Asset policies and ad hoc scans | IBM Partner Pavilion 2.3 guide

How policies apply to ad hoc and background scans

Agent policies apply to both ad hoc and background scans, while asset policies apply to both ad hoc and background scans; however, you can reconfigure some asset policies when you define an ad hoc scan.

The following table describes ad hoc and background scans:

Table 13. Descriptions of ad hoc and background scans

Type of scan	Description

Ad hoc	One-time scans that you start manually for
	discovery scans, assessment scans, or both,
	typically in response to network changes or
	newly discovered threats.
	Note: You can run an ad hoc scan
	immediately, or you can run it only during
	the scan windows defined for the group in
	the Scan Window policy.

Background	Automatic, recurring scans that run on
	separately definable refresh cycles for
	discovery and for assessment scanning.

Asset policies and ad hoc scans

The following table defines configuration options for policies used by ad hoc scans:

Table 14. Asset policies for ad hoc and background scans

Background asset policies that...	Include the following policies:

You can reconfigure scans	v	Assessment
	v	Discovery
Differ for ad hoc scans	Scan Control

Contain the same settings for ad hoc scans	v	Assessment Credentials
as for background scans	v	Network Services
	v	Network Services
	v	Scan Exclusion
		Note: This policy applies only to
		assessment scans, but it applies to both ad
		hoc and background scans.
	v	Scan Window (optional)

Changing assessment and discovery policies

An ad hoc scan initially uses any settings currently configured in the Assessment and Discovery policies for the group. You can run the scan with those settings, or you can modify the settings. The following table describes the advantages of each method:

Table 15. Changes to Assessment and Discovery policies

If you...	Then you...

Use the configured settings	Can easily start an ad hoc scan that
	duplicates a configured background scan.

Chapter 5. Background scanning in SiteProtector 81

Image 89

IBM Partner Pavilion 2.3 manual How policies apply to ad hoc and background scans, Asset policies and ad hoc scans

Contents

User Guide Version Copyright statement Trademarks and Disclaimer Iv Enterprise Scanner User Guide Contents Part 4. Appendixes 163 Part 3. Maintenance Topics About this bookAudience Technical support contacts Related publications Chapters Part 1. Scanning from the Proventia Manager Enterprise Scanner User Guide Ad hoc scanning in the Proventia Manager Section a Network configurationSection B Policy configuration Configuring the management network interface Section a Network configurationProcedure About this task Option Description Interface Configuring the scanning network interfaceMaximum IPs per discovery subtask Maximum assets per assessment subtask Configuring scanning interface DNS settings Assigning perspective to a scanning interface Configuring routes for perspectiveOption Description Perspective Destination Network Defining assets for a discovery scan Section B Policy configurationBefore you begin Option Metric Description If you want to Then Clear groupings Displaying assessment checks by groupsClick Clear Groupings Create groupings interactively Displaying information about assessment checks Selecting assessment checks with filters Option Description Discover and report TCP services Click the Common Settings tabDiscover and report UDP services Option Description Ports to scan with generic TCP checks Option Description Ports to scan with generic UDP checks DefaultOption Description Dynamically determine OS if previously Obtained information is older than Local group membership to verify access Option Description Verify account access level before usingAccess domain controllers to verify access Access level Option Description Allowed account lockout Lockout Allowed is enabled. WhenTemporary lockout allowed Enterprise Maximum Allowable Lockout Duration Defining assessment credentials for a policy Account Type SSH Domain Option Description Account Type SSH LocalDomain/Host Account Level Defining the service names associated with TCP and UDP ports If you want to Then Exclude ports Defining ports or assets to exclude from a scanExclude assets Excluded Hosts box Scan policy Required Interpreting scan results in the Proventia Manager Running an ad hoc scan Action Icon Description Monitoring the status of a scan Click View/Manage Log Files Viewing the results of an ad hoc scanExporting scan results from Proventia Manager Field Description Purging scan data from the database Enterprise Scanner User Guide Part 2. Scanning from the SiteProtector Console Enterprise Scanner User Guide Enterprise Scanner policies Initially blank or unconfigured? Inheritance indicatorsPolicy inheritance with Enterprise Scanner policies General inheritance behavior Enterprise Scanner policies About this task Select Network Enterprise Scanner from the Agent Type list Viewing asset or agent policies for Enterprise Scanner Important Do not click Open Agent policies for Enterprise Scanner Contents of an agent policyAgent policy descriptions for Enterprise Scanner Policy inheritance with agent policies Network Locations policy Assigning perspective to a scanning interface Configuring routes for perspective Click the Event Notification tab Event notification settings for Enterprise ScannerNotification policy Configuring advanced parameters for event notification Access policyClick the Advanced Parameters tab Account Purpose Networking policy Configuring the management network interface Configuring the scanning network interface Configuring scanning interface DNS settings Services policy Time policy Enable the network time protocol NTPIf you want to Then Change the date and time for the agent Network Time Protocol section Asset policy descriptions for Enterprise Scanner Update Settings policyAsset policies for Enterprise Scanner Scope Policy contentsDiscovery policy Before you begin Defining assets to discover Displaying information about assessment checks Assessment policy Displaying assessment checks by groups Selecting assessment checks with filters Configuring common assessment settings Information is older than Option Description Dynamically determine OS if SiteProtector Try to confirm the access level Option Description Allowed account lockout Defining assessment credentials for a policy Assessment Credentials policy Option Description Account Type Windows Scan Control policy Cycle start date Option Description Job nameCycle duration Current cycle start date Important consideration for multiple agents Scan Window policy Defining when scanning is allowed Defining ports or assets to exclude from a scan Scan Exclusion policy Default settings Network Services policyService definition Policy inheritance Configuring a Network Services policy Running an ad hoc discovery scan with Enterprise Scanner Configuration optionsAd Hoc Scan Control policy Running an ad hoc assessment scan with Enterprise Scanner Click Generate Support Data File Click the Debug Settings tab Understanding scanning processes in SiteProtector What is perspective? Defining perspectives Policy How to use Applies toPlacing agents in the correct perspective Perspectives in policies Network locations and perspectives Definitions Scan jobs and related termsAssets with unassigned criticality Term Description Scheduled and running scans Types of tasksImportance of tasks and subtasks Common management tasks Tasks per type of scan Priorities for running tasksCriticality and assessment tasks Scan type Number of tasks Task prioritization Stages of a scanning processDynamic prioritization Type of scan Reason for prioritization Stage Description Process for a scanning cycle Calibration considerations Size of scan windowsDiscovery cycle duration Assessment cycle duration Achieving the right balance Enterprise Scanner User Guide Background scanning in SiteProtector Determining when background scans run Asset policies and ad hoc scans How policies apply to ad hoc and background scansChanging assessment and discovery policies Type of scan Description Scan window and refresh cycle examples Scan Control policy Checklist for background assessment scanning Background scanning checklists for Enterprise ScannerChecklist for background discovery scanning Enabling background scanning Option Description Next cycle start date Defining when scanning is allowed Procedure Type a series of individual IP addresses, a Defining network services Defining assessment credentials for a policy Option Description Account Type SSH Local Monitoring scans in SiteProtector Viewing discovery job results Viewing your scan jobs Assessment subtask explanation Viewing assessment job resultsThis part of the description Describes Finished Assessment On ScanGroupName for hosts with Enterprise Scanner User Guide Managing scans in SiteProtector Stopping and restarting scan jobs Command ImpactImpact of stopping scan jobs Impact of restarting scan jobs Suspending and enabling all background scans Minimum scanning requirements Registration and authenticationSteps to initiate a scan Type of scan Steps to initiate Scanning behaviors for ad hoc scans Troubleshooting scanning behaviors for ad hoc scansInheritance Priority Expected scanning behaviors for background scans Managing scans in SiteProtector Enterprise Scanner User Guide Interpreting scan results in SiteProtector What determines certainty? OS identification Osid certaintySources of Osid Certainty of Osid sources Conditions for reassessing Osid How Osid is updated in Enterprise ScannerException Rules for updating Osid Summary page for vulnerability management Setting up a Summary view for vulnerability managementVulnerability management options Portal Description Portal Description About vulnerability assessment Viewing vulnerabilities by asset in Enterprise ScannerCreating custom views Benefits Field descriptions Field Description Viewing vulnerabilities by detail in Enterprise Scanner Field Description Viewing vulnerabilities by object in Enterprise Scanner Field Vulnerability view by vulnerability name Field Description Types of assessment reports Running reports in the SiteProtector ConsoleReport descriptions Report Description Report Description Procedure Enterprise Scanner User Guide Logs and alerts Two types of log files Log files and alert notificationTwo types of information Log size System log descriptions System logs Enterprise Scanner ES logs Getting log status informationLog descriptions Statistic Description Changing logging detail Download Downloading Enterprise Scanner ES log filesDelete a log file Click View/Manage Log Files Delete Risk level icons Alerts logEvent information icons Icon Description File Description Downloading and saving an Alerts logClick Generate new log file from Alerts Click Clear current Alerts from event log Clearing the Alerts logFinding specific events in the Alerts log Enterprise Scanner User Guide Search by Alert Id# box If you want to Then Search the Alert log file by Alert IDNumber Enterprise Scanner User Guide Ticketing and remediation Tickets Ticketing and Enterprise ScannerVulnerability auto ticketing Custom categories Scanning recommendations Remediation process overview for Enterprise Scanner Task overview Remediation tasks for Enterprise Scanner Option Tab Description Task 6 Close the ticket Part 3. Maintenance Enterprise Scanner User Guide Performing routine maintenance Shutting down your Enterprise Scanner Removing an agent from SiteProtector If you restore a system before you make backups Types of backupsDate of last system backup Options for backing up Enterprise Scanner Backing up configuration settings Click the Full Backup tab Choose an option Making full system backups Updating Enterprise Scanner Update locations Types of updatesType of update Content Update location Description Installation options with scheduled updates Update optionsRollbacks and backups Updating options Authentication method Advantages and Disadvantages Configuring explicit-trust authentication with an XPU server Select the Use Alternate Update Server check box Configuring an Alternate Update locationOption Description Host or IP Name CA Certificate Option Description Trust Level Select Enable Proxy Configuring an Http ProxyConfiguring notification options for XPUs Configuring automatic updates Scheduling a one-time firmware updateClick the Update Settings tab Option Description Check for updates daily or weekly Option Description Do Not Install Option Description Check for updates at given intervalsAutomatically Install Updates Delayed Manually installing updates Viewing the status of the Enterprise Scanner agent System status Proventia Manager HomeNetwork interface status Model Header Updates statusProtection status Viewing agent status Viewing agent status in the SiteProtector Console Viewing the status of the CAM modules Troubleshooting the Enterprise Scanner sensorModule or process Description Troubleshooting option Module or process Description Troubleshooting option Part 4. Appendixes Enterprise Scanner User Guide 165 Enterprise Scanner User Guide Product handling information World trade safety information Product safety labels Product recycling and disposal Laser safety informationLaser compliance Battery return program For the European Union For Taiwan Federal Communications Commission FCC Statement Electronic emissions noticesFor California EC Declaration of Conformity In German Canadian Department of Communications Compliance StatementEuropean Union EU Electromagnetic Compatibility Directive Japan Class a Compliance Statement People’s Republic of China Class a Compliance Statement Korean Class a Compliance Statement Enterprise Scanner User Guide 177 Index Reassessing 105 Rules Sources Scan job