Scan jobs and related terms, Definitions | IBM Partner Pavilion 2.3

Scan jobs and related terms

To tune your system correctly, you must understand how scan jobs run and how the options you define in policies affect jobs and subtasks.

Definitions

The following table describes the terms used by the Enterprise Scanner agent in the scanning process:

Table 8. Terms related to scanning jobs

Term	Description

Criticality	A user-assigned setting that indicates the
	relative importance of an asset to other
	assets:
	v	Critical
	v	High
	v	Medium
	v	Unassigned (the default)
	v	Low
Scan job	SiteProtector schedules a scan job in the
	Command Jobs window, either at the
	beginning of a refresh cycle or when you
	initiate an ad hoc scan. The scan job divides
	the scan into subtasks and displays its
	progress. Scans might not start processing as
	soon as they are posted if they run only
	within scan windows and no scan window
	is open.

Task	A scan job is divided into tasks as described
	in “Types of tasks” on page 72.

Subtask	The portion of a task assigned to an agent at
	one time. A subtask includes the number of
	IPs to discover or the number of assets to
	scan based on settings in the Networking
	policy for the agent that runs the scan. You
	should change the following field names:
	v	Maximum IPs per Discovery Subtask
	v Maximum Assets per Assessment Subtask

Assets with unassigned criticality

The criticality levels in the definition above are listed in order from highest to lowest criticality. The Unassigned level is intentionally higher than the Low level for the following reasons:

vThe default criticality level for a newly discovered asset is Unassigned because the criticality is unknown until you assign it another criticality level.

vBecause you must specifically assign the Low level to an asset, Enterprise Scanner places it below Unassigned assets because unassigned assets might be of a higher criticality.

Chapter 4. Understanding scanning processes in SiteProtector 71

Image 79

IBM Partner Pavilion 2.3 Scan jobs and related terms, Definitions, Assets with unassigned criticality, Term Description

Contents

User Guide Version Copyright statement Trademarks and Disclaimer Iv Enterprise Scanner User Guide Contents Part 4. Appendixes 163 Part 3. Maintenance Audience About this bookTopics Technical support contacts Related publications Chapters Part 1. Scanning from the Proventia Manager Enterprise Scanner User Guide Section B Policy configuration Section a Network configurationAd hoc scanning in the Proventia Manager About this task Section a Network configurationConfiguring the management network interface Procedure Maximum assets per assessment subtask Configuring the scanning network interfaceOption Description Interface Maximum IPs per discovery subtask Configuring scanning interface DNS settings Destination Network Configuring routes for perspectiveAssigning perspective to a scanning interface Option Description Perspective Option Metric Description Section B Policy configurationDefining assets for a discovery scan Before you begin Create groupings interactively Displaying assessment checks by groupsIf you want to Then Clear groupings Click Clear Groupings Displaying information about assessment checks Selecting assessment checks with filters Option Description Ports to scan with generic TCP checks Click the Common Settings tabOption Description Discover and report TCP services Discover and report UDP services Obtained information is older than DefaultOption Description Ports to scan with generic UDP checks Option Description Dynamically determine OS if previously Access level Option Description Verify account access level before usingLocal group membership to verify access Access domain controllers to verify access Maximum Allowable Lockout Duration Lockout Allowed is enabled. WhenOption Description Allowed account lockout Temporary lockout allowed Enterprise Defining assessment credentials for a policy Account Level Option Description Account Type SSH LocalAccount Type SSH Domain Domain/Host Defining the service names associated with TCP and UDP ports Excluded Hosts box Defining ports or assets to exclude from a scanIf you want to Then Exclude ports Exclude assets Scan policy Required Interpreting scan results in the Proventia Manager Running an ad hoc scan Action Icon Description Monitoring the status of a scan Exporting scan results from Proventia Manager Viewing the results of an ad hoc scanClick View/Manage Log Files Field Description Purging scan data from the database Enterprise Scanner User Guide Part 2. Scanning from the SiteProtector Console Enterprise Scanner User Guide Enterprise Scanner policies General inheritance behavior Inheritance indicatorsInitially blank or unconfigured? Policy inheritance with Enterprise Scanner policies Enterprise Scanner policies About this task Select Network Enterprise Scanner from the Agent Type list Viewing asset or agent policies for Enterprise Scanner Important Do not click Open Policy inheritance with agent policies Contents of an agent policyAgent policies for Enterprise Scanner Agent policy descriptions for Enterprise Scanner Network Locations policy Assigning perspective to a scanning interface Configuring routes for perspective Notification policy Event notification settings for Enterprise ScannerClick the Event Notification tab Account Purpose Access policyConfiguring advanced parameters for event notification Click the Advanced Parameters tab Networking policy Configuring the management network interface Configuring the scanning network interface Configuring scanning interface DNS settings Services policy Network Time Protocol section Enable the network time protocol NTPTime policy If you want to Then Change the date and time for the agent Asset policies for Enterprise Scanner Update Settings policyAsset policy descriptions for Enterprise Scanner Discovery policy Policy contentsScope Before you begin Defining assets to discover Displaying information about assessment checks Assessment policy Displaying assessment checks by groups Selecting assessment checks with filters Configuring common assessment settings Information is older than Option Description Dynamically determine OS if SiteProtector Try to confirm the access level Option Description Allowed account lockout Defining assessment credentials for a policy Assessment Credentials policy Option Description Account Type Windows Scan Control policy Current cycle start date Option Description Job nameCycle start date Cycle duration Important consideration for multiple agents Scan Window policy Defining when scanning is allowed Defining ports or assets to exclude from a scan Scan Exclusion policy Policy inheritance Network Services policyDefault settings Service definition Configuring a Network Services policy Ad Hoc Scan Control policy Configuration optionsRunning an ad hoc discovery scan with Enterprise Scanner Running an ad hoc assessment scan with Enterprise Scanner Click Generate Support Data File Click the Debug Settings tab Understanding scanning processes in SiteProtector What is perspective? Perspectives in policies Policy How to use Applies toDefining perspectives Placing agents in the correct perspective Network locations and perspectives Term Description Scan jobs and related termsDefinitions Assets with unassigned criticality Common management tasks Types of tasksScheduled and running scans Importance of tasks and subtasks Scan type Number of tasks Priorities for running tasksTasks per type of scan Criticality and assessment tasks Type of scan Reason for prioritization Stages of a scanning processTask prioritization Dynamic prioritization Stage Description Process for a scanning cycle Assessment cycle duration Size of scan windowsCalibration considerations Discovery cycle duration Achieving the right balance Enterprise Scanner User Guide Background scanning in SiteProtector Determining when background scans run Type of scan Description How policies apply to ad hoc and background scansAsset policies and ad hoc scans Changing assessment and discovery policies Scan window and refresh cycle examples Scan Control policy Checklist for background discovery scanning Background scanning checklists for Enterprise ScannerChecklist for background assessment scanning Enabling background scanning Option Description Next cycle start date Defining when scanning is allowed Procedure Type a series of individual IP addresses, a Defining network services Defining assessment credentials for a policy Option Description Account Type SSH Local Monitoring scans in SiteProtector Viewing discovery job results Viewing your scan jobs On ScanGroupName for hosts with Viewing assessment job resultsAssessment subtask explanation This part of the description Describes Finished Assessment Enterprise Scanner User Guide Managing scans in SiteProtector Impact of restarting scan jobs Command ImpactStopping and restarting scan jobs Impact of stopping scan jobs Suspending and enabling all background scans Type of scan Steps to initiate Registration and authenticationMinimum scanning requirements Steps to initiate a scan Priority Troubleshooting scanning behaviors for ad hoc scansScanning behaviors for ad hoc scans Inheritance Expected scanning behaviors for background scans Managing scans in SiteProtector Enterprise Scanner User Guide Interpreting scan results in SiteProtector Certainty of Osid sources OS identification Osid certaintyWhat determines certainty? Sources of Osid Rules for updating Osid How Osid is updated in Enterprise ScannerConditions for reassessing Osid Exception Portal Description Setting up a Summary view for vulnerability managementSummary page for vulnerability management Vulnerability management options Portal Description Benefits Viewing vulnerabilities by asset in Enterprise ScannerAbout vulnerability assessment Creating custom views Field descriptions Field Description Viewing vulnerabilities by detail in Enterprise Scanner Field Description Viewing vulnerabilities by object in Enterprise Scanner Field Vulnerability view by vulnerability name Field Description Report Description Running reports in the SiteProtector ConsoleTypes of assessment reports Report descriptions Report Description Procedure Enterprise Scanner User Guide Logs and alerts Log size Log files and alert notificationTwo types of log files Two types of information System log descriptions System logs Statistic Description Getting log status informationEnterprise Scanner ES logs Log descriptions Changing logging detail Delete Downloading Enterprise Scanner ES log filesDownload Delete a log file Click View/Manage Log Files Icon Description Alerts logRisk level icons Event information icons Click Generate new log file from Alerts Downloading and saving an Alerts logFile Description Finding specific events in the Alerts log Clearing the Alerts logClick Clear current Alerts from event log Enterprise Scanner User Guide Number If you want to Then Search the Alert log file by Alert IDSearch by Alert Id# box Enterprise Scanner User Guide Ticketing and remediation Custom categories Ticketing and Enterprise ScannerTickets Vulnerability auto ticketing Scanning recommendations Remediation process overview for Enterprise Scanner Task overview Remediation tasks for Enterprise Scanner Option Tab Description Task 6 Close the ticket Part 3. Maintenance Enterprise Scanner User Guide Performing routine maintenance Shutting down your Enterprise Scanner Removing an agent from SiteProtector Options for backing up Enterprise Scanner Types of backupsIf you restore a system before you make backups Date of last system backup Backing up configuration settings Click the Full Backup tab Choose an option Making full system backups Updating Enterprise Scanner Update location Description Types of updatesUpdate locations Type of update Content Updating options Update optionsInstallation options with scheduled updates Rollbacks and backups Authentication method Advantages and Disadvantages Configuring explicit-trust authentication with an XPU server Name Configuring an Alternate Update locationSelect the Use Alternate Update Server check box Option Description Host or IP CA Certificate Option Description Trust Level Configuring notification options for XPUs Configuring an Http ProxySelect Enable Proxy Option Description Check for updates daily or weekly Scheduling a one-time firmware updateConfiguring automatic updates Click the Update Settings tab Delayed Option Description Check for updates at given intervalsOption Description Do Not Install Automatically Install Updates Manually installing updates Viewing the status of the Enterprise Scanner agent Model Proventia Manager HomeSystem status Network interface status Protection status Updates statusHeader Viewing agent status Viewing agent status in the SiteProtector Console Module or process Description Troubleshooting option Troubleshooting the Enterprise Scanner sensorViewing the status of the CAM modules Module or process Description Troubleshooting option Part 4. Appendixes Enterprise Scanner User Guide 165 Enterprise Scanner User Guide Product handling information World trade safety information Product safety labels Laser compliance Laser safety informationProduct recycling and disposal Battery return program For the European Union For Taiwan For California Electronic emissions noticesFederal Communications Commission FCC Statement European Union EU Electromagnetic Compatibility Directive Canadian Department of Communications Compliance StatementEC Declaration of Conformity In German Japan Class a Compliance Statement People’s Republic of China Class a Compliance Statement Korean Class a Compliance Statement Enterprise Scanner User Guide 177 Index Reassessing 105 Rules Sources Scan job