Issue:

How to configure sending of Elements Exposure Management scan notification emails to multiple recipient email addresses? 

Resolution:

If you want to have the email notifications to be sent to multiple recipient email addresses when either a Discovery Scan or a Network Scan (System scan / Web Scan) has started or finished, you can follow the steps below. 

For Network scan:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Scans page
3. Select the Network scans tab
4. Click on the three dots for a scan group 
5. Select Edit scan group 
6. Go to the Notifications step
7. Enable notifications
8. Select if you want to send the notification when:
   1. Scan starts
   2. Scan ends 
   3. Scan starts or ends
9. Enter the recipient email addresses separated by a comma:
   1. user1@example.com, user2@example.com, user3@example.com
10. Finish the setup

For Discovery scan:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Scans page
3. Select the Discovery scans tab
4. Click on the three dots for a discovery scan
5. Click Edit scan settings 
6. Go to the Other settings step
7. Enable Notifications 
8. Select if you want to send the notification when:
   1. Scan starts
   2. Scan ends 
   3. Scan starts or ends
9. nter the recipient email addresses separated by a comma:
   1. user1@example.com, user2@example.com, user3@example.com
10. Click Save and close

Issue:

I receive the following error when trying to access the Exposure Management in the Elements Security Center:

No access rights.
You do not have rights to Exposure Management content of this organization.
No permission You don't have access to view this page. Please contact your organization administrator to receive access

Resolution:

Ensure that you have valid subscription for Elements Exposure Management. If you have an expired commercial or trial subscription for Elements Exposure Management but you still have Elements Exposure Management access rights, you will receive "No access rights – Failed to fetch" errors when you try to access pages meant for Elements Exposure Management.

You can check the validity of your Elements Exposure Management subscription from the Management > Subscriptions page in the Elements portal

If you have a valid Elements Exposure Management subscription, ensure that your user has the following access rights (roles):

• Exposure Management – Exposure (admin)
• Exposure Management – Vulnerabilities (role)

The access rights can be checked by following these steps:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Management > Organization Settings > Security Administrators page
3. Click on the user's email address
4. Check that the user has both enabled:
   1. Exposure – Full Editing
   2. Vulnerabilities – Management or Team member
5. Click close 

If you are partner, check if the error only occurs when selecting a specific company from the scope-selector drop-down menu. 

Issue:

How can I check if specific vulnerability or CVE is covered in Elements Exposure Management (formerly known as Vulnerability Management)?

Resolution:

You can view if Elements Exposure Management has coverage for a specific vulnerability directly from the Elements portal:

1. Login to Elements Elements Security Center: https://elements.withsecure.com/
2. Open Environment section from the menu on the left
   • If you are a partner, also navigate with the scope selector drop-down menu to the company level
3. Navigate to the Environment > Exposure > Findings definitions tab
4. Create a Finding – Includes – <insert CVE name> filter and click Add

Here you can see if there is already a finding for the CVE. 

Issue:

I found that Elements Vulnerability Management Authenticated scan (WinRM using HTTP port 5985) found fewer vulnerabilities. There is no information about installed software or patches in the scan result.

Resolution:

If you are using port 5985 (HTTP) for the WInRM configuration in the system scan template, make sure to add the target host into the trusted list on Elements Vulnerability Management Scan Node.

Reference:
Configuring the WinRM service to use HTTP on individual hosts

Issue:

My Elements Vulnerability Management Linux Scan Node Agent is not running, scanning or updating. I get the following error:

Engine update: Scan Node Agent does not contain the latest available (revision: 65388) vulnerability signatures and updates. Either the Scan Node Agent is not running or there is no network connectivity between the Scan Node and WithSecure Radar Update Service

Resolution:

Kindly take note of the operating system time, as it can impact the Elements Vulnerability Management Linux Scan Node Agent engine updates if the time is incorrect. You can enforce manual update of Elements Vulnerability Management Scan Node Agent scan engines by executing the following command:

• cd /opt/f-secure/radar-scannodeagent
  sudo ./ScanNodeAgent update-engines

If the step above did not resolve the issue, you can perform a reset operation that will cause the engines to be downloaded from scratch:

• cd /opt/f-secure/radar-scannodeagent
  sudo ./ScanNodeAgent reset-engines

Note: Elements Vulnerability Management Scan Node engine update is not instant. By default, the update check is performed once per every 4 hours so it is recommended to monitor and check after 4 hours. 

Issue:

1. I would like to confirm if WithSecure Elements Vulnerability Management (Radar) can detect CVE-2021-44228 (Log4j2)?
2. What is the schedule for adding detection for CVE-2021-44228 (Log4j2)?
3. How can I verify when detection for CVE-2021-44228 (Log4j2) is available?

Resolution:

The detection of CVE-2021-44228 is available for selected software, following vendor security advisories publishing new versions of products with fixed and older versions of software that are marked as vulnerable.  The list of affected software is constantly increasing, therefore more often re-scans should be considered.  

WithSecure does not recommend limiting the scanning template to specific plugins only.  

Moreover, F-Secure released System Scan plugins for Linux and Windows authenticated scans, where vulnerable libraries are being discovered on a local drive and listed in the plugin output.

In addition to the above, there is also a remote unauthenticated check that uses an exploit-based approach. A test with jndi:ldap expression in the payload is performed and we listen for the signs of successful exploitation.

You can view the current list of Log4Shell / Log4Jam detection capabilities by following these steps:

1. Log in to the Elements Vulnerability Management portal
2. Go to the Vulnerabilities page 
3. Select the Vulnerability coverage tab
4. Click on the blue Filter arrow 
5. Add the following filters:
   • CVE references including CVE-2021-44228
   • CVE references including CVE-2021-45046
6. Click Apply

The Element Vulnerability Management news section (RSS feed) is available on the Vulnerability Management portal to find out what the newly added vulnerability definitions are.  Vulnerability coverage can be checked from the WithSecure Vulnerability Management portal. If a specific CVE-ID is not found, coverage for the detection is not yet available.   

Vulnerability coverage: https://portal.radar.f-secure.com/vulnerabilities/definitions   

Please also follow https://portal.radar.f-secure.com/news for further updates

Details from the National Vulnerability database: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

Issue:

What kind of network firewall openings need to be in place between scan nodes and hosts to be scanned?
What ports need to open for the Scan Node?

Resolution:

Any limitation to the visibility of the scanned host will result in less findings from network-based vulnerability scans. We recommended deploying scan nodes in the same private networks where scan-targets are present and allowing all incoming/outcoming traffic from scan nodes. Only in this scenario can you detect e.g. unwanted services running on non-standard TCP/UDP ports.

However, there is additional network access requirement applicable when using authenticated scanning where scan node needs to communicate with scan targets and fetch data. Each of those methods has a default port that needs to be open and these are documented in the online documentation available here:

The paragraph starting with "Network access to" from this page for Windows: Installing scan nodes (Windows) | Elements Vulnerability Management | 4.0 | WithSecure User Guides and for Linux: Installing WithSecure Elements VM scan nodes (Linux) | Elements Vulnerability Management | 4.0 | WithSecure User Guides

The TCP-port used is 443 and in the default configuration, the traffic is OUTBOUND (from SNA point of view).

To summarize: the network access requirement depends on the authenticated scan method select and is summarized below using default TCP-ports (note that the TCP-ports used can be differently configured in your environment).

1. WinRM based authenticated scanning, either WinRM port 5985/TCP (http) or 5986 (https) need to be open (INBOUND) on the scan targets.
2. RPC based authenticated scanning, TCP/135 need to be open (INBOUND) on scan targets.
3. SSH based authenticated scanning, TCP/22 need to be open (INBOUND) on scan targets.

Important!

Related to firewall access, scan nodes need to have unlimited access to the IP addresses associated with *.fsapi.com. A good example is active test for the Log4J vulnerability, which requires the scan node to access a call-back server hosted by WithSecure. 

Issue:

During the installation of a Vulnerability scan node, a license.fsrl file is required. Where can I order or download the Scan Node license for my Elements Vulnerability Management account? 

Resolution:

A user with an administrator role or with "manage system" privileges can order a Scan Node license and download the Scan Node Agent installer from Elements Vulnerability Management portal.

Ordering Scan Node License

1. Log in to WithSecure Security Center portal
2. Navigate to Elements Vulnerability Management.
3. Go to Scans > Scan node
4. Click New scan node.

   When your request is approved, the license file automatically starts to download. Follow the steps on the Summary page to install the scan node.

   1. Select Request a new scan node and click Next.
   2. Enter a name and description (optional) for the scan node and click Request.
   3. Click Done.

After this, you can proceed to install the new Scan node. and verify that the scan node can connect to the Elements Vulnerability Management portal. It should take less than 1 minute for the scan node to connect to the Elements Vulnerability Management portal. If it takes longer, refer to the troubleshooting section.

Below are the default Scan Node limits for paid and trial Elements Vulnerability Management accounts:

• 5 Scan Nodes for paid Elements Vulnerability Management account
• 1 Scan Node for trial  Elements Vulnerability Management account

If you have reached the Scan Node limit or encounter error "The organization is not synchronized with Elements Vulnerability Management backend", proceed to contact support.

Issue:

Why is a user receiving Elements Vulnerability Management "No connection with scan node" notification emails?

Resolution:

These notification emails are sent to Elements Vulnerability Management users who have configured in their Elements Vulnerability Management account settings notification to be sent for different notification categories. The notification settings are user account specific and the user can themselves change them in the Elements Vulnerability Management Portal.

Follow these steps to change the Elements Vulnerability Management notification settings:

1. Log into Elements Vulnerability Management Portal: https://portal.radar.f-secure.com/
2. Navigate to the Settings page from the menu on the left
3. Select the Notification settings tab
4. Enable or disable different notification categories
5. Click Save 

Issue:

The server with the WithSecure Elements Exposure Management scan node had a hardware failure and user has unregistered the existing scan node in Elements Vulnerability Management portal.

When requesting for a new scan node license in WithSecure Elements Exposure Management portal, user is getting error: "number of allowed scan node licenses has been reached".

How to delete / release the scan node license? 

Resolution:

By default, customers can download five (5) Elements Exposure Management scan node license files (trial customers can download 1). When a scan node license file download takes place, the counter is decreased by one. However, unregistering a scan node in the Elements Exposure Management portal's Security configurations > Scans > Scan nodes page will not release the license. It is meant that if you want to move a scan node to a new server, you should use the old .fsrl license file on the new server. Do note that the same license file is not allowed to be in use on two scan node servers at a time.

If you have misplaced (lost) a previously downloaded scan node license file and you would like to release the license to be used again, please contact support to resolve the issue.