannot be uploaded. The referenced check [value] in [value] is invalid or missing.

Resolution
A default selection must be included for items with multiple options for an element, such as a rule. If the item has multiple options that can be selected then you must specify the default option.

The application does not recognize CPE platform reference in the SCAP XCCDF benchmark file. Remove the CPE platform reference from the SCAP XCCDF benchmark file.

Review the SCAP XCCDF benchmark file to locate the infinite loop and revise the code to correct this error.

There is an item referenced in the SCAP XCCDF benchmark file that is not included in the Benchmark. Revise the SCAP XCCDF benchmark file to remove the reference to the missing item or add the item to the Benchmark. There is an check referenced in the SCAP XCCDF benchmark file that is not included in the Benchmark. Revise the SCAP XCCDF benchmark file to remove the reference to the missing check or add the check to the Benchmark.

[value] benchmark files were found within the archive, you can only upload one benchmark at a time.

The archive must contain only one benchmark or it cannot be uploaded. Create a separate archive for each benchmark and upload each archive to the application. The application cannot resolve the value within the policy. Review the benchmark and revise the value. The SCAP XCCDF benchmark file cannot be parsed due to the issue indicated at the end of the error message.

The SCAP XCCDF Benchmark Value [value] cannot be created within the policy [value]. The SCAP XCCDF Benchmark file [value] cannot be parsed. [value] The SCAP XCCDF item [value] does not reference a valid value [value] and the Benchmark cannot be parsed.

A requirement in the SCAP XCCDF benchmark file is referencing an item that is not recognized or is the wrong item. Review the requirement specified in the error message to determine which item to replace.

The SCAP XCCDF Benchmark file contains a XCCDF Value [value] that has no value provided. The Benchmark cannot be parsed.

Add a value to XCCDF value reference in the SCAP XCCDF benchmark file.

NOTE: In this table, [value] is a placeholder for a specific reference in the error message. (Sheet 3 of 4)

Nexpose Users Guide

235

Error
The SCAP OVAL file [value] cannot be parsed. [value] The SCAP OVAL Source file [value] could not be found.

Resolution
This parsing error identifies the issue preventing the SCAP OVAL file from loading. Review the SCAP OVAL file and located the issue listed in the error message to determine the appropriate revision. The application cannot find the SCAP OVAL Source file in the archive. This file must end with -oval.xml or -patches.xml. Verify that the SCAP OVAL Source file exists in the archive and the file name ends in the correct format.

NOTE: In this table, [value] is a placeholder for a specific reference in the error message. (Sheet 4 of 4)

Nexpose Users Guide

236

Working with risk strategies to analyze threats

One of the biggest challenges to keeping your environment secure is prioritizing remediation of vulnerabilities. If Nexpose discovers hundreds or even thousands of vulnerabilities with each scan, how do you determine which vulnerabilities or assets to address first? Each vulnerability has a number of characteristics that indicate how easy it is to exploit and what an attacker can do to your environment after performing an exploit. These characteristics make up the vulnerabilitys risk to your organization. Every asset also has risk associated with it, based on how sensitive it is to your organizations security. For example, if a database that contains credit card numbers is compromised, the damage to your organization will be significantly greater than if a printer server is compromised. The application provides several strategies for calculating risk. Each strategy emphasizes certain characteristics, allowing you to analyze risk according to your organizations unique security needs or objectives. You can also create custom strategies and integrate them with the application. After you select a risk strategy you can use it in the following ways:

Sort how vulnerabilities appear in Web interface tables according to risk. By sorting vulnerabilities you can make a quick visual determination as to which vulnerabilities need your immediate attention and which are less critical. View risk trends over time in reports, which allows you to track progress in your remediation effort or determine whether risk is increasing or decreasing over time in different segments of your network.

Working with risk strategies involves the following activities:

Changing your risk strategy and recalculating past scan data on page 241 Using custom risk strategies on page 243 Changing the appearance order of risk strategies on page 245

Nexpose Users Guide

237

Comparing risk strategies

Each risk strategy is based on a formula in which factors such as likelihood of compromise, impact of compromise, and asset importance are calculated. Each formula produces a different range of numeric values. For example, the Real Risk strategy produces a maximum score of 1,000, while the Temporal strategy has no upper bounds, with some high-risk vulnerability scores reaching the hundred thousands. This is important to keep in mind if you apply different risk strategies to different segments of scan data. See Changing your risk strategy and recalculating past scan data on page 241. Many of the available risk strategies use the same factors in assessing risk, each strategy evaluating and aggregating the relevant factors in different ways. The common risk factors are grouped into three categories: vulnerability impact, initial exploit difficulty, and threat exposure. The factors that comprise vulnerability impact and initial exploit difficulty are the six base metrics employed in the Common Vulnerability Scoring System (CVSS).

Vulnerability impact is a measure of what can be compromised on an asset when attacking it through the vulnerability, and the degree of that compromise. Impact is comprised of three factors:

Confidentiality impact indicates the disclosure of data to unauthorized individuals or systems. Integrity impact indicates unauthorized data modification. Availability impact indicates loss of access to an asset's data.

Initial exploit difficulty is a measure of likelihood of a successful attack through the vulnerability, and is comprised of three factors:

Access vector indicates how close an attacker needs to be to an asset in order to exploit the vulnerability. If the attacker must have local access, the risk level is low. Lesser required proximity maps to higher risk. Access complexity is the likelihood of exploit based on the ease or difficulty of perpetrating the exploit, both in terms of the skill required and the circumstances which must exist in order for the exploit to be feasible. Lower access complexity maps to higher risk. Authentication requirement is the likelihood of exploit based on the number of times an attacker must authenticate in order to exploit the vulnerability. Fewer required authentications map to higher risk.

Nexpose Users Guide

238

Threat exposure includes three variables:

Vulnerability age is a measure of how long the security community has known about the vulnerability. The longer a vulnerability has been known to exist, the more likely that the threat community has devised a means of exploiting it and the more likely an asset will encounter an attack that targets the vulnerability. Older vulnerability age maps to higher risk. Exploit exposure is the rank of the highest-ranked exploit for a vulnerability, according to the Metasploit Framework. This ranking measures how easily and consistently a known exploit can compromise a vulnerable asset. Higher exploit exposure maps to higher risk. Malware exposure is a measure of the prevalence of any malware kits, also known as exploit kits, associated with a vulnerability. Developers create such kits to make it easier for attackers to write and deploy malicious code for attacking targets through the associated vulnerabilities.

Review the summary of each model before making a selection.

Real Risk strategy

This strategy is recommended because you can use it to prioritize remediation for vulnerabilities for which exploits or malware kits have been developed. A security hole that exposes your environment to an unsophisticated exploit or an infection developed with a widely accessible malware kit is likely to require your immediate attention. The Real Risk algorithm applies unique exploit and malware exposure metrics for each vulnerability to CVSS base metrics for likelihood and impact. Specifically, the model computes a maximum impact between 0 and 1,000 based on the confidentiality impact, integrity impact, and availability impact of the vulnerability. The impact is multiplied by a likelihood factor that is a fraction always less than 1. The likelihood factor has an initial value that is based on the vulnerability's initial exploit difficulty metrics from CVSS: access vector, access complexity, and authentication requirement. The likelihood is modified by threat exposure: likelihood matures with the vulnerability's age, growing ever closer to 1 over time. The rate at which the likelihood matures over time is based on exploit exposure and malware exposure. A vulnerability's risk will never mature beyond the maximum impact dictated by its CVSS impact metrics. The Real Risk strategy can be summarized as base impact, modified by initial likelihood of compromise, modified by maturity of threat exposure over time. The highest possible Real Risk score is 1,000.

Nexpose Users Guide

239

TemporalPlus strategy
Like the Temporal strategy, TemporalPlus emphasizes the length of time that the vulnerability has been known to exist. However, it provides a more granular analysis of vulnerability impact by expanding the risk contribution of partial impact vectors. The TemporalPlus risk strategy aggregates proximity-based impact of the vulnerability, using confidentiality impact, integrity impact, and availability impact in conjunction with access vector. The impact is tempered by an aggregation of the exploit difficulty metrics, which are access complexity and authentication requirement. The risk then grows over time with the vulnerability age. The TemporalPlus strategy has no upper bounds. Some high-risk vulnerability scores reaching the hundred thousands. This strategy distinguishes risk associated with vulnerabilities with partial impact values from risk associated with vulnerabilities with none impact values for the same vectors. This is especially important to keep in mind if you switch to TemporalPlus from the Temporal strategy, which treats them equally. Making this switch will increase the risk scores for many vulnerabilities already detected in your environment.

Temporal strategy
This strategy emphasizes the length of time that the vulnerability has been known to exist, so it could be useful for prioritizing older vulnerabilities for remediation. Older vulnerabilities are regarded as likelier to be exploited because attackers have known about them for a longer period of time. Also, the longer a vulnerability has been in an existence, the greater the chance that less commonly known exploits exist. The Temporal risk strategy aggregates proximity-based impact of the vulnerability, using confidentiality impact, integrity impact, and availability impact in conjunction with access vector. The impact is tempered by dividing by an aggregation of the exploit difficulty metrics, which are access complexity and authentication requirement. The risk then grows over time with the vulnerability age. The Temporal strategy has no upper bounds. Some high-risk vulnerability scores reach the hundred thousands.

Nexpose Users Guide

240

Weighted strategy
The Weighted strategy can be useful if you assign levels of importance to sites or if you want to assess risk associated with services running on target assets. The strategy is based primarily on site importance, asset data, and vulnerability types, and it emphasizes the following factors:

vulnerability severity, which is the numberranging from 1 to 10that the application calculates for each vulnerability number of vulnerability instances number and types of services on the asset; for example, a database has higher business value the level of importance, or weight, that you assign to a site when you configure it; see Configuring a dynamic site on page 63 or Configuring a basic static site on page 25. Weighted risk scores scale with the number of vulnerabilities. A higher number of vulnerabilities on an asset means a higher risk score. The score is expressed in single- or double-digit numbers with decimals.

Changing your risk strategy and recalculating past scan data

You may choose to change the current risk strategy to get a different perspective on the risk in your environment. Because making this change could cause future scans to show risk scores that are significantly different from those of past scans, you also have the option to recalculate risk scores for past scan data. Doing so provides continuity in risk tracking over time. If you are creating reports with risk trend charts, you can recalculate scores for a specific scan date range to make those scores consistent with scores for future scans. This ensures continuity in your risk trend reporting. For example, you may change your risk strategy from Temporal to Real Risk on December 1 to do exposure-based risk analysis. You may want to demonstrate to management in your organization that investment in resources for remediation at the end of the first quarter of the year has had a positive impact on risk mitigation. So, when you select Real Risk as your strategy, you will want to calculate Real Risk scores for all scan data since April 1. Calculation time varies. Depending on the amount of scan data that is being recalculated, the process may take hours. You cannot cancel a recalculation that is in progress.

Nexpose Users Guide

241

NOTE: You can perform regular activities, such as scanning and reporting while a recalculation is in progress. However, if you run a report that incorporates risk scores during a recalculation, the scores may appear to be inconsistent. The report may incorporate scores from the previously used risk strategy as well as from the newly selected one.

To change your risk strategy and recalculate past scan data, take the following steps: Go to the Risk Strategies page. 1. 2. 3. Click the Administration tab in the Security Console Web interface. The console displays the Administration page. Click Manage for Global Settings. The Security Console displays the Global Settings panel. Click Risk Strategy in the left navigation pane. The Security Console displays the Risk Strategies page Select a new risk strategy. 1. Click the arrow for any risk strategy on the Risk Strategies page to view information about it. Information includes a description of the strategy and its calculated factors, the strategys source (built-in or custom), and how long it has been in use if it is the currently selected strategy. 2. 3. 4. Click the radio button for the desired risk strategy. Select Do not recalculate if you do not want to recalculate scores for past scan data. Click Save. You can ignore the following steps.

(Optional) View risk strategy usage history. This allows you to see how different risk strategies have been applied to all of your scan data. This information can help you decide exactly how much scan data you need to recalculate to prevent gaps in consistency for risk trends. It also is useful for determining why segments of risk trend data appear inconsistent. 1. 2. Click Usage history on the Risk Strategies page. Click the Current Usage tab in the Risk Strategy Usage box to view all the risk strategies that are currently applied to your entire scan data set. Note the Status column, which indicates whether any calculations did not complete successfully. This could help you troubleshoot inconsistent sections in your risk trend data by running the calculations again. 3. Click the Change Audit tab to view every modification of risk strategy usage in the history of your installation. The table in this section lists every instance that a different risk strategy was applied, the affected date range, and the user who made the change. This information may also be useful for troubleshooting risk trend inconsistencies or for other purposes. 4. (Optional) Click the Export to CSV icon to export the change audit information to CSV format, which you can use in a spreadsheet for internal purposes.

Nexpose Users Guide

242

Recalculate risk scores for past scan data. 1. Click the radio button for the date range of scan data that you want to recalculate. If you select Entire history, the scores for all of your data since your first scan will be recalculated. Click Save. The console displays a box indicating the percentage of recalculation completed.

2.

Using custom risk strategies

You may want to calculate risk scores with a custom strategy that analyzes risk from perspectives that are very specific to your organizations security goals. You can create a custom strategy and use it in Nexpose. Each risk strategy is an XML document. It requires the RiskModel element, which contains the id attribute, a unique internal identifier for the custom strategy. RiskModel contains the following required sub-elements.

NOTE: The Rapid7 Professional Services Organization (PSO) offers custom risk scoring development. For more information, contact your account manager.

name: This is the name of the strategy as it will appear in the Risk Strategies page of the Web interface. The datatype is xs:string. description: This is the description of the strategy as it will appear in the Risk Strategies page of the Web interface. The datatype is xs:string. VulnerabilityRiskStrategy: This sub-element contains the mathematical formula for the strategy. It is recommended that you refer to the XML files of the builtin strategies as models for the structure and content of the VulnerabilityRiskStrategy sub-element.

A custom risk strategy XML file contains the following structure:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <RiskModel id="custom_risk_strategy"> <name>Primary custom risk strategy</name> <description> This custom risk strategy emphasizes a number of important factors. </description> <VulnerabilityRiskStrategy> [formula] </VulnerabilityRiskStrategy> </RiskModel>

Nexpose Users Guide

243

NOTE: Make sure that your custom strategy XML file is wellformed and contains all required elements to ensure that the application performs as expected.

To make a custom risk strategy available in Nexpose, take the following steps: 1. 2. Copy your custom XML file into the directory [installation_directory]/shared/riskStrategies/custom/global. Restart the Security Console.

The custom strategy appears at the top of the list on the Risk Strategies page.

Setting the appearance order for a risk strategy

To set the order for a risk strategy, add the optional order sub-element with a number greater than 0 specified, as in the following example. Specifying a 0 would cause the strategy to appear last.
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <RiskModel id="janes_risk_strategy"> <name>Janes custom risk strategy</name> <description> Janes custom risk strategy emphasizes factors important to Jane. </description> <order>1</order> <VulnerabilityRiskStrategy> [formula] </VulnerabilityRiskStrategy> </RiskModel>

To set the appearance order: 1. Open the desired risk strategy XML file, which appears in one of the following directories:

2. 3. 4.

for a custom strategy: [installation_directory]/shared/riskStrategies/custom/global for a built-in strategy: [installation_directory]/shared/riskStrategies/builtin

Add the order sub-element with a specified numeral to the file, as in the preceding example. Save and close the file. Restart the Security Console.

Nexpose Users Guide

244

Changing the appearance order of risk strategies

You can change the order of how risk strategies are listed on the Risk Strategies page. This could be useful if you have many strategies listed and you want the most frequently used ones listed near the top. To change the order, you assign an order number to each individual strategy using the optional order element in the risk strategys XML file. This is a sub-element of the RiskModel element. See Using custom risk strategies on page 243. For example: Three people in your organization create custom risk strategies: Janes Risk Strategy, Tims Risk Strategy, and Terrys Risk Strategy. You can assign each strategy an order number. You can also assign order numbers to built-in risk strategies. A resulting order of appearance might be the following:

NOTE: The order of built-in strategies will be reset to the default order with every product update.

Janes Risk Strategy (1) Tims Risk Strategy (2) Terrys Risk Strategy (3) Real Risk (4) TemporalPlus (5) Temporal (6) Weighted (7)

Custom strategies always appear above built-in strategies. So, if you assign the same number to a custom strategy and a built-in strategy, or even if you assign a lower number to a built-in strategy, custom strategies always appear first. If you do not assign a number to a risk strategy, it will appear at the bottom in its respective group (custom or built-in). In the following sample order, one custom strategy and two built-in strategies are numbered 1. One custom strategy and one built-in strategy are not numbered:

Janes Risk Strategy (1) Tims Risk Strategy (2) Terrys Risk Strategy (no number assigned) Weighted (1) Real Risk (1) TemporalPlus (2) Temporal (no number assigned)

Note that a custom strategy, Tims, has a higher number than two numbered, built-in strategies; yet it appears above them.

Nexpose Users Guide

245

Understanding how risk scoring works with scans

An asset goes through several phases of scanning before it has a status of completed for that scan. An asset that has not gone through all the required scan phases has a status of in progress. Nexpose only calculates risk scores based on data from assets with completed scan status. If a scan pauses or stops, The application does not use results from assets that do not have completed status for the computation of risk scores. For example: 10 assets are scanned in parallel. Seven have completed scan status; three do not. The scan is stopped. Risk is calculated based on the results for the seven assets with completed status. For the three in progress assets, it uses data from the last completed scan. To determine scan status consult the scan log. See Viewing the scan log on page 71.

Nexpose Users Guide

246

Chapter 6 Resources
This section provides useful information and tools to help you get optimal use out of the application.

Using regular expressions on page 248: This sections provides tips on using regular expressions in various activities, such as configuring scan authentication on Web targets. Using Exploit Exposure on page 251: This section describes how the application integrates exploitability data for vulnerabilities. Performing configuration assessment on page 252: This section describes how you can use the application to verify compliance with configuration security standards such as USGCB and CIS. Scan templates on page 254: This section lists all built-in scan templates and their settings. It provides suggestions for when to use each template. Report templates and sections on page 272: This section lists all built-in report templates and the information that each contains. It also lists and describes report sections that make up document report templates and data fields that make up CSV export templates. This information is useful for configuring custom report templates. Glossary on page 290: This section lists and defines terms used and referenced in the application.

Nexpose Users Guide

247

Using regular expressions

A regular expression, also known as a regex, is a text string used for searching for a piece of information or a message that an application will display in a given situation. Regex notation patterns can include letters, numbers, and special characters, such as dots, question marks, plus signs, parentheses, and asterisks. These patterns instruct a search application not only what string to search for, but how to search for it. Regular expressions are useful in configuring scan activities:

searching for file names on local drives; see How the file name search works with regex on page 249 searching for certain results of logon attempts to Telnet servers; see Configuring scans of Telnet servers on page 218 determining if a logon attempt to a Web server is successful; see How to use regular expressions when logging on to a Web site on page 250

General notes about creating a regex

A regex can be a simple pattern consisting of characters for which you want to find a direct match. For example, the pattern nap matches character combinations in strings only when exactly the characters n, a, and p occur together and in that exact sequence. A search on this pattern would return matches with strings such as snap and synapse. In both cases the match is with the substring nap. There is no match in the string an aperture because it does not contain the substring nap. When a search requires a result other than a direct match, such as one or more n's or white space, the pattern requires special characters. For example, the pattern ab*c matches any character combination in which a single a is followed by 0 or more bs and then immediately followed by c. The asterisk indicates 0 or more occurrences of the preceding character. In the string cbbabbbbcdebc, the pattern matches the substring abbbbc. The asterisk is one example of how you can use a special character to modify a search. You can create various types of search parameters using other single and combined special characters.

Nexpose Users Guide

248

How the file name search works with regex

Nexpose searches for matching files by comparing the search string against the entire directory path and file name. See Configuring file searches on target systems on page 219. Files and directories appear in the results table if they have any greedy matches against the search pattern. If you don't include regex anchors, such ^ and $, the search can result in multiple matches. Refer to the following examples to further understand how the search algorithm works with regular expressions. Note that the search matches are in bold typeface. With search pattern .*xls

the following search input, C$/Documents and Settings/user/My Documents/patientData.xls results in one match: C$/Documents and Settings/user/My Documents/patientData.xls

the following search input, C$/Documents and Settings/user/My Documents/patientData.doc results in no matches

the following search input, C$/Documents and Settings/user/My Documents/xls/patientData.xls results in one match: C$/Documents and Settings/user/My Documents/xls/patientData.xls

the following search input, C$/Documents and Settings/user/My Documents/xls/patientData.doc results in one match: C$/Documents and Settings/user/My Documents/xls/patientData.doc

With search pattern^.*xls$:

the following search input, C$/Documents and Settings/user/My Documents/patientData.xls results in one match: C$/Documents and Settings/user/My Documents/patientData.xls

the following search input, C$/Documents and Settings/user/My Documents/patientData.docresults in no matches the following search input, C$/Documents and Settings/user/My Documents/xls/patientData.xls results in one match: C$/Documents and Settings/user/My Documents/xls/patientData.xls

the following search input, C$/Documents and Settings/user/My Documents/xls/patientData.doc results in no matches

Nexpose Users Guide

249

How to use regular expressions when logging on to a Web site

When Nexpose makes a successful attempt to log on to a Web application, the Web server returns an HTML page that a user typically sees after a successful logon. If the logon attempt fails, the Web server returns an HTML page with a failure message, such as Invalid password. Configuring the application to log on to a Web application with an HTML form or HTTP headers involves specifying a regex for the failure message. During the logon process, it attempts to match the regex against the HTML page with the failure message. If there is a match, the application recognizes that the attempt failed. It then displays a failure notification in the scan logs and in the Security Console Web interface. If there is no match, the application recognizes that the attempt was successful and proceeds with the scan.

Nexpose Users Guide

250

Using Exploit Exposure

With Nexpose Exploit Exposure, you can now use the application to target specific vulnerabilities for exploits using the Metasploit exploit framework. Verifying vulnerabilities through exploits helps you to focus remediation tasks on the most critical gaps in security. For each discovered vulnerability, the application indicates whether there is an associated exploit and the required skill level for that exploit. If a Metasploit exploit is available, the console displays the icon and a link to a Metasploit module that provides detailed exploit information.

Why exploit your own vulnerabilities?

On a logistical level, exploits can provide critical access to operating systems, services, and applications for penetration testing. Also, exploits can afford better visibility into network security, which has important implications for different stakeholders within your organization:

Penetration testers and security consultants use exploits as compelling proof that security flaws truly exist in a given environment, eliminating any question of a false positive. Also, the data they collect during exploits can provide a great deal of insight into the seriousness of the vulnerabilities. Senior managers demand accurate security data that they can act on with confidence. False positives can cause them to allocate security resources where they are not needed. On the other hand, if they refrain from taking action on reported vulnerabilities, they may expose the organization to serious breaches. Managers also want metrics to help them determine whether or not security consultants and vulnerability management tools are good investments. System administrators who view vulnerability data for remediation purposes want to be able to verify vulnerabilities quickly. Exploits provide the fastest proof.

Nexpose Users Guide

251

Performing configuration assessment

Performing regular audits of configuration settings on your assets may be mandated in your organization. Whether you work for a United States government agency, a company that does business with the federal government, or a company with strict security rules, you may need to verify that your assets meet a specific set of configuration standards. For example, your company may require that all of your workstations lock out users after a given number of incorrect logon attempts. Like vulnerability scans, policy scans are useful for gauging your security posture. They help to verify that your IT department is following secure configuration practices. Using the application, you can scan your assets as part of a configuration assessment audit. A license-enabled feature named Policy Manager provides compliance checks for several configuration standards:

USGCB 2.0 policies

The United States Government Configuration Baseline (USGCB) is an initiative to create security configuration baselines for information technology products deployed across U.S. government agencies. USGCB 2.0 evolved from FDCC (see below), which it replaces as the configuration security mandate in the U.S. government. Companies that do business with the federal government or have computers that connect to U.S. government networks must conform to USGCB 2.0 standards. For more information, go to usgcb.nist.gov.

USGCB 1.0 policies

USGCB 2.0 is not an update of 1.0. The two versions are considered separate entities. For that reason, the application includes USGCB 1.0 checks in addition to those of the later version. For more information, go to usgcb.nist.gov.

FDCC policies
The Federal Desktop Core Configuration (FDCC) preceded USGCB as the U.S. government-mandated set of configuration standards. For more information, go to fdcc.nist.gov.

CIS benchmarks
These benchmarks are consensus-based, best-practice security configuration guidelines developed by the not-for-profit Center for Internet Security (CIS), with input and approval from the U.S. government, private-sector businesses, the security industry, and academia. The benchmarks include technical control rules and values for hardening network devices, operating systems, and middleware and software applications. They are widely held to be the configuration security standard for commercial businesses. For more information, go to www.cisecurity.org.

Nexpose Users Guide

252

How do I run configuration assessment scans?

Configure a site with a scan template that includes Policy Manager checks. Depending on your license, the application provides built-in USGCB, FDCC, and CIS templates. These templates do not include vulnerability checks. If you prefer to run a combined vulnerability/policy scan, you can configure a custom scan template that includes vulnerability checks and Policy Manager policies or benchmarks. See the following sections for more information:

Selecting the type of scanning you want to do on page 193 Selecting Policy Manager checks on page 206

How do I know if my license enables Policy Manager?

To verify that your license enables Policy Manager and includes the specific checks that you want to run, go the Licensing page on the Security Console Configuration panel. See Viewing, activating, renewing, or changing your license in the administrators guide.

What platforms are supported by Policy Manager checks?

For a complete list of platforms that are covered by Policy Manager checks, go to the Rapid7 Community at https://community.rapid7.com/docs/DOC-2061.

How do I view Policy Manager scan results?

Go to the Policies page, where you can view results of policy scans, including those of individual rules that make up policies. You can also override rule results. See Working with Policy Manager results on page 106.

Can I create custom checks based on Policy Manager manager checks?

You can customize policy checks based on Policy Manager checks. See Creating a custom policy on page 222.

Nexpose Users Guide

253

Scan templates
This appendix lists all built-in scan templates available in Nexpose It provides descriptions, specifications, and suggestions for when to use each template.

CIS template
This template incorporates the Policy Manager scanning feature for verifying compliance with Center for Internet Security (CIS) benchmarks. The scan runs application-layer audits. Policy checks require authentication with administrative credentials on targets. Vulnerability checks are not included.

Nexpose Users Guide

254

Denial of service template

This basic audit of all network assets uses both safe and unsafe (denial-of-service) checks. This scan does not include in-depth patch/hotfix checking, policy compliance checking, or application-layer auditing. You can run a denial of service scan in a preproduction environment to test the resistance of assets to denial-of service conditions.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 Stealth scan (SYN) Well known numbers + 1-1040 Well-known numbers 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

Local, patch, policy check types

* Any value of lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

255

Discovery scan template

This scan locates live assets on the network and identifies their host names and operating systems. This template does not include enumeration, policy, or vulnerability scanning. You can run a discovery scan to compile a complete list of all network assets. Afterward, you can target subsets of these assets for intensive vulnerability scans, such as with the Exhaustive scan template.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/N/N/N 10 Y 21, 22, 23, 25, 53, 80, 88, 110, 111, 113, 135, 139, 143, 220, 264, 389, 443, 445, 449, 524, 585, 636, 993, 995, 1433, 1521, 1723, 3306, 3389, 5900, 8080, 9100 53, 67, 68, 69, 111, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1701, 1900, 4500, 49152 Stealth scan (SYN) 21, 22, 23, 25, 80, 110, 113, 139, 143, 220, 264, 443, 445, 449, 524, 585, 993, 995, 1433, 1521, 1723, 8080, 9100 123, 161, 500 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan

UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

256

Discovery scan (aggressive) template

This fast, cursory scan locates live assets on high-speed networks and identifies their host names and operating systems. The system sends packets at a very high rate, which may trigger IPS/IDS sensors, SYN flood protection, and exhaust states on stateful firewalls. This template does not perform enumeration, policy, or vulnerability scanning. This template is identical in scope to the discovery scan, except that it uses more threads and is, therefore, much faster. The trade-off is that scans run with this template may not be as thorough as with the Discovery scan template.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/N/N/N 25 Y 21, 22, 23, 25, 53, 80, 88, 110, 111, 113, 135, 139, 143, 220, 264, 389, 443, 445, 449, 524, 585, 636, 993, 995, 1433, 1521, 1723, 3306, 3389, 5900, 8080, 9100 53, 67, 68, 69, 111, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1701, 1900, 4500, 49152 Stealth scan (SYN) 21,22,23,25,80,110,113,139,143,220,264,443,445,449,524,585,993,9 95,1433,1521,1723,8080,9100 123, 161, 500 6 500 ms 50 ms 1250 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan

UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

257

Exhaustive template
This thorough network scan of all systems and services uses only safe checks, including patch/hotfix inspections, policy compliance assessments, and application-layer auditing. This scan could take several hours, or even days, to complete, depending on the number of target assets. Scans run with this template are thorough, but slow. Use this template to run intensive scans targeting a low number of assets.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 The system determines optimal method All possible (1-65535) Well-known numbers 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

258

FDCC template
This template incorporates the Policy Manager scanning feature for verifying compliance with all Federal Desktop Core Configuration (FDCC) policies. The scan runs application-layer audits on all Windows XP and Windows Vista systems. Policy checks require authentication with administrative credentials on targets. Vulnerability checks are not included. Only default ports are scanned. If you work for a U.S. government organization or a vendor that serves the government, use this template to verify that your Windows Vista and XP systems comply with FDCC policies.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery UDP ports used for asset discovery TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

Value
Y/N/N/Y 10 Y 135,139, 445 None The system determines optimal method 135,139,445 None 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

0 0 None

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

259

Full audit template

This full network audit of all systems uses only safe checks, including network-based vulnerabilities, patch/hotfix checking, and application-layer auditing. The system scans only default ports and disables policy checking, which makes scans faster than with the Exhaustive scan. Also, This template does not check for potential vulnerabilities. This is the default scan template. Use it to run a fast, thorough vulnerability scan right out of the box.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 Stealth scan (SYN) Well known numbers + 1-1040 Well-known numbers 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

Policy check type

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

260

HIPAA compliance template

This template uses safe checks in this audit of compliance with HIPAA section 164.312 (Technical Safeguards). The scan will flag any conditions resulting in inadequate access control, inadequate auditing, loss of integrity, inadequate authentication, or inadequate transmission security (encryption). Use this template to scan assets in a HIPAA-regulated environment, as part of a HIPAA compliance program.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53,67,68,69,123,135,137,138,139,161,162,445,500,514,520,631,143 4,1900,4500,49152 Stealth scan (SYN) Well-known numbers + 1-1040 Well-known numbers 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

261

Internet DMZ audit template

This penetration test covers all common Internet services, such as Web, FTP, mail (SMTP/POP/ IMAP/Lotus Notes), DNS, database, Telnet, SSH, and VPN. This template does not include indepth patch/hotfix checking and policy compliance audits. Use this template to scan assets in your DMZ.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery UDP ports used for asset discovery TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

Value
Y/Y/Y/Y 10 N None None Stealth scan (SYN) Well-known numbers None 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

0 10 DNS, database, FTP, Lotus Notes/Domino, Mail, SSH, TFTP, Telnet, VPN, Web check categories None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

262

Linux RPMs template

This scan verifies proper installation of RPM patches on Linux systems. For best results, use administrative credentials. Use this template to scan assets running the Linux operating system.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 Stealth scan (SYN) 22, 23 None 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 RPM check type

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

263

Microsoft hotfix template

This scan verifies proper installation of hotfixes and service packs on Microsoft Windows systems. For optimum success, use administrative credentials. Use this template to verify that assets running Windows have hotfix patches installed on them.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1433, 1723, 2433, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 Stealth scan (SYN) 135, 139, 445, 1433, 2433 None 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 Microsoft hotfix check type

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

264

Payment Card Industry (PCI) audit template

This audit of Payment Card Industry (PCI) compliance uses only safe checks, including networkbased vulnerabilities, patch /hotfix verification, and application-layer testing. All TCP ports and wellknown UDP ports are scanned. Policy checks are not included. Use this template to scan assets as part of a PCI compliance program.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 Stealth scan (SYN) All possible (1-65535) Well-known numbers 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 10 None

Policy check types

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

265

Penetration test template

This in-depth scan of all systems uses only safe checks. Host-discovery and network penetration features allow the system to dynamically detect assets that might not otherwise be detected. This template does not include in-depth patch/hotfix checking, policy compliance checking, or applicationlayer auditing. With this template, you may discover assets that are out of your initial scan scope. Also, running a scan with this template is helpful as a precursor to conducting formal penetration test procedures.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 The system determines optimal method Well known numbers + 1-1040 Well-known numbers 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

Local, patch, policy check types

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

266

Safe network audit template

This non-intrusive scan of all network assets uses only safe checks. This template does not include indepth patch/hotfix checking, policy compliance checking, or application-layer auditing. This template is useful for a quick, general scan of your network.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 Stealth scan (SYN) Well known numbers + 1-1040 Well-known numbers 3 100 ms 100 ms 3000 ms 400 ms 1000 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay Maximum scan delay Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

Local, patch, policy check types

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

267

Sarbanes-Oxley (SOX) compliance template

This is a safe-check Sarbanes-Oxley (SOX) audit of all systems. It detects threats to digital data integrity, data access auditing, accountability, and availability, as mandated in Section 302 (Corporate Responsibility for Fiscal Reports), Section 404 (Management Assessment of Internal Controls), and Section 409 (Real Time Issuer Disclosures) respectively. Use this template to scan assets as part of a SOX compliance program.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery

Value
Y/Y/Y/Y 10 Y 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080 53, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514, 520, 631, 1434, 1900, 4500, 49152 Stealth scan (SYN) Well known numbers +1-1040 Well-known numbers 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

UDP ports used for asset discovery

TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

0 0 None

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

268

SCADA audit template

This is a polite, or less aggressive, network audit of sensitive Supervisory Control And Data Acquisition (SCADA) systems, using only safe checks. Packet block delays have been increased; time between sent packets has been increased; protocol handshaking has been disabled; and simultaneous network access to assets has been restricted. Use this template to scan SCADA systems.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery UDP ports used for asset discovery TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay Maximum scan delay Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

Value
Y/Y/Y/Y 5 Y None None Stealth scan (SYN) Well known numbers + 1-1040 Well-known numbers 4 5000 ms 1000 ms 5000 ms 1000 ms 2000 ms 0 0

0 0 None

Policy check type

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

269

USGCB template
This template incorporates the Policy Manager scanning feature for verifying compliance with all United States Government Configuration Baseline (USGCB) policies. The scan runs applicationlayer audits on all Windows 7 systems. Policy checks require authentication with administrative credentials on targets. Vulnerability checks are not included. Only default ports are scanned. If you work for a U.S. government organization or a vendor that serves the government, use this template to verify that your Windows 7 systems comply with USGCB policies.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery UDP ports used for asset discovery TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

Value
N/N/N/Y 10 Y 135, 139, 445 None The system determines optimal method 135, 139, 45 None 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

0 0 None

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

270

Web audit template

This audit of all Web servers and Web applications is suitable public-facing and internal assets, including application servers, ASPs, and CGI scripts. The template does not include patch checking or policy compliance audits. Nor does it scan FTP servers, mail servers, or database servers, as is the case with the DMZ Audit scan template. Use this template to scan public-facing Web assets.
Setting
Asset/vulnerability/Web spidering/policy scan Maximum # scan threads ICMP (Ping hosts) TCP ports used for asset discovery UDP ports used for asset discovery TCP port scan method TCP ports to scan UDP ports to scan Maximum retries Initial timeout interval Minimum timeout interval Maximum timeout interval* Minimum scan delay** Maximum scan delay** Minimum rate of packets to send each second** Maximum rate of packets to send each second** Minimum simultaneous discovery requests** Maximum simultaneous discovery requests** Specific vulnerability check types or categories enabled (which disables all other checks) Specific vulnerability check types or categories disabled

Value
Y/Y/Y/Y 10 N None None Stealth scan (SYN) Well-known numbers None 3 100 ms 100 ms 3000 ms 0 ms 0 ms 0 0

0 10 Web category check

None

* Any value lower than 5 ms disables manual settings, in which case, the application auto-adjusts the settings. ** The default value of 0 disables manual settings, in which case, the application auto-adjusts the settings. To enable manual settings, enter a value of 1 or greater.

Nexpose Users Guide

271

Report templates and sections

Use this appendix to help you select the right built-in report template for your needs. You can also learn about the individual sections or data fields that make up report templates, which is helpful for creating custom templates. This appendix includes the following information:

Built-in report templates and included sections on page 272 Document report sections on page 281 Export template attributes on page 287

Built-in report templates and included sections

Creating custom document templates enables you to include as much, or as little, information in your reports as your needs dictate. For example, if you want a report that only lists all assets organized by risk level, a custom report might be the best solution. This template would include only the Discovered System Information section. Or, if you want a report that only lists vulnerabilities, create a template with the Discovered Vulnerabilities section. Configuring a document report template involves selecting the sections to be included in the template. Each report template in the following section lists all sections available for each of the document report templates, including those that appear in built-in report templates and those that you can include in a customized template. You may find that a given built-in template contains all the sections that you require in a particular report, making it unnecessary to create a custom template. Built-in reports and sections are listed below:

Audit Report Baseline Comparison Executive Overview Highest Risk Vulnerabilities PCI Attestation of Compliance PCI Audit (legacy) PCI Executive Overview (legacy) PCI Executive Summary PCI Host Details PCI Vulnerability Details Policy Evaluation Remediation Plan Report Card SANS Top 20 Top 10 Assets by Vulnerability Risk Top 10 Assets by Vulnerabilities Top Remediations Top Remediations with Details Vulnerability Trends

Nexpose Users Guide

272

Audit Report
Of all the built-in templates, the Audit is the most comprehensive in scope. You can use it to provide a detailed look at the state of security in your environment.

The Audit Report template provides a great deal of granular information about discovered assets: host names and IP addresses discovered services, including ports, protocols, and general security issues risk scores, depending on the scoring algorithm selected by the administrator users and asset groups associated with the assets discovered databases* discovered files and directories* results of policy evaluations performed* spidered Web sites*

It also provides a great deal of vulnerability information: affected assets vulnerability descriptions severity levels references and links to important information sources, like security advisories general solution information

Additionally, the Audit Report template includes charts with general statistics on discovered vulnerabilities and severity levels. * To gather this deep information the application must have logon credentials for the target assets. An Audit Report based on a non-credentialed scan will not include this information. Also, it must have policy testing enabled in the scan template configuration. See Configuring scan credentials on page 42 and Testing the credentials on page 44. Note that the Audit Report template is different from the PCI Audit template. See PCI Audit (legacy) on page 276. The Audit report template includes the following sections:

Cover Page Discovered Databases Discovered Files and Directories Discovered Services Discovered System Information Discovered Users and Groups Discovered Vulnerabilities Executive Summary Policy Evaluation Spidered Web Site Structure Vulnerability Report Card by Node

Nexpose Users Guide

273

Baseline Comparison
You can use the Baseline Comparison to observe security-related trends or to assess the results of a scan as compared with the results of a previous scan that you are using as a baseline, as in the following examples.

You may use the first scan that you performed on a site as a baseline. Being the first scan, it may have revealed a high number of vulnerabilities that you subsequently remediated. Comparing current scan results to those of the first scan will help you determine how effective your remediation work has been. You may use a scan that revealed an especially low number of vulnerabilities as a benchmark of good security health. You may use the last scan preceding the current one to verify whether a certain patch removed a vulnerability in that scan.

Trending information indicates changes discovered during the scan, such as the following:

new assets and services assets or services that are no longer running since the last scan new vulnerabilities previously discovered vulnerabilities did not appear in the most current scan

Trending information is useful in gauging the progress of remediation efforts or observing environmental changes over time. For trending to be accurate and meaningful, make sure that the compared scans occurred under identical conditions:

the same site was scanned the same scan template was used if the baseline scan was performed with credentials, the recent scan was performed with the same credentials.

The Baseline Comparison report template includes the following sections:

Cover Page Executive Summary

Executive Overview
You can use the Executive Overview template to provide a high-level snapshot of security data. It includes general summaries and charts of statistical data related to discovered vulnerabilities and assets. Note that the Executive Overview template is different from the PCI Executive Overview. See PCI Executive Overview (legacy) on page 276. The Executive Overview template includes the following sections:

Baseline Comparison Cover Page Executive Summary Risk Trends

Nexpose Users Guide

274

Highest Risk Vulnerabilities

The Highest Risk Vulnerabilities template lists the top 10 discovered vulnerabilities according to risk level. This template is useful for targeting the biggest threats to security as priorities for remediation. Each vulnerability is listed with risk and CVSS scores, as well references and links to important information sources. Risk scores are based on the types and numbers of vulnerabilities on affected assets. The Highest Risk Vulnerabilities report template includes the following sections:

Cover Page Highest Risk Vulnerability Details Table of Contents

PCI Attestation of Compliance

This is one of three PCI-mandated report templates to be used by ASVs for PCI scans as of September 1, 2010. The PCI Attestation of Compliance is a single page that serves as a cover sheet for the completed PCI report set. In the top left area of the page is a form for entering the customers contact information. If the ASV added scan customer organization information in the site configuration on which the scan data is based, the form will be auto-populated with that information. See Including organization information in a site in the user's guide or Help. In the top right area is a form with auto-populated fields for the ASVs information. The Scan Status section lists a high-level summary of the scan, including whether the overall result is a Pass or Fail, some statistics about what the scan found, the date the scan was completed, and scan expiration date, which is the date after which the results are no longer valid. In this section, the ASV must note the number of components left out of the scope of the scan. Two separate statements appear at the bottom. The first is for the customer to attest that the scan was properly scoped and that the scan result only applies to external vulnerability scan requirement of PCI Data Security Standard (DSS). It includes the attestation date, and an indicated area to fill in the customers name. The second statement is for the ASV to attest that the scan was properly conducted, QA-tested, and reviewed. It includes the following auto-populated information:

attestation date for scan customer ASV name* certificate number* ASV reviewer name* (the individual who conducted the scan and review process) To support auto-population of these fields*, you must enter create appropriate settings in the oem.xml configuration file. See The ASV guide, which you can request from Technical Support.

The PCI Attestation report template includes the following section:

Asset and Vulnerabilities Compliance Overview

Nexpose Users Guide

275

PCI Audit (legacy)

This is one of two reports no longer used by ASVs in PCI scans as of September 1, 2010. It provides detailed scan results, ranking each discovered vulnerability according to its Common Vulnerability Scoring System (CVSS) ranking. Note that the PCI Audit template is different from the Audit Report template. See Audit Report on page 273. The PCI Audit (Legacy) report template includes the following sections:

Cover Page Payment Card Industry (PCI) Scanned Hosts/Networks Payment Card Industry (PCI) Vulnerability Details Payment Card Industry (PCI) Vulnerability Synopsis Table of Contents Vulnerability Exceptions

PCI Executive Overview (legacy)

This is one of two reports no longer used by ASVs in PCI scans as of September 1, 2010. It provides high-level scan information. Note that the PCI Executive Overview template is different from the template PCI Executive Summary. See PCI Executive Summary on page 276. The PCI Executive Overview (Legacy) report template includes the following sections:

Cover Page Payment Card Industry (PCI) Executive Summary Table of Contents

PCI Executive Summary

This is one of three PCI-mandated report templates to be used by ASVs for PCI scans as of September 1, 2010. The PCI Executive Summary begins with a Scan Information section, which lists the dates that the scan was completed and on which it expires. This section includes the auto-populated ASV name and an area to fill in the customers company name. If the ASV added scan customer organization information in the site configuration on which the scan data is based, the customers company name will be auto-populated. See Including organization information in a site on page 41. The Component Compliance Summary section lists each scanned IP address with a Pass or Fail result. The Asset and Vulnerabilities Compliance Overview section includes charts that provide compliance statistics at a glance. The Vulnerabilities Noted for each IP Address section includes a table listing each discovered vulnerability with a set of attributes including PCI severity, CVSS score, and whether the vulnerability passes or fails the scan. The assets are sorted by IP address. If the ASV marked a vulnerability for exception in the application, the exception is indicated here. The column labeled Exceptions, False Positives, or Compensating Controls field in the PCI Executive Summary report is auto-populated with the user name of the individual who excluded a given vulnerability.

Nexpose Users Guide

276

In the concluding section, Special Notes, ASVs must disclose the presence of any software that may pose a risk due to insecure implementation, rather than an exploitable vulnerability. The notes should include the following information:

the IP address of the affected asset the note statement, written according to PCIco (see the PCI ASV Program Guide v1.2) information about the issue such as name or location of the affected software the customers declaration of secure implementation or description of action taken to either remove the software or secure it Any instance of remote access software or directory browsing is automatically noted. ASVs must add any information pertaining to point-of-sale terminals and absence of synchronization between load balancers. ASVs must obtain and insert customer declarations or description of action taken for each special note before officially releasing the Attestation of Compliance.

The PCI Executive Overview report template includes the following sections:

Payment Card Industry (PCI) Component Compliance Summary Payment Card Industry (PCI) Scan Information Payment Card Industry (PCI) Special Notes Payment Card Industry (PCI) Vulnerabilities Noted (sub-sectioned into High, Medium, and Small)

PCI Host Details

This template provides detailed, sorted scan information about each asset, or host, covered in a PCI scan. This perspective allows a scanned merchant to consume, understand, and address all the PCIrelated issues on an asset-by-asset basis. For example, it may be helpful to note that a non-PCI-compliant asset may have a number of vulnerabilities specifically related to its operating system or a particular network communication service running on it. The PCI Host Details report template includes the following sections:

Payment Card Industry (PCI) Host Details Table of Contents

PCI Vulnerability Details

This is one of three PCI-mandated report templates to be used by ASVs for PCI scans as of September 1, 2010. The PCI Vulnerability Details report begins with a Scan Information section, which lists the dates that the scan was completed and on which it expires. This section includes the auto-populated ASV name and an area to fill in the customer's company name.
NOTE: The PCI Vulnerability Details report takes into account approved vulnerability exceptions to determine compliance status for each vulnerability instance.

The Vulnerability Details section includes statistics and descriptions for each discovered vulnerability, including affected IP address, Common Vulnerability Enumeration (CVE) identifier, CVSS score, PCI severity, and whether the vulnerability passes or fails the scan. Vulnerabilities are grouped by severity level, and within grouping vulnerabilities are listed according to CVSS score. The PCI Vulnerability Details report template includes the following sections:

Nexpose Users Guide

Payment Card Industry (PCI) Scan Information Payment Card Industry (PCI) Vulnerability Details Table of Contents

277

Policy Evaluation
The Policy Evaluation displays the results of policy evaluations performed during scans. The application must have proper logon credentials in the site configuration and policy testing enabled in the scan template configuration. See Establishing scan credentials and Modifying and creating scan templates in the administrator's guide. Note that this template provides a subset of the information in the Audit Report template. The Policy Evaluation report template includes the following sections:

Cover Page Policy Evaluation

Remediation Plan
The Remediation Plan template provides detailed remediation instructions for each discovered vulnerability. Note that the report may provide solutions for a number of scenarios in addition to the one that specifically applies to the affected target asset. The Remediation Plan report template includes the following sections:

Cover Page Discovered System Information Remediation Plan Risk Assessment

Report Card
The Report Card template is useful for finding out whether, and how, vulnerabilities have been verified. The template lists information about the test that Nexpose performed for each vulnerability on each asset. Possible test results include the following:

not vulnerable not vulnerable version exploited

For any vulnerability that has been excluded from reports, the test result will be the reason for the exclusion, such as acceptable risk. The template also includes detailed information about each vulnerability. The Report Card report template includes the following sections:

Cover Page Index of Vulnerabilities Vulnerability Report Card by Node

Nexpose Users Guide

278

SANS Top 20
The SANS Top 20 template lists discovered vulnerabilities that appear on the most recent list compiled and posted by the SysAdmin, Audit, Network, Security (SANS) Institute (www.sans.org) as of the last update. This template is useful for viewing serious security issues in your environment from the perspective of this widely recognized provider of information and security training. The SANS Top 20 report template includes the following sections:

Cover Page SANS Top 20 Device Listing SANS Top 20 Device Synopsis SANS Top 20 Executive Summary SANS Top 20 Vulnerability Details SANS Top 20 Vulnerability Synopsis

Top 10 Assets by Vulnerability Risk

NOTE: The Top 10 Assets by Vulnerability Risk and Top 10 Assets by Vulnerabilities report templates do not contain individual sections that can be applied to custom report templates.

The Top 10 Assets by Vulnerability Risk lists the 10 assets with the highest risk scores. For more information about ranking see Viewing active vulnerabilities on page 84. This report is useful for prioritizing your remediation efforts by providing your remediation team with an overview of the assets in your environment that pose the greatest risk. This report template is complete; it does not contain individual sections.

Top 10 Assets by Vulnerabilities

The Top 10 Assets by Vulnerabilities report lists 10 the assets in your organization that have the most vulnerabilities. This report does not account for cumulative risk. You can use this report to view the most vulnerable services to determine if services should be turned off to reduce risk. This report is also useful for prioritizing remediation efforts by listing the assets that have the most vulnerable services.

Top Remediations
The Prioritized Remediations template provides high-level information for assessing the highest impact remediation solutions. The template includes the percentage of total vulnerabilities resolved, the percentage of vulnerabilities with malware kits, the percentage of vulnerabilities with known exploits, and the number of assets affected when the top remediation solutions are applied. The Prioritized Remediation Plan includes information in the following areas:

the number of vulnerabilities that will be remediated, including vulnerabilities with no exploits or malware that will be remediated vulnerabilities and total risk score associated with the solution the number of targeted vulnerabilities that have known exploits associated with them the number of targeted vulnerabilities with available malware kits the number of assets to be addressed by remediation the amount of risk that will be reduced by the remediations

Nexpose Users Guide

279

Top Remediations with Details

The Prioritized Remediations with details template provides expanded information for assessing remediation solutions and implementation steps. The template includes the percentage of total vulnerabilities resolved and the number of assets affected when remediation solutions are applied. The Prioritized Remediations with details includes the information from the Prioritized remediations template with information in the following areas:

remediation steps that need to be performed vulnerabilities and total risk score associated with the solution the assets that require the remediation steps

Vulnerability Trends
The Vulnerability Trends template provides information about how vulnerabilities in your environment have changed, if your remediation efforts have succeeded, how assets have changed over time, how asset groups have been affected when compared to other asset groups, and how effective your asset scanning process is. To manage the readability and size of the report, when you configure the date range there is a limit of 15 data points that can be included on a chart. For example, you can set your date range for a weekly interval for a two-month period, and you will have eight data points in your report. You can configure the period of time for the report to see if you are improving your security posture and where you can make improvements.
NOTE: Ensure you schedule adequate time to run this report template because of the large amount of data that it aggregates. Each data point is the equivalent of a complete report. It may take a long time to complete.

The Vulnerability Trends template provides charts and details in the following areas:

assets scanned and vulnerabilities severity levels trend by vulnerability age vulnerabilities with malware or exploits

The Vulnerability Trends template helps you improve your remediation efforts by providing information about the number of assets included in a scan and if any have been excluded, if vulnerability exceptions have been applied or expired, and if there are new vulnerability definitions that have been added to the application. The Vulnerability Trends template differs from the vulnerability trend section in the Baseline report by providing information for more in-depth analysis regarding your security posture and remediation efforts provides.

Nexpose Users Guide

280

Document report sections

Some of the following documents report sections can have vulnerability filters applied to them. This means that specific vulnerabilities can be included or excluded in these sections based on the report Scope configuration. When the report is generated, sections with filtered vulnerabilities will be so identified. Document report templates that do not contain any of these sections do not contain filtered vulnerability data. The document report sections are listed below:

Asset and Vulnerabilities Compliance Overview Baseline Comparison Cover Page Discovered Databases Discovered Files and Directories Discovered Services Discovered System Information Discovered Users and Groups Discovered Vulnerabilities Executive Summary Highest Risk Vulnerability Details Index of Vulnerabilities Payment Card Industry (PCI) Component Compliance Summary Payment Card Industry (PCI) Executive Summary Payment Card Industry (PCI) Host Details Payment Card Industry (PCI) Scan Information Payment Card Industry (PCI) Scanned Hosts/Networks Payment Card Industry (PCI) Special Notes Payment Card Industry (PCI) Vulnerabilities Noted for each IP Address Payment Card Industry (PCI) Vulnerability Details Payment Card Industry (PCI) Vulnerability Synopsis Policy Evaluation Remediation Plan Risk Assessment Risk Trend SANS Top 20 Device Listing SANS TOP 20 Device Synopsis SANS TOP 20 Executive Summary SANS TOP 20 Vulnerability Details SANS Top 20 Vulnerability Synopsis Scanned Hosts and Networks Table of Contents Trend Analysis Vulnerabilities by IP Address and PCI Severity Level Vulnerability Details Vulnerability Exceptions Vulnerability Report Card by Node Vulnerability Report Card Across Network Vulnerability Test Errors

Nexpose Users Guide

281

Asset and Vulnerabilities Compliance Overview

This section includes charts that provide compliance statistics at a glance.

Baseline Comparison
This section appears when you select the Baseline Report template. It provides a comparison of data between the most recent scan and the baseline, enumerating the following changes:

discovered assets that did not appear in the baseline scan assets that were discovered in the baseline scan but not in the most recent scan discovered services that did not appear the baseline scan services that were discovered in the baseline scan but not in the most recent scan discovered vulnerabilities that did not appear in the baseline scan vulnerabilities that were discovered in the baseline scan but not in the most recent scan

Additionally, this section provides suggestions as to why changes in data may have occurred between the two scans. For example, newly discovered vulnerabilities may be attributable to the installation of vulnerable software that occurred after the baseline scan. In generated reports, this section appears with the heading Trend Analysis.

Cover Page
The Cover Page includes the name of the site, the date of the scan, and the date that the report was generated. Other display options include a customized title and company logo.

Discovered Databases
This section lists all databases discovered through a scan of database servers on the network. For information to appear in this section, the scan on which the report is based must meet the following conditions:

database server scanning must be enabled in the scan template the application must have correct database server logon credentials

Discovered Files and Directories

This section lists files and directories discovered on scanned assets. For information to appear in this section, the scan on which the report is based must meet the following conditions:

file searching must be enabled in the scan template the application must have correct logon credentials

See Configuring scan credentials on page 42 for information on configuring these settings.

Nexpose Users Guide

282

Discovered Services
This section lists all services running on the network, the IP addresses of the assets running each service, and the number of vulnerabilities discovered on each asset. Vulnerability filters can be applied.

Discovered System Information

This section lists the IP addresses, alias names, operating systems, and risk scores for scanned assets.

Discovered Users and Groups

This section provides information about all users and groups discovered on each node during the scan.
NOTE: In generated reports, the Discovered Vulnerabilities section appears with the heading Discovered and Potential Vulnerabilities.

Discovered Vulnerabilities
This section lists all vulnerabilities discovered during the scan and identifies the affected assets and ports. It also lists the Common Vulnerabilities and Exposures (CVE) identifier for each vulnerability that has an available CVE identifier. Each vulnerability is classified by severity. If you selected a Medium technical detail level for your report template, the application provides a basic description of each vulnerability and a list of related reference documentation. If you selected a High level of technical detail, it adds a narrative of how it found the vulnerability to the description, as well as remediation options. Use this section to help you understand and fix vulnerabilities. This section does not distinguish between potential and confirmed vulnerabilities. Vulnerability filters can be applied.

Executive Summary
This section provides statistics and a high-level summation of the scan data, including numbers and types of network vulnerabilities.

Highest Risk Vulnerability Details

This section lists highest risk vulnerabilities and includes their categories, risk scores, and their Common Vulnerability Scoring System (CVSS) Version 2 scores. The section also provides references for obtaining more information about each vulnerability.

Index of Vulnerabilities
This section includes the following information about each discovered vulnerability:

severity level Common Vulnerability Scoring System (CVSS) Version 2 rating category URLs for reference description solution steps

In generated reports, this section appears with the heading Vulnerability Details. Vulnerability filters can be applied.

Nexpose Users Guide

283

Payment Card Industry (PCI) Component Compliance Summary

This section lists each scanned IP address with a Pass or Fail result.

Payment Card Industry (PCI) Executive Summary

This section includes a statement as to whether a set of assets collectively passes or fails to comply with PCI security standards. It also lists each scanned asset and indicates whether that asset passes or fails to comply with the standards.

Payment Card Industry (PCI) Host Details

This section lists information about each scanned asset, including its hosted operating system, names, PCI compliance status, and granular vulnerability information tailored for PCI scans.

Payment Card Industry (PCI) Scan Information

This section includes name fields for the scan customer and approved scan vendor (ASV). The customer's name must be entered manually. If the ASV has configured the oem.xml file to auto-populate the name field, it will contain the ASVs name. Otherwise, the ASVs name must be entered manually as well. For more information, see the ASV guide, which you can request from Technical Support. This section also includes the date the scan was completed and the scan expiration date, which is the last day that the scan results are valid from a PCI perspective.

Payment Card Industry (PCI) Scanned Hosts/Networks

This section lists the range of scanned assets.

NOTE: Any instance of remote access software or directory browsing is automatically noted.

Payment Card Industry (PCI) Special Notes

In this PCI report section, ASVs manually enter the notes about any scanned software that may pose a risk due to insecure implementation, rather than an exploitable vulnerability. The notes should include the following information:

the IP address of the affected asset the note statement, written according to PCIco (see the PCI ASV Program Guide v1.2) the type of special note, which is one of four types specified by PCIco (see the PCI ASV Program Guide v1.2) the scan customers declaration of secure implementation or description of action taken to either remove the software or secure it

Payment Card Industry (PCI) Vulnerabilities Noted for each IP Address

This section includes a table listing each discovered vulnerability with a set of attributes including PCI severity, CVSS score, and whether the vulnerability passes or fails the scan. The assets are sorted by IP address. If the ASV marked a vulnerability for exception, the exception is indicated here. The column labeled Exceptions, False Positives, or Compensating Controls field in the PCI Executive Summary report is auto-populated with the user name of the individual who excluded a given vulnerability.

Nexpose Users Guide

284

NOTE: The PCI Vulnerability Details report takes into account approved vulnerability exceptions to determine compliance status for each vulnerability instance.

Payment Card Industry (PCI) Vulnerability Details

This section contains in-depth information about each vulnerability included in a PCI Audit report. It quantifies the vulnerability according to its severity level and its Common Vulnerability Scoring System (CVSS) Version 2 rating. This latter number is used to determine whether the vulnerable assets in question comply with PCI security standards, according to the CVSS v2 metrics. Possible scores range from 1.0 to 10.0. A score of 4.0 or higher indicates failure to comply, with some exceptions. For more information about CVSS scoring or go to the FIRST Web site at http://www.first.org/cvss/cvss-guide.html.

Payment Card Industry (PCI) Vulnerability Synopsis

This section lists vulnerabilities by categories, such as types of client applications and server-side software.

Policy Evaluation
This sections lists the results of any policy evaluations, such as whether Microsoft security templates are in effect on scanned systems. Section contents include system settings, registry settings, registry ACLs, file ACLs, group membership, and account privileges.

Remediation Plan
This section consolidates information about all vulnerabilities and provides a plan for remediation. The database of vulnerabilities feeds the Remediation Plan section with information about patches and fixes, including Web links for downloading them. For each remediation, the database provides a time estimate. Use this section to research fixes, patches, work-arounds, and other remediation measures. Vulnerability filters can be applied.

Risk Assessment
This section ranks each node (asset) by its risk index score, which indicates the risk that asset poses to network security. An assets confirmed and unconfirmed vulnerabilities affect its risk score.

Risk Trend
This section enables you to create graphs illustrating risk trends in reports in your Executive Summary. The reports can include your five highest risk sites, asset groups, assets, or you can select all assets in your report scope.

SANS Top 20 Device Listing

This section includes detailed network information about each scanned asset and lists its vulnerabilities that appear on the current SANS Top 20 vulnerabilities list. In generated reports, this section appears with the heading Device Details.

SANS TOP 20 Device Synopsis

This section includes a matrix of network assets and the number of discovered vulnerabilities discovered in each SANS category from the current SANS Top 20 list.

Nexpose Users Guide

285

SANS TOP 20 Executive Summary

This section includes high-level network information, summarizing the incidence of SANS Top 20 discovered vulnerabilities on scanned assets that appear on the current SANS Top 20 list.

SANS TOP 20 Vulnerability Details

This section includes exhaustive information about each discovered SANS Top 20 vulnerability that appears on the current SANS Top 20 list. The section also includes, the affected assets, and remediation steps.

SANS Top 20 Vulnerability Synopsis

This section includes a list of all discovered SANS Top 20 vulnerabilities that appear on the current SANS Top 20 list, sorted by various criteria, such as types of client applications, server-side software, and other categories.

Scanned Hosts and Networks

This section lists the assets that were scanned. If the IP addresses are consecutive, the console displays the list as a range.

Table of Contents
This section lists the contents of the report.

Trend Analysis
This section appears when you select the Baseline report template. It compares the vulnerabilities discovered in a scan against those discovered in a baseline scan. Use this section to gauge progress in reducing vulnerabilities improving network's security.

Vulnerabilities by IP Address and PCI Severity Level

This section, which appears in PCI Audit reports, lists each vulnerability, indicating whether it has passed or failed in terms of meeting PCI compliance criteria. The section also includes remediation information.

Vulnerability Details
The Vulnerability Details section includes statistics and descriptions for each discovered vulnerability, including affected IP address, Common Vulnerability Enumeration (CVE) identifier, CVSS score, PCI severity, and whether the vulnerability passes or fails the scan. Vulnerabilities are grouped by severity level, and within grouping vulnerabilities are listed according to CVSS score.

Vulnerability Exceptions
This section lists each vulnerability that has been excluded from report and the reason for each exclusion. You may not wish to see certain vulnerabilities listed with others, such as those to be targeted for remediation; but business policies may dictate that you list excluded vulnerabilities if only to indicate that they were excluded. A typical example is the PCI Audit report. Vulnerabilities of a certain severity level may result in an audit failure. They may be excluded for certain reasons, but the exclusions must be noted.

Nexpose Users Guide

286

Do not confuse an excluded vulnerability with a disabled vulnerability check. An excluded vulnerability has been discovered by the application, which means the check was enabled. Vulnerability filters can be applied.

Vulnerability Report Card by Node

This section lists the results of vulnerability tests for each node (asset) in the network. Use this section to assess the vulnerability of each asset. Vulnerability filters can be applied.

Vulnerability Report Card Across Network

This section lists all tested vulnerabilities, and indicates how each node (asset) in the network responded when the application attempted to confirm a vulnerability on it. Use this section as an overview of the network's susceptibility to each vulnerability. Vulnerability filters can be applied.

Vulnerability Test Errors

This section displays vulnerabilities that were not confirmed due to unexpected failures. Use this section to anticipate or prevent system errors and to validate that scan parameters are set properly. Vulnerability filters can be applied.

Export template attributes

When creating a custom export template, you can select from a full set of vulnerability data attributes. The following table lists the name and description of each attribute that you can include. Export template attributes Attribute name
Asset Alternate IPv4 Addresses Asset Alternate IPv6 Addresses Asset IP Address Asset MAC Addresses

Description
This is the set of alternate IPv4 addresses of the scanned asset. This is the set of alternate IPv6 addresses of the scanned asset. This is the IP address of the scanned asset. These are the MAC addresses of the scanned asset. In the case of multi-homed assets, multiple MAC addresses are separated by commas. Example: 00:50:56:39:06:F5, 00:50:56:39:06:F6 These are the host names of the scanned asset. On the Assets page, asset names may be referred to as aliases. This is the fingerprinted operating system family of the scanned asset. Only the family with the highest-certainty fingerprint is listed. Examples: Linux, Windows This is the fingerprinted operating system of the scanned asset. Only the operating system with the highest-certainty fingerprint is listed. This is the fingerprinted version number of the scanned assets operating system. Only the version with the highest-certainty fingerprint is listed. This is the overall risk score of the scanned asset when the vulnerability test was run. Note that this is different from the vulnerability risk score, which is the specific risk score associated with the vulnerability.

Asset Names Asset OS Family

Asset OS Name

Asset OS Version

Asset Risk Score

(Sheet 1 of 3)

Nexpose Users Guide

287

Export template attributes (Continued) Attribute name

Exploit Count Exploit Minimum Skill Exploit URLs Malware Kit Names Malware Kit Count Scan ID

Description
This is the number of exploits associated with the vulnerability. This is the minimum skill level required to exploit the vulnerability. These are the URLs for all exploits as published by Metasploit or the Exploit Database. These are the malware kits associated with the vulnerability. Multiple kits are separated by commas. This is the number of malware kits associated with the vulnerability. This is the ID for the scan during which the vulnerability test was performed as displayed in a sites scan history. It is the last scan during which the asset was scanned. Different assets within the same site may point to different scan IDs as of individual asset scans (as opposed to site scans). This is the name of the scan template currently applied to the scanned assets site. It may or may not be the template used for the scan during which the vulnerability was discovered, since a user could have changed the template since the scan was last run. This is the fingerprinted service type of the port on which the vulnerability was tested. Examples: HTTP, CIFS, SSH In the case of operating system checks, the service name is listed as System. This is the port on which the vulnerability was found. For example, all HTTP-related vulnerabilities are mapped to the port on which the Web server was found. In the case of operating system checks, the port number is 0. This is the fingerprinted product that was running the scanned service on the port where the vulnerability was found. In the case of operating system checks, this column is blank. This is the network protocol of the scanned port. Examples: TCP, UDP This is the site importance according to the current site configuration at the time of the CSV export. See Starting a static site configuration on page 28. This is the name of the site to which the scanned asset belongs. There are the URLs that provide information about the vulnerability in addition to those cited as Vulnerability Reference URLs. They appear in References table of vulnerability details page, labeled as URL. Multiple URLs are separated by commas. This is the number of days since the vulnerability was first discovered on the scanned asset. These are the Common Vulnerabilities and Exposure (CVE) IDs associated with the vulnerability. If the vulnerability has multiple CVE IDs, the 10 most recent IDs are listed. For multiple values, each value is separated by a comma and space. This is the URL of the CVEs entry in the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD). For multiple values, each value is separated by a comma and space. This is the vulnerabilitys Common Vulnerability Scoring System (CVSS) score according to CVSS 2.0 specification. This is the vulnerabilitys Common Vulnerability Scoring System (CVSS) vector according to CVSS 2.0 specification. This is useful information about the vulnerability as displayed in the vulnerability details page. Descriptions can include a substantial amount of text. You may need to expand the column in the spreadsheet program for better reading. This value can include line breaks and appears in double quotation marks. This is the unique identifier for the vulnerability as assigned by Nexpose. This is the PCI status if the asset is found to be vulnerable. If an asset is not found to be vulnerable, the PCI severity level is not calculated, and the value is Not Applicable. If an asset is found to be vulnerable, the PCI severity is calculated, and the value is either Pass or Fail. If the vulnerability instance on the asset is excluded, the value is Pass.

Scan Template

Service Name

Service Port

Service Product

Service Protocol Site Importance

Site Name Vulnerability Additional URLs

Vulnerability Age Vulnerability CVE IDs

Vulnerability CVE URLs

Vulnerability CVSS Score Vulnerability CVSS Vector Vulnerability Description

Vulnerability ID Vulnerability PCI Compliance Status

(Sheet 2 of 3)

Nexpose Users Guide

288

Export template attributes (Continued) Attribute name

Vulnerability Proof

Description
This is the method used to prove that the vulnerability exists or doesnt exist as reported by Scan Engine. Proofs can include a substantial amount of text. You may need to expand the column in the spreadsheet program for better reading. This value can include line breaks and appears in double quotation marks. This is the date when information about the vulnerability was first released. These are reference identifiers of the vulnerability, typically assigned by vendors such as Microsoft, Apple, and Redhat or security groups such as Secunia; SysAdmin, Audit, Network, Security (SANS) Institute; Computer Emergency Readiness Team (CERT); and SecurityFocus. These appear in the References table of the vulnerability details page. The format of this attribute is Source:Identifier. Multiple values are separated by commas and spaces. Example: BID:4241, CALDERA:CSSA-2002-012.0, CONECTIVA:CLA-2002:467, DEBIAN:DSA-119, MANDRAKE:MDKSA2002:019, NETBSD:NetBSD-SA2002-004, OSVDB:730, REDHAT:RHSA-2002:043, SANS-02:U3, XF:openssh-channelerror(8383) These are reference URLs for information about the vulnerability. They appear in the References table of the vulnerability details page. Multiple values separated by commas. Example: http://www.securityfocus.com/bid/29179, http://www.cert.org/advisories/TA08-137A.html, http:// www.kb.cert.org/vuls/id/925211, http://www.debian.org/security/DSA-/DSA-1571, http://www.debian.org/security/ DSA-/DSA-1576, http://secunia.com/advisories/30136/, http://secunia.com/advisories/30220/ This is the risk score assigned to the vulnerability. Note that this is different from the asset risk score, which is the overall risk score of the asset. This is the date when the vulnerability was first discovered on the scanned asset. This is the solution for remediating the vulnerability. Currently, a solution is exported even if the vulnerability test result was negative. Solutions can include a substantial amount of text. You may need to expand the column in the spreadsheet program for better reading. This value can include line breaks and appears in double quotation marks. These are tags assigned by Nexposefor the vulnerability. This is the word or phrase describing the vulnerability test result. See Vulnerability result codes on page 177.

Vulnerability Published Date Vulnerability Reference IDs

Vulnerability Reference URLs

Vulnerability Risk Score

Vulnerable Since Vulnerability Solution

Vulnerability Tags Vulnerability Test Result Description Vulnerability Test Date

This is the date when the vulnerability test was run. It is the same as the last date that asset was scanned. Format: mm/dd/YYYY This is the result code for the vulnerability test. See Vulnerability result codes on page 177. This is the vulnerabilitys numeric severity level assigned by Nexpose. Scores range from 1 to 10 and map to severity rankings in the Vulnerability Listing table of the Vulnerabilities page: 1-3=Moderate; 4-7=Severe; and 8-10=Critical. This is not the PCI severity level. This is the name of the vulnerability.

Vulnerability Test Result Code Vulnerability Severity Level

Vulnerability Title (Sheet 3 of 3)

Nexpose Users Guide

289

Glossary
For more detailed information on any term in this glossary, search for the term in Help.

API (application programming interface)

An API is a function that a developer can integrate with another software application by using program calls. The term API also refers to one of two sets of XML APIs, each with its own included operations: API v1.1 and Extended API v1.2. To learn about each API, see the API documentation, which you can download from the Support page of Help.

Appliance
An Appliance is a set of Nexpose components shipped as a dedicated hardware/software unit. Appliance configurations include a Security Console/Scan Engine combination and an Scan Engine-only version.

Asset
An asset is a single device on a network that the application discovers during a scan. In the Web interface and API, an asset may also be referred to as a device. See Managed asset on page 295 and Unmanaged asset on page 300. An assets data has been integrated into the scan database, so it can be listed in sites and asset groups. In this regard, it differs from a node. See Node on page 295.

Asset group
An asset group is a logical collection of managed assets to which specific members have access for creating or viewing reports or tracking remediation tickets. An asset group may contain assets that belong to multiple sites or other asset groups. An asset group is either static or dynamic. An asset group is not a site. See Site on page 299, Dynamic asset group on page 293, and Static asset group on page 300.

Asset Owner
Asset Owner is one of the preset roles. A user with this role can view data about discovered assets, run manual scans, and create and run reports in accessible sites and asset groups.

Asset search filter

An asset search filter is a set of criteria with which a user can refine a search for assets to include in a dynamic asset group. An asset search filter is different from a vAsset discovery filter on page 301.

Authentication
Authentication is the process of a security application verifying the logon credentials of a client or user that is attempting to gain access. By default the application authenticates users with an internal process, but you can configure it to authenticate users with an external LDAP or Kerberos source.

Nexpose Users Guide

290

Average risk
Average risk is a setting in risk trend report configuration. It is based on a calculation of your risk scores on assets over a report date range. For example, average risk gives you an overview of how vulnerable your assets might be to exploits whether its high or low or unchanged. Some assets have higher risk scores than others. Calculating the average score provides a high-level view of how vulnerable your assets might be to exploits.

Benchmark
In the context of scanning for FDCC policy compliance, a benchmark is a combination of policies that share the same source data. Each policy in the Policy Manager contains some or all of the rules that are contained within its respective benchmark. See Federal Desktop Core Configuration (FDCC) on page 294 and United States Government Configuration Baseline (USGCB) on page 300.

Breadth
Breadth refers to the total number of assets within the scope of a scan.

Category
In the context of scanning for FDCC policy compliance, a category is a grouping of policies in the Policy Manager configuration for a scan template. A policys category is based on its source, purpose, and other criteria. See Policy Manager on page 296, Federal Desktop Core Configuration (FDCC) on page 294, and United States Government Configuration Baseline (USGCB) on page 300.

Check type
A check type is a specific kind of check to be run during a scan. Examples: The Unsafe check type includes aggressive vulnerability testing methods that could result in Denial of Service on target assets; the Policy check type is used for verifying compliance with policies. The check type setting is used in scan template configurations to refine the scope of a scan.

Center for Internet Security (CIS)

Center for Internet Security (CIS) is a not-for-profit organization that improves global security posture by providing a valued and trusted environment for bridging the public and private sectors. CIS serves a leadership role in the shaping of key security policies and decisions at the national and international levels. The Policy Manager provides checks for compliance with CIS benchmarks including technical control rules and values for hardening network devices, operating systems, and middleware and software applications. Performing these checks requires a license that enables the Policy Manager feature and CIS scanning. See Policy Manager on page 296.

Command console
The command console is a page in the Security Console Web interface for entering commands to run certain operations. When you use this tool, you can see real-time diagnostics and a behind-the-scenes view of Security Console activity. To access the command console page, click the Run console commands link next to the Troubleshooting item on the Administration page.

Nexpose Users Guide

291

Common Configuration Enumeration (CCE)

Common Configuration Enumeration (CCE) is a standard for assigning unique identifiers known as CCEs to configuration controls to allow consistent identification of these controls in different environments. CCE is implemented as part of its compliance with SCAP criteria for an Unauthenticated Scanner product.

Common Platform Enumeration (CPE)

Common Platform Enumeration (CPE) is a method for identifying operating systems and software applications. Its naming scheme is based on the generic syntax for Uniform Resource Identifiers (URI). CCE is implemented as part of its compliance with SCAP criteria for an Unauthenticated Scanner product.

Common Vulnerabilities and Exposures (CVE)

The Common Vulnerabilities and Exposures (CVE) standard prescribes how the application should identify vulnerabilities, making it easier for security products to exchange vulnerability data. CVE is implemented as part of its compliance with SCAP criteria for an Unauthenticated Scanner product.

Common Vulnerability Scoring System (CVSS)

Common Vulnerability Scoring System (CVSS) is an open framework for calculating vulnerability risk scores. CVSS is implemented as part of its compliance with SCAP criteria for an Unauthenticated Scanner product.

Compliance
Compliance is the condition of meeting standards specified by a government or respected industry entity. The application tests assets for compliance with a number of different security standards, such as those mandated by the Payment Card Industry (PCI) and those defined by the National Institute of Standards and Technology (NIST) for Federal Desktop Core Configuration (FDCC).

Continuous scan
A continuous scan starts over from the beginning if it completes its coverage of site assets within its scheduled window. This is a site configuration setting.

Coverage
Coverage indicates the scope of vulnerability checks. A coverage improvement listed on the News page for a release indicates that vulnerability checks have been added or existing checks have been improved for accuracy or other criteria.

Depth
Depth indicates how thorough or comprehensive a scan will be. Depth refers to level to which the application will probe an individual asset for system information and vulnerabilities.

Discovery (scan phase)

Discovery is the first phase of a scan, in which the application finds potential scan targets on a network. Discovery as a scan phase is different from vAsset discovery on page 301.

Nexpose Users Guide

292

Document report template

Document templates are designed for human-readable reports that contain asset and vulnerability information. Some of the formats available for this template typeText, PDF, RTF, and HTML are convenient for sharing information to be read by stakeholders in your organization, such as executives or security team members tasked with performing remediation.

Dynamic asset group

A dynamic asset group contains scanned assets that meet a specific set of search criteria. You define these criteria with asset search filters, such as IP address range or operating systems. The list of assets in a dynamic group is subject to change with every scan or when vulnerability exceptions are created. In this regard, a dynamic asset group differs from a static asset group. See Asset group on page 290 and Static asset group on page 300.

Dynamic Scan Pool

The Dynamic Scan Pool feature allows you to use Scan Engine pools to enhance the consistency of your scan coverage. A Scan Engine pool is a group of shared Scan Engines that can be bound to a site so that the load is distributed evenly across the shared Scan Engines. You can configure scan pools using the Extended API v1.2.

Dynamic site
A dynamic site is a collection of assets that are targeted for scanning and that have been discovered through vAsset discovery. Asset membership in a dynamic site is subject to change if the discovery connection changes or if filter criteria for asset discovery change. See Static site on page 300, Site on page 299, and vAsset discovery on page 301.

Exploit
An exploit is an attempt to penetrate a network or gain access to a computer through a security flaw, or vulnerability. Malicious exploits can result in system disruptions or theft of data. Penetration testers use benign exploits only to verify that vulnerabilities exist. The Metasploit product is a tool for performing benign exploits. See Metasploit on page 295 and Published exploit on page 297.

Export report template

Export templates are designed for integrating scan information into external systems. The formats available for this type include various XML formats, Database Export, and CSV.

Exposure
An exposure is a vulnerability, especially one that makes an asset susceptible to attack via malware or a known exploit.

Nexpose Users Guide

293

Extensible Configuration Checklist Description Format (XCCDF)

As defined by the National Institute of Standards and Technology (NIST), Extensible Configuration Checklist Description Format (XCCDF) is a specification language for writing security checklists, benchmarks, and related documents. An XCCDF document represents a structured collection of security configuration rules for some set of target systems. The specification is designed to support information interchange, document generation, organizational and situational tailoring, automated compliance testing, and compliance scoring. Policy Manager checks for FDCC policy compliance are written in this format.

False positive
A false positive is an instance in which the application flags a vulnerability that doesnt exist. A false negative is an instance in which the application fails to flag a vulnerability that does exist.

Federal Desktop Core Configuration (FDCC)

The Federal Desktop Core Configuration (FDCC) is a grouping of configuration security settings recommended by the National Institute of Standards and Technology (NIST) for computers that are connected directly to the network of a United States government agency. The Policy Manager provides checks for compliance with these policies in scan templates. Performing these checks requires a license that enables the Policy Manager feature and FDCC scanning.

Fingerprinting
Fingerprinting is a method of identifying the operating system of a scan target or detecting a specific version of an application.

Global Administrator
Global Administrator is one of the preset roles. A user with this role can perform all operations that are available in the application and they have access to all sites and asset groups.

Host
A host is a physical or virtual server that provides computing resources to a guest virtual machine. In a high-availability virtual environment, a host may also be referred to as a node. The term node has a different context in the application. See Node on page 295.

Latency
Latency is the delay interval between the time when a computer sends data over a network and another computer receives it. Low latency means short delays.

Malware
Malware is software designed to disrupt or deny a target systemss operation, steal or compromise data, gain unauthorized access to resources, or perform other similar types of abuse. The application can determine if a vulnerability renders an asset susceptible to malware attacks.

Nexpose Users Guide

294

Malware kit
Also known as an exploit kit, a malware kit is a software bundle that makes it easy for malicious parties to write and deploy code for attacking target systems through vulnerabilities.

Managed asset
A managed asset is a network device that has been discovered during a scan and added to a sites target list, either automatically or manually. Only managed assets can be checked for vulnerabilities and tracked over time. Once an asset becomes a managed asset, it counts against the maximum number of assets that can be scanned, according to your license.

Manual scan
A manual scan is one that you start at any time, even if it is scheduled to run automatically at other times. Synonyms include ad-hoc scan and unscheduled scan.

Metasploit
Metasploit is a product that performs benign exploits to verify vulnerabilities. See Exploit on page 293.

MITRE
The MITRE Corporation is a body that defines standards for enumerating security-related concepts and languages for security development initiatives. Examples of MITRE-defined enumerations include Common Configuration Enumeration (CCE) and Common Vulnerability Enumeration (CVE). Examples of MITRE-defined languages include Open Vulnerability and Assessment Language (OVAL). A number of MITRE standards are implemented, especially in verification of FDCC compliance.

National Institute of Standards and Technology (NIST)

National Institute of Standards and Technology (NIST) is a non-regulatory federal agency within the U.S. Department of Commerce. The agency mandates and manages a number of security initiatives, including Security Content Automation Protocol (SCAP). See Security Content Automation Protocol (SCAP) on page 299.

Node
A node is a device on a network that the application discovers during a scan. After the application integrates its data into the scan database, the device is regarded as an asset that can be listed in sites and asset groups. See Asset on page 290.

Open Vulnerability and Assessment Language (OVAL)

Open Vulnerability and Assessment Language (OVAL) is a development standard for gathering and sharing security-related data, such as FDCC policy checks. In compliance with an FDCC requirement, each OVAL file that the application imports during configuration policy checks is available for download from the SCAP page in the Security Console Web interface.

Nexpose Users Guide

295

Override
An override is a change made by a user to the result of a check for compliance with a configuration policy rule. For example, a user may override a Fail result with a Pass result.

Payment Card Industry (PCI)

The Payment Card Industry (PCI) is a council that manages and enforces the PCI Data Security Standard for all merchants who perform credit card transactions. The application includes a scan template and report templates that are used by Approved Scanning Vendors (ASVs) in official merchant audits for PCI compliance.

Permission
A permission is the ability to perform one or more specific operations. Some permissions only apply to sites or asset groups to which an assigned user has access. Others are not subject to this kind of access.

Policy
A policy is a set of primarily security-related configuration guidelines for a computer, operating system, software application, or database. Two general types of polices are identified in the application for scanning purposes: Policy Manager policies and standard policies. The application's Policy Manager (a license-enabled feature) scans assets to verify compliance with policies encompassed in the United States Government Configuration Baseline (USGCB) and the Federal Desktop Core Configuration (FDCC), as well as user-configured custom policies based on these policies. See Policy Manager on page 296, Federal Desktop Core Configuration (FDCC) on page 294, United States Government Configuration Baseline (USGCB) on page 300, and Scan on page 298. The application also scans assets to verify compliance with standard policies. See Scan on page 298 and Standard policy on page 299.

Policy Manager
Policy Manager is a license-enabled scanning feature that performs checks for compliance with Federal Desktop Core Configuration (FDCC), United States Government Configuration Baseline (USGCB), and other configuration policies. Policy Manager results appear on the Policies page, which you can access by clicking the Policies tab in the Web interface. They also appear in the Policy Listing table for any asset that was scanned with Policy Manager checks. Policy Manager policies are different from standard policies, which can be scanned with a basic license. See Policy on page 296 and Standard policy on page 299.

Policy Result
In the context of FDCC policy scanning, a result is a state of compliance or non-compliance with a rule or policy. Possible results include Pass, Fail, or Not Applicable.

Policy Rule
A rule is one of a set of specific guidelines that make up an FDCC configuration policy. See Federal Desktop Core Configuration (FDCC) on page 294, United States Government Configuration Baseline (USGCB) on page 300, and Policy on page 296.

Nexpose Users Guide

296

Potential vulnerability
A potential vulnerability is one of three positive vulnerability check result types. The application reports a potential vulnerability during a scan under two conditions: First, potential vulnerability checks are enabled in the template for the scan. Second, the application determines that a target is running a vulnerable software version but it is unable to verify that a patch or other type of remediation has been applied. For example, an asset is running version 1.1.1 of a database. The vendor publishes a security advisory indicating that version 1.1.1 is vulnerable. Although a patch is installed on the asset, the version remains 1.1.1. In this case, if the application is running checks for potential vulnerabilities, it can only flag the host asset as being potentially vulnerable. The code for a potential vulnerability in XML and CSV reports is vp (vulnerable, potential). For other positive result types, see Vulnerability check on page 302.

Published exploit
In the context of the application, a published exploit is one that has been developed in Metasploit or listed in the Exploit Database. See Exploit on page 293.

Real Risk strategy

Real Risk is one of the built-in strategies for assessing and analyzing risk. It is also the recommended strategy because it applies unique exploit and malware exposure metrics for each vulnerability to Common Vulnerability Scoring System (CVSS) base metrics for likelihood (access vector, access complexity, and authentication requirements) and impact to affected assets (confidentiality, integrity, and availability). See Risk strategy on page 297.

Report template
Each report is based on a template, whether it is one of the templates that is included with the product or a customized template created for your organization. See Document report template on page 293 and Export report template on page 293.

Risk
In the context of vulnerability assessment, risk reflects the likelihood that a network or computer environment will be compromised, and it characterizes the anticipated consequences of the compromise, including theft or corruption of data and disruption to service. Implicitly, risk also reflects the potential damage to a compromised entitys financial well-being and reputation.

Risk score
A risk score is a rating that the application calculates for every asset and vulnerability. The score indicates the potential danger posed to network and business security in the event of a malicious exploit. You can configure the application to rate risk according to one of several built-in risk strategies, or you can create custom risk strategies.

Risk strategy
A risk strategy is a method for calculating vulnerability risk scores. Each strategy emphasizes certain risk factors and perspectives. Four built-in strategies are available: Real Risk strategy on page 297, TemporalPlus risk strategy on page 300TemporalPlus risk strategy, Temporal risk strategy on page 300, and Weighted risk strategy on page 302. You can also create custom risk strategies.

Nexpose Users Guide

297

Risk trend
A risk trend graph illustrates a long-term view of your assets probability and potential impact of compromise that may change over time. Risk trends can be based on average or total risk scores. The highest-risk graphs in your report demonstrate the biggest contributors to your risk on the site, group, or asset level. Tracking risk trends helps you assess threats to your organizations standings in these areas and determine if your vulnerability management efforts are satisfactorily maintaining risk at acceptable levels or reducing risk over time. See Average risk on page 291 and Total risk on page 300.

Role
A role is a set of permissions. Five preset roles are available. You also can create custom roles by manually selecting permissions. See Asset Owner on page 290, Security Manager on page 299, Global Administrator on page 294, Site Owner on page 299, and User on page 301.

Scan
A scan is a process by which the application discovers network assets and checks them for vulnerabilities. See Exploit on page 293 and Vulnerability check on page 302.

Scan credentials
Scan credentials are the user name and password that the application submits to target assets for authentication to gain access and perform deep checks. Many different authentication mechanisms are supported for a wide variety of platforms. See Shared scan credentials on page 299 and Site-specific scan credentials on page 299.

Scan Engine
The Scan Engine is one of two major application components. It performs asset discovery and vulnerability detection operations. Scan engines can be distributed within or outside a firewall for varied coverage. Each installation of the Security Console also includes a local engine, which can be used for scans within the consoles network perimeter.

Scan template
A scan template is a set of parameters for defining how assets are scanned. Various preset scan templates are available for different scanning scenarios. You also can create custom scan templates. Parameters of scan templates include the following:

methods for discovering assets and services types of vulnerability checks, including safe and unsafe Web application scanning properties verification of compliance with policies and standards for various platforms

Scheduled scan
A scheduled scan starts automatically at predetermined points in time. The scheduling of a scan is an optional setting in site configuration. It is also possible to start any scan manually at any time.

Nexpose Users Guide

298

Security Console
The Security Console is one of two major application components. It controls Scan Engines and retrieves scan data from them. It also controls all operations and provides a Web-based user interface.

Security Content Automation Protocol (SCAP)

Security Content Automation Protocol (SCAP) is a collection of standards for expressing and manipulating security data. It is mandated by the U.S. government and maintained by the National Institute of Standards and Technology (NIST). The application complies with SCAP criteria for an Unauthenticated Scanner product.

Security Manager
Security Manager is one of the preset roles. A user with this role can configure and run scans, create reports, and view asset data in accessible sites and asset groups.

Shared scan credentials

One of two types of credentials that can be used for authenticating scans, shared scan credentials are created by Global Administrators or users with the Manage Site permission. Shared credentials can be applied to multiple assets in any number of sites. See Site-specific scan credentials on page 299.

Site
A site is a collection of assets that are targeted for a scan. Each site is associated with a list of target assets, a scan template, one or more Scan Engines, and other scan-related settings. See Dynamic site on page 293 and Static site on page 300. A site is not an asset group. See Asset group on page 290.

Site-specific scan credentials

One of two types of credentials that can be used for authenticating scans, a set of single-instance credentials is created for an individual site configuration and can only be used in that site. See Scan credentials on page 298 and Shared scan credentials on page 299.

Site Owner
Site Owner is one of the preset roles. A user with this role can configure and run scans, create reports, and view asset data in accessible sites.

Standard policy
A standard policy is one of several that the application can scan with a basic license, unlike with a Policy Manager policy. Standard policy scanning is available to verify certain configuration settings on Oracle, Lotus Domino, AS/400, Unix, and Windows systems. Standard policies are displayed in scan templates when you include policies in the scope of a scan. Standard policy scan results appear in the Advanced Policy Listing table for any asset that was scanned for compliance with these policies. See Policy on page 296 and Policy Manager on page 296.

Nexpose Users Guide

299

Static asset group

A static asset group contains assets that meet a set of criteria that you define according to your organization's needs. Unlike with a dynamic asset group, the list of assets in a static group does not change unless you alter it manually. See Dynamic asset group on page 293.

Static site
A static site is a collection of assets that are targeted for scanning and that have been manually selected. Asset membership in a static site does not change unless a user changes the asset list in the site configuration. For more information, see Dynamic site on page 293 and Site on page 299.

Temporal risk strategy

One of the built-in risk strategies, Temporal indicates how time continuously increases likelihood of compromise. The calculation applies the age of each vulnerability, based on its date of public disclosure, as a multiplier of CVSS base metrics for likelihood (access vector, access complexity, and authentication requirements) and asset impact (confidentiality, integrity, and availability). Temporal risk scores will be lower than TemporalPlus scores because Temporal limits the risk contribution of partial impact vectors. See Risk strategy on page 297.

TemporalPlus risk strategy

One of the built-in risk strategies, TemporalPlus provides a more granular analysis of vulnerability impact, while indicating how time continuously increases likelihood of compromise. It applies a vulnerability's age as a multiplier of CVSS base metrics for likelihood (access vector, access complexity, and authentication requirements) and asset impact (confidentiality, integrity, and availability). TemporalPlus risk scores will be higher than Temporal scores because TemporalPlus expands the risk contribution of partial impact vectors. See Risk strategy on page 297.

Total risk
Total risk is a setting in risk trend report configuration. It is an aggregated score of vulnerabilities on assets over a specified period.

United States Government Configuration Baseline (USGCB)

The United States Government Configuration Baseline (USGCB) is an initiative to create security configuration baselines for information technology products deployed across U.S. government agencies. USGCB evolved from FDCC, which it replaces as the configuration security mandate in the U.S. government. The Policy Manager provides checks for Microsoft Windows 7, Windows 7 Firewall, and Internet Explorer for compliance with USGCB baselines. Performing these checks requires a license that enables the Policy Manager feature and USGCB scanning. See Policy Manager on page 296 and Federal Desktop Core Configuration (FDCC) on page 294.

Unmanaged asset
An unmanaged asset is a device that has been discovered during a scan but not correlated against a managed asset or added to a sites target list. The application is designed to provide sufficient information about unmanaged assets so that you can decide whether to manage them. An unmanaged asset does not count against the maximum number of assets that can be scanned according to your license.

Nexpose Users Guide

300

Unsafe check
An unsafe check is a test for a vulnerability that can cause a denial of service on a target system. Be aware that the check itself can cause a denial of service, as well. It is recommended that you only perform unsafe checks on test systems that are not in production.

Update
An update is a released set of changes to the application. By default, two types of updates are automatically downloaded and applied:

Content updates include new checks for vulnerabilities, patch verification, and security policy compliance. Content updates always occur automatically when they are available. Product updates include performance improvements, bug fixes, and new product features. Unlike content updates, it is possible to disable automatic product updates and update the product manually.

User
User is one of the preset roles. An individual with this role can view asset data and run reports in accessible sites and asset groups.

vAsset discovery
vAsset discovery is a process by which the application automatically discovers virtual assets through a connection with a vSphere server or virtual machine host. You can refine or limit asset discovery with criteria filters. See vAsset discovery filter on page 301 and vConnection on page 301. vAsset discovery is different from Discovery (scan phase) on page 292.

vAsset discovery filter

A vAsset discovery filter is a set of criteria refining or limiting vAsset discovery results. This type of filter is different from an Asset search filter on page 290.

vConnection
A vConnection is a connection that is initiated with a server that manages virtual machines in order to discover those assets. A Global Administrator can configure a vConnection. See vAsset discovery filter on page 301.

Validated vulnerability
A validated vulnerability is a vulnerability that has had its existence proven by an integrated Metasploit exploit. See Exploit on page 293.

Vulnerable version
Vulnerable version is one of three positive vulnerability check result types. The application reports a vulnerable version during a scan if it determines that a target is running a vulnerable software version and it can verify that a patch or other type of remediation has not been applied. The code for a vulnerable version in XML and CSV reports is vv (vulnerable, version check). For other positive result types, see Vulnerability check on page 302.

Nexpose Users Guide

301

Vulnerability
A vulnerability is a security flaw in a network or computer.

Vulnerability category
A vulnerability category is a set of vulnerability checks with shared criteria. For example, the Adobe category includes checks for vulnerabilities that affect Adobe applications. There are also categories for specific Adobe products, such as Air, Flash, and Acrobat/Reader. Vulnerability check categories are used to refine scope in scan templates. Vulnerability check results can also be filtered according category for refining the scope of reports. Categories that are named for manufacturers, such as Microsoft, can serve as supersets of categories that are named for their products. For example, if you filter by the Microsoft category, you inherently include all Microsoft product categories, such as Microsoft Path and Microsoft Windows. This applies to other company categories, such as Adobe, Apple, and Mozilla.

Vulnerability check
A vulnerability check is a series of operations that are performed to determine whether a security flaw exists on a target asset. Check results are either negative (no vulnerability found) or positive. A positive result is qualified one of three ways: See Vulnerability found on page 302, Vulnerable version on page 301, and Potential vulnerability on page 297. You can see positive check result types in XML or CSV export reports. Also, in a site configuration, you can set up alerts for when a scan reports different positive results types.

Vulnerability exception
A vulnerability exception is the removal of a vulnerability from a report and from any asset listing table. Excluded vulnerabilities also are not considered in the computation of risk scores.

Vulnerability found
Vulnerability found is one of three positive vulnerability check result types. The application reports a vulnerability found during a scan if it verified the flaw with asset-specific vulnerability tests, such as an exploit. The code for a vulnerability found in XML and CSV reports is ve (vulnerable, exploited). For other positive result types, see Vulnerability check on page 302.

Weighted risk strategy

One of the built-in risk strategies, Weighted is based primarily on asset data and vulnerability types, and it takes into account the level of importance, or weight, that you assign to a site when you configure it. See Risk strategy on page 297.

Nexpose Users Guide

302

Index
A
Access page add users to a site 31 add host name to site 29 adding address to site 29 adding IP address to site 29 adding IPv4 assets 29 adding IPv6 assets 29 administration deleting sites 32 Security Console, using 20 alerts confirmed 40 potential 40 setting up 39 unconfirmed 40 API report sharing 161 archive file uploading policies 230 asset Asset Listing table 71 Asset Listing table, vulnerability 71 configuring discovery 194 discovery 194 MAC addresses, authorized 198 PCI audit template 195 port 80 194 ports used 195 Scan Engine 194 TCP handshake 195 DNS resolution 195 dynamic asset group, Asset Filter 121 file searches 219 filter by asset name 126 filtering by vulnerability CVSS score 133 by vulnerability exposures 134 by vulnerability risk scores 134 by vulnerability title 135 combining filters 135 CVSS risk vectors 132 IP fingerprinting 196 MAC address, unauthorized 194 risk factors 238 risk strategies 238 scan target 195 search by IP address range 127 by IP address type 126 by operating system name 127 by other IP address type 128 by service name 129 by site name 129 by software name 130 search by host type 126 search by last scan date 127 search by PCI compliance status 129 single asset 45 target asset, live 194 vAsset discovery 24 vulnerabilities detected 71 asset groups 120 asset information, reporting 120 asset information, viewing 120 display all assets 123 dynamic asset group, criteria 121 dynamic asset group, inclusion in 138 dynamic asset group, live asset inventory 121 dynamic asset group, using 121 exploits 120 network location 120 operating system 120 risk scores 120 scanning 120 snapshot 120 static asset groups, using 121 using 120 vulnerabilities 120 assets Asset Compliance 107 Asset Exclusions page 30 blocked discovery connection 194 configuring search filters 124 dead 194 discovered assets 196 discovery data collection 196 DNS servers 196 fingerprinting 196 firewalls 194 information 196 MAC addresses, unauthorized 197 other assets 196 Whois 196 WINS servers 196 discovery method 195 exclude from scans 30 filtered searches 124 filtering search results 136 fingerprinting 81

Nexpose Users Guide

303

Global Asset Exclusion 30 ICMP echo requests 194 IP stack 196 locating 78 by asset groups 80 by operating system 80 by services 80 by sites 79 by software 81 managing assets in a dynamic site 64 managing dynamic sites 63 non responsive assets not responding 194 not include in reports 181 pings 194 Policy Manager 107 all assets in a site 114 override rules 113, 115, 116 Policy Manager tested assets, results 109 reports asset and vulnerabilities compliance overview 282 scan schedule 186 scanning retries 201 scanning, fine-tuning 195 search filter attributes 124 service discovery 199 simultaneous scan 188 specifying assets to scan 29 specifying in a report 146 subset 124 TCP packets 194 Tested Assets 108 UDP packets 194 vAsset filters 130 viewing details 81 vulnerable 279 ASV PCI Attestation of Compliance 275 Attestation of Compliance 166

B
basic report, creating 142 benchmark 230 benchmark file ID 231 benchmark ID 230 policy 231 benchmarks 253 Best practices for scheduling reports 153

C
CCE 230 Configuration Policy Rules table 110 Overview table 110 Parameters table 110

Policy Manager 110 References table 110 Technical Mechanisms table 110 Center for Internet Security (CIS) 252 Center for Internet Security (CIS) benchmarks 106 checks Advanced Policy Engine 206 CIDR using CIDR notation in sites 29 CIS 252, 253 CIS benchmarks configuration assessment 252 CIS template 254 compliance AS/400 policy 209 CIFS/SMB account policy 209 CSV export 174 CyberScope 139 database servers 215 FDCC 139 Lotus Domino policy 207 Oracle policy 207 PCI Audit 180 Policy Manager 106, 107 Policy Rules, Policy Manager 108 policy settings 207, 215 reports 285 Attestation of Compliance 275 rules 107 UNIX policy 209 USGCB 139 Web servers 216 Windows Group Policy 208 Compliance programs, PCI 153 compressed IPv6 addresses 29 configuration configuration panels, using 22 editing sites 220 report settings 141 report sharing settings 160 resources 220 URL redirection 158 configuration assessment 252 configuration panels 22 configure Web spider 210 configuring a static site 28 consoles.xml Configuring the Security Console to work with a new Scan Engine 35 conventions document 10 Cover Page 166 CPE 230, 231

Nexpose Users Guide

304

Create a new report panel 169, 172 Create a report panel 168 creating a basic report 142 credential types configuring LMNTLM hash 46 SSH public keys 46 credentials checking custom settings 192 default settings 192 configuring account 44 configuring new set 43 editing, site 46 for sites 42 key pair, generating 48 LM/NTLM hash 44 LM/NTLM hash authentication 49 log on 42 logon creating for Web site form 51 logon, creating for Web site session authentication 52 new 43 scan authentication 50 shared 42 site-specific 42, 43 specific port 45 SSH public key authentication 48 SSH public key, paired 46 SSH public keys 44 testing 44 using SSH public key authentication 46 using, credentials enabling 43 Web site form authentication 50 Web site session authentication 50 web site session with HTTP headers 52 CSV export reports 180 custom logo report template 171 custom policy 230, 231 customizable CSV 169 CVE 230, 231 CVSS (Common Vulnerability Scoring System) 132 CyberScope Automated Data Feeds Submission Manual 145 Bureau 145 Component 145 Enclave 145 entering information 145 CyberScope reports 139 CyberScope XML 144 CyberScope XML bureau 145 CyberScope XML configuration 145

CyberScope XML enclave 145 CyberScope XML Export report 145

D
Data export template 169 data template attributes 287 database export 178 Database Export 165 delete custom report template 141 delete report template 141 delete sites 32 directory paths Web spider 213 discovery asset 194 Asset Discovery Connection panel 57 asset membership 58 configure filters 62 connection 54 connection settings, changing 58 continuous 54 create dynamic site 62 credentials, Credentials page 57 delete connections 58 Discovery Management page 58 Discovery Statistics page 63 dynamic discovery of virtual assets 54, 55 echo request (ping) 194 ESX(i) versions, vAsset discovery 55 export connections, CSV file 58 filter, applying discovery, apply filters 62 filter, cluster 59 filter, combining discovery filters 61 filter, datacenter 59, 60 filter, guest OS family 59, 60 filter, host 59, 60 filter, IP address range 59, 60 filter, power state 59, 61 filter, resource pool path 59, 61 filter, virtual machine name 59, 61 Filtered asset discovery page 57 filters and operators 59 filters, adding 62 filters, using 59 initiate vAsset discovery 55 list of discovered assets 58 Manage sites permissions 58 monitoring 63 New Dynamic Site 58 scans 54 service configuration 200 service, configuring 199

Nexpose Users Guide

305

target environments 54 vAsset connections, creating 57 vAsset connections, managing 57 vAsset discovery 24, 54 vAsset discovery icon 57 vAsset discovery, initiating 58 vAsset, account credentials 56 vAsset, performing 55 vAsset, port 443 56 vAssets, discoverable 56 vCenter versions, vAsset discovery 55 virtual assets 54 Web spider 210 without running a scan 54 distributed Scan Engine selecting a Scan Engine for a site 33 DNS Web spider 211 document conventions 10 document template type 143 dynamic asset groups criteria 121 criteria for inclusion 138 inventory 121 user access 121 User Configuration panel 121 using 121 dynamic site discovery delete connections 58 dynamic sites update 54 vAsset discovery 54

malware kits 239 Malware tab 86 Metasploit module 92 pen test 251 penetration test 251 remediation 239 threat exposure 239 verify vulnerabilities 251 vulnerabilities 92 vulnerability age 239 well-known 240 Exploit Exposure using 251 Export 85 export database 178 export template attributes 287 export template type 143 Exporting scan data to external databases 165

F
FDCC 139, 252, 253 custom Policy Manager scans 106 Policy Manager 106 Policy Manager scans 106 FDCC policies 252 FDCCconfiguration assessment 252 Federal Desktop Core Configuration (FDCC) 252 federal government agency 252 filter by host type bare metal 126 Hypervisor 126 unknown host type 126 Virtual machine 126 filters asset searches 124 attributes 124 by asset name 126 by host type 126 by IP address range 127 by IP address type 126 by last scan date 127 by operating system name 127 by other IP address type 128 by PCI compliance status 129 configuring asset search filters 124 search by service name 129 by site name 129 by software name 130 search filters 124 selecting filters 125 vulnerability information 148 Discovered Services 148

E
Editing a policy 223 Editing policies during a scan 222 elevated permissions 47 Engine Address Configuring the Security Console to work with a new Scan Engine 34 Engine Address and Port fields in Scan Engine configuration 34 errors 233 exploit access complexity 238 access vector 238 authentication requirement 238 email spam relaying settings 207, 215 exploit exposure 239 exploit skill 86 information 92 initial difficulty 238 initial exploit difficulty 238 malware exposure 239

Nexpose Users Guide

306

Discovered Vulnerabilities 148 Index of Vulnerabilities 148 Remediation Plan 148 Vulnerability Exceptions 148 Vulnerability Report Card Across Network 148 Vulnerability Report Card by Node 148 Vulnerability Test Errors 148 fingerprinting 196, 231 TCP/IP stacks 196 firewall block discovery of an asset 194 formats CSV export formats 174 vulnerability exceptions in XML and CSV 177 frequency of schedule 152

I
Including organization information in a site 41 IP fingerprinting 196 IP address Specifying assets to scan 29 IPv4 notation configuring a static site 29 IPv6 notation configuring a static site 29

L
license Administration tab 56 Security Console Configuration panel, Licensing page 56 vAsset discovery 56 vAsset, virtualization 56 logging on 14 login root 47 su 47 sudo 47

G
gauging your security posture configuration assessment 252 getting started 12 configuration 12 daemon host system 13 restarting 13 first time duration 13 host system 12 logging on 14 Security Console Linux 13 Security Console, starting 12 starting automatically as a service 12 starting in Linux 13 starting in Windows 12 stopping in Linux 13 stopping in Windows 12 working with the daemon 13 getting starting daemon stopping 13 give users access to a site 31 Global Administrator creating shared scan credentials 42 uploading policies 230 global settings exclude assets from scans 30

M
mail servers scanning 217 malware exposure 239 malware kits 71 Manage report templates 169, 172 Manage Site permissions creating shared scan credentials 42 Managing the sharing of reports 157 Media Access Control (MAC address) 197 Metasploit 71, 85 Exploit Exposure, using 251 exploit ranking 86

N
Navigating the Security Console Home page 18 not an update of USGCB 1.0 252

O
Other documents and Help 9 OVAL 230 OVAL check types 230

P
pair Security Console and Scan Engine 35 pairing Scan Engines and Security Consoles 34 pairing Security Console and Scan Engine 35 Payment Card Industry (PCI) Component Compliance Summary 166 Payment Card Industry (PCI) Host Details 166 Payment Card Industry (PCI) Scan Information 166 Payment Card Industry (PCI) Special Notes 166 Payment Card Industry (PCI) Vulnerabilities Noted 166 Payment Card Industry (PCI) Vulnerability Details 166

H
host names Specifying assets to scan 29 How do I know if my license enables Policy Manager? 253 How do I run configuration assessment scans? 253 How do I view Policy Manager scan results? 253 HTTPS vAsset discovery 56 hyperlink Web spider 213

Nexpose Users Guide

307

PCI Audit template asset discovery 195 TCP ports 195 PCI compliance filtering by status 129 PCI Council restrictions 166 PCI Executive Summary 166 PCI Host Detail 166 PCI Vulnerability Details 166 PDF report 153 Pen test 266 penetration test 251 performance bandwidth metrics 189 bottlenecks 188 credentialed scans 188 discovery settings, editing 200 increasing accuracy 188 port scanning 199 resource availability 188 tuning scan template 190 Web site scanning 216 tuning discovery 202 tuning options 220 Web spider fine tuning 214 performing discovery scans 54 permissions 47 generating restricted reports 164 report sharing 159 policies 253 policy 230 Advanced Policy Engine checks 206 archive file 230 AS/400 policy 106 benchmark ID 231 CIFS/SMB Account policy 106 database servers, scanning 215 Lotus Domino policy 106 Oracle policy 106 Policy Manager rule test results, override 111 Standard 106 standard policy checks 106 uploading 230 Web servers, scanning 216 Windows Group policy 106 policy checks 252 Policy Manager asset compliance 107 assets in a all sites 113 benchmark ID 109 category 109 CCE data 110

configuration assessment 252 copy policy 107 custom policies 106 delete policy 107 edit policy 107 FDCC 106 license 106 name 109 override history, viewing 112 override permissions 111 override requests 117 override rule, all scan on one asset 116 override rule, all scans on an asset 115 override rule, delete request 118 override scope options 111 override scope options, A specific scan result on a single asset 112 override scope options, All assets in a specific site 111 override scope options, All scan results for a single asset 112 override scope options, global 111 permissions 111 Policies tab 107 policy checks 106 Policy Listing table 107 policy results 108 Policy Rule Compliance 108 policy rules 109 results overview 107 results, working with 106 reviewing override requests 117 Rule Compliance 107 rule results 109 rules, all assets in a site 114 scanning 109 scope options 111, 112 standard policies 106 submitting an override 113 test results, override 111 Tested Assets 108 USGCB 106 view details 108 Policy Manager checks 252 configuration assessment 253 policy scan 253 policy scanning 253 port scanning 201 Prioritized Remediations template 279 Prioritized Remediations with Details template 280

R
Real Risk strategy 239 regex creating 248

Nexpose Users Guide

308

file name search 249 using 248 Web site logon 250 Web spider 213 regular expression (regex) 248 remediation prioritizing 181 reports 181 templates 285 tickets 182 remediation efforts 279 remediation plan templates, using 153 replaced USGCB 2.0 as U.S. government standard 252 replaces FDCC 252 Report ConfigurationOutput page 165 report data settings 181 report format 169 report history 141 Report Template ConfigurationGeneral page 167 reporting MAC address 198 scan MAC address 198 reports access list 159 API 161 assets 146 assets not included 181 Attestation of compliance 139 baseline 155 baseline comparison 274 trends 274 configuration 141, 142 URL redirection 158 configuring 139 content, understanding 179 creating 142 credentials, missing 179 CSV export 174, 180 CSV export formats 174 custom 139 cover page 282 CyberScope 139 Bureau 145 Component 145 Enclave 145 CyberScope information 145 data remediation 181 database export 178 deleting sites 32 designated owner 157 discovery-only templates 179

FDCC 139 FISMA 139 formats 144 CyberScope 145 database export 178 HTML 144, 173 human-readable 173 PDF 173 RTF 144, 173 text 173 vulnerability filtering not supported 148 working with 173 XCCDF Human Readable CSV report 139 XCCDF XML report 139 XML 144 generating restricted reports 164 manual scans 179 metrics 251 Microsoft Excel pivot tables 174 new 142 PCI audit 180 PCI Executive Summary 139 pivot tables 174 policy checks not enabled 179 remediation 180, 181 Report Card 180 report data 179 scan settings 179 report formats 179 risk score 181 risk strategies 181 risk trends 237 scan data 181 schedule 181 section, restricting 163 settings 181 sharing 157 administrative tasks 157 configuration 160 sharing, permission 159 sharing, settings 157 table of contents 286 templates 139 asset and vulnerabilities compliance overview 282 audit report 273 Baseline comparison 286 baseline report 282 cover page 282 custom logo 171 custom PCI sections 284, 285 custom SANS Top 20 sections 285, 286 custom vulnerabilities sections 286, 287 data template attributes 287

Nexpose Users Guide

309

discovered databases 282 discovered files and directories 282 discovered services 283 discovered system information 283 discovered users and groups 283 discovered vulnerabilities 283 Executive Overview 274 Executive summary 283 fine-tuning information 168 Highest Risk Vulnerabilities 275 highest risk vulnerability details 283 index of vulnerabilities 283 PCI Attestation of Compliance 275 PCI Audit (legacy) 276 PCI Executive Overview (legacy) 276 PCI Executive Summary 276 PCI Host Details 277 PCI Vulnerability Details 277 Policy evaluation 278, 285 Remediation plan 278, 285 Report Card 278 Risk trends 285 SANS Top 20 279 Scanned hosts and networks 286 sections 163 Table of Contents templates 286 Top 10 Riskiest Assets 279 Top 10 Vulnerable Assets 279 Trend analysis 286 vulnerability filters 281 templates, built-in 272 templates, custom 168 templates,Risk assessment 285 top 10 riskiest assets 279 top 10 vulnerable assets 279 unsafe checks not enabled 179 USGCB 139 viewing, Web interface 140 vulnerabilities 180, 251 remediation 181 vulnerabilities not checked 179 vulnerabilities not included 181 vulnerability certainty 180 Vulnerability Details 139 vulnerability exceptions 177 vulnerability information 148 vulnerability result codes 177 working with 139 XCCDF Human Readable CSV Report 174 XML export 180 XML schema 178 risk assets with the most risk 279 report template

trends 285 Top 10 Riskiest Asset report 279 risk factors strategies 238 availability impact 238 confidentiality impact 238 integrity impact 238 vulnerability impact 238 risk strategies analysis 237 appearance order, setting 244 calculating risk 237 calculation times 241 changing 241 changing the appearance order 245 custom risk strategies 243 custom, XML file 243 description sub-element 243 maximum impact 239 name element 243 new strategy 242 Real Risk 238, 239 recalculating scan data 241 risk factors 238 risk trends 237 reports 237 RiskModel element 243 scoring 246 Temporal 238, 240 Temporal Plus 238 TemporalPlus 240 threats 237 trends 237 usage history 242 VulnerabilityRiskStrategy sub-element 243 Weighted 238 weighted 241 weighted risk scores 241 risk trends baseline comparison 274 reports templates 285 root 47

S
scan accuracy 186, 187 accuracy, improved 220 asset discovery 190 Asset Exclusions page 30 asset groups 120 Asset Listing table 71 assets in a site 66 authenticated scans 42 authenticated scans of SMTP services 198

Nexpose Users Guide

310

bandwidth 186, 187 baseline 155 baseline comparison 274 configuring 190 configuring credentials 42 credentials, shared 42 credentials, site-specific 42 custom FDCC 106 CVS servers 217 data 186 reports 181 database servers 215 dead assets 194 Defeat Rate Limit 202 delay 201 DHCP servers 217 disable vulnerability checks 205 discovery phase 190 enable schedule 38 enable vulnerability checks 205 exclude assets 30 excluding assets by host name 30 exhaustive template 38 FDCC 106 fine-tune 216 fine-tuning 195 firewalls, open 221 full audit template 38 Global Asset Exclusions page 30 goals 186 hanging scan 186 hung scan 186 live assets 195 log file, downloading 72 log files 71 mail servers 217 manual scan 66 manual scan targets 66 manual, host name 66 manual, IP address 66 memory usage 186 metasploit 71 packet-per-second rate 202 parallelism 202 pause 71 performance 185, 186 adjustment 187 goals 186 improved 186 improvement 191 improving 185 port scanning 199 schedule 186 phases 190

policy compliance 36, 207, 215 Policy Manager 106, 109 port discovery 36 port scanning 201 quickly 186 recalculating scan data 241 remove vulnerability check types 204 report templates scanned hosts and networks 286 resources 187 results, viewing 71 resume 71 retries 201 running a manual scan 66 scan attributes 36 Scan Engine placement 188 scan history, viewing 72, 76 scan log file name 72 scan log, downloading 72 scan log, viewing 71 scan set up 38 scan template selection 188 schedule 181, 186 alerts 39 schedule, creating 37 service discovery 190 settings report data 179 settings, compliance 207, 215 simultaneous assets 188 Site Listing pane, Home page 66 Sites page 66 specific ports 45 specific targets 66 specifying assets to scan 29 speed 186 stop 71 targets 221 Telnet servers 218 template FDCC 206 MAC address 198 PCI audit 195 selecting 36 settings 191 template, limiting 191 templates 185, 190 custom 193 templates, changing 191 templates, default 192 time 186, 187 time availability 187 time, slow 186 timeout interval 201

Nexpose Users Guide

311

tuning system resources 186 tuning, adjustment 187 types asset discovery 193 vulnerabilities 193 USGCB 106 USGCB, custom policies 106 vulnerability checking 36 vulnerability checks 190, 203 Web applications 50 Web servers 216 Web spider 210 Windows targets 221 Scan Engine asset discovery 194 performance 188 placement 188 static site, create a site 25 Scan Engine, new 35 Scan Engines assigning sites 35 availability 33 changing deployment 220 configuring 34 deleting 35 deleting sites 32 deploying 220 distributed 34 editing properties 35 hosted 33 local 33, 34 logon credentials 42 new 35 paired with Security Consoles 34 pairing 34 pairing with Security Consoles 34 reassigning sites 35 remote 34 Security Consoles, paired 33 Security Consoles, working with 34 selecting 33 updating 35 Scan Engines (NSE) 34 scan log download 72 log file 72 reading 72 viewing 71, 72 scan long scan history, viewing 72 scan template Defeat Rate Limit 202 packet-per-second rate 202

parallelism 202 scan delay 201 timeout interval 201 Scan templates 254 scan templates built-in 192 CIS template 254 creating 192 custom 193 default 192 deleting sites 32 editing 192 fine-tuning 192 modifying 192 parameters 192 Web spider 210 scan type Discovery scan 256 Discovery scan (aggressive) 258 Exhaustive 258 Internet DMZ audit 262 Linux RPMs 263 Microsoft hotfix 264 Payment Card Industry (PCI) audit 265 Penetration test 266 Safe network audit 267 Sarbanes-Oxley (SOX) compliance 268 SCADA audit 269 Web audit 271 scan types, HIPAA compliance 261 scanning pausing, resuming, and stopping a scan 71 scan logs 72 scan results 71 services scanned 173 viewing the scan log 71 scans completed 246 discovery scans 54 risk scoring 246 SCAP uploading policies 230 SCAP policy 230, 231 upload errors 233 SCAP reports SCAP compatible XML 174 schedule alerts 39 enabling 38 policy compliance 38 scan 37 scan times 38 schedule reports 152 Scheduling reports 152

Nexpose Users Guide

312

scheduling reports 152 scope assets in a report 146 search filter by IP address range 127 by IP address type 126 by last scan date 127 by operating system name 127 by other IP address type IPv4 128 IPv6 128 filter by asset name 126 filtered asset searches 124 filters by host type 126 regex, using 249 selecting filters 125 search feature using 21 searches target systems 219 Security Console administration 20 browsers 14 configuration panels, using 22 Current Scan Listings for All Sites 19 logging on 14 navigation 20 search feature 21 viewing reports 140 Web interface 18 reports 157 Web interface sessions, extending 22 Security Consoles pairing 34 Security Consoles (NSC) 34 selecting a template 144 Setting up scan alerts 39 settings Web spider performance 211 site 35 account authentication 44 comparing dynamic and static sites 24 configuration Scan Engines 33 configuration, editing 220 configuring scan credentials 42 configuring site-level scan credentials 42 create dynamic site 62 creating dynamic 63 creating static sites 25 credentials 43 dynamic site 24

dynamic site based on discovery results 59 dynamic site configuration 24 dynamic sites 24 dynamic sites, associated with a connection 58 editing credentials 46 filter by site name 129 general information for static site 28 Global Asset Exclusions page 30 grouping for a static site 25 managing assets in a dynamic site 64 managing assets in a static site 25 organization information 41 policy compliance 38 Policy Manager override rule 114 Scan Engine 33 Scan Engines 35 scan times 38 Site Configuration panel, exclude assets 30 site membership 25 specify assets in a static site 29 static site 24 Scan Engine placement 25, 28 static site configuration 28 target environment 24 using credentials 43 site importance static site 28 sites deleting 32 dynamic sites 54 SMTP services scans, authenticated 198 SOX 268 Standard policies license 106 standard policies 207 standard policy 207 static asset groups display all assets 123 filtered asset search, performing 121 Group Configuration panel, using 121 new static asset group 122 using 121 static site create a site 28 Storing reports in report owner directories 156 su 47 sudo 47 sudoers 47 support, technical 10

T
Table of Contents 166 target system

Nexpose Users Guide

313

file searches 219 TCP/IP stacks fingerprinting 196 technical support 10 template HIPAA compliance template 36 import Security Templates Snap-In 208 Internet DMZ template 36 scan attributes 36 service discovery settings 200 Web audit template 36 template type 169, 172 document template 169 templates Baseline Report 282 built-in 190, 272 compliance 36 discovery-only 179 exhaustive 38 full audit 38 performance 190 policy compliance 36 policy evaluation 285 report baseline 155 custom logo 171 Executive Overview 274 fine-tuning information 168 reports 139 asset vulnerabilities and compliance overview 282 Attestation of Compliance 275 audit report 273 cover page 282 custom PCI sections 284, 285 custom SANS Top 20 sections 285, 286 custom vulnerabilities sections 286, 287 data template attributes 287 discovered databases 282 discovered files and directories 282 discovered services 283 discovered system information 283 discovered users and groups 283 discovered vulnerabilities 283 Executive summary 283 Highest Risk Vulnerabilities 275 highest risk vulnerability details 283 index of vulnerabilities 283 PCI Audit (legacy) 276 PCI Executive Overview (legacy) 276 PCI Executive Summary) 276 PCI Host Details 277 PCI Vulnerability Details) 277

Policy evaluation 278, 285 Remediation plan 278, 285 Report Card 278 restricting sections 163 Risk trends 285 SANS Top 20 279 scanned hosts and networks 286 Top 10 Riskiest Assets 279 Top 10 Vulnerable Assets 279 trend analysis 286 reports, custom 168 reports,Risk assessment 285 scan baseline 155 Web spider 210 scan template 36 testing AS/400 compliance 209 CIFS/SMB account policy 209 Lotus Domino policy 207 Oracle policy compliance 207 UNIX policy compliance 209 Web spider 214 Windows Group policy 208 ticket configuration 182 history 183 history, updating 183 tickets creating 182 opening 182 remediation 182 updating 182 using 182 viewing 182 top 10 riskiest assets 279 top 10 vulnerable assets 279 tuning accuracy, improved 220 discovery performance 202 environment 220 firewalls 221 open firewalls 221 other options 220 resources, increasing 220 scan performance 185 scan templates 185, 192 site configuration 220 speed 220 vulnerability checks 205 Web site scanning 216 Web spider 214

U
U.S. government agency 252

Nexpose Users Guide

314

U.S. government mandate 252 uncompressed IPv6 addresses 29 United States government agency federal government mandate 252 United States Government Configuration Baseline (USGCB) 106, 252 unsafe check 301 update Update Scan Engine 35 Upload template file 169 URI 231 URL redirection 158 Use the last scan data check box 146 USGCB 139, 252, 253 custom Policy Manager scans 106 Policy Manager 106 Policy Manager scans 106 USGCB 1.0 policies 252 USGCB 2.0 252 USGCB 2.0 is not an update of USGCB 1.0 252 USGCB 2.0 or USGCB 1.0 listed as "USGCB" in Policy Manager results 107 USGCB 2.0 policies 252 using CIDR notation in site configuration 29 using remediation plan templates 153 Using the search function 21

V
vAsset account credentials 56 connections, creating 57 connections, managing 57 discovered assets 58 discovery 54, 55 discovery, filters and operators 59 discovery, monitoring 63 discovery, using filters 59 dynamic sites 54 ESX(i) direct connection to standalone hosts 56 ESX(i) hosts 55 ESX(i) versions 55 filtering by datacenter 131 by host 131 by power state 131 by resource pool path 132 initiate discovery 55 initiating discovery 58 Licensing page 56 New Dynamic Site 58 permissions, Global Administrator 57 port 443, open 56 target assets, discoverable 56 target environment, preparing 55

update dynamic sites 54 vAsset Discovery icon 57 vCenter 55 vCenter versions 55 vCenter, port 443 56 vCenter, target 56 vConnections 56 virtual asset hosts 56 virtualization 56 VMware interoperability matrix 56 VMware Tools 56 vSphere 56 vSphere API 56 vAssets Administrative virtual machines 55 filtering by cluster 130 guest virtual machines 55 hypervisors 55 management consoles 55 management servers 55 using filters 130 vulnerabilities 281 acceptable risk 94 acceptable use 94 affected assets 91 analysis 237 availability impact 238 categories 86 certainty 180 check codes 105 check settings, selecting vulnerability checks 203 check types 86, 192 checks 193 Common Vulnerabilities and Exposures (CVE) index 84 Common Vulnerabilities Scoring System (CVSS) v2. 84 compensating controls 94 confidentiality impact 238 confirmed 40 CVS servers 217 CVSS risk scoring 86 CVSS score 84 description 91 details 91 details report 139 DHCP servers 217 disable checks 205 discovered 85 enable checks 205 exceptions 94 all instances 96 all instances in a site 96 all instances on an asset 96 by asset 98

Nexpose Users Guide

315

CSV format 104 delete 103 global 96 permissions 95 permissions, delete 95 permissions, review 95 recall request 101 Report Card 103 request by site 97 results 105 review 102 scope 96 single instance 96, 100 site-specific 97 status 95 submit 96 viewing 103 Vulnerabilities page 96 workflow 95 XML format 104 excluding 86, 94 Exploit Database 85 exploit database 71 Exploit Exposure 251 exploit information 92 exploit, ranking 86 exploitable 71 exploits 85 false positives 94 Exploits tab 85 false positives 94, 251 backporting 94 exclude 94 filtering information in a report 148 found on hosts 173 found on services 173 instances 241 integrity impact 238 MAC address, unauthorized 197 mail servers 217 malware exposure 85 malware kit, export to CSV 85 malware kits 71, 85 Malware tab 86 Malware table 92 Metasploit 85 Metasploit module 92 metrics 251 not included in reports 181 partial impact 240 patch verification checks 203 PCI risk scoring 86 priority 181 proximity-based impact 240

published exploit 85 remediation 91, 180, 181, 182, 239 remove check types 204 report templates custom sections 286, 287 reports 251 asset and vulnerabilities compliance overview 282 CVE 283 CVSS 283 discovered vulnerabilities 283 Highest Risk Vulnerabilities 275 index of vulnerabilities 283 risk score 181 risk strategies 237 scan templates 36 checks 203 scan types 193 scores 86 severity 241 severity scores 86 Telnet servers 218 TemporalPlus risk strategy 240 threat exposure 238, 239 Threat Listing 85 threats 237 ticket configuration 182 Top 10 Vulnerable Assets report 279 tuning checks 205 validated vulnerabilities 92 verified 40 verify 251 viewing details 91 viewing reports 180 viewing, active 84 virtual assets 55 virtual targets 55 Vulnerabilities Checks page 204 Vulnerabilities Listing table 96 Vulnerability Listing table, columns 85 Vulnerability Listing table, exceptions 96 vulnerability result codes 177 Web spidering 214 well-known 240 working with 84 vulnerability certainty characteristics 180 Vulnerability Details 166 Vulnerability Trends Survey template 280 vulnerable assets 279

W
Web interface search 21 session time out 22 sessions, extending 22

Nexpose Users Guide

316

Web robots Web spider 213 Web spider 210 configuring 210 crawls 213 Cross-link checking 211 directory paths 213 directory structure 210 DNS 211 fine tuning 214 foreign hosts 211 maximum directory levels to spider 212 options 211 performance settings 211 query strings 211 regex 213 regular expressions 213 settings 210, 211 using the Web spider 210 vulnerability testing 214 Web robots 213 What platforms are supported by Policy Manager checks 253

X
XCCDF 230 XCCDF Benchmark file 230 XML Export reports 180 XML formats attributes 173 CSV export 174 CyberScope XML Export 174 Qualys XML Export 174 raw XML 173 SCAP compatible XML 174 Simple XML 173 XCCDF Results XML Report 174 XML 174 XML Export 173 XML Export 2.0 173

Nexpose Users Guide

317