{ "concept_BA55FDB13ABA44A8B16E9421713F4913-4.0-en.json": { "title": "title_C4D8D307F07048F78E7C9C35344BA210", "title_C4D8D307F07048F78E7C9C35344BA210": "Elements Vulnerability Management ", "shortdesc": "shortdesc_1A068E8D7F3140408D21878226988ABB", "shortdesc_1A068E8D7F3140408D21878226988ABB": "This documentation provides instructions and information on using the product. ", "content.title_84DCE99CE44D4C54BEC4E6C4EAF189B0": "Other material", "content.p_5E5AEE7BBC884805BFA339C2F69238DD": "To see the latest release information for the product, follow the link to WithSecure Elements Vulnerability Management change logs.", "desc": [ "content.title_84DCE99CE44D4C54BEC4E6C4EAF189B0", "content.p_5E5AEE7BBC884805BFA339C2F69238DD" ] }, "concept_97F5A4549C714718AF3531B7277FD698-4.0-en.json": { "title": "title_5AEC32094FFD488B8750AF70084FF7F0", "title_5AEC32094FFD488B8750AF70084FF7F0": "Getting started", "shortdesc": "shortdesc_6034F4F559D343338A548A7FFBAEC59A", "shortdesc_6034F4F559D343338A548A7FFBAEC59A": "WithSecure Elements Vulnerability Management enables you to run network discovery and port scans, platform and service vulnerability scans, endpoint agent scans, and web application scans. ", "content.p_5BD99895B5B94F9488B5BC85FC599992": "External vulnerability scanning focuses on the systems and infrastructure exposed to the internet or a number of networks. Inevitably, this will reveal vulnerabilities varying from faulty server configurations and network design issues to software bugs and backdoors.", "desc": [ "content.p_5BD99895B5B94F9488B5BC85FC599992" ] }, "concept_8A8EE953B33045A6803988051D512055-4.0-en.json": { "title": "title_CD3D445216164866B898E26476B515B9", "title_CD3D445216164866B898E26476B515B9": "Main concepts and components", "shortdesc": "shortdesc_A5025F596AD540F8AA440DCB7427D5C1", "shortdesc_A5025F596AD540F8AA440DCB7427D5C1": "This section describes some of the key concepts and components of WithSecure Elements Vulnerability Management that are referenced throughout this documentation. ", "content.dt_F0330A2E199D49BEA7E67BBAEDBCB906": "Assets ", "content.dd_B651BA3EE37D46B78DAFEA960FD27726": "Elements Vulnerability Management keeps an inventory of all the assets, such as servers, computers, printers, routers, IoT devices, etc. within your network environment, discovered by Elements Vulnerability Management during the Discovery scan or a network as well as agent-based vulnerability scan. The Discovery scan maps your whole network and all its assets.", "content.dt_DBC98EB8BBF449038E2A363FA89F1BD9": "Authenticated scanning ", "content.dd_CD86D457FD4346FFBF1B83C5A2A0BA40": "In addition to regular network-based scanning, where the host's ports are scanned and the exposed services are reviewed for flaws, you can also run a system scan in authenticated mode, which enables it to authenticate the target host. Authenticated scanning helps the scanner eliminate potential false positives and check patch levels and other misconfigurations.", "content.dt_FB4AE299BF304002A04F8C7C018D2D30": "Discovery scan ", "content.dd_CED93A0A4376462899C95ABFBF9227EB": "Discovery scan is a relatively simple scanning process, but one that can make a big difference for your workflow. It helps you to identify all systems and their exposed ports (services) within your network. The network discovery scan creates a report that lists all scanned targets with all services detected. Once all systems on a network have been found, they can easily be transferred to a scan group for vulnerability scanning. The scan results are always compared to the previous scan, making it very easy to spot changes in your network. To support this feature, you can also set up email notifications, for example for when new hosts have been found.", "content.dt_2E3F2A7613C84B7295637794B82CE16B": "The WithSecure Elements portal", "content.dd_A4BA58E524384A77B9740F70DA86517A": "The WithSecure Elements portal is the core component of the whole WithSecure Elements Vulnerability Management solution. It is a web-based interface where you can manage assets, start and stop scans, browse vulnerabilities, create reports, and much more.", "content.dt_76C362F066044282ACAE5B6FA17FB0D2": "Internet discovery ", "content.dd_11E827E0D0B64E32A95BA34C9177889C": "Internet discovery allows you to collect data on public systems through crawling and port mapping. You can use this to find your organization's internet-facing systems and add them to scan groups for network vulnerability scanning.", "content.dt_C09BE6474DE34B85BFFEDD2888D16766": "Network scans ", "content.dd_4A531B5330F34A12A3C1ED357CB986B6": "Network vulnerability scans test systems or web applications within your network for vulnerabilities that could be exploited in a cyber attack. Elements Vulnerability Management includes two separate types of network vulnerability scan: system scan and web scan.", "content.dt_6B12A687D3BC47D2BD4948D052367660": "Elements Agent with VM capabilities ", "content.dd_FAC4DCB78E624F878AADA5BBDF20ED3A": "WithSecure Elements Agent with VM capabilities is a Windows client application that provides an additional approach to performing vulnerability scans on devices in your network.
", "content.dd_02D5D23B47CD4959938F017D704DFE47": "Using an Elements Agent with VM capabilities to perform vulnerability scans has certain benefits. For example, some devices may be used largely outside the office, so there is a risk that they are not connected to the network when scheduled vulnerability scans are run. An Elements Agent with VM capabilities allows you to oversee these devices even when they are not on the office premises. In addition, this provides improved scalability and performance compared to using only a dedicated scan node to handle all scanning activity.
", "content.dd_17F46FF24CB248F5AC3F8F56D3AFC31A": "Elements Agents with VM capabilities also provide more consistent data in environments that use dynamically changing IP addresses. As the agents are tied to specific devices instead of an IP address, the reporting and remediation of vulnerabilities is much easier. This also allows you to collect details about the devices, such as hardware and software, more easily.", "content.dt_0A42612AA55D4602A14AEBE3AD8A17EC": "Scan groups ", "content.dd_E7A39240242E4AEEA05D3B0825167272": "In Elements Vulnerability Management, all network vulnerability scan targets are stored in logical containers called scan groups. Each scan group can contain both system scans and web scans.", "content.dt_17409923AEF84D5ABBA1B89ABA0F4B37": "Scan node ", "content.dd_E3DEA58FFD624C9D98A0B13E89A3AD58": "A scan node is a server with a Scan Node Agent application installed. This application maintains up to three different scanning engines (discovery, system, and web scan) and uses them to execute scans configured in the Elements Vulnerability Management portal. You can attach an unlimited number of scan nodes to the WithSecure Elements portal. You may need multiple scan nodes if you have several network segments or more scanning power.", "content.dt_5267B458F2ED4080A2B62696C6A00061": "System scan ", "content.p_DD19738C49744D6A804D8DD98FBBF5DC": "Note: System scan is non-disruptive and designed not to cause Denial of Service conditions on your systems.", "content.dd_21B15847817F42EE85AE69009F5F6FEE": "System scan is a network-based vulnerability scanner that can scan any system with an IP for common vulnerabilities. System scan's vulnerability detection is based on both active and passive vulnerability checks. For example, it will attempt to identify the service (product) and its version number. Once identified, the system scan checks if that particular software has any known vulnerabilities. In addition to passive scanning based on banner grabbing, system scan also runs active checks in an attempt to confirm the existence of certain vulnerabilities or system misconfigurations. It can also identify missing security patches and outdated software when using authenticated scanning.", "content.dt_C6ACC1C503F0419689F4D555D9270E7A": "Scan templates ", "content.dd_7F9483FEC0284BAA921F4E5AAF2290C0": "Scan templates allow you to easily create several scans, each of which can apply to a specific scenario or part of your network, but share several settings. You can create templates for each scan type (discovery scan, system scan, and web scan) as well as scheduling templates that can be applied to any scan.", "content.dt_C9B64E0BD61A407E88C45B85A56E6C2C": "Web scan ", "content.dd_F79BA6138B3F4F879BCADE35175ACF63": "Web scan allows you to scan and test web applications. You can use web scans during the development of new applications as part of the development life cycle. This results in being able to uncover vulnerabilities faster, thus significantly reducing the cost and amount of resources required to mitigate vulnerabilities at a later stage, as security issues are caught very early in the process. Web scan is considered an additional scanning feature that can be applied on top of an existing system scan. In other words, it is recommended that whenever you scan a target with a web scan, it should also be scanned with system scan.", "desc": [ { "dl.dl_27B6D7E602F34E57BFA45F1678C17864": [ { "dlentry.dlentry_BD4E8DF99E864502951E165F180FC8AE": [ "content.dt_F0330A2E199D49BEA7E67BBAEDBCB906", "content.dd_B651BA3EE37D46B78DAFEA960FD27726" ] }, { "dlentry.dlentry_8E195A7C5C154059872005CA7467016A": [ "content.dt_DBC98EB8BBF449038E2A363FA89F1BD9", "content.dd_CD86D457FD4346FFBF1B83C5A2A0BA40" ] }, { "dlentry.dlentry_A75E3A2CEA254FA48138FE8B6F5DB3AC": [ "content.dt_FB4AE299BF304002A04F8C7C018D2D30", "content.dd_CED93A0A4376462899C95ABFBF9227EB" ] }, { "dlentry.dlentry_DE884031105E426FB805D5E9C935A919": [ "content.dt_2E3F2A7613C84B7295637794B82CE16B", "content.dd_A4BA58E524384A77B9740F70DA86517A" ] }, { "dlentry.dlentry_F67FA4405C854EF4A9E8185807DA9737": [ "content.dt_76C362F066044282ACAE5B6FA17FB0D2", "content.dd_11E827E0D0B64E32A95BA34C9177889C" ] }, { "dlentry.dlentry_A98D2CCA73184073A306C7C9BD4545BB": [ "content.dt_C09BE6474DE34B85BFFEDD2888D16766", "content.dd_4A531B5330F34A12A3C1ED357CB986B6" ] }, { "dlentry.dlentry_32E97669D2AA415685E3AE95D888138C": [ "content.dt_6B12A687D3BC47D2BD4948D052367660", "content.dd_FAC4DCB78E624F878AADA5BBDF20ED3A", "content.dd_02D5D23B47CD4959938F017D704DFE47", "content.dd_17F46FF24CB248F5AC3F8F56D3AFC31A" ] }, { "dlentry.dlentry_7B5F5E53376F4E00BD324455E3BF35B8": [ "content.dt_0A42612AA55D4602A14AEBE3AD8A17EC", "content.dd_E7A39240242E4AEEA05D3B0825167272" ] }, { "dlentry.dlentry_A91C732CA2A94B4BBDE378E9FBC410FF": [ "content.dt_17409923AEF84D5ABBA1B89ABA0F4B37", "content.dd_E3DEA58FFD624C9D98A0B13E89A3AD58" ] }, { "dlentry.dlentry_8D4C4D4ECD0E4382AAC8DE1811C97822": [ "content.dt_5267B458F2ED4080A2B62696C6A00061", "content.dd_21B15847817F42EE85AE69009F5F6FEE", { "content.note_DD19738C49744D6A804D8DD98FBBF5DC": [ "content.p_DD19738C49744D6A804D8DD98FBBF5DC" ] } ] }, { "dlentry.dlentry_6AE93E72EA494B06A24E9D161F614ECC": [ "content.dt_C6ACC1C503F0419689F4D555D9270E7A", "content.dd_7F9483FEC0284BAA921F4E5AAF2290C0" ] }, { "dlentry.dlentry_1911F18E798041C2A98B79F64AC25B1D": [ "content.dt_C9B64E0BD61A407E88C45B85A56E6C2C", "content.dd_F79BA6138B3F4F879BCADE35175ACF63" ] } ] } ] }, "concept_1F3767DC287F404EB58EF95E2932BD9E-4.0-en.json": { "title": "title_D35E18DC0DC840BCBFFBB4559E8FA3C2", "title_D35E18DC0DC840BCBFFBB4559E8FA3C2": "The WithSecure Elements portal", "shortdesc": "shortdesc_E21D13617FAB4F9AAEC67368D78F4560", "shortdesc_E21D13617FAB4F9AAEC67368D78F4560": "The WithSecure Elements portal is the core component of the whole WithSecure Elements Vulnerability Management solution. ", "content.p_A6A0647D8FB24CD68BD6A28DDCF8A6DA": "The WithSecure Elements portal is a web-based interface where you can manage assets, start and stop scans, browse vulnerabilities, create reports, and much more.", "content.p_E180C489A3244EF0AC6EF4A35E3F04D1": "You can deploy the Elements Vulnerability Management portal by having the solution set up in the cloud, hosted by WithSecure Cyber Security Services.", "desc": [ "content.p_A6A0647D8FB24CD68BD6A28DDCF8A6DA", "content.p_E180C489A3244EF0AC6EF4A35E3F04D1" ] }, "task_0C713C0B795B4E21AF1F41ED2226E201-4.0-en.json": { "title": "title_C166E4C228FD4A068F93FE6701170638", "title_C166E4C228FD4A068F93FE6701170638": "Logging in", "shortdesc": "shortdesc_FC8D3B34B6A546E2AEF7E8DA223FC915", "shortdesc_FC8D3B34B6A546E2AEF7E8DA223FC915": "Instructions on how to log into the Elements Security Center. ", "content.p_47A872D7831149E18A84B60F15747459": "Log into your account as follows:", "content.p_4947B4E69EF84D53868ED8225918B16D": "The Log in page opens.", "step.step_08798CB46A6B43AFA606AC812E50372F": "Open the following link in the web browser: https://elements.withsecure.com/", "content.p_0ACB732E9D804CF5861900B284FE2737": "Note: We recommend that you use your email address as your username. If you forget your password, you can order a new one by selecting Forgot password. Instructions for resetting your password are sent to your email address.", "content.p_95AC9A844CF44EACB18A509DC4036D15": "The portal opens. You can toggle between the services using the navigation menu in the sidebar.", "step.step_0FA8252EBBD14B56A774FFB721244F58": "Enter your username and password, and select Log in.", "desc": [ "content.p_47A872D7831149E18A84B60F15747459", { "steps.steps_6BAC495010DD4BE99CAF5E3CC799737E": [ "step.step_08798CB46A6B43AFA606AC812E50372F", "content.p_4947B4E69EF84D53868ED8225918B16D", "step.step_0FA8252EBBD14B56A774FFB721244F58", { "content.note_0ACB732E9D804CF5861900B284FE2737": [ "content.p_0ACB732E9D804CF5861900B284FE2737" ] }, "content.p_95AC9A844CF44EACB18A509DC4036D15" ] } ] }, "concept_8C98A83345D649658D8DE5B4623D56AC-4.0-en.json": { "title": "title_DBA13586106F44CE8A8B5FD3EC19DC28", "title_DBA13586106F44CE8A8B5FD3EC19DC28": "Using widgets", "shortdesc": "shortdesc_90975A7EF84647419EEACF1927995D8C", "shortdesc_90975A7EF84647419EEACF1927995D8C": "Regardless of your role (manager, system owner, developer, or other), you can customize the Home > Vulnerabilities page and its widgets to make it fit your needs. ", "desc": [] }, "task_0873163434964380838C8481AAD08754-4.0-en.json": { "title": "title_0F90BCD1B4B54029B605C3D0D2C66279", "title_0F90BCD1B4B54029B605C3D0D2C66279": "Adding widgets", "shortdesc": "shortdesc_2CEA52324F5F4C7E95D5DC97F874E491", "shortdesc_2CEA52324F5F4C7E95D5DC97F874E491": "You can add widgets to suit your specific needs. ", "content.p_86EC676316264B1A884B81253274B674": "You can add any number of widgets, resize them, and place them exactly where you want.", "step.step_35C86504CD784CF986D2A5A1A1543908": "Click the menu button and select Add new widget.", "substep.substep_3A01C3F79F71472593ED34D32EAF879E": "Enter a name for the widget.", "substep.substep_0A18841A49E64427A1EA27BA2BD18D03": "Select Table, Donut, Circle, Histogram, or Gauge as the widget type.", "substep.substep_AA003FE6FB124B448DCC3E694FEBE077": "Select the size and position for the new widget.", "content.p_9C7B27425B94412A8081AF80C814EB0C": "The available options vary according to the widget type that you selected.", "substep.substep_88E543CC01D744EBACDDC1F1A9DE195D": "Select the data options for the widget.", "step.step_150F5DE7E1174EB29BB6C95FFE987B1F": "Edit the new widget settings.", "content.p_61F42826AC0D48F5A88AE4DA03B1A67E": "The new widget appears on Home > Vulnerabilities.", "step.step_B228015AC88F45B1A31F91EB98983A97": "Click Save to add the new widget.", "content.p_E84A409AED3E4B37A05D44DF9638A1AB": "Each widget also has a set of control buttons in its top-right corner to edit, clone, or remove the widget.", "step.step_3E76DC344EB44ED99C98A1645B866686": "Drag the widget to change its location and size on Home > Vulnerabilities.", "desc": [ "content.p_86EC676316264B1A884B81253274B674", { "steps.steps_F98067C457C64F5AB994B95EA5246ECC": [ "step.step_35C86504CD784CF986D2A5A1A1543908", "step.step_150F5DE7E1174EB29BB6C95FFE987B1F", { "substeps.substepsalpha_3BD9DB668712416EA4EAB0CC1EC608A0": [ "substep.substep_3A01C3F79F71472593ED34D32EAF879E", "substep.substep_0A18841A49E64427A1EA27BA2BD18D03", "substep.substep_AA003FE6FB124B448DCC3E694FEBE077", "substep.substep_88E543CC01D744EBACDDC1F1A9DE195D", "content.p_9C7B27425B94412A8081AF80C814EB0C" ] }, "step.step_B228015AC88F45B1A31F91EB98983A97", "content.p_61F42826AC0D48F5A88AE4DA03B1A67E", "step.step_3E76DC344EB44ED99C98A1645B866686", "content.p_E84A409AED3E4B37A05D44DF9638A1AB" ] } ] }, "concept_5655E157F4A14C7BB3C1A4CD71A1BB63-4.0-en.json": { "title": "title_2D67238B786D433CBA386459A1893C28", "title_2D67238B786D433CBA386459A1893C28": "My profile", "shortdesc": "shortdesc_2A7711DAAB4145B6A5573879139B0295", "shortdesc_2A7711DAAB4145B6A5573879139B0295": "You can customize your profile settings on the My profile page. ", "content.p_6E17753B715240AA96605020614A510D": "Click the user icon in the top-right corner of the page and select My profile to edit your profile.", "content.p_A08B37353D5F4390A9DEE46757EB9C8D": "You should at least check the following:", "choice.choice_F07C8B7D695F4F92B2BA1CFD243174C9": "Make sure that your personal details such as first and last name, phone number, and contact email are correct. You need to contact your administrator if you need to change your email address.", "choice.choice_3D1B6A2BFDC24DD1BB26EE4E1EEBB314": "Notification: By default, this is configured to Send each notification instantly. For example, if you configured email notifications to be sent every time a discovery scan starts and ends, you will receive 20 emails. To avoid large amounts of emails, change the email frequency to hourly, daily, or weekly instead.", "choice.choice_E46E5284F7E6472D9CD872447ACCDEE7": "Time zone: Defines which time zone is used for displaying dates and times.", "choice.choice_A44031691AEC42BDB937ADC07247E286": "Language: Select the language used in the WithSecure Elements portal.", "content.p_7090C683B74A44E7BB0A0254D4C84515": "Note: Two-factor authentication supports Google Authenticator, Microsoft Authenticator, and any other mobile authentication app that supports the TOTP (Time-based One-Time Password) algorithm.", "choice.choice_CB71F6B451084A4E9F0BA0D510C95078": "Security settings: Click Change password or set up 2-step verification to change the security settings for your WithSecure Business Account. If two-factor authentication has not already been enforced on all users by the administrator for your account, you can enable it yourself for increased security.", "desc": [ "content.p_6E17753B715240AA96605020614A510D", "content.p_A08B37353D5F4390A9DEE46757EB9C8D", { "choices.ul_A8CB885E286E4F4D87CCA65C77578241": [ "choice.choice_F07C8B7D695F4F92B2BA1CFD243174C9", "choice.choice_3D1B6A2BFDC24DD1BB26EE4E1EEBB314", "choice.choice_E46E5284F7E6472D9CD872447ACCDEE7", "choice.choice_A44031691AEC42BDB937ADC07247E286", "choice.choice_CB71F6B451084A4E9F0BA0D510C95078", { "content.note_7090C683B74A44E7BB0A0254D4C84515": [ "content.p_7090C683B74A44E7BB0A0254D4C84515" ] } ] } ] }, "task_E468293BDA7D41968696CCEB06A8278D-4.0-en.json": { "title": "title_6B6E6711B8C8444AA0B30CE0769018C9", "title_6B6E6711B8C8444AA0B30CE0769018C9": "Using filters", "shortdesc": "shortdesc_9D5507F187F04BE7AD8A63CF81740A8B", "shortdesc_9D5507F187F04BE7AD8A63CF81740A8B": "Several of the pages and sections in Elements Vulnerability Management have a filter option to help you view the data that is most relevant to you. ", "content.p_EB0262BC56C046F7B484B64A3F3BB335": "On any of the pages where you see the Filter section:", "content.p_63F200A13F234855AAD65F0436B56706": "If a filter is already in use:", "subchoice.choice_F71442948E2F4308864AE17E2E819E9C": "Click Clear filter to reset the currently applied filter.", "subchoice.choice_39A9598DF0CD4FD1A073365FA9D6DF59": "Select Select filter > New filter to create a new one.", "subchoice.choice_79BBDA6E6DE0442BA416B5081664A752": "Click Select filter and choose a previously saved filter.", "step.step_4A73305D98254C68BD276DF8E67516E7": "Open Filter.", "content.p_C4F3B55E90524FC0A3F31B52AB4C1232": "The available options vary according to the page that you are on and the data that is listed.", "step.step_0316F5B923DD49B4B26D864B07578AB2": "Select the options that you want to use in your filter.", "step.step_CE9EA06555C6482A8BBD777B27AD751C": "Click Apply.", "substep.substep_56B9E8C258FF481C9E4AD89E5A095FD8": "Click Save.", "substep.substep_0A3EEEAD003849FA9B63DA7FE33F3DD7": "Enter a name for the filter.", "substep.substep_AAA4B3890BA8402C883A1C578DC1E9FC": "Click Save and apply.", "step.step_CA52EFC2F9844E01B0347D35E948CB8B": "If you want to save the filter for future use:", "desc": [ "content.p_EB0262BC56C046F7B484B64A3F3BB335", { "steps.steps_BC89DC7F23504538A8486B1653A120B8": [ "step.step_4A73305D98254C68BD276DF8E67516E7", "content.p_63F200A13F234855AAD65F0436B56706", { "subchoices.choices_4EE37FCA111F4DF3B1430CFDBDAD397C": [ "subchoice.choice_F71442948E2F4308864AE17E2E819E9C", "subchoice.choice_39A9598DF0CD4FD1A073365FA9D6DF59", "subchoice.choice_79BBDA6E6DE0442BA416B5081664A752" ] }, "step.step_0316F5B923DD49B4B26D864B07578AB2", "content.p_C4F3B55E90524FC0A3F31B52AB4C1232", "step.step_CE9EA06555C6482A8BBD777B27AD751C", "step.step_CA52EFC2F9844E01B0347D35E948CB8B", { "substeps.substepsalpha_FEDF1845F6AA491A8F917C10CCCA41B4": [ "substep.substep_56B9E8C258FF481C9E4AD89E5A095FD8", "substep.substep_0A3EEEAD003849FA9B63DA7FE33F3DD7", "substep.substep_AAA4B3890BA8402C883A1C578DC1E9FC" ] } ] } ] }, "concept_8E6DC73546CA43AFBF3FB3446A449616-4.0-en.json": { "title": "title_20358101DF7A4684AA71988482202587", "title_20358101DF7A4684AA71988482202587": "Support", "shortdesc": "shortdesc_42883559393A47379ED56E8480451E81", "shortdesc_42883559393A47379ED56E8480451E81": "The Support > VM support tab in the portal shows you the available options for assistance in using Elements Vulnerability Management. ", "content.p_F45C682B81B74298BC4E8E77F224134E": "To contact Elements Vulnerability Management support, go to the WithSecure support page and fill in the details of your issue. Our support staff will be in touch with you as soon as possible.", "content.p_4B782AC25F59470F811314A8E953A2C0": "You can also click on the tooltip icons () within the WithSecure Elements portal to get more information about specific functionality or fields.", "desc": [ "content.p_F45C682B81B74298BC4E8E77F224134E", "content.p_4B782AC25F59470F811314A8E953A2C0" ] }, "concept_C0969FC4765744E4A6CD4DAD65D1E116-4.0-en.json": { "title": "title_DA42F5C890EB426CBE5AC266EB125568", "title_DA42F5C890EB426CBE5AC266EB125568": "Deployment", "shortdesc": "shortdesc_D042BA72EA784B1989050260149729E7", "shortdesc_D042BA72EA784B1989050260149729E7": "This section describes the deployment steps required for WithSecure Elements Vulnerability Management. ", "choice.choice_12F209E7276E43A39C897DC3F78BDA85": "If you are using WithSecure Elements portal hosted by WithSecure, the only components you may want to install are Elements VM Scan Nodes for scanning internal networks and WithSecure Elements Agents with VM capabilities for continuous vulnerability management on your endpoints.", "choice.choice_DBBE61E991D44C4CBE7AC055BB0E5D7D": "If you are using the product as a privately hosted solution, you also need to install the Radar Security Center. See the related topic on installing the Radar Security Center.", "content.p_62718B2AFD6A409598AB263B89000B58": "", "desc": [ { "choices.ul_3E016A73C2594147A78FC4EE85CB46FD": [ "choice.choice_12F209E7276E43A39C897DC3F78BDA85", "choice.choice_DBBE61E991D44C4CBE7AC055BB0E5D7D" ] } ], "related": [ "concept_9FB99DCC6CF949AFA72CE901505A4ED9-4.0-en" ] }, "concept_AFCE4EB5D8434AEA9D6C79496D3609D4-4.0-en.json": { "title": "title_FE2B3BBD969D4F3AA3B4B7A0DE7000A2", "title_FE2B3BBD969D4F3AA3B4B7A0DE7000A2": "Installing scan nodes (Windows)", "shortdesc": "shortdesc_1593A8A3FCA64B0A8C8C475D70A16765", "shortdesc_1593A8A3FCA64B0A8C8C475D70A16765": "Scan nodes are used to perform the actual discovery and network vulnerability scans. ", "content.p_E864A83004FD4684805D26ABCA4294DE": "A scan node can be installed with one or more of the following scanning engines:", "choice.choice_53816B44CD3142F99DA45FF63A8F2A0B": "Discovery scan is a network discovery and port scanning engine.", "choice.choice_162F85322A444BA28451FC0FE71D16D0": "System scan is able to scan IP addresses for known vulnerabilities.", "choice.choice_92BCBA4FB1C6499ABB12FC1446D162E9": "Web scan is designed to scan custom web applications for vulnerabilities.", "content.title_548C72DA5B9F4B90B136D39BE3048919": "Scan node requirements (Windows)", "content.p_D2006F2463614FB5AA6AD55F728EF05A": "Supported operating systems", "choice.choice_D3981F9AB4A74FF7AF395C40EA2334CF": "Latest Windows Server (minimum: Windows Server 2012 R2)", "content.p_pzv_4g1_f2c": "Note: While the recommended operating system for Scan Node installation is the latest Windows Server, Windows 10 or 11 can also be used. Performance or result accuracy should not differ. However, our regular pre-release testing primarily targets server operating systems, so we cannot guarantee full assurance for Windows desktop versions.", "choice.choice_87747C40DC1F4342A0A7C9F1CA256780": "Windows 10/11 desktop (Beta)", "content.p_000E97A60BF3418B83FF44369673DE6A": "Software requirements", "choice.choice_B93634416B934A4A9374AD383C8D2B85": "Microsoft .NET Framework: recommended version 4.8 (minimum version: 4.7.2)", "choice.choice_ABDDBF32737D4465B6B2D1002D72CB30": "npcap", "choice.choice_3A685C433F684EC590858B207C4B2529": "Microsoft Visual C++ 2015-2022 Redistributable Package (x86)", "choice.choice_0459B7307B364CE6B9968FC715530511": "User account: Local or Active Directory account with administrative rights required during installation", "content.p_kss_vs2_phc": "Note: The installer automatically downloads and installs all required third-party components. However, Microsoft Visual C++ is included with the Windows operating system, and the version available depends on the specific Windows OS you are using.", "content.p_ECE214BF88534C07A3C65C5481F0BC21": "Hardware requirements", "choice.choice_A8A2F8C536F6460FB32454ADDE04A8DA": "Minimum 4 GB RAM (recommended: 8GB or more)", "choice.choice_EE216CDF779D48BFB679CC7323988213": "Minimum 2 GHz processor", "choice.choice_673426F0074845EBA3CF51F4FC539E75": "Minimum 30 GB disk space", "content.p_ED1CB505403F44988786EF3810A6061D": "Network requirements - access to the following URLs:", "choice.choice_D363F64E7E4A49B18E674852A1459778": "https://sn-api.radar-prd.fsapi.comhttps://gateway.radar-prd.fsapi.com, and https://updates-api.radar-prd.fsapi.com (Elements Vulnerability Management Update Service)", "choice.choice_52209E6E8FAD4241BF2083B516D152ED": "https://api.radar-prd.fsapi.com (Elements Vulnerability Management API)", "choice.choice_D197FB1CEF9E4CE68AB3EE23F7AA16D0": "If you are using a proxy server, it must allow the following HTTP request methods: GET, HEAD, and POST towards the mentioned web services", "content.p_3CEE8367146F43779A2D9F19296E0C6F": "", "content.p_nwh_kp2_phc": "Note: Antivirus software may detect vulnerability scans as malicious activity and block them. If antivirus software is installed on the scan node, we recommend allowlisting the entire scan node installation directory. Additionally, scheduled antivirus scans can interfere with Elements Vulnerability Management scans and may cause them to terminate prematurely.", "desc": [ "content.p_E864A83004FD4684805D26ABCA4294DE", { "choices.ul_01BA3F0FB3EE4C90867B72829AD9DB68": [ "choice.choice_53816B44CD3142F99DA45FF63A8F2A0B", "choice.choice_162F85322A444BA28451FC0FE71D16D0", "choice.choice_92BCBA4FB1C6499ABB12FC1446D162E9" ] }, "content.title_548C72DA5B9F4B90B136D39BE3048919", "content.p_D2006F2463614FB5AA6AD55F728EF05A", { "choices.ul_18CD3849C61141E0A64B00E3F7ADAECE": [ "choice.choice_D3981F9AB4A74FF7AF395C40EA2334CF", "choice.choice_87747C40DC1F4342A0A7C9F1CA256780", { "content.note_pzv_4g1_f2c": [ "content.p_pzv_4g1_f2c" ] } ] }, "content.p_000E97A60BF3418B83FF44369673DE6A", { "choices.ul_jcz_yn2_phc": [ "choice.choice_B93634416B934A4A9374AD383C8D2B85", "choice.choice_ABDDBF32737D4465B6B2D1002D72CB30", "choice.choice_3A685C433F684EC590858B207C4B2529", "choice.choice_0459B7307B364CE6B9968FC715530511" ] }, { "content.note_kss_vs2_phc": [ "content.p_kss_vs2_phc" ] }, "content.p_ECE214BF88534C07A3C65C5481F0BC21", { "choices.ul_tzz_c42_phc": [ "choice.choice_A8A2F8C536F6460FB32454ADDE04A8DA", "choice.choice_EE216CDF779D48BFB679CC7323988213", "choice.choice_673426F0074845EBA3CF51F4FC539E75" ] }, "content.p_ED1CB505403F44988786EF3810A6061D", { "choices.ul_clf_f42_phc": [ "choice.choice_D363F64E7E4A49B18E674852A1459778", "choice.choice_52209E6E8FAD4241BF2083B516D152ED", "choice.choice_D197FB1CEF9E4CE68AB3EE23F7AA16D0" ] }, { "content.note_nwh_kp2_phc": [ "content.p_nwh_kp2_phc" ] } ] }, "task_9346600FE057438F84A7CA8BAB2C1FFA-4.0-en.json": { "title": "title_AE106F5DB61443C4B9B9DD85B76F3734", "title_AE106F5DB61443C4B9B9DD85B76F3734": "Installation steps", "shortdesc": "shortdesc_C44B440F5E1C4E2DA242638B7344FABC", "shortdesc_C44B440F5E1C4E2DA242638B7344FABC": "", "content.p_DDEAEBABA999489AB4DFD65C2539E1E7": "", "content.p_A2C325EE6B34453CA2E293B37EEA47D6": "Note: For information on how to get the license file that is required during installation, see Adding new scan nodes.", "content.p_l2r_4hw_1hc": "Note: You can download Scan Node installers for Windows and Linux from Elements Security Center under Management > Downloads .", "substep.substep_6E233C6C5DA84D05B64F2BBBDDDF623B": "In the WithSecure Elements portal, go to Security Configurations > Scans > Scan nodes and select New scan node.", "substep.substep_C71F13C9564C4FE18D43270605C6F631": "Select Request a new scan node > Next.", "content.p_06DAEC0F9EA24CB2AE4BEC706C1CB012": "The resulting page includes the download link and basic instructions. The license information included in the installation package is valid for 14 days.", "substep.substep_999099A01DA34E9D89E1FEA9AE1F2FF7": "Enter a name and description for the scan node, then select Request.", "step.step_BFC6FFDF69E545A1839129E92E03352A": "Download the scan node installation package and the scan node license file:", "content.p_618332E2CD0F4DC594B2D38F87B96CFA": "The installation wizard checks that all prerequisites are installed and installs any missing software if necessary.", "step.step_F3208AD2514643B8A3D5DCF26CCD5FEA": "Run the scan node installer (executable) and follow the installation wizard steps.", "step.step_8A883503C02346CD9CD862A1AC9B1462": "After successful installation, verify that everything works as intended.", "desc": [ { "content.note_A2C325EE6B34453CA2E293B37EEA47D6": [ "content.p_A2C325EE6B34453CA2E293B37EEA47D6" ] }, { "steps.steps_00FF2D59CF504A2CB3EA95B7B859C28F": [ "step.step_BFC6FFDF69E545A1839129E92E03352A", { "content.note_l2r_4hw_1hc": [ "content.p_l2r_4hw_1hc" ] }, { "substeps.substepsalpha_B1FA9EA42A3F44839F955E7670DCC7EC": [ "substep.substep_6E233C6C5DA84D05B64F2BBBDDDF623B", "substep.substep_C71F13C9564C4FE18D43270605C6F631", "substep.substep_999099A01DA34E9D89E1FEA9AE1F2FF7", "content.p_06DAEC0F9EA24CB2AE4BEC706C1CB012" ] }, "step.step_F3208AD2514643B8A3D5DCF26CCD5FEA", "content.p_618332E2CD0F4DC594B2D38F87B96CFA", "step.step_8A883503C02346CD9CD862A1AC9B1462" ] } ] }, "task_78097642BD8641A8B54AE5EA6F8D5AFD-4.0-en.json": { "title": "title_7C6956CE58A642E69589A6C643C6A887", "title_7C6956CE58A642E69589A6C643C6A887": "Verify installation", "shortdesc": "shortdesc_DA4F2B81EA954054A1A22F700FAC7B0B", "shortdesc_DA4F2B81EA954054A1A22F700FAC7B0B": "", "content.p_73A0981FB1004238AA874A166FBFF617": "You can use the Task Manager or Windows Services to verify if the service is running.", "step.step_372DBA447E9D44D99975A714F7EF4A99": "Verify that the Windows Service WithSecure Radar Agent is installed and running.", "content.p_A8C99525DFF04D1FA25891C773318508": "The Scan Node Agent should be activated within a few minutes after it is first run.", "step.step_A0086D00A76C433F851FE7584E18249B": "Open WithSecure Elements VM Scan Node - Control Center and verify that the Scan Node Agent is active.", "subchoice.choice_AAE85CBBF08B4B53ACF26F5F3E0EAACC": "[drive]:\\Program Files (x86)\\F-Secure\\RadarScanAgent\\binaries_ds", "subchoice.choice_BAA9484D397C4A5BA0C9EDD04E63F6E8": "[drive]:\\Program Files (x86)\\F-Secure\\RadarScanAgent\\binaries_ws", "subchoice.choice_EA2B621207124D7DA3C5714DF39CE5D9": "[drive]:\\Program Files (x86)\\F-Secure\\RadarScanAgent\\binaries_ss", "content.p_B5DA2639EBAA417EA11D93BBFFB95951": "After the installation, wait 5-10 minutes for the Radar.Scan.Daemon to download all the binaries. Once completed, you should see the following folders:", "content.p_65F116660A1C48B997A4AC015C564B18": "Note: If a scan engine module is deactivated, its binaries will not be downloaded.", "step.step_31F8E968D0EC480EAB51A2A6EAF7505C": "Verify that the scanning engines and plugins can be downloaded.", "substep.substep_8D989D4CB56A4648A917927170FABD78": "Log in to the WithSecure Elements portal.", "content.p_255D15F3B7C84C6599EEFD9CC7E66CA6": "It should always be less than 1 minute since the scan node attempted to connect to the Elements Security Center. If Last seen is longer, see the troubleshooting section.", "substep.substep_F16E06AF28AC4DE8A0BDFB8791E3BD40": "Go to Security Configurations > Scans > Scan nodes.", "step.step_B9CD185F085D4BD5BC8457AB57257CF5": "Verify that the scan node can connect to the Elements Security Center:", "step.step_11615C8328C140EE96925221C9F9FB0E": "Review the log files in [drive]:\\Program Files (x86)\\F-Secure\\RadarScanAgent\\logs for other errors.", "content.p_C74DB1E5F3CB4725BD7770E02CBF5259": "For example:", "substep.substep_DE741C4DC59B49A3A3916C58643F9B3F": "Run a Discovery Scan using the Host Discovery mode.", "substep.substep_8C0E5FC563004E6BAF1383919B2C9B63": "Run a System Scan with a limited port range (e.g. TCP/80,443).", "substep.substep_338E847D29E241CDB6F86E4F6E356BC3": "Run a Web Scan with Run attacks disabled.", "step.step_30F87A72036F43799502F6EF0CDCAE44": "Run a few test scans.", "desc": [ { "steps.steps_561A347BA6F5485AAFAC6A76F81EDFBC": [ "step.step_372DBA447E9D44D99975A714F7EF4A99", "content.p_73A0981FB1004238AA874A166FBFF617", "step.step_A0086D00A76C433F851FE7584E18249B", "content.p_A8C99525DFF04D1FA25891C773318508", "step.step_31F8E968D0EC480EAB51A2A6EAF7505C", "content.p_B5DA2639EBAA417EA11D93BBFFB95951", { "subchoices.ul_0D433A875AD342A4886B7531565D23D5": [ "subchoice.choice_AAE85CBBF08B4B53ACF26F5F3E0EAACC", "subchoice.choice_BAA9484D397C4A5BA0C9EDD04E63F6E8", "subchoice.choice_EA2B621207124D7DA3C5714DF39CE5D9" ] }, { "content.note_65F116660A1C48B997A4AC015C564B18": [ "content.p_65F116660A1C48B997A4AC015C564B18" ] }, "step.step_B9CD185F085D4BD5BC8457AB57257CF5", { "substeps.substepsalpha_BA4B83EC762840AF972CA61D5F75B2F8": [ "substep.substep_8D989D4CB56A4648A917927170FABD78", "substep.substep_F16E06AF28AC4DE8A0BDFB8791E3BD40", "content.p_255D15F3B7C84C6599EEFD9CC7E66CA6" ] }, "step.step_11615C8328C140EE96925221C9F9FB0E", "step.step_30F87A72036F43799502F6EF0CDCAE44", "content.p_C74DB1E5F3CB4725BD7770E02CBF5259", { "substeps.substepsalpha_1951024522904D129780CB2A61467420": [ "substep.substep_DE741C4DC59B49A3A3916C58643F9B3F", "substep.substep_8C0E5FC563004E6BAF1383919B2C9B63", "substep.substep_338E847D29E241CDB6F86E4F6E356BC3" ] } ] } ] }, "task_82B78C67199740B3A28EC7FDF9E16FC1-4.0-en.json": { "title": "title_102EE324114F4DB7B13638C1D0C1119A", "title_102EE324114F4DB7B13638C1D0C1119A": "Configuring scan nodes", "shortdesc": "shortdesc_FE32F10FC3A64541AB0CC61947AEE1EA", "shortdesc_FE32F10FC3A64541AB0CC61947AEE1EA": "", "content.p_0DC2FF21F5A94E4789841D3B014571B0": "Scan nodes can be configured via the control center application.", "step.step_A500E3875ACB4DA49502E50C0F64BB57": "Find the scan node installation directory (e.g. [drive]:\\Program Files (x86)\\F-Secure\\RadarScanAgent\\).", "step.step_515D0972671B4C5AA34EDE3E9041529A": "Start the control center application FSRadarAgent.Tray.exe.", "cell.entry_88470065AF5A4EB8AE805C45D99C7208": "ID", "cell.entry_207B65D99F47493B8134BB90698E46F5": "Name", "cell.entry_39FDD2A5FF56406A8B425F3050C39064": "Value (recommended)", "cell.entry_99C536C18C3A4AF1B3C10DC0EF75CDC2": "Description", "cell.entry_9E9B5E32BFCC469FAD3CE6597458C487": "4", "cell.entry_88087D777F3A418B856BFB101D66DE62": "SCANNODE.​ModuleLoopInterval", "cell.entry_CFCF3FDFBE9A4564AB48ABD3C6E2A5A3": "14400000", "cell.entry_CB26EEACEB224B198E24C13EB72EA3A0": "How often the scan node should check for updates in milliseconds. The default is every 4 hours.", "cell.entry_BF625DC339594A93800BEECEE0EE7322": "10-12", "cell.entry_E3333E01448C46DDA6515F53F3119A9D": "Module.​{Scan​Engine​Name}.​Enabled", "cell.entry_E57D70B77F6941BEB9B4ED675C7668EB": "True", "cell.entry_BA787CF8B04846CDBA584CBD50E6AE6D": "Defines which scan engines are enabled on the scan node.", "cell.entry_A4F80253290D4047A0886C68381B3D47": "13-15", "cell.entry_8C3C2BD432A04BA39A0C5969478714EA": "Module.​{Scan​Engine​Name}.​ScanNodeId", "cell.entry_A409D554D97E49859BC2FE1AFE550762": "GUID", "cell.entry_5E95FFF9B9014BB3BA9CC89C381056BA": "The unique identifier for each scan engine module.
The IDs are used when new scan nodes are added to the WithSecure Elements portal.", "cell.entry_445363E7CB714AD18F450EDFE505A808": "19-21", "cell.entry_4DAAC7870F5A42FC90861103EE232468": "Module.​{Scan​Engine​Name}.​Max​Simultaneous​Scans", "cell.entry_1DB670C1A6034059B8DC136F937A8F28": "DiscoveryScan: 10 SystemScan: 30 WebScan: 5", "cell.entry_EB8FA047BD4C4EA0A1C9066F7FA1451C": "These values control the maximum number of simultaneous scans that the scan node is allowed to run.
Too high values might result in open ports being missed during port scanning.", "cell.entry_5D89D602A1F141FD8F760B6EA499B002": "127", "cell.entry_4D1097F93E0A4BD4B34464CB91CC7892": "Communication.​Web​Serivce.​Updates.​Skip​SSL​Certificate​Validation", "cell.entry_C3C3DB75A71A4AC7BBFBF0D62BC68930": "False", "cell.entry_12323A7082644F64B56227EDE6C75DC8": "Skip certificate validation while connecting to Elements Vulnerability Management Update Service.", "cell.entry_D91B4BE264844E9DB0203F6D8E7EC5C1": "128", "cell.entry_9A2035081484428281CC31241A5B376D": "Communication.​Web​Serivce.​Security​Centre.​Skip​SSL​Certificate​Validation", "cell.entry_152177269A374438A08E5246F6E10C07": "False", "cell.entry_1EE0814DF61F420E90022179799E9870": "Skip certificate validation while connecting to the WithSecure Elements portal.", "content.p_AF47BCAF294B48AC989ED98F2534AB9A": "The most important configuration options are:", "step.step_80F520B8B6604220B8CC9D919666651F": "Go to the Management > Vulnerability settings tab to find all the configuration options.", "desc": [ "content.p_0DC2FF21F5A94E4789841D3B014571B0", { "steps.steps_40E9D93FFFCC484A9A030C78966977E0": [ "step.step_A500E3875ACB4DA49502E50C0F64BB57", "step.step_515D0972671B4C5AA34EDE3E9041529A", "step.step_80F520B8B6604220B8CC9D919666651F", "content.p_AF47BCAF294B48AC989ED98F2534AB9A", { "table.table_D7B51C9BB1DA45FFBAD2D69C2B9BF949": [ { "thead.thead_0DB8BDF2BF46481D94805540D75FC706": [ "cell.entry_88470065AF5A4EB8AE805C45D99C7208", "cell.entry_207B65D99F47493B8134BB90698E46F5", "cell.entry_39FDD2A5FF56406A8B425F3050C39064", "cell.entry_99C536C18C3A4AF1B3C10DC0EF75CDC2" ] }, { "row.row_ABF23C351BD6449D940908ED4912E285": [ "cell.entry_9E9B5E32BFCC469FAD3CE6597458C487", "cell.entry_88087D777F3A418B856BFB101D66DE62", "cell.entry_CFCF3FDFBE9A4564AB48ABD3C6E2A5A3", "cell.entry_CB26EEACEB224B198E24C13EB72EA3A0" ] }, { "row.row_C79368FFFCB54742AF192FE5BA99F9B0": [ "cell.entry_BF625DC339594A93800BEECEE0EE7322", "cell.entry_E3333E01448C46DDA6515F53F3119A9D", "cell.entry_E57D70B77F6941BEB9B4ED675C7668EB", "cell.entry_BA787CF8B04846CDBA584CBD50E6AE6D" ] }, { "row.row_FA05ECE9862D40608CBB5246BA12CEDD": [ "cell.entry_A4F80253290D4047A0886C68381B3D47", "cell.entry_8C3C2BD432A04BA39A0C5969478714EA", "cell.entry_A409D554D97E49859BC2FE1AFE550762", "cell.entry_5E95FFF9B9014BB3BA9CC89C381056BA" ] }, { "row.row_304EE29E6DE8484C88B8D9AFF96B09AD": [ "cell.entry_445363E7CB714AD18F450EDFE505A808", "cell.entry_4DAAC7870F5A42FC90861103EE232468", "cell.entry_1DB670C1A6034059B8DC136F937A8F28", "cell.entry_EB8FA047BD4C4EA0A1C9066F7FA1451C" ] }, { "row.row_9F7F829B757B415681DB6C668008D427": [ "cell.entry_5D89D602A1F141FD8F760B6EA499B002", "cell.entry_4D1097F93E0A4BD4B34464CB91CC7892", "cell.entry_C3C3DB75A71A4AC7BBFBF0D62BC68930", "cell.entry_12323A7082644F64B56227EDE6C75DC8" ] }, { "row.row_A85CCBD175CF45378ABE850A86F2C23E": [ "cell.entry_D91B4BE264844E9DB0203F6D8E7EC5C1", "cell.entry_9A2035081484428281CC31241A5B376D", "cell.entry_152177269A374438A08E5246F6E10C07", "cell.entry_1EE0814DF61F420E90022179799E9870" ] } ] } ] } ] }, "concept_F6FDEE68ABC547D68EBF7BB0311018A6-4.0-en.json": { "title": "title_6EA939060876444A843E936B41C52C95", "title_6EA939060876444A843E936B41C52C95": "Troubleshooting scan nodes issues", "shortdesc": "shortdesc_4625E9FC23794CBD8CE6AAA144FA8785", "shortdesc_4625E9FC23794CBD8CE6AAA144FA8785": "", "content.p_C2CE92C21D7649AF8D97D2990A2021E5": "You can try the following steps to resolve scan node issues:", "choice.choice_254D778DADCB40289025B68338BB8863": "Ensure that the scan node Windows service is running.", "choice.choice_C757398604CE43B9A7EA79999C1BF438": "Open Elements VM Scan Node - Control Center and check if the scan node is active and that scanning engines were downloaded (revision is greater then 0).", "choice.choice_049E53CFC4B44128811EC71AA7443968": "Review the scan node log files (C:\\Program Files (x86)\\F-Secure\\RadarScanAgent\\logs).", "choice.choice_66075E12238E473D834563F9442D1B25": "Perform a connection test. Run the following command as the same user that runs the service: C:\\Program Files (x86)\\F-Secure\\RadarScanAgent>FSRadarAgent.exe -test.", "content.p_0F0C0272F09B40AE9DAE12465720C02A": "Note: Remember to run the command line as the user running the \"WithSecure Elements VM Scan Node Agent\" service.", "subchoice.choice_166FB9AF86754853AF9151450470E2FC": "Via the command line with the following command: FSRadarAgent.exe -c -vv. For example: C:\\Program Files (x86)\\F-Secure\\RadarScanAgent>FSRadarAgent.exe -c -vv.", "content.p_823A8245DC9F46EC97C937FB822E57FD": "Note: Editing the system registry is a very sensitive operation. Proceed with caution if you use this approach.", "subchoice.choice_5826EB1B283D47B3A0ED73E56FFC3E97": "Alternatively, as a service. To do this, add the
-vv argument to the service startup command. The service startup parameters can be modified in the system registry.", "choice.choice_0D71AAAC45724C2A93FB30D12770F239": "Run the scan node agent in debug mode:", "choice.choice_D02456A0535647348C4FA7877901B490": "Check Windows Event Viewer for possible errors.", "choice.choice_F66A71639C574456A392683AE9C48C91": "If none of these steps has helped, contact Elements Vulnerability Management support. When sending your support request, please describe your problem in detail and always attach log files (at least the one from the date when the issue occurred).", "desc": [ "content.p_C2CE92C21D7649AF8D97D2990A2021E5", { "choices.ul_445729FD569E4995912B442569524154": [ "choice.choice_254D778DADCB40289025B68338BB8863", "choice.choice_C757398604CE43B9A7EA79999C1BF438", "choice.choice_049E53CFC4B44128811EC71AA7443968", "choice.choice_66075E12238E473D834563F9442D1B25", "choice.choice_0D71AAAC45724C2A93FB30D12770F239", { "subchoices.ul_37E837D614A54284B149DFDFD4F0774C": [ "subchoice.choice_166FB9AF86754853AF9151450470E2FC", { "content.note_0F0C0272F09B40AE9DAE12465720C02A": [ "content.p_0F0C0272F09B40AE9DAE12465720C02A" ] }, "subchoice.choice_5826EB1B283D47B3A0ED73E56FFC3E97", { "content.note_823A8245DC9F46EC97C937FB822E57FD": [ "content.p_823A8245DC9F46EC97C937FB822E57FD" ] } ] }, "choice.choice_D02456A0535647348C4FA7877901B490", "choice.choice_F66A71639C574456A392683AE9C48C91" ] } ] }, "task_12E07949BD0B480AB40CC1805F5BE3FE-4.0-en.json": { "title": "title_8616370767D24726B1220EE23360FF26", "title_8616370767D24726B1220EE23360FF26": "Using scan nodes in an offline environment", "shortdesc": "shortdesc_CBF8960E5B894C5DA23F42A43899C79C", "shortdesc_CBF8960E5B894C5DA23F42A43899C79C": "In some cases, you may need to install the scan nodes in an offline environment, for example when a scan node is deployed in a highly secured environment with no connection to the Internet. ", "content.p_jfx_mnd_wbc": "Note: These instructions apply only to existing on-premise customers.", "content.p_D9D2225498BD4F9C850D811B62F6A184": "The inconvenience of such environments is that they break important scan node features, such as automatic activation, automatic product updates, and automatic scanning engine (plugin) updates.", "content.p_AA1FF776805446D984DF600EC5E6B6A6": "Elements Vulnerability Management supports such configurations, although the administrator must handle scan node updates manually.", "content.p_85669FBE85B348948E13E51DDFD42BDE": "To handle activation and updates for scan nodes in an offline environment:", "step.step_7CC3CF955C29409DB92FBAC1CAB3D07D": "Go to the scan node machine.", "step.step_6AF5AE288619402398795632BA1DA8C4": "Open Elements VM Scan Node - Control Center (located at C:\\Program files (x86)\\F-Secure\\RadarScanAgent\\FSRadarAgent.Tray.exe).", "content.p_F195D48D24B84CCD94DC7A94C669B327": "", "step.step_2C5A083D9FAC40769AFD63A2D48A65C2": "Generate the authorization key.", "step.step_51DA6E815A644D17983596A7C4871FE6": "Copy the key to a computer that has online access to the Elements VM Update Service.", "content.p_3A0837AC06AC4BF59E175D9DE4EBACDF": "", "step.step_3C2FDE222B2445088C77A14212D0CBEC": "Send the key to the Elements VM Update Service at https://updates-api.radar-prd.fsapi.com.", "content.p_2BEBD99BA14D4637A02E94E328B54D27": "", "step.step_1008967D65B640C196C9357CE4688B7E": "If your scan node was not activated yet, copy the activation code from the Elements VM Update Service to the scan node machine.", "content.p_0BCD9CE2239243B1BE7B8B88EA127698": "", "step.step_F69252B1D6314C3183D70C3D533FB1D0": "Download software updates for your scan node from the Elements VM Update Service and copy them to scan node machine.", "content.p_3AB8513AF4954D7EA0794476FEF5F7E5": "", "step.step_5AC9C780684B43AFB9C95104B206F390": "If your scan node is not activated yet, open Elements VM Scan Node - Control Center and apply the activation code.", "content.p_4DA1CFBFBB8E4B10A01125CBB674A326": "There are two ways to install the updates on the scan node machine:", "subchoice.choice_90278B86938249ECB7BB497411C402E4": "Manual: Run the update package on the scan node machine. It will ask you to enter your Windows service user credentials.", "subchoice.choice_DC654514167647C69286DC6BC1327B69": "Semi-automatic: Place the package under C:\\Program Files (x86)\\F-Secure\\RadarScanAgent\\updates and wait for the scan node to install the updates. This should happen within the next 5 minutes.", "step.step_2620E7E6D01E43B890C2643C608742DF": "Install the updates.", "content.p_A8EF4552D00845D6933C41CCE08BDD86": "As an alternative method, you can use an external script (for example PowerShell on a remote computer) to perform the updates. Here is a sample script that can help you with this approach: $authKey = .\\FSRadarAgent.exe -authKeyS
$updateService = \"https://updates-api.radar-prd.fsapi.com\"
$authResult = Invoke-RestMethod -Method Post -Uri \"$updateService/api/1.0/ProductUpdates/Components/ScanNodeAgent/AuthKey\" -Header @{\"Content-Type\" = \"application/json\"} -Body (ConvertTo-Json @{\"authKey\" = $authKey[0]})
if ($authResult.ActivationCode) {echo $authResult.ActivationCode | .\\FSRadarAgent.exe -activate}
$token = $authResult.RequestToken
$packageResult = Invoke-RestMethod -Method Post -Uri \"$updateService/api/1.0/ProductUpdates/Packages/$token/Generate\" -Header @{\"Content-Type\" = \"application/json\"} -Body (ConvertTo-Json @{\"IncludeModules\" = (\"PSNG\", \"SSNG\", \"WSNG\")})
while ($packageResult.Status -eq \"New\" -Or $packageResult.Status -eq \"InProgress\")
{
$packageResult = Invoke-RestMethod -Method Get -Uri \"$updateService/api/1.0/ProductUpdates/Packages/$token/Status\" -Header @{\"Content-Type\" = \"application/json\"}
}
if ($packageResult.Status -eq \"Ready\")
{
mkdir .\\updates\\Script
Invoke-WebRequest -Uri $packageResult.DownloadUrl -OutFile .\\updates\\Script\\Radar_Scan_Node_Agent_installer_with_license.exe
.\\updates\\Script\\Radar_Scan_Node_Agent_installer_with_license.exe -ai
} else {echo \"FAILED!\"}", "desc": [ { "content.note_jfx_mnd_wbc": [ "content.p_jfx_mnd_wbc" ] }, "content.p_D9D2225498BD4F9C850D811B62F6A184", "content.p_AA1FF776805446D984DF600EC5E6B6A6", "content.p_85669FBE85B348948E13E51DDFD42BDE", { "steps.steps_939FC44351FD490386F6289263D1BCC1": [ "step.step_7CC3CF955C29409DB92FBAC1CAB3D07D", "step.step_6AF5AE288619402398795632BA1DA8C4", "step.step_2C5A083D9FAC40769AFD63A2D48A65C2", "content.p_F195D48D24B84CCD94DC7A94C669B327", "step.step_51DA6E815A644D17983596A7C4871FE6", "step.step_3C2FDE222B2445088C77A14212D0CBEC", "content.p_3A0837AC06AC4BF59E175D9DE4EBACDF", "step.step_1008967D65B640C196C9357CE4688B7E", "content.p_2BEBD99BA14D4637A02E94E328B54D27", "step.step_F69252B1D6314C3183D70C3D533FB1D0", "content.p_0BCD9CE2239243B1BE7B8B88EA127698", "step.step_5AC9C780684B43AFB9C95104B206F390", "content.p_3AB8513AF4954D7EA0794476FEF5F7E5", "step.step_2620E7E6D01E43B890C2643C608742DF", "content.p_4DA1CFBFBB8E4B10A01125CBB674A326", { "subchoices.choices_55CB084E49D54F6E9FF272DF56A14ECC": [ "subchoice.choice_90278B86938249ECB7BB497411C402E4", "subchoice.choice_DC654514167647C69286DC6BC1327B69" ] } ] }, "content.p_A8EF4552D00845D6933C41CCE08BDD86" ] }, "task_582ACF29209A4AACB35DFF1637AE5511-4.0-en.json": { "title": "title_9EA0595F1CE148B5B2FAC6E315FE7468", "title_9EA0595F1CE148B5B2FAC6E315FE7468": "Uninstalling scan nodes", "shortdesc": "shortdesc_E5A9DA16FF764268933997AAD69BF8CE", "shortdesc_E5A9DA16FF764268933997AAD69BF8CE": "", "content.p_0FDFFD34CF784434B8020AF2035023B8": "To uninstall an Elements Vulnerability Management scan node:", "step.step_07A3DB3DFA6B43EDB5B34BF43956638B": "Go to Control Panel > Programs > Programs and Features.", "content.p_18191E3DBE9A4DF9846024EDD6B644AF": "If you see WithSecure Elements VM Scan Node Agent:", "substep.substep_4A9E37EC7EF34CBE97D170551FD07096": "Double-click WithSecure Elements VM Scan Node Agent.", "content.p_BD0DEFA90FD54058A5BEE986C19B9149": "Scan Node Agent is successfully uninstalled.", "substep.substep_76E344AAD52840C3A16B237BE623D85C": "Type y and press Enter to confirm that you want to remove Scan Node Agent.", "content.p_238BAF637F25459EB4AEFE1E0722CA27": "If you cannot find WithSecure Elements VM Scan Node Agent, it means that your version of Scan Node Agent is older than 2.6.1.1174. To uninstall earlier versions:", "substep.substep_5038844088474C41A72B210D2B0F2538": "Open an elevated command prompt.", "substep.substep_EC6FBBC9C3AA469DB2A555E10BA93EBA": "Change the directory to C:\\Program Files (x86)\\F-Secure\\RadarScanAgent.", "substep.substep_5493D3D38D8B40A8860F65D63415F0B9": "Uninstall the Elements VM Scan Node Agent's Windows service by running the following command: FSRadarAgent.exe -u.", "substep.substep_5A57EC03BB164EC5B48DCA7D4E548B96": "Delete the scan node folder C:\\Program Files (x86)\\F-Secure\\RadarScanAgent.", "content.p_1A5C13FC12F641099563EBDB6682DE3A": "The scan node software is now uninstalled.", "substep.substep_DACBE82F9B024C7F80EAFB3864760A9B": "Remove the following registry key: HKLM\\Software\\Wow6432Node\\F-Secure\\SN.", "step.step_49833F2CC3A047CCB809775E16A92E21": "Check the list of programs.", "content.p_7B88B837DCC04741B7C5A2B037597452": "To remove any remaining files:", "step.step_3445D322647643D7B46CC746278DF70E": "Log in to the WithSecure Elements portal.", "step.step_D2F468878A7F413B8DC157DEF2C876AC": "Go to Security Configurations > Scans > Scan nodes.", "step.step_E505CD58300442649EFBDDBF9B86F36E": "Use the action menu to unregister the scan engines.", "desc": [ "content.p_0FDFFD34CF784434B8020AF2035023B8", { "steps.steps_6ABF7FB839E84368A64C558E04267736": [ "step.step_07A3DB3DFA6B43EDB5B34BF43956638B", "step.step_49833F2CC3A047CCB809775E16A92E21", "content.p_18191E3DBE9A4DF9846024EDD6B644AF", { "substeps.substepsalpha_B3FD1B89E20A422098F5B80D25328B5A": [ "substep.substep_4A9E37EC7EF34CBE97D170551FD07096", "substep.substep_76E344AAD52840C3A16B237BE623D85C", "content.p_BD0DEFA90FD54058A5BEE986C19B9149" ] }, "content.p_238BAF637F25459EB4AEFE1E0722CA27", { "substeps.substepsalpha_C30E290AD1424C9F89798C08184F51AA": [ "substep.substep_5038844088474C41A72B210D2B0F2538", "substep.substep_EC6FBBC9C3AA469DB2A555E10BA93EBA", "substep.substep_5493D3D38D8B40A8860F65D63415F0B9", "substep.substep_5A57EC03BB164EC5B48DCA7D4E548B96", "substep.substep_DACBE82F9B024C7F80EAFB3864760A9B", "content.p_1A5C13FC12F641099563EBDB6682DE3A" ] } ] }, "content.p_7B88B837DCC04741B7C5A2B037597452", { "steps.ol_3181387E666947E1ADB875D6130C5DE8": [ "step.step_3445D322647643D7B46CC746278DF70E", "step.step_D2F468878A7F413B8DC157DEF2C876AC", "step.step_E505CD58300442649EFBDDBF9B86F36E" ] } ] }, "concept_9B2C05AAE1F34D358F21371C0FC2FEBD-4.0-en.json": { "title": "title_F20280BCCA294994B748CEF539F9AB50", "title_F20280BCCA294994B748CEF539F9AB50": "Installing WithSecure Elements VM scan nodes (Linux)", "shortdesc": "shortdesc_3DF946377D3C4D1F8FF3F4C1EB93FE3C", "shortdesc_3DF946377D3C4D1F8FF3F4C1EB93FE3C": "Scan nodes are used to perform the actual discovery and network vulnerability scans. ", "content.p_AEC5E198CDD54928A70CF14DF6180EF2": "A scan node can be installed with one or more of the following scanning engines:", "choice.choice_53816B44CD3142F99DA45FF63A8F2A0B": "Discovery scan is a network discovery and port scanning engine.", "choice.choice_162F85322A444BA28451FC0FE71D16D0": "System scan is able to scan IP addresses for known vulnerabilities.", "choice.choice_92BCBA4FB1C6499ABB12FC1446D162E9": "Web scan is designed to scan custom web applications for vulnerabilities.", "content.title_9D56689D1DDA4B6FB1E1455B335933FE": "Scan node requirements (Linux)", "choice.choice_D89B74F98262487BB4E2A1C2CAA66F0A": "Any stable LTS release up to Ubuntu 24.04 (64-bit only). Available for download at https://ubuntu.com/download/server), or", "choice.choice_238DF3B3567D491FA170D88874182D6A": "Any stable LTS release up to Debian 13 (64-bit only). Available for download at https://www.debian.org/distrib/)", "choice.choice_A9E2655C2B434550A04D3BC8C3695721": "SSH (GUI is not needed, the required X11 libraries are installed automatically as .deb package dependencies)", "choice.choice_003B4A7D460847DEA0BD464E543D288F": "Network access to the following:", "subchoice.choice_0BBE70DE39DA41CB81FC082E753E63F9": "https://sn-api.radar-prd.fsapi.com, https://gateway.radar-prd.fsapi.com and http://guts2.fsapi.com/", "subchoice.choice_25634E9956C54D93A3FA09D24215C635": "https://updates-api.radar-prd.fsapi.com (Elements VM Update Service API)", "choice.choice_C734933A11B045A9A9A36CCFCFE3B6CC": "", "subchoice.choice_BB990D79FC2145CE9ED540CBABE7660C": "https://api.radar-prd.fsapi.com for accounts with a paid subscription", "subchoice.choice_4E5F6F2FFB8E4F98939227BD8ED5AF3A": "URI assigned during the installation process for on-site installations", "subchoice.choice_5152243CEBDD41DCA6190B9D0FB8FEAE": "If you are using a proxy server, it must allow the following HTTP request methods: GET, HEAD, and POST towards the mentioned web services", "choice.choice_586FA56FE5084502864A1FDCC31069BC": "Network access to Elements Vulnerability Management as follows:", "choice.choice_3488C2B7044D401AA38A58FE0F46EBBF": "Hardware", "subchoice.choice_5BDD913EB2104EE0A71051F851B39ED9": "Minimum 4 GB RAM (recommended: 8GB)", "subchoice.choice_995B32A722854D319C261EC85508DC6F": "Minimum 2 GHz processor / 2 CPU in AWS", "subchoice.choice_27DFDF12C4DD4E6DA3D624B69EA07F2D": "Minimum 30 GB disk space", "choice.choice_A6F161B474444B53BF0F972ADD1D158D": "", "content.p_2843D5A20FEA47D7ACBA2F74ED3C02C4": "", "desc": [ "content.p_AEC5E198CDD54928A70CF14DF6180EF2", { "choices.ul_01BA3F0FB3EE4C90867B72829AD9DB68": [ "choice.choice_53816B44CD3142F99DA45FF63A8F2A0B", "choice.choice_162F85322A444BA28451FC0FE71D16D0", "choice.choice_92BCBA4FB1C6499ABB12FC1446D162E9" ] }, "content.title_9D56689D1DDA4B6FB1E1455B335933FE", { "choices.ul_46EE5730EE344945BB250B810EC2AC67": [ "choice.choice_D89B74F98262487BB4E2A1C2CAA66F0A", "choice.choice_238DF3B3567D491FA170D88874182D6A", "choice.choice_A9E2655C2B434550A04D3BC8C3695721", "choice.choice_003B4A7D460847DEA0BD464E543D288F", "choice.choice_C734933A11B045A9A9A36CCFCFE3B6CC", { "subchoices.ul_D3C437E95984400996C9B141EB367AD4": [ "subchoice.choice_0BBE70DE39DA41CB81FC082E753E63F9", "subchoice.choice_25634E9956C54D93A3FA09D24215C635" ] }, "choice.choice_586FA56FE5084502864A1FDCC31069BC", { "subchoices.ul_5CFC45B6060941A1A764D115B8CCFF54": [ "subchoice.choice_BB990D79FC2145CE9ED540CBABE7660C", "subchoice.choice_4E5F6F2FFB8E4F98939227BD8ED5AF3A", "subchoice.choice_5152243CEBDD41DCA6190B9D0FB8FEAE" ] }, "choice.choice_3488C2B7044D401AA38A58FE0F46EBBF", "choice.choice_A6F161B474444B53BF0F972ADD1D158D", { "subchoices.ul_241013BE78014719B747495957FB6ADD": [ "subchoice.choice_5BDD913EB2104EE0A71051F851B39ED9", "subchoice.choice_995B32A722854D319C261EC85508DC6F", "subchoice.choice_27DFDF12C4DD4E6DA3D624B69EA07F2D" ] } ] } ] }, "task_CE3186C99BF84BA289D58BA8A883DC40-4.0-en.json": { "title": "title_5845F14C548B4BD599440C4D9603207F", "title_5845F14C548B4BD599440C4D9603207F": "Installation steps", "shortdesc": "shortdesc_131059F16A294A54A1FDF71DD9DDCB01", "shortdesc_131059F16A294A54A1FDF71DD9DDCB01": "Follow these steps to install a scan node on your Linux system. ", "content.p_D6234FC1FDBA4E94A53F58F517A413C1": "Using an installation package with automatically applied license information:", "substep.substep_6E233C6C5DA84D05B64F2BBBDDDF623B": "In the WithSecure Elements portal, go to Security Configurations > Scans > Scan nodes and select New scan node.", "substep.substep_C71F13C9564C4FE18D43270605C6F631": "Select Request a new scan node.", "content.p_06DAEC0F9EA24CB2AE4BEC706C1CB012": "The resulting page includes the download link and basic instructions. The license information included in the installation package is valid for 14 days. You do not need to apply the license manually when you use this type of installation package, although an internet connection is required during installation. If you encounter any issues when applying the license, follow the steps given for applying it manually.", "substep.substep_999099A01DA34E9D89E1FEA9AE1F2FF7": "Enter a name and description for the scan node, then select Request.", "content.p_B33DFE2E4A4548218F244F087CBE69E4": "Using an installation package for manually applied license information:", "content.p_A20EF6EF9ED94E77A78360283B6F03EA": "Alternatively, you can also download Scan Node installers for Windows and Linux from Elements Security Center under Management > Downloads or use the following command to download the installation package:", "content.p_4DBBD9E3925048C5875326756DB17525": "wget -P ~ --content-disposition
https://updates-api.radar-prd.fsapi.com/api/1.1/ProductUpdates/​Components/ScanNodeAgent/Releases/4.0.0.0/Download", "substep.substep_0646726537884D00AAD4E45DF7B0E764": "Download the scan node installation package from https://updates-api.radar-prd.fsapi.com/api/1.1/ProductUpdates/Components/ScanNodeAgent/Releases/4.0.0.0/Download.", "substep.substep_5DA4F22E8B574E3198708C3B51618F7F": "In the WithSecure Elements portal, go to Security Configurations > Scans > Scan nodes and select New scan node.", "substep.substep_27563C8A4EDD4F4790F73E70622B62F5": "Select Request a new scan node.", "substep.substep_CDB550E1AC514132815EA77BDABA3D97": "Enter a name and description for the scan node, then select Request.", "content.p_EAE2454CCB4D4EB3A1824E124D195BA8": "The URL is valid for 14 days and should have the following format: https://updates-api.radar-prd.fsapi.com/api/2.9/organizations/productLicenses/​order?token=2Ub3Tfd(....).", "substep.substep_4FABCCAA12E448B9BAE5434F138EEEEE": "Copy the URL under Download scan node license to the clipboard.", "content.p_308E84ABC3EF459CB8075FBB72E37EDD": "wget -O ~/license.fsrl <URL>", "substep.substep_9FFC7380842F477F92223A1D9881CBCA": "Use the following command to download the license file to your Linux system, replacing <URL> with the URL that you copied from the Elements Security Center:", "step.step_BFC6FFDF69E545A1839129E92E03352A": "Download the scan node installation package.", "content.p_80CC5B16263A425BBEADA31F575DEEC4": "These settings are used both for normal scan node operations and for maintenance purposes (installing and updating the scan node).", "content.p_780544195F1E4CBD8EEBFDC6A9274335": "echo \"FSECURE_HTTP_PROXY_HOST=www.proxy.example.com\" | sudo tee -a /etc/environment
echo \"FSECURE_HTTP_PROXY_PORT=8080\" | sudo tee -a /etc/environment", "substep.substep_66EF95325F2046198E3E43CB45B257E7": "Run the following commands to set the variables using the /etc/environment file:", "substep.substep_708466976CBA4F2F8153C6D71597CA2D": "Log out for the changes to take effect and then log in again.", "step.step_056B71BAC01A4F6FAC231FF38D3064B3": "If you need to use a proxy server for communication with external networks, set the FSECURE_HTTP_PROXY_HOST and FSECURE_HTTP_PROXY_PORT environment variables.", "content.p_1395123DDC764E93BA733E9558A0E9D9": "Note: In the command, replace the OS distribution name and version with the desired ones if you want to deploy the scan node on another operating system. The link in the command should refer to the appropriate *.deb file located in the following repository: https://packages.microsoft.com/config/.", "content.p_79054D79D6114A5BA5F2ED9A76F0E740": "wget -q https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb
sudo apt install ./packages-microsoft-prod.deb
sudo apt update", "step.step_D0882F075A95418B849C47C9CCF90BB7": "Run the following commands to install the prerequisites:", "content.p_49A18108F53D4C7DB1AC241D2D594172": "sudo apt install ./f-secure-radar-scannodeagent-installer_<version>_amd64.deb", "content.p_96F73068F07749D3AAA82EFE395531D4": "Replace <version> with the version number for the agent that you want to install.", "content.p_D7F1A1DC8B964597BBFA628BBD3E7A9D": "Note: In the license selection screen, press Tab to move between the panes, the Up and Down arrow keys to scroll through the lists, and Space to select the file that you want to use.", "content.p_3B159BB247D64B32AAC9D9FB264BB0A9": "The installation directory is /opt/fsecure/radar-scannodeagent. The Linux daemon (service) name is f-secure-radar-scannodeagent.", "content.p_EC675EE6C6B344A3A36881F4E77D6586": "If this is the very first installation, you are asked to provide a license file (.fsrl).", "step.step_E97CA7E4155D43188B23B387A7BB1496": "Run the following command to install the WithSecure Elements VM Scan Node Agent:", "content.p_A79E0BFB961C48038CCD1D95BB30D7A2": "After successful installation, verify that everything works as intended.", "desc": [ { "steps.steps_5DA410A4164B42219517E256FD1F5E15": [ "step.step_BFC6FFDF69E545A1839129E92E03352A", "content.p_D6234FC1FDBA4E94A53F58F517A413C1", { "substeps.substepsalpha_B1FA9EA42A3F44839F955E7670DCC7EC": [ "substep.substep_6E233C6C5DA84D05B64F2BBBDDDF623B", "substep.substep_C71F13C9564C4FE18D43270605C6F631", "substep.substep_999099A01DA34E9D89E1FEA9AE1F2FF7", "content.p_06DAEC0F9EA24CB2AE4BEC706C1CB012" ] }, "content.p_B33DFE2E4A4548218F244F087CBE69E4", { "substeps.substepsalpha_9D109BD027774C55A675E4D96BFD9581": [ "substep.substep_0646726537884D00AAD4E45DF7B0E764", "content.p_A20EF6EF9ED94E77A78360283B6F03EA", "content.p_4DBBD9E3925048C5875326756DB17525", "substep.substep_5DA4F22E8B574E3198708C3B51618F7F", "substep.substep_27563C8A4EDD4F4790F73E70622B62F5", "substep.substep_CDB550E1AC514132815EA77BDABA3D97", "substep.substep_4FABCCAA12E448B9BAE5434F138EEEEE", "content.p_EAE2454CCB4D4EB3A1824E124D195BA8", "substep.substep_9FFC7380842F477F92223A1D9881CBCA", "content.p_308E84ABC3EF459CB8075FBB72E37EDD" ] }, "step.step_056B71BAC01A4F6FAC231FF38D3064B3", "content.p_80CC5B16263A425BBEADA31F575DEEC4", { "substeps.substepsalpha_56CE61DFF7F54E21839F7D5537E079BA": [ "substep.substep_66EF95325F2046198E3E43CB45B257E7", "content.p_780544195F1E4CBD8EEBFDC6A9274335", "substep.substep_708466976CBA4F2F8153C6D71597CA2D" ] }, "step.step_D0882F075A95418B849C47C9CCF90BB7", { "content.note_1395123DDC764E93BA733E9558A0E9D9": [ "content.p_1395123DDC764E93BA733E9558A0E9D9" ] }, "content.p_79054D79D6114A5BA5F2ED9A76F0E740", "step.step_E97CA7E4155D43188B23B387A7BB1496", "content.p_49A18108F53D4C7DB1AC241D2D594172", "content.p_96F73068F07749D3AAA82EFE395531D4", { "content.note_D7F1A1DC8B964597BBFA628BBD3E7A9D": [ "content.p_D7F1A1DC8B964597BBFA628BBD3E7A9D" ] }, "content.p_3B159BB247D64B32AAC9D9FB264BB0A9", "content.p_EC675EE6C6B344A3A36881F4E77D6586" ] }, "content.p_A79E0BFB961C48038CCD1D95BB30D7A2" ] }, "task_00FF3930408A49258B812B2C788E496A-4.0-en.json": { "title": "title_45C00DB9A0334116B6D875A574E4562A", "title_45C00DB9A0334116B6D875A574E4562A": "Verify Linux scan node installation", "shortdesc": "shortdesc_9A611799677A47CB9296C0D1DD9B1E60", "shortdesc_9A611799677A47CB9296C0D1DD9B1E60": "After you have installed the Linux scan node, follow the steps listed here to make sure that it is installed and running successfully. ", "step.step_5CA4B276B40D4036B7609922058E6BD2": "In the WithSecure Elements portal, go to Security Configurations > Scans > Scan nodes and check that your new scan node is synchronized and has received engine updates.", "step.step_D92B9F7EA1DE44CB94B9D75F8DD66257": "On the scan node, check the logs under the /opt/f-secure/radar-scannodeagent/logs/ directory.", "content.p_5FC40AA69DE64B6CA7255923C92AFC07": "This directory contains the scanning engines, which are required to run scans. It should contain at least some files.", "step.step_A0F9D2DE8A0A48899FD81BE17919EB16": "Check that the /opt/f-secure/radar-scannodeagent/Engines/ directory is not empty.", "content.p_839D5F348A0E4C539BA515C64D00887E": "sudo systemctl status f-secure-radar-scannodeagent", "step.step_8DE15FACBEB34326A529C46D4F08F068": "Run the following command to verify that the Linux daemon (service) is in active state:", "content.p_273702931D1D4BA2B32A9643281E5664": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent get-config | more", "step.step_22CB81EB0F01491883FBC5834797697F": "Run the following commands to check the current settings:", "content.p_C140398BDBC94D77B37D31F84416B971": "sudo systemctl restart f-secure-radar-scannodeagent", "step.step_5DD49CBDB68945E0BC7BD69CA834F841": "If you applied the license file, but it has not been picked up by the scan node agent, run the following command to restart the service:", "desc": [ { "steps.steps_D5700DBBD5874C989ED1A05CFAC90CA1": [ "step.step_5CA4B276B40D4036B7609922058E6BD2", "step.step_D92B9F7EA1DE44CB94B9D75F8DD66257", "step.step_A0F9D2DE8A0A48899FD81BE17919EB16", "content.p_5FC40AA69DE64B6CA7255923C92AFC07", "step.step_8DE15FACBEB34326A529C46D4F08F068", "content.p_839D5F348A0E4C539BA515C64D00887E", "step.step_22CB81EB0F01491883FBC5834797697F", "content.p_273702931D1D4BA2B32A9643281E5664", "step.step_5DD49CBDB68945E0BC7BD69CA834F841", "content.p_C140398BDBC94D77B37D31F84416B971" ] } ] }, "concept_46077DBADDFD4F6590716F445AAA8FD3-4.0-en.json": { "title": "title_F95833FCD3124EA787643CA28565C5E6", "title_F95833FCD3124EA787643CA28565C5E6": "Linux scan node paths", "shortdesc": "shortdesc_D83E6CA5F30148F48D373985D712117D", "shortdesc_D83E6CA5F30148F48D373985D712117D": "The stored scan node data can provide useful information for troubleshooting and maintenance purposes. ", "content.p_29A2E8ABE0BC4B13BAB1B008E54D6ECE": "Linux scan nodes use the following paths to store their operation data:", "choice.choice_F5D5158B20F7494CBDBA175D8585D242": "/opt/f-secure/radar-scannodeagent/Scans/<scan_type>/<scan_id> contains files related to currently running scans", "choice.choice_5B8E960314F0409AA41B13E68402B616": "/opt/f-secure/radar-scannodeagent/Engines/ contains the scan engine binaries", "choice.choice_4CCB43C6087A4F0FB1D9734FCFF0C600": "/opt/f-secure/radar-scannodeagent/Updates/ contains temporary update files for scan engines", "choice.choice_44909E32BC494983B166BE6740454C35": "/opt/f-secure/radar-scannodeagent/logs/ contains the scan node's log files", "choice.choice_0B6198E9081B4A7A8652D9DE060F5F7F": "/opt/f-secure/radar-scannodeagent/scannode.db is used for storing configuration data and information on currently running scans", "desc": [ "content.p_29A2E8ABE0BC4B13BAB1B008E54D6ECE", { "choices.ul_8E599F38FA7E480AA618BA6DE3622DCF": [ "choice.choice_F5D5158B20F7494CBDBA175D8585D242", "choice.choice_5B8E960314F0409AA41B13E68402B616", "choice.choice_4CCB43C6087A4F0FB1D9734FCFF0C600", "choice.choice_44909E32BC494983B166BE6740454C35", "choice.choice_0B6198E9081B4A7A8652D9DE060F5F7F" ] } ] }, "task_EC1AA6BA87B549EEA34B3D370E149F9A-4.0-en.json": { "title": "title_C72257FE11004254973D71B8271C7983", "title_C72257FE11004254973D71B8271C7983": "Configuring Linux scan nodes", "shortdesc": "shortdesc_E4C1EF6AC4D84B468D9E06BF60EEE0E1", "shortdesc_E4C1EF6AC4D84B468D9E06BF60EEE0E1": "This topic lists useful commands for modifying the Linux scan node configuration. ", "content.p_1FDCA65BCE6945E2A927707EA987CD37": "cd /opt/f-secure/radar-scannodeagent", "step.step_5381D5DB81C24DC78F5138976E1CBE3E": "Run the following command to go to the Scan Node Agent installation directory:", "content.p_950BF67D149B45208BAA52C11154A981": "To get all settings:", "content.p_4D5EB2B03ECB462891CF29DE6D6CB9DB": "sudo ./ScanNodeAgent get-config", "content.p_DA973AE4B5404474AB3482D757EBED36": "To get a single setting, for example to check the entry that indicates whether or not the Scan Node Agent's private IP address is sent to the Elements Security Center:", "content.p_F03250AC673149F2A069D81A2212335D": "sudo ./ScanNodeAgent get-config HidePrivateIp", "content.p_2BE57BA1D77443B58E941A2D58CA292D": "To modify multiple settings using a file, for example custom_config:", "content.p_D82C9B91982C407CAF2B45B045C3C79A": "sudo ./ScanNodeAgent set-config <custom_config", "content.p_0FEDC20C617543A2B658A2644DFB8780": "Note: The custom_config file that you use must follow the same format as the output of the get-config command.", "content.p_D7D2221765964697A138941E6EC7D93B": "To modify a single setting, for example the maximum number of simultaneous system scans:", "content.p_1A9843EAF816437BBA7E6D93F953895A": "sudo ./ScanNodeAgent set-config SystemScan.MaxSimultaneousScans 12", "step.step_276086D73CA4441EACA82897742A28AA": "Use the following commands to edit the settings:", "desc": [ { "steps.steps_BB0203871657489C87DE112CC5EC66F8": [ "step.step_5381D5DB81C24DC78F5138976E1CBE3E", "content.p_1FDCA65BCE6945E2A927707EA987CD37", "step.step_276086D73CA4441EACA82897742A28AA", "content.p_950BF67D149B45208BAA52C11154A981", "content.p_4D5EB2B03ECB462891CF29DE6D6CB9DB", "content.p_DA973AE4B5404474AB3482D757EBED36", "content.p_F03250AC673149F2A069D81A2212335D", "content.p_2BE57BA1D77443B58E941A2D58CA292D", "content.p_D82C9B91982C407CAF2B45B045C3C79A", { "content.note_0FEDC20C617543A2B658A2644DFB8780": [ "content.p_0FEDC20C617543A2B658A2644DFB8780" ] }, "content.p_D7D2221765964697A138941E6EC7D93B", "content.p_1A9843EAF816437BBA7E6D93F953895A" ] } ] }, "task_FF0C947B25784E27AC97C16AEC212439-4.0-en.json": { "title": "title_089917950038418FAEDC5621E3D2DEBF", "title_089917950038418FAEDC5621E3D2DEBF": "Applying the scan node license manually", "shortdesc": "shortdesc_5EF433D306804EB1BC627914C01152CD", "shortdesc_5EF433D306804EB1BC627914C01152CD": "To apply a new .fsrl license file to an already installed WithSecure Elements VM Scan Node Agent, you need to copy the file to the installation directory. ", "content.p_90549E2CF5824D75A414986FEA2D1F8F": "cd /opt/f-secure/radar-scannodeagent && sudo ./ScanNodeAgent apply-license ./license.fsrl", "content.p_F931EA1591884954900BF190AA6ABF4B": "Note: To download the license file, follow the instructions in #business/radar/4.0/en/task_9346600FE057438F84A7CA8BAB2C1FFA-4.0-en.", "step.step_F1FD00AC6E6849BEBDD003A06F67B7D6": "Run the following commands to apply the new license file:", "content.p_A5A18C9E5C884949B7E9F643B7D779A2": "For example, for the system scan module, run the following commands:", "content.p_73F7212107A54E7096B85861379A957B": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent set-config SystemScan.License 85f95bbf-15cf-4d06-8347-e91a1eb539b8
sudo ./ScanNodeAgent set-config SystemScan.Enabled true
sudo ./ScanNodeAgent update-engines", "content.p_80B1961EF21C404A93BB044304F83169": "Note: If the installation directory (/opt/f-secure/radar-scannodeagent) already contains a .fsrl file, the data from that license file is applied when you restart the agent, overwriting the manual changes.", "content.p_8FC04E48349348478726C0BA8AAA4014": "Note: If the installation directory contains more than one .fsrl file, you can run the following command to check which one is in use: sudo ./ScanNodeAgent get-config LicenseFileName", "step.step_D7CBF2AB746645888365F8DE432F01FB": "To apply a known WithSecure Elements VM Scan Node Agent license ID for a particular scanning module, you can apply the license ID directly to the Scan Node Agent configuration.", "desc": [ { "steps.steps_9EA573B9DB5C493A81FF5FACC010E00C": [ "step.step_F1FD00AC6E6849BEBDD003A06F67B7D6", "content.p_90549E2CF5824D75A414986FEA2D1F8F", { "content.note_F931EA1591884954900BF190AA6ABF4B": [ "content.p_F931EA1591884954900BF190AA6ABF4B" ] }, "step.step_D7CBF2AB746645888365F8DE432F01FB", "content.p_A5A18C9E5C884949B7E9F643B7D779A2", "content.p_73F7212107A54E7096B85861379A957B", { "content.note_80B1961EF21C404A93BB044304F83169": [ "content.p_80B1961EF21C404A93BB044304F83169" ] }, { "content.note_8FC04E48349348478726C0BA8AAA4014": [ "content.p_8FC04E48349348478726C0BA8AAA4014" ] } ] } ] }, "task_3655E78C670D473FB3899E51211C1254-4.0-en.json": { "title": "title_1DD9135D08A54353B1C32DF2D010D795", "title_1DD9135D08A54353B1C32DF2D010D795": "Set up encryption keys for authenticated scanning", "shortdesc": "shortdesc_E98E83916CF343B6AF0306B1A391F11D", "shortdesc_E98E83916CF343B6AF0306B1A391F11D": "Both Windows and Linux authenticated scanning is supported on Linux scan nodes. ", "content.p_263722BD70D44E49B9525E27E595F100": "Windows authenticated scanning is supported using WinRM. Select the Specify credentials explicitly option when creating the system scan template.", "content.p_E20DDABF714A444782896ED890313D7B": "For Linux authenticated scanning, you need to once set up the encryption keys to transfer the credentials securely. For more information and instructions on how to do it, see Preparation steps.", "content.p_D1B6B5D0F2DF4FCE9926C7FE54FBD0B9": "Apart from adding the encryption keys allowing the secure credentials flow for Linux authenticated scanning, you can also manage the already existing keys:", "content.p_DBE6F17F41B54CBFB2737DF9DDACBB96": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent list-private-keys", "step.step_DBD22772DA994C2FBA47A8AFE267582B": "To list all encryption keys, run the following command:", "content.p_CD605E457105495EA3425F2E188100C0": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent remove-private-key NameOfTheKeyPair", "step.step_D147CA763AF848D4800E75F263AAB874": "To remove an existing key, run the following command:", "desc": [ "content.p_263722BD70D44E49B9525E27E595F100", "content.p_E20DDABF714A444782896ED890313D7B", "content.p_D1B6B5D0F2DF4FCE9926C7FE54FBD0B9", { "steps.steps_87EE854D298D4AC59B7B5A04DCBA8047": [ "step.step_DBD22772DA994C2FBA47A8AFE267582B", "content.p_DBE6F17F41B54CBFB2737DF9DDACBB96", "step.step_D147CA763AF848D4800E75F263AAB874", "content.p_CD605E457105495EA3425F2E188100C0" ] } ] }, "task_422FDF8D227C4A8EB2FF5CC756637470-4.0-en.json": { "title": "title_3F1462452260453791CD00037F0D2B5C", "title_3F1462452260453791CD00037F0D2B5C": "Configuring communication for privately hosted Elements Vulnerability Management", "shortdesc": "shortdesc_283960596F6E4CE2A748797250534282", "shortdesc_283960596F6E4CE2A748797250534282": "If you are using a privately hosted installation of the WithSecure Elements portal, you need to set its address in the scan node configuration. ", "content.p_4215C257EDB4462D9726B1B91955E79F": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent set-config SecurityCenterUri https://securitycenter.example.com:8080", "content.p_406312C38FA54B5398234B7545DFC0A0": "Note: If the installation directory (/opt/f-secure/radar-scannodeagent) already contains a .fsrl file that points to a different Elements Security Center address, the data from that license file may overwrite the manual changes.", "step.step_81EFED2913E04F548F2AB0B0FD1CDB32": "Run the following commands:", "desc": [ { "steps.steps_08743FB70B37423B8ADE6E54AC457BB0": [ "step.step_81EFED2913E04F548F2AB0B0FD1CDB32", "content.p_4215C257EDB4462D9726B1B91955E79F", { "content.note_406312C38FA54B5398234B7545DFC0A0": [ "content.p_406312C38FA54B5398234B7545DFC0A0" ] } ] } ] }, "task_F3A57DD6C8784F9FB7EA59A3B7FDF3DF-4.0-en.json": { "title": "title_C8DF464E29AA427BAD98F35506C57E2F", "title_C8DF464E29AA427BAD98F35506C57E2F": "Redirecting traffic to a proxy server", "shortdesc": "shortdesc_DF789D484A3542638FB4CC8642F6C92C", "shortdesc_DF789D484A3542638FB4CC8642F6C92C": "As WithSecure Elements VM Scan Node Agent sends requests to the Elements Security Center and Update Service, you need to configure the appropriate proxy address to redirect the traffic. ", "content.p_6F614AA836504261A40C6EEE7461677D": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent set-config SecurityCenterProxyUri http://proxy.example.com:8080
sudo ./ScanNodeAgent set-config UpdateServiceProxyUri http://proxy.example.com:8080", "content.p_BE1E4E2811C541BB876B0E05C91FDD43": "Note: If you used environment variables to set proxy settings (FSECURE_HTTP_PROXY_HOST and FSECURE_HTTP_PROXY_PORT) before installation, then these should be already applied automatically.", "step.step_6720CAA62CCD48D9A25AE24DC224AF19": "Run the following commands:", "content.p_F5ED67161B9C4F43A9AC8C964CD65BDD": "To reset the proxy setting, use the following commands to set the value to none: cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent set-config SecurityCenterProxyUri \"(none)\"
sudo ./ScanNodeAgent set-config UpdateServiceProxyUri \"(none)\"", "content.p_C86C9653A9A943D596B68ABC6FCC478B": "To use the system proxy settings instead of setting the proxy configuration explicitly, run the following commands: cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent set-config UseDefaultProxySettingsForSecurityCenter true
sudo ./ScanNodeAgent set-config UseDefaultProxySettingsForUpdateService true", "desc": [ { "steps.steps_3C99E2CEB1A74391B56421597E95D177": [ "step.step_6720CAA62CCD48D9A25AE24DC224AF19", "content.p_6F614AA836504261A40C6EEE7461677D", { "content.note_BE1E4E2811C541BB876B0E05C91FDD43": [ "content.p_BE1E4E2811C541BB876B0E05C91FDD43" ] } ] }, "content.p_F5ED67161B9C4F43A9AC8C964CD65BDD", "content.p_C86C9653A9A943D596B68ABC6FCC478B" ] }, "task_40B8E66B46D6425D807B01FC959C8474-4.0-en.json": { "title": "title_814E04E3FECF43499DE8A1F18A94A24D", "title_814E04E3FECF43499DE8A1F18A94A24D": "Disabling SSL certificate validation", "shortdesc": "shortdesc_B241527156F04CA1B7E9343FAFEBCB67", "shortdesc_B241527156F04CA1B7E9343FAFEBCB67": "If you use a proxy server or host your local Elements Security Center using a self-signed SSL certificate, you can disable certificate validation by setting the appropriate configuration keys. ", "content.p_662D327471D54F609EC0EECC8789490E": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent set-config SkipSecurityCenterSslCertificateCheck true
sudo ./ScanNodeAgent set-config SkipUpdateServiceSslCertificateCheck true", "content.p_AFD8732A8BA04113BE8B237A617CE9AC": "Important: WithSecure does not recommend disabling the SSL certificate validation check, especially for Radar Update Service communication.", "step.step_44E9EE8A938E4F57AEE62C3A71D8F564": "Run the following commands:", "desc": [ { "steps.steps_EAC0637EC69E4C66AB3FBCA12A4591F6": [ "step.step_44E9EE8A938E4F57AEE62C3A71D8F564", "content.p_662D327471D54F609EC0EECC8789490E", { "content.note_AFD8732A8BA04113BE8B237A617CE9AC": [ "content.p_AFD8732A8BA04113BE8B237A617CE9AC" ] } ] } ] }, "task_C1F229503FF44C0C9F2424184A1A6C56-4.0-en.json": { "title": "title_A1EBA5AA3C9844BD81EFFC313B8DF844", "title_A1EBA5AA3C9844BD81EFFC313B8DF844": "Installing a local CA certificate", "shortdesc": "shortdesc_82F0AEAAF7B148848AB68E01B6BA0F29", "shortdesc_82F0AEAAF7B148848AB68E01B6BA0F29": "For network vulnerability scans to correctly validate SSL/TLS certificates signed by a local certification authority (CA), you have to install the root certificate on the scan node server. System scans use the same certificate store as OpenSSL. ", "content.p_76A0B245713342839B87C484092C9C9D": "To install the rootCA.crt certificate file on Debian or Ubuntu distributions:", "content.p_FA9ADDE5CC3F4D4B83840203A96B135A": "sudo mkdir /usr/local/share/ca-certificates/extra", "step.step_A99A9ED7E143439785C6A15A2211F691": "Run the following command to create a directory for your own trusted CA certificates:", "content.p_7122479AC5934A53A35FCB62A26AF613": "sudo cp rootCA.crt /usr/local/share/ca-certificates/extra/", "content.p_081D20B1C9064F328A5334341FB0310D": "Make sure that the certificate has the .crt extension.", "step.step_FDFD16E446DE4FD7B741918DBE5C326C": "Copy the root certificate to the new directory:", "content.p_18E7DB07A2EF4D658FC2D1221878BAAD": "sudo update-ca-certificates", "step.step_48A609B90E094FE8B6AE6EE01DEB121B": "Run the following command to update the system certificates:", "desc": [ "content.p_76A0B245713342839B87C484092C9C9D", { "steps.steps_3CA1491CC5D9455D89779EB124ABFF2F": [ "step.step_A99A9ED7E143439785C6A15A2211F691", "content.p_FA9ADDE5CC3F4D4B83840203A96B135A", "step.step_FDFD16E446DE4FD7B741918DBE5C326C", "content.p_7122479AC5934A53A35FCB62A26AF613", "content.p_081D20B1C9064F328A5334341FB0310D", "step.step_48A609B90E094FE8B6AE6EE01DEB121B", "content.p_18E7DB07A2EF4D658FC2D1221878BAAD" ] } ] }, "task_B98C152AE41B49849B4A28CDEC1AA8A9-4.0-en.json": { "title": "title_4D3DE367B3974AE1A4A65198C3B46630", "title_4D3DE367B3974AE1A4A65198C3B46630": "Limiting the maximum number of simultaneous scans", "shortdesc": "shortdesc_03479E16CC6B498AA60AB4E03ED99F19", "shortdesc_03479E16CC6B498AA60AB4E03ED99F19": "If the default limits for simultaneous scans cause performance issues, you can customize the limits. ", "content.p_71F6578C1CA544058B1F32E362923973": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent set-config DiscoveryScan.MaxSimultaneousScans 3
sudo ./ScanNodeAgent set-config SystemScan.MaxSimultaneousScans 10
sudo ./ScanNodeAgent set-config WebScan.MaxSimultaneousScans 3", "step.step_25A98EA2DAD84225BC77EC16E163789B": "Run the following commands to change the default limits:", "desc": [ { "steps.steps_AB75D98442D54BD5802584BD854509E5": [ "step.step_25A98EA2DAD84225BC77EC16E163789B", "content.p_71F6578C1CA544058B1F32E362923973" ] } ] }, "task_60CF01CC7AFC4AD79AB1788923A682DB-4.0-en.json": { "title": "title_461E9F19DDF64824B4BE7C386B5B1582", "title_461E9F19DDF64824B4BE7C386B5B1582": "Updating scan engines manually", "shortdesc": "shortdesc_D562722D35F74F75998A14B564CAA4F1", "shortdesc_D562722D35F74F75998A14B564CAA4F1": "By default, the scan node agent checks for engine updates automatically every 4 hours, but you can also check for updates and install them manually. ", "content.p_B2CF6AA5E0384326B47714A8667443A3": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent update-engines", "step.step_36AC32349E8748A389F41BA8201CC55A": "Run the following commands to manually update the scan engines:", "desc": [ { "steps.steps_EF7C3F16833343F295CC80EB7B3DF167": [ "step.step_36AC32349E8748A389F41BA8201CC55A", "content.p_B2CF6AA5E0384326B47714A8667443A3" ] } ] }, "task_4E1AFA5375BF4378862BDC23AAEFDC78-4.0-en.json": { "title": "title_F316F71D572C45E78E505EABC35366F1", "title_F316F71D572C45E78E505EABC35366F1": "Resetting scan engines", "shortdesc": "shortdesc_A87116AEC9CF4C479DAE7E64FA75CC10", "shortdesc_A87116AEC9CF4C479DAE7E64FA75CC10": "If there are any issues with the scan engine directory integrity, you can reset the engines to download fresh instances. ", "content.p_E93C99FBE5064814AEBB7A3CC528F814": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent reset-engines", "content.p_F04148C759554226BDFE84D7218673F9": "To reset a specific scan engine, you can use the engine type as an argument:", "content.p_77E0E7DB1F01420D92C021D5D8094EB4": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent reset-engines DiscoveryScan
sudo ./ScanNodeAgent reset-engines SystemScan
sudo ./ScanNodeAgent reset-engines WebScan", "content.p_2F33E4BC84714B2980D23B0215144712": "Note: It might take a few minutes to reset the scan engines. We do not recommend using this operation to update the engines - use the sudo ./ScanNodeAgent update-engines command instead.", "step.step_49857FC5807D40B5AA57573923CC14F1": "Run the following commands to reset the scan engines:", "desc": [ { "steps.steps_19CF49C3BBC04C2A887BF39564966412": [ "step.step_49857FC5807D40B5AA57573923CC14F1", "content.p_E93C99FBE5064814AEBB7A3CC528F814", "content.p_F04148C759554226BDFE84D7218673F9", "content.p_77E0E7DB1F01420D92C021D5D8094EB4", { "content.note_2F33E4BC84714B2980D23B0215144712": [ "content.p_2F33E4BC84714B2980D23B0215144712" ] } ] } ] }, "task_06098B970DE946A3AF6B0D01C4DB33D6-4.0-en.json": { "title": "title_F73590CF661C47FBB29ED5D0F75B55C3", "title_F73590CF661C47FBB29ED5D0F75B55C3": "Uninstalling scan nodes", "shortdesc": "shortdesc_117A59593ADA48CC8E0DE460A3543951", "shortdesc_117A59593ADA48CC8E0DE460A3543951": "Follow these steps to uninstall a scan node from your Linux system. ", "content.p_AA423C754B694E1D9485CEFA34FACC90": "sudo apt remove --purge f-secure-radar-scannodeagent-installer", "step.step_6143FFA0465744169A28D02F487F1F95": "Run the following command to uninstall a scan node:", "desc": [ { "steps.steps_801CBB5362F540259B72AFF374EE499D": [ "step.step_6143FFA0465744169A28D02F487F1F95", "content.p_AA423C754B694E1D9485CEFA34FACC90" ] } ] }, "task_24CA2B7A08CE4D2FACE248941EC94CF3-4.0-en.json": { "title": "title_A0B999AC63C2406BBD3C8DBE3BDD1446", "title_A0B999AC63C2406BBD3C8DBE3BDD1446": "Installing WithSecure Elements Agent with VM capabilities", "shortdesc": "shortdesc_E2742D66DB6641E29871667B5C2EA9C7", "shortdesc_E2742D66DB6641E29871667B5C2EA9C7": "You can download the installation package for WithSecure Elements Agent with VM capabilities from the WithSecure Elements portal and install it on Windows devices in your network. ", "content.p_4FC3A16DF067461EB9D5D2D2CEBB4AD8": "WithSecure Elements Agent with VM capabilities requirements", "content.p_6F34E4D107A6451BB8FD7F135C01B6BD": "WithSecure Elements Agent with VM capabilities supports the following operating system versions:", "choice.choice_C2A8459A2AB949A48480735F80E7A59E": "Microsoft Windows 10 (all 32-bit and 64-bit editions), ARM-based tablets are not supported", "choice.choice_D158643BFFC54E4880D1F3E0983DD423": "Microsoft Windows 8.1 (all 32-bit and 64-bit editions), ARM-based tablets are not supported", "choice.choice_5E05706FFFF94983AE0548311A90A1CB": "Microsoft Windows 7 Service Pack 1 (all 32-bit and 64-bit editions)", "content.p_E2A0340D8F374ED4ABDAA0BC24EB690A": "You can find the list of supported Windows server versions here.", "content.p_CA99DDCA07CA4218B7A6027E5060C729": "System requirements", "choice.choice_029E78287B3E497AA13CA00E432799D5": "Processor: Intel Pentium 4 2GHz or higher (processor must support SSE2).", "choice.choice_D211C9C1610548A19780C0540E426520": "Memory: 1 GB on 32-bit systems / 2 GB or more on 64-bit systems.", "choice.choice_9FEA3869BA464A21A908C15F10410A32": "Disk space: 2 GB free disk space.", "choice.choice_07277339BCB4488F8A06C604D218CCE3": "Display with a resolution of 1024 x 768 or higher.", "choice.choice_BF83E9B47CA641C98969BE16ECD3AAD0": "Internet Connection: An Internet connection is required to confirm your subscription, receive product updates, and use the cloud-based detection.", "choice.choice_2DE4657FC68442D694BA7FE6F22A7B27": "Javascript must be turned on in the browser settings to use active block pages.", "content.p_D7E1E57F6EAB45B4BDB77ADCD2D4B3B2": "", "content.p_806C3100A7CB4921B7423D378A46323F": "Supported browsers", "choice.choice_E27BB983BC834D2AB5372D63633CE083": "Edge (Windows 10). Does not support extensions.", "choice.choice_63D3DAAFC73C48758D21102F83765C6A": "Internet Explorer 11 (Windows 8.1).", "choice.choice_3A052A3054124AE19F08C40125AD7C57": "Internet Explorer 10 & 11 (Windows 7).", "choice.choice_5CB5F8043EE34C8993D423B8E0A9146E": "Chrome, two latest major versions.", "choice.choice_19143860C5844058B4CE9F847183CB3E": "Firefox, two latest major versions.", "content.p_B1666881A1D54E32A81AFB5ABE770E5B": "", "content.p_0369FCFE9AB34847969D5C83229BD2E4": "", "content.p_47582868332B422EB14B86BFE0B97A0D": "Note: WithSecure Elements Agent scanning is only available if you are using Elements Vulnerability Management as an WithSecure cloud service.", "content.p_D57E89E2313945DBAAEAAF009E3F4827": "If you are using Elements Endpoint Protection or Elements Detection and Response on Windows devices in your network and want to run vulnerability scans on those devices, you do not need to install WithSecure Elements Agent with VM capabilities on them. In such cases, you can go directly to Environment > Devices > Device Discovery and select those devices for vulnerability scanning.", "content.p_09F95EBCD40040E1922542DB5484E2DC": "This means that in connection with Elements Endpoint Protection or Elements Detection and Response, you only need to install the standalone WithSecure Elements Agent with VM capabilities on devices that are not using the Windows client for the other services, which gives you more flexibility for subscription usage. You can check the status of your subscription on Management > Vulnerability settings > General settings > Subscription details under .", "content.p_723A8594DFC9402282636E3C64E9137C": "", "content.p_514E3B49EB4C4154B63F973A12F8712B": "Note: Elements Vulnerability Management supports Elements Endpoint Protection and Elements Detection and Response endpoint applications when your company account (tenant ID and name) is exactly the same for each service.", "content.p_7419C1E60BCF49F8A933CDB3F87F88AC": "To install the standalone WithSecure Elements Agent with VM capabilities (without Elements Vulnerability Management or Elements Detection and Response):", "step.step_AA13D65ECBDC41829ECF870F9D12726A": "In the WithSecure Elements portal, go to Environment > Devices > Device Discovery and click Download installer.", "content.p_65AF68F27D604B349B63E70CA3A15F62": "Note: The downloaded exe file includes the subscription key.", "content.p_DFBD9AC4BA5C4C47AE80F1BC9263780E": "The installation file is downloaded.", "step.step_5613C19B83C14EF587B0AC27DED86D51": "Click Download under WithSecure Elements Agent.", "content.p_4A2CFFCCC3CC470DA9E4B7AE536D1526": "To use command-line parameters, start the installation with the following command: installer_AB12-CD34-EF56-GH78_.exe", "content.p_27B3CB41839C4F08AE5AAE4284B35310": "Note: To perform a silent installation (if there is no sidegrade), add the following to the installer file name: --silent. For example, installer_AB12-CD34-EF56-GH78_.exe --silent. To do this, you must have the subscription key added to the installer file name. To install Elements Vulnerability Management as a standalone application to use purely for vulnerability scans and without removing any existing antimalware applications on the device, add the --skip-sidegrade \"*\" parameter to the installation command. For example, installer_AB12-CD34-EF56-GH78_.exe --skip-sidegrade \"*\".", "step.step_6946009274204FF0835C2F35F366CFC3": "Locate the downloaded installation file and double-click it to start the installation.", "step.step_909D68E0416746019C8451AEBCEEC131": "Select the language and restart options that you want to use for installation, and select Next.", "step.step_90D270C3D4374C42A42EC059E2191E99": "Read the license agreement. To accept the agreement and continue, click Accept.", "step.step_8E20258FF52C46FC8B857076DD6E78DA": "On the Subscription key screen, enter your subscription key that you can copy from under Management > Vulnerability settings > General settings > Subscription details in the WithSecure Elements portal, and select Next.", "step.step_5EA473995F304499B456EB508C1CD0CF": "Follow the instructions on the screen.", "desc": [ "content.p_4FC3A16DF067461EB9D5D2D2CEBB4AD8", "content.p_6F34E4D107A6451BB8FD7F135C01B6BD", { "choices.ul_8109049D58314B98BBDB6F1DC02F01B1": [ "choice.choice_C2A8459A2AB949A48480735F80E7A59E", "choice.choice_D158643BFFC54E4880D1F3E0983DD423", "choice.choice_5E05706FFFF94983AE0548311A90A1CB" ] }, "content.p_E2A0340D8F374ED4ABDAA0BC24EB690A", "content.p_CA99DDCA07CA4218B7A6027E5060C729", { "choices.ul_41A393339EB54BC4A10121B094EA7081": [ "choice.choice_029E78287B3E497AA13CA00E432799D5", "choice.choice_D211C9C1610548A19780C0540E426520", "choice.choice_9FEA3869BA464A21A908C15F10410A32", "choice.choice_07277339BCB4488F8A06C604D218CCE3", "choice.choice_BF83E9B47CA641C98969BE16ECD3AAD0", "choice.choice_2DE4657FC68442D694BA7FE6F22A7B27" ] }, "content.p_806C3100A7CB4921B7423D378A46323F", { "choices.ul_C0D43A9EB1214BB7A63C722F56F7AEF7": [ "choice.choice_E27BB983BC834D2AB5372D63633CE083", "choice.choice_63D3DAAFC73C48758D21102F83765C6A", "choice.choice_3A052A3054124AE19F08C40125AD7C57", "choice.choice_5CB5F8043EE34C8993D423B8E0A9146E", "choice.choice_19143860C5844058B4CE9F847183CB3E" ] }, { "content.note_47582868332B422EB14B86BFE0B97A0D": [ "content.p_47582868332B422EB14B86BFE0B97A0D" ] }, "content.p_D57E89E2313945DBAAEAAF009E3F4827", "content.p_09F95EBCD40040E1922542DB5484E2DC", { "content.note_514E3B49EB4C4154B63F973A12F8712B": [ "content.p_514E3B49EB4C4154B63F973A12F8712B" ] }, "content.p_7419C1E60BCF49F8A933CDB3F87F88AC", { "steps.steps_7A69183ECAA2490BABD81B0F86EBA664": [ "step.step_AA13D65ECBDC41829ECF870F9D12726A", "step.step_5613C19B83C14EF587B0AC27DED86D51", { "content.note_65AF68F27D604B349B63E70CA3A15F62": [ "content.p_65AF68F27D604B349B63E70CA3A15F62" ] }, "content.p_DFBD9AC4BA5C4C47AE80F1BC9263780E", "step.step_6946009274204FF0835C2F35F366CFC3", "content.p_4A2CFFCCC3CC470DA9E4B7AE536D1526", { "content.note_27B3CB41839C4F08AE5AAE4284B35310": [ "content.p_27B3CB41839C4F08AE5AAE4284B35310" ] }, "step.step_909D68E0416746019C8451AEBCEEC131", "step.step_90D270C3D4374C42A42EC059E2191E99", "step.step_8E20258FF52C46FC8B857076DD6E78DA", "step.step_5EA473995F304499B456EB508C1CD0CF" ] } ], "related": [ "task_11226CDD36C941E5B09F6AE63ABE9284-4.0-en" ] }, "concept_0A6A4E352A814CC894A71AFED65C9CF3-4.0-en.json": { "title": "title_1C45053FD7A3443FB4527ADBF765708B", "title_1C45053FD7A3443FB4527ADBF765708B": "Command-line parameters", "shortdesc": "shortdesc_1D9BF393AD8E40B784F38B212B78B55A", "shortdesc_1D9BF393AD8E40B784F38B212B78B55A": "When installing the product using an .exe file, you can use the command-line parameters listed here. ", "content.p_6752F18CCA5F435292D5FFB3AAF32E57": "", "cell.entry_2DE9B5D44560470FAE6AA510A1A1E1CE": "EXE parameter", "cell.entry_8E5E98C0C8DF4697A6A04C16DE482E83": "MSI property", "cell.entry_28F5AB32DF904DBDB6830F8BD96744BA": "Explanation", "cell.entry_C5C201BFDDD445B6B45F19B34EE44F74": "--language <id>
-l <id>", "cell.entry_09607924DBE14B8BA45877BB869CFF6C": "LANGUAGE", "cell.entry_D63A7626843B42F8ABDF7C05B4A83AF6": "Selects the language used in the installation. The parameter \"ID\" must be a valid language identifier in IETF-format. If \"id\" is not specified, the installer shows the language selection dialog. The ID value can be one of the following: en, bg, cs, da, de, el, en, es-MX, es, et, fi, fr-CA, fr, hu, it, ja, ko, lt, nl, no, pl, pt-BR, pt, ro, ru, sl, sv, tr, vi, zh-HK, zh-TW, zh.", "cell.entry_C14877DEFB9F4793AABE1FF78F8BD94B": "--silent -s", "cell.entry_C75617065F374FC990816038FD01A219": "", "cell.entry_76DB93FA247C4F4BB59431BF2660AD3C": "Sets the silent installation flow. There are no dialogs for the user. EULT is assumed to be accepted. If there is an embedded keycode, it is automatically used by the software when it is installed. Otherwise, the software is left without a keycode (that is, in an expired initial state). If the installation requires restarting the computer, no dialog is shown about it, but the executable return code is 99 and it will automatically continue after the restart.", "cell.entry_DEFD1AE8B3834B37A58BD8BA653A2530": "--voucher <subscription key>", "cell.entry_72212021B18044D2A2402990AD70499B": "VOUCHER", "cell.entry_1ADC5F18142E4A8BBCAC67C6BD8A20F3": "Sets the subscription key. The subscription key is handled as if it was embedded in the installer filename. If a subscription key exists in the filename and is also added to the command-line, the command-line overrides the filename subscription key.", "cell.entry_8EDEC2A4D6C24333AD3E441C0DF82375": "--proxy", "cell.entry_9EF7E18055364323A039292212FECFCF": "", "cell.entry_6328AF27C3E14BDA9A9A30A62E91B2DD": "Overrides the proxy to use for downloads. Example: --proxy http://proxy.gtn:3128", "cell.entry_4903B512C3E7490ABA9FFC779A1D2B50": "--skip-sidegrade <skip options>", "cell.entry_F44F7370CA394EF2A6942D78D9135DC5": "SIDEGRADE_SKIPLIST", "choice.choice_8DB315940C42422689C751A45DB39FE7": "--skip-sidegrade \"Sophos Cloud Endpoint| HitmanPro. Alert\"", "choice.choice_87300B4359A441F3B353E44F1D52C441": "--skip-sidegrade \"HitmanPro. Alert| SG16|SG1\"", "choice.choice_04664906089442ADB7EE3808477E4291": "--skip-sidegrade \"*\" - do not sidegrade anything (including WithSecure products)", "choice.choice_A80F9B1140F940B6AE8695A3138C38C9": "--skip-sidegrade \"[skip-reboot]*\" - all conflicts are removed and restart is not required", "choice.choice_44CDC7E783E248B0A732A9286A20E293": "--skip-sidegrade \"[skip-reboot]Sophos Cloud Endpoint| SG1\" - Sophos Cloud Endpoint is uninstalled without a restart and SG1 is not detected as a conflict", "cell.entry_965A8159905B44E99BA757DADEC851D3": "Allows you to specify a list of competitor products that should not be sidegraded during the installation. \"*\" skips all sidegrades.
You can also add [skip-reboot] before a conflict name to indicate that this sidegrade must not require restart (but will be sidegraded). Separate the values (sidegrade ID's or names) by \"|\":", "cell.entry_32847B723EF84A4D8CBEFD3DDC1B4E4E": "--installation-tags <tags>", "cell.entry_FC0DD7906AF145AD9A3ECDDC66B8E7C7": "INSTALLATION_TAGS", "cell.entry_9F21F39E3853441CA78AA3AED1B18A3B": "Installation tags to be reported to a back-end portal (Elements Endpoint Protection, Elements Detection and Response, Elements Vulnerability Management), for example: --installation-tags \"ElementsEndpointProtection=tag1:tag2:tag3,ElementsVulnerabilityManagement=tag4:tag5:tag6,department=accounting,role=secretary\"", "cell.entry_8669CE9BBD804ABF9A2E3FA51054A630": "--use_smbios_guid", "cell.entry_A739B909980B442BA37885196E048E75": "UNIQUE_SIGNUP_ID", "cell.entry_BDFB43E4BCB043CD8224972B03819BA2": "For Citrix support in Elements Endpoint Protection. Use SMBIOS GUID as the unique identifier of this machine. When the same machine (with the same smbios guid) does installation or registration again with same subscription key, instead of creating a new device on the portal, it will connect to the same device on the portal.", "desc": [ { "table.table_5985BEBA54E5461B9DF76E745192B044": [ { "thead.thead_600E8825C5C04594A7B2350D02D27A4A": [ "cell.entry_2DE9B5D44560470FAE6AA510A1A1E1CE", "cell.entry_8E5E98C0C8DF4697A6A04C16DE482E83", "cell.entry_28F5AB32DF904DBDB6830F8BD96744BA" ] }, { "row.row_71B303E56BD94B89897EF414F98473E7": [ "cell.entry_C5C201BFDDD445B6B45F19B34EE44F74", "cell.entry_09607924DBE14B8BA45877BB869CFF6C", "cell.entry_D63A7626843B42F8ABDF7C05B4A83AF6" ] }, { "row.row_191982BD3FC74EEB88AAD05F14DE3141": [ "cell.entry_C14877DEFB9F4793AABE1FF78F8BD94B", "cell.entry_C75617065F374FC990816038FD01A219", "cell.entry_76DB93FA247C4F4BB59431BF2660AD3C" ] }, { "row.row_6836DE264FE44F96AD9D4A8D6DA7EFAA": [ "cell.entry_DEFD1AE8B3834B37A58BD8BA653A2530", "cell.entry_72212021B18044D2A2402990AD70499B", "cell.entry_1ADC5F18142E4A8BBCAC67C6BD8A20F3" ] }, { "row.row_92A5AF17AB6A438291BBB738AAB66081": [ "cell.entry_8EDEC2A4D6C24333AD3E441C0DF82375", "cell.entry_9EF7E18055364323A039292212FECFCF", "cell.entry_6328AF27C3E14BDA9A9A30A62E91B2DD" ] }, { "row.row_ACE6CC17F9F045108A3C4936C05CA6F2": [ "cell.entry_4903B512C3E7490ABA9FFC779A1D2B50", "cell.entry_F44F7370CA394EF2A6942D78D9135DC5", "cell.entry_965A8159905B44E99BA757DADEC851D3", { "choices.ul_9F9916211A864047B151AF597840AF62": [ "choice.choice_8DB315940C42422689C751A45DB39FE7", "choice.choice_87300B4359A441F3B353E44F1D52C441", "choice.choice_04664906089442ADB7EE3808477E4291", "choice.choice_A80F9B1140F940B6AE8695A3138C38C9", "choice.choice_44CDC7E783E248B0A732A9286A20E293" ] } ] }, { "row.row_086C5B9187FE45C5A73C89FED9EE96E4": [ "cell.entry_32847B723EF84A4D8CBEFD3DDC1B4E4E", "cell.entry_FC0DD7906AF145AD9A3ECDDC66B8E7C7", "cell.entry_9F21F39E3853441CA78AA3AED1B18A3B" ] }, { "row.row_D6CED4B9F1DD4EF5BCCB8E25129F60EF": [ "cell.entry_8669CE9BBD804ABF9A2E3FA51054A630", "cell.entry_A739B909980B442BA37885196E048E75", "cell.entry_BDFB43E4BCB043CD8224972B03819BA2" ] } ] } ] }, "concept_A78B6C2F48B6485293F6BAEED93F22A0-4.0-en.json": { "title": "title_AD009261CAD348E8BF62CB0C4BE8E2C6", "title_AD009261CAD348E8BF62CB0C4BE8E2C6": "Scanning", "shortdesc": "shortdesc_5687B589F289437BB4909ECC67B28F98", "shortdesc_5687B589F289437BB4909ECC67B28F98": "This section gives you instructions and information on using Elements Vulnerability Management to scan your network. ", "content.title_78FF5130FA7B4A82936247C7FA6D9915": "The scanning process", "content.p_4FE61D79638A4C7798AA20570FCC2FBD": "First, the discovery scan maps out the available network using automatic device discovery for a complete overview of 'live' hosts, ports and services available for further scanning. This phase gives you a simple and quick overview of which components to include.", "content.p_2186D6F8A1E949E3A64DF06DDE4114A3": "Subsequently, all selected hosts, ports and services are scanned for vulnerabilities with the system scan and web scan, before presenting the data in the WithSecure Elements portal. The reporting tool will take you from complete overview to extreme technical detail, giving you all the information you need for the remediation phase, where you assign and manage your security issues.", "content.p_BBDC6B5C307C4D19865F647EC5DAEB28": "Verification scans control that issues have been handled – and everything works with simple, intuitive point-and-click control and full benchmarking history.", "content.title_650BF92169EB47AFB4623D16F7A40689": "Detailed descriptions", "content.p_B3A4320678434284898E2D6728B66126": "Usually the first step in the process of conducting a security audit is to identify the assets to scan for vulnerabilities. Discovery scan provides an easy way to map the devices and services in the target network.", "content.p_FB8E6B765FD144E2B402659A8DF6EA1B": "In WithSecure Elements Vulnerability Management, all system scan and web scan targets are stored in logical containers called scan groups. The scan groups serve multiple purposes:", "choice.choice_5931D10C189A4B2AB5A9A7DA00B8325C": "Organize your assets. For example, you can organize your assets based on your network ranges, physical locations, or by system owners.", "choice.choice_DDF21DECAE9D49E7BD7C01602A2ADD5F": "Apply scan templates to assets within the scan group.", "choice.choice_6FE56D8F017B4B28992FA2F501D2A3CC": "Apply scheduling to assets within the scan group.", "choice.choice_F6C9109F9AA7454698ED2E0813B0E8F8": "Select scan nodes used to perform the network vulnerability scans.", "choice.choice_C171E1435DCF4D518F0F91133DD35F46": "Control email notifications for the entire scan group.", "desc": [ "content.title_78FF5130FA7B4A82936247C7FA6D9915", "content.p_4FE61D79638A4C7798AA20570FCC2FBD", "content.p_2186D6F8A1E949E3A64DF06DDE4114A3", "content.p_BBDC6B5C307C4D19865F647EC5DAEB28", "content.title_650BF92169EB47AFB4623D16F7A40689", "content.p_B3A4320678434284898E2D6728B66126", "content.p_FB8E6B765FD144E2B402659A8DF6EA1B", { "choices.ul_B4CB31D7056F4A2A88DD014D2A6FBF93": [ "choice.choice_5931D10C189A4B2AB5A9A7DA00B8325C", "choice.choice_DDF21DECAE9D49E7BD7C01602A2ADD5F", "choice.choice_6FE56D8F017B4B28992FA2F501D2A3CC", "choice.choice_F6C9109F9AA7454698ED2E0813B0E8F8", "choice.choice_C171E1435DCF4D518F0F91133DD35F46" ] } ] }, "concept_D97E26BCE08F41E2A5E1E58338765AA5-4.0-en.json": { "title": "title_8D3959C59F674A19B0A8E34F13134C66", "title_8D3959C59F674A19B0A8E34F13134C66": "Discovery scan", "shortdesc": "shortdesc_CE6D2FB10CF047F3A322F7D9CA604D13", "shortdesc_CE6D2FB10CF047F3A322F7D9CA604D13": "Discovery scans help you to identify all systems and their exposed ports (services) within your network. ", "related": [ "concept_8A8EE953B33045A6803988051D512055-4.0-en" ] }, "task_4CDEE4FBD9AA4C63AB979B98F2DEE834-4.0-en.json": { "title": "title_4110AC6D938A49C7B4344C759F9E1E5E", "title_4110AC6D938A49C7B4344C759F9E1E5E": "Adding a discovery scan", "shortdesc": "shortdesc_7CBCB27C5D62439BAF93D55BCE15CDB7", "shortdesc_7CBCB27C5D62439BAF93D55BCE15CDB7": "You can add a new discovery scan on the Security Configurations > Scans > Discovery scans page. ", "content.p_68385070C38B402AAB32E7E93854F32D": "To add a new discovery scan:", "step.step_5CE318D2A9A64660B8C66645DD78712D": "Click the menu button.", "step.step_B569ADD18F3F456BBD9F9A2848A92195": "Select Add discovery scan.", "subchoice.choice_78410D2EB7AF431DA9AE6C847E3FA6C1": "Host discovery identifies if hosts are online or offline. The scan procedures include ARP resolution (in local segments), ICMP PING, and a limited scan for default SSH, HTTP, and HTTPS ports, as well as for Remote Desktop services.", "subchoice.choice_98DF06E65E4A4DB48BE37F4F3F1B1BEE": "Port scan finds the open ports on the hosts and reports the services (for example, database and web services) that are running on each one.", "step.step_73B6B9DDA981429FBC1C86FF6DBF205D": "Select either the Host discovery or Port scan mode.", "subchoice.choice_4048DA8D8BC641CCA6BB4F569318EA53": "Enter a name for each IP range that you enter. Click Add to add more IP ranges to the same scan.", "subchoice.choice_3059ECF8D43B401094F5116C5963A5CA": "You can exclude an IP range within the included range by adding it to the Excluded IP ranges field.", "content.p_28610AF86342463A9C793AA2D0D320CC": "", "content.p_9C70407876DA4C87A6B3A006FB4B20BE": "For example: 192.168.1.0/24", "step.step_4EA6BB46671441E0A72C6212EE3D3CCA": "Enter the IP ranges to include in the scan or select Upload targets from file to upload targets in CSV format.", "step.step_1292BC2F277C44BEB3DCCE914F70B3B9": "Select the Scan node to use for the scan.", "step.step_CE8C018FEEFD49F2B63091656CEB4046": "Click Next.", "step.step_4C0BC03BCA0F4FD8A7A4CDDA71A55D40": "Select the template to use for the scan.", "step.step_474239CBABF249D680215DF4EDA112EA": "Define the scan scheduling if you want the scan to run automatically, for example once a month.", "step.step_D500129442344EE0A1625C079B5FF8E4": "Configure the email notifications if you want to receive alerts on certain events.", "step.step_00CAED2D554F4F05A71EC286F41BD0E4": "Click Finish.", "desc": [ "content.p_68385070C38B402AAB32E7E93854F32D", { "steps.steps_C632A6242E904EAFBD6126E7D822A2E5": [ "step.step_5CE318D2A9A64660B8C66645DD78712D", "step.step_B569ADD18F3F456BBD9F9A2848A92195", "step.step_73B6B9DDA981429FBC1C86FF6DBF205D", { "subchoices.choices_23D5DCF5FB9846629764CC90EAD1A7AF": [ "subchoice.choice_78410D2EB7AF431DA9AE6C847E3FA6C1", "subchoice.choice_98DF06E65E4A4DB48BE37F4F3F1B1BEE" ] }, "step.step_4EA6BB46671441E0A72C6212EE3D3CCA", "content.p_28610AF86342463A9C793AA2D0D320CC", { "subchoices.ul_AC20AA6E37C4459B8B2F6449826ADF31": [ "subchoice.choice_4048DA8D8BC641CCA6BB4F569318EA53", "subchoice.choice_3059ECF8D43B401094F5116C5963A5CA" ] }, "content.p_9C70407876DA4C87A6B3A006FB4B20BE", "step.step_1292BC2F277C44BEB3DCCE914F70B3B9", "step.step_CE8C018FEEFD49F2B63091656CEB4046", "step.step_4C0BC03BCA0F4FD8A7A4CDDA71A55D40", "step.step_474239CBABF249D680215DF4EDA112EA", "step.step_D500129442344EE0A1625C079B5FF8E4", "step.step_00CAED2D554F4F05A71EC286F41BD0E4" ] } ] }, "task_65FC3338189F4A21A14F499E3B3247DA-4.0-en.json": { "title": "title_27C6E9E49A634E22941AC2123325946C", "title_27C6E9E49A634E22941AC2123325946C": "Configuring discovery scan templates", "shortdesc": "shortdesc_B73EAAD18B3D4CBEACDE5AC2C35692A7", "shortdesc_B73EAAD18B3D4CBEACDE5AC2C35692A7": "Scan templates give you an easy way to store a set of options that you want to use across several discovery scans. ", "step.step_A594B5DEE6734715A84600E216EBAF69": "Go to the Security Configurations > Scan Templates tab.", "step.step_22814A13A5294D538BD0F09B17C6FE53": "On the Discovery scan templates tab, click Add discovery scan template or click the menu button in the Actions column and select Edit to edit an existing template.", "step.step_016D3F5C0A714F88B93D8CD161AECAC6": "Enter a name and a description for the template.", "step.step_C7DEF851755847C59768F001C6B204A7": "Click Next.", "subchoice.choice_43837AF39E5D41F4B604C13C84849DE9": "Host discovery mode is extremely fast at identifying hosts on a network. It is mainly used on internal networks where all hosts reply to an ICMP ping. The host discovery mode is fast because its only purpose is to identify hosts on the network. It does not care about how many open ports a given system has.", "subchoice.choice_E8624C8BCFFA4AB194A5343232EDE09E": "Port scan mode will attempt to detect hosts on a network and their open ports within the specified port range. Port scan is mainly used to identify hosts and services on Internet-facing systems.", "subsubchoice.choice_6129B263E8A64DA38D99D601B0BA26AF": "Top 100 scans each IP for the 100 most common open ports.", "subsubchoice.choice_81BC8EF75B364A36BC1F97E2C6921811": "Top 1000 scans each IP for the 1000 most common open ports.", "subsubchoice.choice_47F75B4EF29A49898A2AC0129B9890BE": "Full range scans the full TCP and UDP range from 0 to 65535.", "subsubchoice.choice_4EF62DB86FD94CAB80BB6ED4CBF6AD04": "Custom allows you to select your own range. For example, TCP 0 - 10000 and UDP 0 - 5000.", "content.p_28B9A5A955BC49628FC6E3BA8AF3B17A": "", "substep.substep_8708648A30FE4C95AD75D4962AA28660": "To select Port scan, select the port range to scan:", "substep.substep_D2E639A3E0774DC4826B04D86306A01A": "Select Detect operating system to attempt to detect the operating system based on the information gathered during the port scan.", "substep.substep_A4F76EA1B45A4AA9A11F34E6BE43A88C": "Select Proceed if no PING to force the discovery scan to port scan an IP even if it does not reply to PING. If this option is disabled, the port scan might go faster, but some open ports might not be detected.", "step.step_51B3EC5D76C04B30B3BF954AC4AC0AC7": "Define settings for the template. Choose a scan mode between host discovery or one of the port scan options:", "content.p_85AF80480AC64F0B911350484CCBCBDA": "This setting controls the timeout, which means how long the discovery scan should wait for a reply before it moves on to the next port number. Note that aggressive settings may cause a Denial of Service condition on the target host itself or the intermediate network equipment, such as a firewall.", "step.step_367502AFC9DB41C1865EB2C07FB2AD9B": "Select the Scanning performance.", "content.p_6381A1FD77C944C482EFB3F902B1C69C": "This setting defines how much resources are used to scan a single IP address. A higher amount of threads increases the overall scan speed, but it should be used carefully - especially if the scanning performance settings are above normal. Such optimized configuration might decrease the scan precision.", "step.step_8131483CC5E34C46A5C6A11100A73CF8": "Select the Number of threads.", "content.p_B7F3A3EC82464252AE5FFA7843A2BC13": "This setting forces the discovery scan to scan each port twice. Use this option when scan accuracy is more important than scan speed, or if the network is slow or unstable.", "step.step_F599C6A52BC444F783EBDDEAD62A0530": "Turn Double check on or off.", "content.p_52A26306F08A48A1BD357E83C24678AF": "The fragmented scan mode can be used to fragment IP packets in an attempt to bypass low-quality or misconfigured firewalls.", "step.step_3C059697AE9042748C3728692158B2E4": "Turn Fragmented scan on or off.", "step.step_6E2147D485384C5196EEBD3A1DF94D21": "Click Finish to save the template.", "desc": [ { "steps.steps_97BB465E603D4530BA7F6A4767AE6C0E": [ "step.step_A594B5DEE6734715A84600E216EBAF69", "step.step_22814A13A5294D538BD0F09B17C6FE53", "step.step_016D3F5C0A714F88B93D8CD161AECAC6", "step.step_C7DEF851755847C59768F001C6B204A7", "step.step_51B3EC5D76C04B30B3BF954AC4AC0AC7", { "subchoices.choices_F82D4049681A4270AEFC4ABE2D54A8F7": [ "subchoice.choice_43837AF39E5D41F4B604C13C84849DE9", "subchoice.choice_E8624C8BCFFA4AB194A5343232EDE09E" ] }, { "substeps.substepsalpha_817C8CFDAB7D4DBEA3E9A1C5462B116E": [ "substep.substep_8708648A30FE4C95AD75D4962AA28660", "content.p_28B9A5A955BC49628FC6E3BA8AF3B17A", { "subsubchoices.ul_1E87BD28BF6A44DFB240CF9DB4655CFF": [ "subsubchoice.choice_6129B263E8A64DA38D99D601B0BA26AF", "subsubchoice.choice_81BC8EF75B364A36BC1F97E2C6921811", "subsubchoice.choice_47F75B4EF29A49898A2AC0129B9890BE", "subsubchoice.choice_4EF62DB86FD94CAB80BB6ED4CBF6AD04" ] }, "substep.substep_D2E639A3E0774DC4826B04D86306A01A", "substep.substep_A4F76EA1B45A4AA9A11F34E6BE43A88C" ] }, "step.step_367502AFC9DB41C1865EB2C07FB2AD9B", "content.p_85AF80480AC64F0B911350484CCBCBDA", "step.step_8131483CC5E34C46A5C6A11100A73CF8", "content.p_6381A1FD77C944C482EFB3F902B1C69C", "step.step_F599C6A52BC444F783EBDDEAD62A0530", "content.p_B7F3A3EC82464252AE5FFA7843A2BC13", "step.step_3C059697AE9042748C3728692158B2E4", "content.p_52A26306F08A48A1BD357E83C24678AF", "step.step_6E2147D485384C5196EEBD3A1DF94D21" ] } ] }, "task_0DD2E426DC8146D295A90F2A8299BF37-4.0-en.json": { "title": "title_DDAC87362649490481533A0BAF99C179", "title_DDAC87362649490481533A0BAF99C179": "Running a discovery scan", "shortdesc": "shortdesc_040C65314B004740B4CFC8B2F2F9D587", "shortdesc_040C65314B004740B4CFC8B2F2F9D587": "You can run any of your available discovery scans on the Security Configurations > Scans > Discovery scans page. ", "content.p_E45A93A308B94F288B80244B46DC442A": "To run a discovery scan:", "content.p_4037F878C4734DC0AC945A6D316627A3": "The action bar appears at the bottom of the page.", "step.step_to_start_a_scan": "Select the checkboxes of the scans that you want to run.", "content.p_9CF6881F4A164E598A69BD1B5D534EA1": "Tip: You can click the Play button in the Status column to run a single scan.", "step.step_to_start_a_scan2": "Select Start scanning from the action bar.", "subchoice.choice_2917EE3002B94C27B282FFF27E62A596": "Idle - the scan has never been started before.", "subchoice.choice_BA20A1B73DDF4EFEBB66AD0E2741B758": "Initialized - the scan has been picked up by the scan node and will start shortly.", "subchoice.choice_752DDFD20F9142A2B556661A78CDAA61": "Queued - the scan is waiting for an available slot on the scan node.", "subchoice.choice_6792C5FFD29340D9955A0F6FE899C800": "Running - the scan is in progress on the scan node, and you can move your cursor over the progress bar to see more detailed information.", "subchoice.choice_D0FA76A9D9DE47B4ACC805B9191F7C95": "Completed - the scan has finished.", "content.p_1B1D13CF156D4A59869306C19149C8F0": "A scan can have one of the following statuses:", "step.step_while_scan_is_running": "While the scan is running, you can follow its progress by checking the Status column.", "step.step_E119BE9048344B449D150B9252CA4A9F": "When the scan is completed, click the name of the scan to view the results.", "desc": [ "content.p_E45A93A308B94F288B80244B46DC442A", { "steps.steps_500A76AA4BA24D92807DF2215666D562": [ "step.step_to_start_a_scan", "content.p_4037F878C4734DC0AC945A6D316627A3", "step.step_to_start_a_scan2", { "content.note_9CF6881F4A164E598A69BD1B5D534EA1": [ "content.p_9CF6881F4A164E598A69BD1B5D534EA1" ] }, "step.step_while_scan_is_running", "content.p_1B1D13CF156D4A59869306C19149C8F0", { "subchoices.ul_555968EDFA7A46AFA1EC64F06806F803": [ "subchoice.choice_2917EE3002B94C27B282FFF27E62A596", "subchoice.choice_BA20A1B73DDF4EFEBB66AD0E2741B758", "subchoice.choice_752DDFD20F9142A2B556661A78CDAA61", "subchoice.choice_6792C5FFD29340D9955A0F6FE899C800", "subchoice.choice_D0FA76A9D9DE47B4ACC805B9191F7C95" ] }, "step.step_E119BE9048344B449D150B9252CA4A9F" ] } ] }, "task_C70B7FCEC6D34C19B0CF926608B4CB41-4.0-en.json": { "title": "title_32EF7761B4D344D686CECEC1CAA06B7D", "title_32EF7761B4D344D686CECEC1CAA06B7D": "Viewing the discovery scan results", "shortdesc": "shortdesc_42335D8662404EC6BB1A414A88E2665B", "shortdesc_42335D8662404EC6BB1A414A88E2665B": "The discovery scan results page contains a summary of the scan details, such as scan time and overall statistics, as well as a list of the identified hosts. ", "content.p_view_scan_results": "To view the scan results:", "content.p_5BDD2F06AF244686924D9BEB019219DF": "This opens the report for the selected scan. The actual scan results are listed below the filter and scan summary. This list contains detailed information about each IP, such as its MAC address, reverse DNS hostname, the potential operating system, and the open ports found. Some IPs are marked with a green checkmark icon while others are not. Hosts that are already added to a system scan for network vulnerability scanning are marked with a green checkmark icon.", "step.step_A4E39598DFEB43E4BD89A2A1CD488D49": "On the Security Configurations > Scans > Discovery scans page, click the name of the scan that you want to view.", "content.p_6C391FBE966E4B53950D764268D60A09": "This helps you remove irrelevant hosts if the scan covered a wide IP range and a large number of hosts were discovered, as the full list of hosts can be overwhelming.", "substep.substep_1802DB541C2E46A3B5D0FABD34DC1CF7": "Click Filter.", "substep.substep_EC0B69EE7F5E4B3BAE8DE93A82411F57": "Specify the filtering parameters that you want to apply.", "substep.substep_9DF9A3F9C32B42E88B700AAFE96708E3": "Click Apply.", "step.step_B42A8B7015C940E591D161BB23C675EB": "If you want to narrow down the list of hosts displayed:", "substep.substep_B60ADBCB2CB44A5C978FA7213C798BF9": "Select the hosts that you want.", "substep.substep_20416DBEFC074874AF52633F1C4F2782": "Click Add to network vulnerability scan group at the bottom of the page.", "substep.substep_EF586B5DD8744FFEAC09CC42A2889060": "Select the target network scan groups.", "substep.substep_1660A33EAA42438087BB19B8E446F1DE": "Click Finish.", "content.p_E143A05DF8664B11982884BC73879600": "Note: You can also add the discovery scan as a source for a scan group, after which new hosts are automatically added to the scan group. For more information, see Editing scan groups.", "step.step_06674D046541465B91C5EE0575F34FDC": "To add listed hosts to a scan group:", "desc": [ "content.p_view_scan_results", { "steps.steps_E2A8F861E67B466687897612C3EA5BAE": [ "step.step_A4E39598DFEB43E4BD89A2A1CD488D49", "content.p_5BDD2F06AF244686924D9BEB019219DF", "step.step_B42A8B7015C940E591D161BB23C675EB", { "substeps.substepsalpha_C514A05D7E864438A1B64F55D9C5EE1E": [ "substep.substep_1802DB541C2E46A3B5D0FABD34DC1CF7", "content.p_6C391FBE966E4B53950D764268D60A09", "substep.substep_EC0B69EE7F5E4B3BAE8DE93A82411F57", "substep.substep_9DF9A3F9C32B42E88B700AAFE96708E3" ] }, "step.step_06674D046541465B91C5EE0575F34FDC", { "substeps.substepsalpha_FB0DCAA379644EDEAEC4E7AEEBC1CC8C": [ "substep.substep_B60ADBCB2CB44A5C978FA7213C798BF9", "substep.substep_20416DBEFC074874AF52633F1C4F2782", "substep.substep_EF586B5DD8744FFEAC09CC42A2889060", "substep.substep_1660A33EAA42438087BB19B8E446F1DE" ] }, { "content.note_E143A05DF8664B11982884BC73879600": [ "content.p_E143A05DF8664B11982884BC73879600" ] } ] } ] }, "concept_3E26C3913A984D538704BD8D35FB7B1D-4.0-en.json": { "title": "title_FCAE0C55B9314DC2800E3EC3FF4D6ED3", "title_FCAE0C55B9314DC2800E3EC3FF4D6ED3": "Network scan", "shortdesc": "shortdesc_6108252DAE864F8384005DD9C2B01001", "shortdesc_6108252DAE864F8384005DD9C2B01001": "Security Configurations > Scans > Network scans is used to manage your scans by using scan groups. ", "content.p_B9472D56A4744E4B9F05B4DC8505FB65": "To start and stop scans, open scan reports, and configure your network vulnerability scans in the WithSecure Elements Security Center, select Security Configurations > Scans and open Security Configurations > Scans > Network scans.", "content.p_vuln_open_network_scans": "Note: If you are using WithSecure Vulnerability Management only, go to the Network scans page.", "content.title_FF09B493C6D14E0A9F25D5457F7C1F21": "Updating scan targets automatically", "content.p_4C83CF69B0D449439EAEC598D34B54F3": "You can add discovery scans and Internet discovery search queries as sources that automatically update the targets of network vulnerability scans. The selected discovery scan or Internet discovery search then automatically modifies the set of hosts or sites included in the scan group based on the rules that you select.", "content.p_9EEAE6AE299C430D89F2C3BC1B3886BA": "This approach is especially useful when scanning hosts with dynamic IP addresses, for example. You can also configure the sources so that the vulnerability scan is run for new hosts and network services as soon as they are found.", "content.p_C21CA2B4C5024BF7AE51E15A1E468729": "The scan group details show the targets that have been added automatically from a selected source. Discovery scans also show if they are in use as a source for a scan group. Scan groups can include both automatically and manually added targets.", "desc": [ "content.p_B9472D56A4744E4B9F05B4DC8505FB65", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, "content.title_FF09B493C6D14E0A9F25D5457F7C1F21", "content.p_4C83CF69B0D449439EAEC598D34B54F3", "content.p_9EEAE6AE299C430D89F2C3BC1B3886BA", "content.p_C21CA2B4C5024BF7AE51E15A1E468729" ], "related": [ "concept_8A8EE953B33045A6803988051D512055-4.0-en" ] }, "task_A5F8A59B22674478837EDE20E877312C-4.0-en.json": { "title": "title_C35C704036D442DCAB2A48BF66F481B5", "title_C35C704036D442DCAB2A48BF66F481B5": "Editing scan groups", "shortdesc": "shortdesc_9D96702AB74145DBB01674536E76C23D", "shortdesc_9D96702AB74145DBB01674536E76C23D": "In Elements Vulnerability Management, all system scan and web scan targets are stored in logical containers called scan groups. ", "content.p_3946754B555B410B86758F59A9E8AEAF": "To view or edit a scan group:", "content.p_vuln_open_network_scans": "Note: If you are using WithSecure Vulnerability Management only, go to the Network scans page.", "step.step_vuln_open_network_scans": "In the WithSecure Elements Security Center, select Security Configurations > Scans > Network scans.", "step.step_95800F608A354BA5884002F7135F066C": "Click Group view.", "step.step_50D5C529F6D94745B02C24936780E3B3": "Click the menu button for the group that you want to edit.", "step.step_45A8ABD2212748739606E8CE0967F174": "Select Edit scan group.", "step.step_105916589C7D4138839E3386D4E9F318": "In Group name, enter the name of scan group.", "step.step_D7F39AD8B9244983AC4DB3599CFFF0F6": "In Responsible, set the Elements Vulnerability Management user who is responsible for the group", "step.step_5DB519C93B60439D911CF3F3432C28D5": "In Description, edit the group description.", "step.step_8DBEBABA29494A17A230CF043DB83660": "Click Next.", "content.p_AC582654344844809FBF6E206365CCDB": "If System scans is on:", "substep.substep_67EABC4E0EDC4DF59C53E6D1EE98D031": "Select the scan template to use for all assets within the group.", "substep.substep_80AEB2EC23894A43B9AFB5540E2BD2E6": "Select the scan node to use.", "substep.substep_F2C733479FDF40ABAEB2A0EAB9368BBA": "Set the maximum number of concurrent system scans that can be running at the same time within the group.", "content.p_update_asset_sources": "You also need to select the type of Source, the Source instance, Trigger, and Actions for the asset update. You must have at least one discovery scan already defined to select Discovery scan as a source. You can create a new discovery scan on the Security Configurations > Scans > Discovery scans page.", "substep.substep_8F604D113C9E44ABB54B4AF15F048DD9": "Turn on Asset update sources and then click Add asset update source if you want to synchronize the scan targets with the results of a discovery scan or Internet discovery search.", "substep.substep_07430CCB6116470ABD64145226C84355": "Turn on Scan schedule to set the schedule for system scans.", "step.step_F2625CDA3C324DA18A89B5B62F69B87F": "Turn System scans on or off.", "step.step_CB8D79DCDF15476C8C373FC28E078DFF": "Click Next.", "content.p_A0D581CE0BE8454F83676E951ABF9A52": "If Web scans is on:", "substep.substep_4AE1112620A942C2A270E62CCF9591F6": "Select the scan template to use for all assets within the group.", "substep.substep_56EC688766704F38B5557523AA6F2736": "Select the scan node to use.", "substep.substep_F104C412905A413D962DBC88014B7474": "Set the maximum number of concurrent system scans that can be running at the same time within the group.", "substep.substep_C092033751804A79A8C664863EA1E0D3": "Turn on Asset update sources and then click Add asset update source if you want to synchronize the scan targets with the results of a discovery scan or Internet discovery search.", "substep.substep_9EA5B335DDD945189C506DB9ED3F111A": "Turn on Scan schedule to set the schedule for web scans.", "step.step_FF86C3230E4D43CDB2F60AD107726E6B": "Turn Web scans on or off.", "step.step_95B6CFEA1113417BAA8D3C8B3CA54152": "Click Next.", "step.step_C618498B3C374ACBB35BACE8C07008CB": "Set the default tags that you want to show for scans that are added to this group.", "step.step_0E6E03ED5C3E47219FC41CF0C27288DD": "Click Next.", "step.step_D2814E0A8DF14791A1239CE41BEEC1F1": "Set the notification rules for the scan group.", "step.step_CE9D5E212CB24C90952B391432C12CE5": "Click Next.", "step.step_5DBE3A4E6F874CAC9BE41D6DCE34AF22": "Check the details for the scan group on the Summary page, then click Finish to save the changes.", "desc": [ "content.p_3946754B555B410B86758F59A9E8AEAF", { "steps.steps_A7D5EBB104EA4027875A00197A751710": [ "step.step_vuln_open_network_scans", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, "step.step_95800F608A354BA5884002F7135F066C", "step.step_50D5C529F6D94745B02C24936780E3B3", "step.step_45A8ABD2212748739606E8CE0967F174", "step.step_105916589C7D4138839E3386D4E9F318", "step.step_D7F39AD8B9244983AC4DB3599CFFF0F6", "step.step_5DB519C93B60439D911CF3F3432C28D5", "step.step_8DBEBABA29494A17A230CF043DB83660", "step.step_F2625CDA3C324DA18A89B5B62F69B87F", "content.p_AC582654344844809FBF6E206365CCDB", { "substeps.substepsalpha_0822E8958C954CFE9EF6445451F7CF37": [ "substep.substep_67EABC4E0EDC4DF59C53E6D1EE98D031", "substep.substep_80AEB2EC23894A43B9AFB5540E2BD2E6", "substep.substep_F2C733479FDF40ABAEB2A0EAB9368BBA", "substep.substep_8F604D113C9E44ABB54B4AF15F048DD9", "content.p_update_asset_sources", "substep.substep_07430CCB6116470ABD64145226C84355" ] }, "step.step_CB8D79DCDF15476C8C373FC28E078DFF", "step.step_FF86C3230E4D43CDB2F60AD107726E6B", "content.p_A0D581CE0BE8454F83676E951ABF9A52", { "substeps.substepsalpha_E62D0124243F4F8480A113F8D0D781F2": [ "substep.substep_4AE1112620A942C2A270E62CCF9591F6", "substep.substep_56EC688766704F38B5557523AA6F2736", "substep.substep_F104C412905A413D962DBC88014B7474", "substep.substep_C092033751804A79A8C664863EA1E0D3", "content.p_update_asset_sources", "substep.substep_9EA5B335DDD945189C506DB9ED3F111A" ] }, "step.step_95B6CFEA1113417BAA8D3C8B3CA54152", "step.step_C618498B3C374ACBB35BACE8C07008CB", "step.step_0E6E03ED5C3E47219FC41CF0C27288DD", "step.step_D2814E0A8DF14791A1239CE41BEEC1F1", "step.step_CE9D5E212CB24C90952B391432C12CE5", "step.step_5DBE3A4E6F874CAC9BE41D6DCE34AF22" ] } ] }, "task_69771361E7AD4470842EC68827095B5A-4.0-en.json": { "title": "title_F3B510F12D73435BA6257119416231CD", "title_F3B510F12D73435BA6257119416231CD": "Running network vulnerability scans", "shortdesc": "shortdesc_11EBC08243104B72BF755B3ABA6EC5F8", "shortdesc_11EBC08243104B72BF755B3ABA6EC5F8": "You can run any of your available system scans or web scans on Security Configurations > Scans > Network scans. ", "content.p_E45A93A308B94F288B80244B46DC442A": "To run a network vulnerability scan:", "content.p_4037F878C4734DC0AC945A6D316627A3": "The action bar appears at the bottom of the page.", "step.step_to_start_a_scan": "Select the checkboxes of the scans that you want to run.", "content.p_9CF6881F4A164E598A69BD1B5D534EA1": "Tip: You can click the Play button in the Status column to run a single scan.", "step.step_to_start_a_scan2": "Select Start scanning from the action bar.", "subchoice.choice_2917EE3002B94C27B282FFF27E62A596": "Idle - the scan has never been started before.", "subchoice.choice_BA20A1B73DDF4EFEBB66AD0E2741B758": "Initialized - the scan has been picked up by the scan node and will start shortly.", "subchoice.choice_752DDFD20F9142A2B556661A78CDAA61": "Queued - the scan is waiting for an available slot on the scan node.", "subchoice.choice_6792C5FFD29340D9955A0F6FE899C800": "Running - the scan is in progress on the scan node, and you can move your cursor over the progress bar to see more detailed information.", "subchoice.choice_D0FA76A9D9DE47B4ACC805B9191F7C95": "Completed - the scan has finished.", "content.p_1B1D13CF156D4A59869306C19149C8F0": "A scan can have one of the following statuses:", "step.step_while_scan_is_running": "While the scan is running, you can follow its progress by checking the Status column.", "step.step_E119BE9048344B449D150B9252CA4A9F": "When the scan is completed, click the name of the scan to view the results.", "desc": [ "content.p_E45A93A308B94F288B80244B46DC442A", { "steps.steps_500A76AA4BA24D92807DF2215666D562": [ "step.step_to_start_a_scan", "content.p_4037F878C4734DC0AC945A6D316627A3", "step.step_to_start_a_scan2", { "content.note_9CF6881F4A164E598A69BD1B5D534EA1": [ "content.p_9CF6881F4A164E598A69BD1B5D534EA1" ] }, "step.step_while_scan_is_running", "content.p_1B1D13CF156D4A59869306C19149C8F0", { "subchoices.ul_555968EDFA7A46AFA1EC64F06806F803": [ "subchoice.choice_2917EE3002B94C27B282FFF27E62A596", "subchoice.choice_BA20A1B73DDF4EFEBB66AD0E2741B758", "subchoice.choice_752DDFD20F9142A2B556661A78CDAA61", "subchoice.choice_6792C5FFD29340D9955A0F6FE899C800", "subchoice.choice_D0FA76A9D9DE47B4ACC805B9191F7C95" ] }, "step.step_E119BE9048344B449D150B9252CA4A9F" ] } ] }, "task_F44EAC5C654F4E76B3233854CEE5BAA7-4.0-en.json": { "title": "title_DBDC09490A334691897D16A44B960E0B", "title_DBDC09490A334691897D16A44B960E0B": "Viewing the scan results", "shortdesc": "shortdesc_B32B989BEDBC499181DA00E02B4EC08E", "shortdesc_B32B989BEDBC499181DA00E02B4EC08E": "Once you have completed a system scan or web scan, the results are delivered to the WithSecure Elements portal. ", "content.p_8FFF54D5D1E44E01ABFFFD1D5ACD70AE": "", "content.p_xml_or_word": "Note: In addition to viewing the web-based scan report, you can also download the results in XML or Word format.", "content.p_view_scan_results": "To view the scan results:", "step.step_0780272FE89F4008B2FD0AF560D58C3A": "In the List view, click the menu icon in the Actions column.", "content.p_5D1DE9C4FE2443F7B5D3716DE7496DCC": "This opens the scan results page for the selected scan.", "step.step_06DDA528B1574F32A048B3FCA2A14CF1": "Select View scan results.", "content.p_2133D713182844199DAC410A9374D8FF": "Tip: Click the menu icon to download an XML or Word version of the report, and also to view the scan log.", "content.dt_75C87CB0913645B1BDFC1DE17D9BEB18": "Scan Properties ", "content.dd_6D5B1867B1EE4F78868C0D8D9427B1E3": "Contains information about the scan type, scan group, time when the scan started and how long it took.", "content.dt_D4324B1395634938BB5A7F15E99A66CE": "Scan results ", "content.dd_99B63C6009C14F1BBE80E3432D4CC539": "Contains information about open ports, vulnerabilities, and findings that the scan found.", "content.dt_F3D74FCC78AD4C0CB5D62BC45140FE15": "Statistics ", "content.dd_D47CAC92BD004015BA86D59CF0041D84": "Contains details about the scan execution and statistics.", "content.p_8D17D59F145D4BBF8B1B97D4DA974D75": "", "content.p_A3745458A12A4610A27BB7514FAB8E86": "For web scans, the vulnerabilities are listed according to WASC categories.", "step.step_BBFBD7CEC45C42AC9230CCF5EA0DAEB5": "The scan results shows the scan properties, scan results, and statistics.", "subchoice.choice_9549C9C115094FC6AA073492B94259AD": "ID is the plugin identifier. You can click the link to see all hosts affected by this vulnerability.", "subchoice.choice_E3217B36DF3C4A44AEECE3EE175802F8": "Title of the vulnerability.", "subchoice.choice_7B2977657EF44F24BAAA3DDCBDF05461": "Status and Auditor notes are core functionalities of the Elements Vulnerability Management system. Use these fields to update the status of each vulnerability and write notes related to it. This helps to track the status of each vulnerability over time. When a vulnerability status is set, it is reflected in future scans as well. For example, if a vulnerability is marked as a \"False Positive\" it is marked as such in future scan results. Keep in mind that the vulnerability statuses can be used later when you generate Summary reports.", "subchoice.choice_76927ED3DAC14D9EB7DCC21B64C718A7": "Synopsis provides a brief description of the vulnerability.", "subchoice.choice_0B0B077CD550451D9BA0643E378F540C": "Description contains a detailed and often technical description of the vulnerability.", "subchoice.choice_EDBF3E7F63C6417CB7293CF9E0A4D9D4": "Solution describes how the vulnerability can be fixed.", "subchoice.choice_78C238FFF7D1466D87745CE346C9E7B6": "Findings contains details or evidence about how the scan detected the vulnerability.", "subchoice.choice_8C990E76F5E949FBA6C41D8B3FE9A93C": "Port describes the port and protocol affected by a given vulnerability.", "subchoice.choice_EDA40B86E95C4EC7A404B21D5CD21A89": "Risk factor is assigned to all vulnerabilities and are based on CVSS v2. The CVSS base score is then converted into a more human-readable format (High, Medium, Low, or Informational).", "subchoice.choice_281774848EF84DA89E712ECC1AD58AB3": "Denial of Service is Yes, No, or Not applicable and indicates if the vulnerability can be exploited to cause Denial of Service conditions. If Yes, the vulnerability does not affect PCI compliance.", "content.p_DCBC6F4E1050477A92B28D267BFD264A": "The following information is available for each listed vulnerability:", "step.step_21ECF4BD9F154CD3A50B99C6559A8919": "Open Scan results > Vulnerabilities and findings and click any of the listed vulnerabilities to see all of the information for it.", "substep.substep_A856531BBCBC4F60BCEBD7EC1D5DEF4B": "Select the vulnerabilities that you want to add to a ticket.", "substep.substep_1990D0DC81F94297B4FF262959C103FE": "On the action bar, click either Create new ticket or Add to existing ticket.", "content.p_4584AA579DFA42D8AD6A9E793D8F40D9": "When you fill in the necessary details, the ticket opens with the new information included.", "step.step_2A2F5D50219B490499596C9357F3F611": "Add any of the vulnerabilities to a ticket for tracking purposes if necessary.", "desc": [ { "content.note_xml_or_word": [ "content.p_xml_or_word" ] }, "content.p_view_scan_results", { "steps.steps_F95FFF88CD1E43CB9F366A424F69A380": [ "step.step_0780272FE89F4008B2FD0AF560D58C3A", "step.step_06DDA528B1574F32A048B3FCA2A14CF1", "content.p_5D1DE9C4FE2443F7B5D3716DE7496DCC", "step.step_BBFBD7CEC45C42AC9230CCF5EA0DAEB5", { "content.note_2133D713182844199DAC410A9374D8FF": [ "content.p_2133D713182844199DAC410A9374D8FF" ] }, "content.p_8D17D59F145D4BBF8B1B97D4DA974D75", { "dl.dl_1C68DD130191405CA144666317741B9F": [ { "dlentry.dlentry_D7FFA36FADF440DDAB7821C0E08C68A4": [ "content.dt_75C87CB0913645B1BDFC1DE17D9BEB18", "content.dd_6D5B1867B1EE4F78868C0D8D9427B1E3" ] }, { "dlentry.dlentry_3162837C9DE94D148E82C16E2ACE93D7": [ "content.dt_D4324B1395634938BB5A7F15E99A66CE", "content.dd_99B63C6009C14F1BBE80E3432D4CC539" ] }, { "dlentry.dlentry_5DEEC372F185414EA5BCDD132258B2F1": [ "content.dt_F3D74FCC78AD4C0CB5D62BC45140FE15", "content.dd_D47CAC92BD004015BA86D59CF0041D84" ] } ] }, "content.p_A3745458A12A4610A27BB7514FAB8E86", "step.step_21ECF4BD9F154CD3A50B99C6559A8919", "content.p_DCBC6F4E1050477A92B28D267BFD264A", { "subchoices.vulnerability_details": [ "subchoice.choice_9549C9C115094FC6AA073492B94259AD", "subchoice.choice_E3217B36DF3C4A44AEECE3EE175802F8", "subchoice.choice_7B2977657EF44F24BAAA3DDCBDF05461", "subchoice.choice_76927ED3DAC14D9EB7DCC21B64C718A7", "subchoice.choice_0B0B077CD550451D9BA0643E378F540C", "subchoice.choice_EDBF3E7F63C6417CB7293CF9E0A4D9D4", "subchoice.choice_78C238FFF7D1466D87745CE346C9E7B6", "subchoice.choice_8C990E76F5E949FBA6C41D8B3FE9A93C", "subchoice.choice_EDA40B86E95C4EC7A404B21D5CD21A89", "subchoice.choice_281774848EF84DA89E712ECC1AD58AB3" ] }, "step.step_2A2F5D50219B490499596C9357F3F611", { "substeps.substepsalpha_603C41CB6D3F4C9FA288E73DCF74B31B": [ "substep.substep_A856531BBCBC4F60BCEBD7EC1D5DEF4B", "substep.substep_1990D0DC81F94297B4FF262959C103FE" ] }, "content.p_4584AA579DFA42D8AD6A9E793D8F40D9" ] } ], "related": [ "task_0F3497976DE84688AA5D8CAB84ED0A22-4.0-en", "task_F151009F910A436ABD713F199715DB29-4.0-en" ] }, "concept_B1820DD479FC4091812980DB77D06BA8-4.0-en.json": { "title": "title_CBE91085037D4EB69C65E2E647A0FE1D", "title_CBE91085037D4EB69C65E2E647A0FE1D": "System scan", "shortdesc": "shortdesc_69FCA1DAAA544BF3A887F4A775BFA9C0", "shortdesc_69FCA1DAAA544BF3A887F4A775BFA9C0": "System scan is a network-based vulnerability scanner that is able to scan any system with an IP for common vulnerabilities. ", "content.p_8E56E22A26C04C73B79A709BDAE01873": "System scan's vulnerability detection is based on both active and passive vulnerability checks. For example, it will attempt to identify the service (product) and its version number. Once that is identified, the system scan checks if that particular software has any known vulnerabilities. In addition to passive scanning based on banner grabbing, system scans also run active checks in an attempt to confirm the existence of certain vulnerabilities or system misconfigurations. It can also identify missing security patches and outdated software if authenticated scanning has been enabled.", "content.p_E07EC7638C4443FBBEF0BEDD4930AEAC": "", "content.p_C1165814A6A04396862E6DE97141CBDE": "Note: System scan is non-disruptive and designed not to cause Denial of Service conditions on your systems.", "content.p_76D90B3D4B5E442796E70D5D3B84EEFF": "When you start a system scan, it first performs a port scan of the target and once all the open ports (services) have been identified, they will be assessed for vulnerabilities. These are just some of the systems that can be scanned by the system scan:", "step.step_43EE360781F14464A1E529DC80A9EA8A": "Web servers", "step.step_97C91DDDD5F24C78B474B30E59BA91D0": "Firewalls", "step.step_A6EB9B1AD8B843ACA0A82C63762900D6": "Email servers and gateways", "step.step_CA57E94F67CA4602A282799F6595AD9A": "Routers and switches", "step.step_3895385A4846400A8A7B14CCC70CC766": "Domain controllers", "step.step_9289D2BEFD9E42F1907A7F5EAAD26B74": "DNS servers", "step.step_1484AE1511F544809A050D708BEEA135": "Antivirus gateways", "step.step_B58B4F2986FF43A586245BB3C1190F7B": "Workstations", "content.p_A5B25242ED244435BE2F5F09C0D5DD48": "The checks that the scanner runs include the following:", "choice.choice_72AAADDDE29B449C9E96A5F3F4D37A71": "Detect services and operating systems discovery (UDP / TCP / ICMP)", "choice.choice_B734D8EB437C4C2AB79C24C87152A0E5": "Testing for vulnerabilities and misconfigurations in services", "choice.choice_181F8247CD8747A09E4D3F229ECC74E3": "Testing for vulnerabilities and misconfigurations in operating systems", "choice.choice_6F1B3E2C2EC24C37BF2F369C731D84DF": "Testing for vulnerabilities and misconfigurations in network devices", "choice.choice_A50F19F0FB9E41B7B249E1CEA5B3BD56": "Secure configuration testing (SSL / SSH)", "choice.choice_20A59800E70D42D887288CC822479BC7": "Default passwords discovery (operating systems / services / network devices)", "content.p_294666FAA3F147FAB75E9333DD5B7334": "", "content.p_114A10092F494C5399E62C79BF3573CB": "All vulnerabilities are reported with a CVSSv2 score, CVE, BID, BugTraq, and other references when available.", "desc": [ "content.p_8E56E22A26C04C73B79A709BDAE01873", { "content.note_C1165814A6A04396862E6DE97141CBDE": [ "content.p_C1165814A6A04396862E6DE97141CBDE" ] }, "content.p_76D90B3D4B5E442796E70D5D3B84EEFF", { "steps.ul_BB48EEC0E7CC4F0EBE4BD2CF2A0C10E7": [ "step.step_43EE360781F14464A1E529DC80A9EA8A", "step.step_97C91DDDD5F24C78B474B30E59BA91D0", "step.step_A6EB9B1AD8B843ACA0A82C63762900D6", "step.step_CA57E94F67CA4602A282799F6595AD9A", "step.step_3895385A4846400A8A7B14CCC70CC766", "step.step_9289D2BEFD9E42F1907A7F5EAAD26B74", "step.step_1484AE1511F544809A050D708BEEA135", "step.step_B58B4F2986FF43A586245BB3C1190F7B" ] }, "content.p_A5B25242ED244435BE2F5F09C0D5DD48", { "choices.ul_B52EC8C0D71D47ACA9D844F302547DF4": [ "choice.choice_72AAADDDE29B449C9E96A5F3F4D37A71", "choice.choice_B734D8EB437C4C2AB79C24C87152A0E5", "choice.choice_181F8247CD8747A09E4D3F229ECC74E3", "choice.choice_6F1B3E2C2EC24C37BF2F369C731D84DF", "choice.choice_A50F19F0FB9E41B7B249E1CEA5B3BD56", "choice.choice_20A59800E70D42D887288CC822479BC7" ] }, "content.p_114A10092F494C5399E62C79BF3573CB" ] }, "task_F6DB4758776F46BB80EEE7D4F7F60307-4.0-en.json": { "title": "title_F1390019836645F391649377CAA9E32B", "title_F1390019836645F391649377CAA9E32B": "Adding a system scan", "shortdesc": "shortdesc_50A9347B5FB34D3BA33455CE64383A61", "shortdesc_50A9347B5FB34D3BA33455CE64383A61": "We recommend that you add a new system scan by adding hosts to a scan group based on the results of a discovery scan, but you can also add a new system scan to the scan group separately. ", "content.p_AA3EF205C97F4D1F9B4B9338E8CA5B33": "If you need to add a new system scan manually:", "content.p_vuln_open_network_scans": "Note: If you are using WithSecure Vulnerability Management only, go to the Network scans page.", "step.step_vuln_open_network_scans": "In the WithSecure Elements Security Center, select Security Configurations > Scans > Network scans.", "content.p_287102C9AD5D4A0198B52968D979946A": "The Scan targets window opens.", "step.step_A42A61A7CD034B78A1ED43E3012A62BD": "Click the menu icon and select Add system scans.", "content.p_DBD1DFB17AE74986BD0438B209CBE03F": "Tip: If you have a large list of scan targets, click Upload targets from file to upload a plain-text file in CSV format. Separate host name or IP address, name, and virtual host name in three different columns in the file.", "step.step_D8EEA0809C564363BC3753BCC28316CF": "In IP range, enter the list of scan targets.", "step.step_DC49385EF192451CBEEE0520067C4879": "Click Finish.", "desc": [ "content.p_AA3EF205C97F4D1F9B4B9338E8CA5B33", { "steps.steps_F0A4962AD6AE47999BEC393CDFC96317": [ "step.step_vuln_open_network_scans", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, "step.step_A42A61A7CD034B78A1ED43E3012A62BD", "content.p_287102C9AD5D4A0198B52968D979946A", "step.step_D8EEA0809C564363BC3753BCC28316CF", { "content.note_DBD1DFB17AE74986BD0438B209CBE03F": [ "content.p_DBD1DFB17AE74986BD0438B209CBE03F" ] }, "step.step_DC49385EF192451CBEEE0520067C4879" ] } ] }, "task_77BEDB21F80C431ABB25DA958DBD6FFB-4.0-en.json": { "title": "title_4954A7F8DBD449E1BC656A8F0A0F6BBE", "title_4954A7F8DBD449E1BC656A8F0A0F6BBE": "Configuring system scans", "shortdesc": "shortdesc_C79CC25C889C4AA8805503425A6B8DE4", "shortdesc_C79CC25C889C4AA8805503425A6B8DE4": "You can use templates to configure multiple system scans at a time (recommended), or you can configure individual scans. ", "content.p_DC3CECAA1A12467AB5282E75FFCDE572": "A scan template is assigned to a scan group and the template is applied to all hosts within that group.", "content.p_490B5E4D6B5E42D39BC7C8B1CA6E5F0F": "To configure system scans, define the desired port range to scan and if needed, modify the performance settings.", "content.p_19251B6F567844ABAAC2AACC3BE28F6C": "Tip: We recommend that you use the default settings.", "content.p_B59BB4B19A9346F29127CB51D0A8C2AF": "To configure a system scan:", "content.p_vuln_open_network_scans": "Note: If you are using WithSecure Vulnerability Management only, go to the Network scans page.", "substep.substep_C8C783B01428410BB70AB77D31FCB1BB": "In the WithSecure Elements Security Center, select Security Configurations > Scans > Network scans.", "substep.substep_55B3CB2136BF4A37B7ACA050FE8CF801": "Click the menu icon and select Add system scans.", "substep.substep_133083A2849A4BE7B992F58F6E65240B": "Configure the scan as needed.", "substep.substep_B6793838917E4DF390B245E7C9DBFEE0": "Click Finish.", "step.step_20FFCCF871F6407897FB4F0A6B73E8BE": "To configure a single system scan:", "substep.substep_F0A806D5967D4EDF9358A24FC2F0DF02": "Go to Security Configurations > Scan Templates.", "content.p_0EA0CD8DA5274506B593331E70A39D5B": "Note: Elements Vulnerability Management has some built-in templates that cannot be edited.", "substep.substep_255992729922484DAE59B004703F0B53": "On the Network scan templates tab, click Add system scan template or click the menu icon in the actions column and select Edit to edit an existing template.", "substep.substep_E5D1F62F15654758ADCD4E6B5C087263": "Configure the template as needed and save your changes.", "substep.substep_38DEE3101E3D4B6F8D566DCDA83212DF": "In the WithSecure Elements Security Center, select Security Configurations > Scans > Network scans.", "substep.substep_6FB6E966BD9244BFB16FDEE5F0306769": "Go to Group view.", "substep.substep_C3EE6E3004F349F69B0D10DA18FF4E20": "Click the menu icon next to the group name and select Edit scan group.", "substep.substep_BE24D9DD5B5F4AD1824EC47B93BB4672": "Click Next to go to the System scans page.", "substep.substep_622439789070445788A255CCCEFB1C23": "Select the template that you created or edited, and decide if you want to overwrite the existing scan configuration.", "substep.substep_B2B1F741934B4752983701D1E710468F": "Click Next until you reach the Summary page, then click Finish to save your changes.", "step.step_1AFF4EC6CB814638848811721ABE4DEA": "To configure a system scan template:", "desc": [ "content.p_DC3CECAA1A12467AB5282E75FFCDE572", "content.p_490B5E4D6B5E42D39BC7C8B1CA6E5F0F", { "content.note_19251B6F567844ABAAC2AACC3BE28F6C": [ "content.p_19251B6F567844ABAAC2AACC3BE28F6C" ] }, "content.p_B59BB4B19A9346F29127CB51D0A8C2AF", { "steps.steps_B2A337586DB94EFCB647BC2A4A42556B": [ "step.step_20FFCCF871F6407897FB4F0A6B73E8BE", { "substeps.substepsalpha_7F67DBD79B4B4512B3899B97A61BA0D9": [ "substep.substep_C8C783B01428410BB70AB77D31FCB1BB", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, "substep.substep_55B3CB2136BF4A37B7ACA050FE8CF801", "substep.substep_133083A2849A4BE7B992F58F6E65240B", "substep.substep_B6793838917E4DF390B245E7C9DBFEE0" ] }, "step.step_1AFF4EC6CB814638848811721ABE4DEA", { "substeps.substepsalpha_43B0F22A5A634E14AE8F89680440ADCE": [ "substep.substep_F0A806D5967D4EDF9358A24FC2F0DF02", "substep.substep_255992729922484DAE59B004703F0B53", { "content.note_0EA0CD8DA5274506B593331E70A39D5B": [ "content.p_0EA0CD8DA5274506B593331E70A39D5B" ] }, "substep.substep_E5D1F62F15654758ADCD4E6B5C087263", "substep.substep_38DEE3101E3D4B6F8D566DCDA83212DF", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, "substep.substep_6FB6E966BD9244BFB16FDEE5F0306769", "substep.substep_C3EE6E3004F349F69B0D10DA18FF4E20", "substep.substep_BE24D9DD5B5F4AD1824EC47B93BB4672", "substep.substep_622439789070445788A255CCCEFB1C23", "substep.substep_B2B1F741934B4752983701D1E710468F" ] } ] } ] }, "concept_F39CF3A8148E4DDDA9E4A980078E489E-4.0-en.json": { "title": "title_DAB7AE6048FE4BE1BEBFFBDB5E58BC32", "title_DAB7AE6048FE4BE1BEBFFBDB5E58BC32": "System scan configuration options", "shortdesc": "shortdesc_D19F53BF163642609A4266CE2FBC179C", "shortdesc_D19F53BF163642609A4266CE2FBC179C": "You can use the tooltips next to any of the options in the UI to see more information about them. ", "content.title_FC8C0657BDCF4B5E89302DC30F434C0F": "General", "choice.choice_9BBF3C54F1064BC6AD08E0A75D45225D": "Define a Template name. We recommend that you make this as descriptive as possible.", "choice.choice_E904885FFFFA41DC91201A79C6059F95": "Define the TCP/UDP Port range that you want to scan. We recommend that you perform a full TCP/UDP port scan to ensure full coverage.", "choice.choice_A4DF11AF738E443FB1FC3E56B404743A": "Scanning performance decides the delay between packets sent (during the port scan).", "content.p_63BC76ECC9E244FE80E79C1D884BA43C": "Note: Backporting is the action of taking parts from a newer version of software and porting them to an older version of the same software. When this approach is used for applying security patches on Linux distributions like Red Hat, Ubuntu, Debian and others, the software's version number does not change. System scans will therefore continue to see the software as outdated and report false positives. The best way to avoid such false positives is to configure authenticated scanning, which will enable system scans to verify the actual patch level on the system being scanned. Unfortunately, it is not always possible to run authenticated scans, which is why you can use the Skip backported software setting. This allows you to decide if system scans should report vulnerabilities in backported software or not.", "choice.choice_9528CADD1077491D8D1C16E31D1005D4": "Skip backported software decides if the system scan should skip reporting certain vulnerabilities on operating systems that support backported software.", "choice.choice_2D32EF610E06446EA8CDD442076E23EF": "Extended scan log. Only enable this option if you need to debug a scan.", "content.p_16AEED87CBDE441DA263CDFF180CACA3": "", "content.title_E7048E595EC64F95A662838B55444D4F": "Plugin selection", "content.p_8D7F87AF82704BB382D38CE0D0B081F9": "You can choose specific plugins that you want to scan for. You can define a scan configuration that will either exclude or include the scanning of certain plugins. The most common scenario is when new critical vulnerabilities are announced to the public and you would like to scan for that specific vulnerability. For example, you can create a scan template that will only scan for the \"Heartbleed\" vulnerability.", "content.p_383E3341CCB64507B412704696940F09": "For inspiration, go to Security Configurations > Scan Templates > Network scan templates to view some of the built-in scan templates.", "content.p_694AEBE53EE849A087A8809DD6DF6022": "", "content.p_C6A32F399991429AA889EE4293CE2F82": "Note: It is recommended that you always scan with a complete set of plugins. A scan that covers a limited number of plugins gives a false security status of the scanned system and may affect the vulnerability remediation status known to Elements Vulnerability Management. For example, previously detected vulnerabilities can disappear on the latest report and be considered fixed.", "content.title_0A7142DD215348D0A041889C45DB1720": "Authentication", "content.p_FC6FB68947D742A7A666D91470B9FC92": "In addition to regular network-based scanning, where the host's ports are scanned and the exposed services are reviewed for flaws, you can also run a system scan in authenticated mode, which enables it to authenticate the target host. Authenticated scanning helps the scanner eliminate potential false positives and check patch levels and other misconfigurations.", "content.p_9BA0CD157FEC4666B6EE88E122B5A252": "For more information, see Authenticated scanning.", "desc": [ "content.title_FC8C0657BDCF4B5E89302DC30F434C0F", { "choices.ul_B47499A318A24EA0A12E60F2EB940689": [ "choice.choice_9BBF3C54F1064BC6AD08E0A75D45225D", "choice.choice_E904885FFFFA41DC91201A79C6059F95", "choice.choice_A4DF11AF738E443FB1FC3E56B404743A", "choice.choice_9528CADD1077491D8D1C16E31D1005D4", { "content.note_63BC76ECC9E244FE80E79C1D884BA43C": [ "content.p_63BC76ECC9E244FE80E79C1D884BA43C" ] }, "choice.choice_2D32EF610E06446EA8CDD442076E23EF" ] }, "content.title_E7048E595EC64F95A662838B55444D4F", "content.p_8D7F87AF82704BB382D38CE0D0B081F9", "content.p_383E3341CCB64507B412704696940F09", { "content.note_C6A32F399991429AA889EE4293CE2F82": [ "content.p_C6A32F399991429AA889EE4293CE2F82" ] }, "content.title_0A7142DD215348D0A041889C45DB1720", "content.p_FC6FB68947D742A7A666D91470B9FC92", "content.p_9BA0CD157FEC4666B6EE88E122B5A252" ] }, "concept_C93DD53B155E479090907499E59C8B4B-4.0-en.json": { "title": "title_6B8AAD8531B743E8A3C7D167AB25264F", "title_6B8AAD8531B743E8A3C7D167AB25264F": "Web scan", "shortdesc": "shortdesc_4BF323A3B70143E58E4D65A74C1490C7", "shortdesc_4BF323A3B70143E58E4D65A74C1490C7": "Web scan allows you to scan and test web applications. You can use web scans during the development of new applications as part of the development life cycle. ", "content.p_E61A7C1BC3114160811897AAAE89E0B7": "This results in being able to uncover vulnerabilities faster, thus significantly reducing the cost and amount of resources required to mitigate vulnerabilities at a later stage, as security issues are caught very early in the process.", "content.p_40215F0A37FF42BF9460CD24BF9BC611": "Web scan is considered an additional scanning feature that can be applied on top of an existing system scan. In other words, it is recommended that whenever you scan a target with a web scan, it should also be scanned with a system scan.", "content.title_0A75C07B36AB4394A4419DE7A87B4D54": "Custom web applications", "content.p_F0BB0652DB4B4529A75987A0B14E2200": "Before you create a new web scan, you must first understand when it makes sense to use it. As a rule of thumb, you should only scan custom web applications with a web scan. For example, if you have a system running a standard deployment of WordPress (without any custom modules installed), it does not make sense to scan it with a web scan, because system scans are able to detect the WordPress version and any known vulnerabilities. However, if you know that your WordPress contains custom-developed modules, it makes sense to scan it with both system and web scans. Keep in mind that you only need to scan the custom code or module and not the entire website.", "desc": [ "content.p_E61A7C1BC3114160811897AAAE89E0B7", "content.p_40215F0A37FF42BF9460CD24BF9BC611", "content.title_0A75C07B36AB4394A4419DE7A87B4D54", "content.p_F0BB0652DB4B4529A75987A0B14E2200" ] }, "task_D1DE26DA9EC4422CABDD47BF4373D6F5-4.0-en.json": { "title": "title_BFBA19DFFDCE4346A4C42BAF5802A0C1", "title_BFBA19DFFDCE4346A4C42BAF5802A0C1": "Adding a web scan", "shortdesc": "shortdesc_5F8D41CD7BBC45458EC5F866453E6B6B", "shortdesc_5F8D41CD7BBC45458EC5F866453E6B6B": "You can add new web scans to any scan group that is configured to include them. ", "content.p_0D0847BFDE7F4CF292AC9DBF840A029B": "To add and configure a new web scan:", "content.p_vuln_open_network_scans": "Note: If you are using WithSecure Vulnerability Management only, go to the Network scans page.", "step.step_vuln_open_network_scans": "In the WithSecure Elements Security Center, select Security Configurations > Scans > Network scans.", "step.step_2CEC7805D3874289AFB575A1180B1A52": "Click the menu icon and select Add web scan.", "substep.substep_DDA05914740C4F97AAC3D95C40C54766": "Enter the URL that you want to scan in the Scan target URL field.", "substep.substep_1CE6888F245B43F8ADADB854BA855672": "Enter a name for the scan in the Name field.", "substep.substep_78F2D5A5AFD24DD2807ED221E28EEC13": "Select the Elements Vulnerability Management user responsible for the scan in the Responsible menu.", "substep.substep_6D44097A530949ED95CF059899ED1BBF": "Add relative URLs for scanning.", "substep.substep_C23B765A5DED489A87B9C3E49541A33C": "Click Next to continue.", "step.step_E443AED1453D46F9B2594A5708D1883D": "Enter the general settings for the scan:", "subchoice.choice_9B018E43E565426584D9FA09BA878FFE": "Run attacks: Select this option to test the application by running SQL injection and cross-site scripting attacks against it. Disabling this option means that the scan will finish quickly, so you can see how much of the application the web scan was able to crawl or detect. This option is mainly intended for debugging the coverage of a Web Scan.", "subchoice.choice_40E3E2ED118943348A0B9E935DB76193": "Crawler enabling: Specifies if the web scan is allowed to crawl and index the application or not. By disabling this feature, you need to use recordings to feed the web scan with the target URLs.", "content.p_6D7EFD775BE84459B301C7FBFD05766D": "Important: If the target web application contains a web form that generates emails or similar and the web scan attacks such a web form, it may generate thousands of emails. If you are unsure if the application includes such functionality, you should disable this option or blacklist the scanning of such functionality.", "subchoice.choice_18B2B6F6B19F45EEBA1683089CCDA9CA": "Attack forms: This option specifies if the web scan is allowed to attack web forms identified within the application. A web form could be a contact form or a search function.", "subchoice.choice_7D318CFFC5C34AD482ACBB95773711CA": "Additional entry points: Here you can add additional relative paths that the web scan might not be able to find automatically, because they are not linked anywhere.", "subchoice.choice_BC1E87717D374F609D931E50E2806E1E": "Extended scan log: Select this option if you want to get more extensive logging for debugging purposes.", "step.step_071F49C83406410A917216B2B542A059": "Enter the policy settings for the scan.", "content.p_C6BB91B5D10C40249CEBF45A9855DCA7": "Scan rules let you control what the web scan is and is not allowed to scan. You can define relative URL paths or use regular expressions.", "step.step_4B7C201DD0B14608864538A4C59D08DC": "Enter any scan rules required for the scan.", "content.p_E0A933C007A2451ABD8C0B7711466961": "This allows you to define custom HTTP request headers that should be used during the scan. For example:", "subchoice.choice_E8CB1A6749AB4D949405275D760163D2": "Change the User-Agent to avoid flooding website statistics.", "subchoice.choice_BCEADC6934CC4C7CB017B76E6F58C4CB": "Change the User-Agent to simulate different browsers or operating systems.", "subchoice.choice_B9BB38A4185941BCB8560455FFEE5EF1": "Apply specific cookies for authentication, load balancing, language etc.", "subchoice.choice_6634BD0E9ACF4A8393E99BBD2F1B6493": "Define a custom Host header to reach an application on the target server.", "step.step_9B630A612BE64DC8AF3077619F518144": "Set the custom headers for the scan.", "content.p_D8E05B296C3448E598AD2160A3580A89": "Note: Web scan is very powerful and too many threads may cause Denial of Service conditions on some websites. We recommend starting with a low number of threads to avoid overloading the application.", "step.step_BAA3D8E02EB8470487949B9DBEC49BAE": "Set the number of threads used by the web scan.", "step.step_8820265FAB604A33B67F4F8D8B46FC98": "Click Next.", "substep.substep_8EBEE96C9B5A43A9BA44AD4BC7E674B3": "Select the recording type.", "content.p_C54DB5F5B4A94925941336EDEBF498A3": "If this setting is not selected, the existing recording will be overwritten.", "substep.substep_B8B98C3E654A4B729C8993A3EDF0F649": "Select Merge with previously added recordings if you want to add it to the existing recording.", "substep.substep_C4D1063685C94865AA689BEDEA286D2B": "Click Browse and select your file.", "step.step_9E8AA7DBE3814747BCB0251F3BF52F46": "Add any recordings if needed:", "subchoice.choice_5F9A5280D00E435F9256829CB848E40A": "HTTP basic authentication: Allows web scan to scan applications that require login credentials using basic authentication.", "subsubchoice.choice_5FC2F7A5B1404324AEF6D8770E57DE9B": "Login fingerprint: A string within any HTTP response indicating that the web scan has successfully authenticated to the application.", "subsubchoice.choice_D20F2EEE9E474166A9C2970EE176766B": "Logout fingerprint: A string within any HTTP response indicating that the web scan has been logged out.", "subsubchoice.choice_DA091261DD8F4D8B98DA754143409813": "A login HTTP request within your web scan recordings.", "subchoice.choice_885271E9AB5144BB92E6F6A6173540A4": "Form-based authentication: Allows web scan to scan applications that require login credentials using form-based authentication. If you use this feature, you need to provide the following information:", "step.step_7208BD3490D94CDAB01D8A4C381AD856": "Select the authentication to use for the scan.", "step.step_49B6BCC8B1D7428582A4894FEB11CB5A": "If you want the scan to trigger notifications, turn on Scan notifications and select the conditions.", "step.step_04DDB197330149C4BB6C174F3C558700": "Click Finish.", "desc": [ "content.p_0D0847BFDE7F4CF292AC9DBF840A029B", { "steps.steps_44C277F02A7A49EFA4EE71BF33BEB972": [ "step.step_vuln_open_network_scans", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, "step.step_2CEC7805D3874289AFB575A1180B1A52", "step.step_E443AED1453D46F9B2594A5708D1883D", { "substeps.substepsalpha_30D6DF814D424DC59421B35E9C312231": [ "substep.substep_DDA05914740C4F97AAC3D95C40C54766", "substep.substep_1CE6888F245B43F8ADADB854BA855672", "substep.substep_78F2D5A5AFD24DD2807ED221E28EEC13", "substep.substep_6D44097A530949ED95CF059899ED1BBF", "substep.substep_C23B765A5DED489A87B9C3E49541A33C" ] }, "step.step_071F49C83406410A917216B2B542A059", { "subchoices.choices_E2B69E4C1BE4446E8F4963892CC3A6A3": [ "subchoice.choice_9B018E43E565426584D9FA09BA878FFE", "subchoice.choice_40E3E2ED118943348A0B9E935DB76193", "subchoice.choice_18B2B6F6B19F45EEBA1683089CCDA9CA", { "content.note_6D7EFD775BE84459B301C7FBFD05766D": [ "content.p_6D7EFD775BE84459B301C7FBFD05766D" ] }, "subchoice.choice_7D318CFFC5C34AD482ACBB95773711CA", "subchoice.choice_BC1E87717D374F609D931E50E2806E1E" ] }, "step.step_4B7C201DD0B14608864538A4C59D08DC", "content.p_C6BB91B5D10C40249CEBF45A9855DCA7", "step.step_9B630A612BE64DC8AF3077619F518144", "content.p_E0A933C007A2451ABD8C0B7711466961", { "subchoices.choices_6B468D78219D4B4BB7505C5FC64C389D": [ "subchoice.choice_E8CB1A6749AB4D949405275D760163D2", "subchoice.choice_BCEADC6934CC4C7CB017B76E6F58C4CB", "subchoice.choice_B9BB38A4185941BCB8560455FFEE5EF1", "subchoice.choice_6634BD0E9ACF4A8393E99BBD2F1B6493" ] }, "step.step_BAA3D8E02EB8470487949B9DBEC49BAE", { "content.note_D8E05B296C3448E598AD2160A3580A89": [ "content.p_D8E05B296C3448E598AD2160A3580A89" ] }, "step.step_8820265FAB604A33B67F4F8D8B46FC98", "step.step_9E8AA7DBE3814747BCB0251F3BF52F46", { "substeps.substepsalpha_9846578FC13B46BCA50070B888B25002": [ "substep.substep_8EBEE96C9B5A43A9BA44AD4BC7E674B3", "substep.substep_B8B98C3E654A4B729C8993A3EDF0F649", "content.p_C54DB5F5B4A94925941336EDEBF498A3", "substep.substep_C4D1063685C94865AA689BEDEA286D2B" ] }, "step.step_7208BD3490D94CDAB01D8A4C381AD856", { "subchoices.choices_37B9887555C24FEB8A76C2D40E4ACC2B": [ "subchoice.choice_5F9A5280D00E435F9256829CB848E40A", "subchoice.choice_885271E9AB5144BB92E6F6A6173540A4", { "subsubchoices.ul_00BEC0AF2395428DBEEA4FDC9A156D4D": [ "subsubchoice.choice_5FC2F7A5B1404324AEF6D8770E57DE9B", "subsubchoice.choice_D20F2EEE9E474166A9C2970EE176766B", "subsubchoice.choice_DA091261DD8F4D8B98DA754143409813" ] } ] }, "step.step_49B6BCC8B1D7428582A4894FEB11CB5A", "step.step_04DDB197330149C4BB6C174F3C558700" ] } ] }, "concept_0790FBBAA21C43E79C65D91E789C32BC-4.0-en.json": { "title": "title_31FA953D22A04FE8BB49E8C80F711CFB", "title_31FA953D22A04FE8BB49E8C80F711CFB": "Web scan recordings", "shortdesc": "shortdesc_0283BD9991CC4F52B944C261DC64541E", "shortdesc_0283BD9991CC4F52B944C261DC64541E": "Recordings are used to feed web scans with valid HTTP requests to use during scanning. ", "content.p_96F9627BD710430CA192F72935A3CB6E": "With a recording, the scanner can follow a normal user's activity, and will as a result get deeper into the application's logic and potentially identify more vulnerabilities. Recordings are useful when certain functionality cannot be identified by the crawling engine or if the web forms require specific input before they are processed by the server. For example, thick-client components such as Flash and Silverlight cannot be interpreted or crawled by web scans, but you can do access the content manually and upload the valid HTTP requests to a web scan. Another example is a banking application that only allows transfers to a specific bank account number. With recordings, you can provide the web scan with the exact HTTP request that contains the valid account number, for example.", "content.p_FE42733DB1704CFDB16613F65C57A3AA": "To create a recording, you will need a HTTP proxy tool that can record requests as you browse the target website. The following recording formats are supported:", "choice.choice_228D598FBBEC44AEB82C0F4458C8A915": "Burp Proxy XML files (proxy-history log)", "choice.choice_5078DE0926E24814B57D036C65ECB981": "Fiddler SAZ Archive files (saved spider items)", "choice.choice_15E5C266D15A48C8B591CCF513F350DC": "Radar nProxy TXT files (logs from Radar nProxy tool)", "choice.choice_768CF4588DF14FD3B26A1C7973BF4198": "Elements Vulnerability Management Recordings XML files (internal format for existing Elements Vulnerability Management recordings)", "content.p_DEAA728811FD41A3881E9AC7BD6C7001": "This document only describes how to use nProxy in detail. The other tools are only described briefly.", "desc": [ "content.p_96F9627BD710430CA192F72935A3CB6E", "content.p_FE42733DB1704CFDB16613F65C57A3AA", { "choices.ul_2BD8AA932C20451D9F3D66799BAE6E72": [ "choice.choice_228D598FBBEC44AEB82C0F4458C8A915", "choice.choice_5078DE0926E24814B57D036C65ECB981", "choice.choice_15E5C266D15A48C8B591CCF513F350DC", "choice.choice_768CF4588DF14FD3B26A1C7973BF4198" ] }, "content.p_DEAA728811FD41A3881E9AC7BD6C7001" ] }, "task_B6DEFCA69B3E463EA91AD7803DA530B0-4.0-en.json": { "title": "title_53D2E92E81904C86A4F74CDD9631EAA7", "title_53D2E92E81904C86A4F74CDD9631EAA7": "Generating recordings with Burp Proxy", "shortdesc": "shortdesc_BD6305F6CDB74956ABB02E05D52E6E68", "shortdesc_BD6305F6CDB74956ABB02E05D52E6E68": "Burp Proxy is an intercepting proxy server for security testing of web applications. ", "content.p_39593F940872460AB5333752D4F040EA": "If you are not familiar with the tool, read the Getting started with Burp Suite guide.", "step.step_DA5AE5A88D94480DBC1BE306B3175AA9": "Download Burp Suite (Free Edition) and run it.", "step.step_1F16F4CB63424F128CA6361B43D96EA2": "Record the target application.", "substep.substep_2D59B1B082824CCE95D0B2953E09D731": "Go to the Proxy > History tab.", "substep.substep_DB2441908E5048248AA35909CA6048E6": "Select the requests from the list and right-click them.", "substep.substep_7DDD1BE0E7C342D79DF80735F87C08E9": "Select Save items.", "substep.substep_913AE3A9827C4B3687A738A60854DCD3": "Store the file, for example as recording.xml.", "step.step_B6D5463835104F498C1B8146506782C2": "Save the data to an XML file:", "desc": [ { "steps.steps_26506BD6FC3B40258A93B52361EA5DE3": [ "step.step_DA5AE5A88D94480DBC1BE306B3175AA9", "content.p_39593F940872460AB5333752D4F040EA", "step.step_1F16F4CB63424F128CA6361B43D96EA2", "step.step_B6D5463835104F498C1B8146506782C2", { "substeps.substepsalpha_37AD5565BA5241D7BD06673BD720277B": [ "substep.substep_2D59B1B082824CCE95D0B2953E09D731", "substep.substep_DB2441908E5048248AA35909CA6048E6", "substep.substep_7DDD1BE0E7C342D79DF80735F87C08E9", "substep.substep_913AE3A9827C4B3687A738A60854DCD3" ] } ] } ] }, "task_6F2AE790998D4BFC8BEF37119C04BF07-4.0-en.json": { "title": "title_70D2C7226A564C28A5BA3F62E52573A3", "title_70D2C7226A564C28A5BA3F62E52573A3": "Generating recordings with Fiddler", "shortdesc": "shortdesc_AA3D4C8B5B444688969DDEA74AE05C3F", "shortdesc_AA3D4C8B5B444688969DDEA74AE05C3F": "Fiddler is a free web debugging proxy for various browsers, systems, and platforms. ", "step.step_D149E4586CD04E28B6B51F7FD853777F": "Download Fiddler.", "content.p_3EE15E61A0144E219CB49C2D2EC39FB1": "This is Fiddler's default proxy configuration.", "step.step_F68F203C62FE444DA5101B7FD2F8B058": "Configure your browser to use it as proxy on localhost port 8888.", "substep.substep_02A5A4BD2E4A479F894D226521A4150A": "Select the list of URLs you want to export.", "substep.substep_5B3D3BF2177E476C8923713200766042": "Select Save > Selected Sessions > in ArchiveZIP... from the context menu.", "content.p_96DCAE6AADFD40C899BF9B9356C5257A": "The session archive file contains all the requests and responses of the traffic generated.", "step.step_7418D33335A244368FFBBF765E6B7B32": "Browse the target web application and save the Fiddler recording as a SAZ archive:", "desc": [ { "steps.steps_5AAC70F5DA884954A69A9AC82FD0B521": [ "step.step_D149E4586CD04E28B6B51F7FD853777F", "step.step_F68F203C62FE444DA5101B7FD2F8B058", "content.p_3EE15E61A0144E219CB49C2D2EC39FB1", "step.step_7418D33335A244368FFBBF765E6B7B32", { "substeps.substepsalpha_E6575FC4698847288E444199D7C758B3": [ "substep.substep_02A5A4BD2E4A479F894D226521A4150A", "substep.substep_5B3D3BF2177E476C8923713200766042" ] }, "content.p_96DCAE6AADFD40C899BF9B9356C5257A" ] } ] }, "task_58E5C812FE844227B1973ECA3E1D1273-4.0-en.json": { "title": "title_A565A9DDC0A64136A51467A9502E9CE0", "title_A565A9DDC0A64136A51467A9502E9CE0": "Finding internet-facing systems", "shortdesc": "shortdesc_8F1233EC86954F2192B916D6AF40B538", "shortdesc_8F1233EC86954F2192B916D6AF40B538": "You can find your organization's internet-facing systems in Elements Vulnerability Management with Internet discovery. ", "content.p_600CB3DBCA224C59996367E5D7AE4011": "The internet discover feature uses the Shodan.io search engine API, which employs crawling and port mapping to allow you to collect data on public systems. You can search for data based on location, top-level domain, pay-level domain, keywords, host name, and IP address.", "content.p_E49C2DF88EDE40B68051A4B4E35DB83C": "You can add the discovered hosts to a scan group for network vulnerability scanning using either passive or active scanning. Passive scans check for vulnerabilities without connecting to the target host. Active scanning runs a regular system scan on the host.", "step.step_501D0B539B434FD5AE1355CFE73AD3D8": "Go to Environment > Network > Internet.", "step.step_D60E75675CE540F49B5090279E22D5DD": "Open Filter.", "subchoice.choice_04A9A527FC6D454E832BA9D8279CA0C3": "Use country:<country code> to search for hosts in a specific country", "subchoice.choice_E0E53B2586F243B7B17FBCB2F8FDEC49": "Use tld:<top-level domain> to search for hosts using a specific top-level domain", "subchoice.choice_08A531B0B9E74E63976DCF7AAB685F55": "Use pld:<domain> to search for hosts within a specific pay-level domain", "subchoice.choice_8B38AC84201E410AB60E424CF7F0693F": "Use host:<search string> to search for host names that contain a specific string", "subchoice.choice_2EE67C8616A74FA5A82D12600029E422": "Use keyword:<search string> to search for hosts that contain a specific keyword", "subchoice.choice_3AE76A8A05B44359AF6B2B477E4080BF": "Use ip:<IP address> to search for hosts that use a specific IP address.", "step.step_55836DD7169B41808F4C9ADADA47034B": "Enter your search query using the following format:", "step.step_CE9EA06555C6482A8BBD777B27AD751C": "Click Apply.", "step.step_F081F8050F324E5CB6BC4749CA199D5B": "Select the hosts that you want to scan.", "step.step_21374F0A149343FE8E022ABBE0713750": "Click Add to scan group.", "step.step_23379F9280E54706B00DADE23338CC87": "Choose the type of scan that you want to run.", "step.step_EDD668BC78FC4469B052DA2D5BC81B7A": "Select the scan groups for the hosts.", "step.step_3CBE414CB2374B77A3B7C48F3F8E1441": "Click Add.", "desc": [ "content.p_600CB3DBCA224C59996367E5D7AE4011", "content.p_E49C2DF88EDE40B68051A4B4E35DB83C", { "steps.steps_D774D4B526A8424787BE88F856F52AD1": [ "step.step_501D0B539B434FD5AE1355CFE73AD3D8", "step.step_D60E75675CE540F49B5090279E22D5DD", "step.step_55836DD7169B41808F4C9ADADA47034B", { "subchoices.choices_FA0D7E4F23B3495988FA442ADDA50A1C": [ "subchoice.choice_04A9A527FC6D454E832BA9D8279CA0C3", "subchoice.choice_E0E53B2586F243B7B17FBCB2F8FDEC49", "subchoice.choice_08A531B0B9E74E63976DCF7AAB685F55", "subchoice.choice_8B38AC84201E410AB60E424CF7F0693F", "subchoice.choice_2EE67C8616A74FA5A82D12600029E422", "subchoice.choice_3AE76A8A05B44359AF6B2B477E4080BF" ] }, "step.step_CE9EA06555C6482A8BBD777B27AD751C", "step.step_F081F8050F324E5CB6BC4749CA199D5B", "step.step_21374F0A149343FE8E022ABBE0713750", "step.step_23379F9280E54706B00DADE23338CC87", "step.step_EDD668BC78FC4469B052DA2D5BC81B7A", "step.step_3CBE414CB2374B77A3B7C48F3F8E1441" ] } ] }, "task_11226CDD36C941E5B09F6AE63ABE9284-4.0-en.json": { "title": "title_67F7B826AAA3446E986DB8444EB9E7B7", "title_67F7B826AAA3446E986DB8444EB9E7B7": "Activating WithSecure Elements Agent scanning on devices", "shortdesc": "shortdesc_6DD5099617C04BD9BB88DCB978C411DE", "shortdesc_6DD5099617C04BD9BB88DCB978C411DE": "To run vulnerability scans on endpoint devices in your network, you have to enable the feature for those devices. ", "content.p_0369FCFE9AB34847969D5C83229BD2E4": "WithSecure Elements Agent with VM capabilities is a Windows client application that provides an additional approach to performing vulnerability scans on devices in your network.", "content.p_53495C36584E4FB39712AB5C7952604A": "", "content.p_47582868332B422EB14B86BFE0B97A0D": "Note: WithSecure Elements Agent scanning is only available if you are using Elements Vulnerability Management as a WithSecure cloud service.", "content.p_D7E7CF94097946918A4765524587EEF4": "This page shows you a list of the detected devices that have WithSecure Elements Agent with VM capabilities installed. If your network has Elements Endpoint Protection or Elements Detection and Response installed on Windows devices, these are also shown here.", "step.step_BE76E14DBDDE40A6A84A02E8149A1881": "In the WithSecure Elements portal, go to Environment > Devices > Device Discovery.", "content.p_C8893192A75B4CDB9F3A0A2E4992AC2D": "This activates the Elements Vulnerability Management module on the device and triggers the initial vulnerability scan. It also creates a scanning schedule based on the settings for your organization, for example to run a vulnerability scan every 6 hours.", "step.step_6DD91417B0CA42728875C835028BFC64": "Select the devices on which you want to activate vulnerability scanning, then select Enable scanning.", "content.p_672A28B3839D4CFBB003F1780D236B89": "At first, the details for the devices only include basic telemetry data such as IP address, hostname and MAC address. After a while, the vulnerability findings from the WithSecure Elements Agent scan start to appear on the Vulnerabilities and findings tab of the Asset details page for the device.", "step.step_F60EA9BE2ADF479F91BDCB8F00B13ED3": "Select Assets and check that the activated devices appear on the list.", "content.p_CA10589CA5724B1B932F28227FCD3464": "After the initial scan, WithSecure Elements Agent with VM capabilities runs a new scan whenever there are major changes to the software installed on the device.", "desc": [ "content.p_0369FCFE9AB34847969D5C83229BD2E4", { "content.note_47582868332B422EB14B86BFE0B97A0D": [ "content.p_47582868332B422EB14B86BFE0B97A0D" ] }, { "steps.steps_9518C22BB9FB4F2BB966DFC27F56E763": [ "step.step_BE76E14DBDDE40A6A84A02E8149A1881", "content.p_D7E7CF94097946918A4765524587EEF4", "step.step_6DD91417B0CA42728875C835028BFC64", "content.p_C8893192A75B4CDB9F3A0A2E4992AC2D", "step.step_F60EA9BE2ADF479F91BDCB8F00B13ED3", "content.p_672A28B3839D4CFBB003F1780D236B89" ] }, "content.p_CA10589CA5724B1B932F28227FCD3464" ], "related": [ "task_24CA2B7A08CE4D2FACE248941EC94CF3-4.0-en" ] }, "task_1B8B9F58AD444648ACE88BD33AB4A048-4.0-en.json": { "title": "title_9873B79DC921415E989D63D7B989CBC2", "title_9873B79DC921415E989D63D7B989CBC2": "Changing the frequency for endpoint status updates", "shortdesc": "shortdesc_2E333C6C4F56439F8EF534114CE3F9F5", "shortdesc_2E333C6C4F56439F8EF534114CE3F9F5": "You can set how often Elements Agent with VM capabilities sends updated status information on vulnerabilities in the devices in your network to the WithSecure Elements portal. ", "content.p_289017A3138645888DCF417954D858BA": "", "content.p_51A2FF40C5B04EAABBD648BE972B98AF": "Note: In addition to the scheduled status updates, endpoints automatically send any information to the WithSecure Elements portal from scans that are triggered by changes to the installed software.", "step.step_D06D3203D04C4958BE0743617138896F": "Select the Management > Vulnerability settings page and go to General settings > Miscellaneous.", "step.step_1550202C3C62480C9D1F35BE478D33A0": "Choose the update frequency that you want in the Vulnerability data refresh schedule on endpoints drop-down field.", "step.step_C71EBDF186AA4969BEAE7175A3AD00AC": "Click Save.", "desc": [ { "content.note_51A2FF40C5B04EAABBD648BE972B98AF": [ "content.p_51A2FF40C5B04EAABBD648BE972B98AF" ] }, { "steps.steps_30F34B16253A413480846B22A3C19F13": [ "step.step_D06D3203D04C4958BE0743617138896F", "step.step_1550202C3C62480C9D1F35BE478D33A0", "step.step_C71EBDF186AA4969BEAE7175A3AD00AC" ] } ] }, "concept_AB45C3CF1EE74D0699BB8BCFFA1C3BA1-4.0-en.json": { "title": "title_B453DCEA836844E9B81C95D6E017E75E", "title_B453DCEA836844E9B81C95D6E017E75E": "Authenticated scanning", "shortdesc": "shortdesc_C4ECBA3C41564381BEBF63D03D847F02", "shortdesc_C4ECBA3C41564381BEBF63D03D847F02": "In addition to regular network-based scanning, where the host's ports are scanned and the exposed services are reviewed for flaws, you can also run system scans in authenticated mode, which enables it to authenticate the target host. ", "content.p_316DA794D2C94BB8833D7D304FBA347A": "", "content.p_C7D214B2E3CB493C85366B9AD6F57B8C": "Note: You can only run authenticated scans for Linux and Windows system scan targets that are configured to use private scan nodes that are installed in the customer network. Authenticated system scans do not work if they are configured to use cloud scan nodes.", "content.p_F89D67857DD54F749460958DF9E632F7": "Network-based system scans can reveal hidden services and vulnerable products and configurations. However, a vast majority of known vulnerabilities (with or without a CVE number) affects some particular versions of a software package. The network scanning cannot always determine exact product versions, which is why WithSecure Elements Vulnerability Management combines the external vulnerability scanning results with the internal - \"authenticated\" - results.", "content.title_1713FED7EE3B45E08D2CCCC30CF68F64": "Authentication method on Windows", "content.p_88BB3366587E463F8D73AEC7427C109E": "Use an endpoint agent for the best authenticated scanning method with Windows targets. When WithSecure Elements Agent is installed on the target server, it sends the scanning results to the WithSecure Elements portal. In this mode, remote management interfaces can be disabled and no additional credentials are necessary. To install the endpoint agent, follow the instructions in Installing WithSecure Elements Agent with VM capabilities.", "content.p_73A2FADBB60B496B900D1788375C8341": "If you cannot use the endpoint agent, configure the scan authentication via Windows Remote Management (WinRM). When you configure it to use the Scan Node service account, which scans hosts in the same AD domain, no credentials are stored in WithSecure Elements Vulnerability Management database. For more information, see Windows authenticated scanning (WinRM).", "content.p_4D0E987BD78643598B789404F95C487F": "The authenticated scan requires administrator privileges on Windows targets.", "content.title_0629E75581CE4A5BB8876501AFD54401": "Authentication method on Linux", "content.p_6A44824BFA084981A53BF07AF746AE1E": "WithSecure Elements Vulnerability Management uses the industry-standard SSH protocol to perform the authenticated scanning on Linux-based hosts. We recommend that you set up a key-based SSH authentication, but the password-based authentication method is also supported. For more information about the configuration, see Linux authenticated scanning", "content.p_5F1FCCAADE0844D2B78A2C589448F5C4": "", "content.p_81A7A838BF954FDB81F8EC4AF479C348": "Note: Credentials are stored in WithSecure Elements portal in an encrypted form. To perform the authenticated scans, generate a \"transfer\" key pair, upload the public key to the Portal and the private key to the Scan Node Agent. This key pair keeps the credentials encrypted while they are stored or transferred. The decryption is only possible on the Scan Node Agent with appropriate public key when a scan starts.", "content.p_0875FD9364304A49A4BEF2B09274F0D0": "The authenticated scan does not require superuser access, but without it some system details are hidden, which may make the scanning results incomplete.", "content.title_2718A06132CF4E4DA99D6C7E611D011D": "Managing credentials", "content.p_6DC73295846D46639346F60D2D8F94C1": "Follow security policies and procedures of your organization when setting up the authenticated scanning.", "content.p_FE1598D5DCD54B829089BF0C03612C16": "It is up to the organization to perform a risk assessment and evaluate the need to split the systems into smaller groups with different credentials for scanning. From the technical point of view, it is possible to configure single credentials for the whole group of scans or for each scan separately.", "content.p_449889FC31C94C07BF1C24F86C680B7C": "Using a single user that is dedicated to authenticated scanning has its pros and cons. It is easy to set up, identify in logs and deactivate if it is misbehaving. On the other hand, if a threat actor gains access to the account, they would gain access to a significant number of assets.", "content.p_E654F61CD4BF41E0AFD841618DB1009A": "We do not recommend that you disable the user that is used for authenticated scans outside the scan schedule. Based on our experience, it does not improve the security posture significantly but can cause issues when the scanning takes longer than expected or scan has to be redone, for example.", "desc": [ { "content.note_C7D214B2E3CB493C85366B9AD6F57B8C": [ "content.p_C7D214B2E3CB493C85366B9AD6F57B8C" ] }, "content.p_F89D67857DD54F749460958DF9E632F7", "content.title_1713FED7EE3B45E08D2CCCC30CF68F64", "content.p_88BB3366587E463F8D73AEC7427C109E", "content.p_73A2FADBB60B496B900D1788375C8341", "content.p_4D0E987BD78643598B789404F95C487F", "content.title_0629E75581CE4A5BB8876501AFD54401", "content.p_6A44824BFA084981A53BF07AF746AE1E", { "content.note_81A7A838BF954FDB81F8EC4AF479C348": [ "content.p_81A7A838BF954FDB81F8EC4AF479C348" ] }, "content.p_0875FD9364304A49A4BEF2B09274F0D0", "content.title_2718A06132CF4E4DA99D6C7E611D011D", "content.p_6DC73295846D46639346F60D2D8F94C1", "content.p_FE1598D5DCD54B829089BF0C03612C16", "content.p_449889FC31C94C07BF1C24F86C680B7C", "content.p_E654F61CD4BF41E0AFD841618DB1009A" ] }, "concept_BA66387E71964C3DBA0DDBBFBC1DA023-4.0-en.json": { "title": "title_686D691D7B9F4081889A441DEFB4AB3D", "title_686D691D7B9F4081889A441DEFB4AB3D": "Windows authenticated scanning (WinRM)", "shortdesc": "shortdesc_F13571D826794A54A4B9C2BC6A3DD372", "shortdesc_F13571D826794A54A4B9C2BC6A3DD372": "This section provides instructions on how to prepare your internal network for authenticated scanning using Windows Remote Management (WinRM). ", "content.p_C79835A7846F494A9D54337BA0701471": "WithSecure Elements Vulnerability Management supports two ways of authenticating to Windows systems:", "choice.choice_3DF8717DD616461BBF6215812679004D": "If the scan node is deployed on a Windows computer, use the scan node service account credentials (recommended)", "choice.choice_C4771B08467D4F7EB0B4FA574219A33F": "Specify credentials explicitly in the WithSecure Elements portal", "content.p_137991BB3A204B479137FD8D05A10C01": "WithSecure Elements Vulnerability Management uses WinRM to check for missing Windows patches and detect vulnerabilities related to common third-party software. WinRM obtains the list of Windows patches from Windows Update Agent using one of the following sources:", "choice.choice_F6D8A8AE206D4891AE9A8462F68FFB2F": "Microsoft's own Windows Update Service (internet access required)", "choice.choice_D61BA3AC80874F45A29A6812DC651927": "An internal network WSUS service", "choice.choice_4D408D447ECF4101BE67D6CC9CDB6FE1": "A Windows Updates database file", "content.p_4ED993E492D9472DB94AED03225B26CC": "These options can be turned on or off in the WithSecure Elements Vulnerability Management scan templates.", "content.p_51B2E3A101554C55808CD298864F9F9B": "If you choose the first option (Windows Update Service), you can also select the Check for other Microsoft products option. This allows you to retrieve updates not only for Windows systems, but also for other Microsoft products (such as Microsoft Office).", "content.p_5F915DDB27FC4C8BBD345C04EBEB868B": "", "content.p_9D0620B46549407E8E43545D5D7AAB1A": "Note: Windows 10, Windows Server 2016, or newer target systems that do not have the Receive updates for other Microsoft products when you update Windows option turned on in Windows Update settings may not include the service required for finding updates for other Microsoft products. To mitigate this, Elements Vulnerability Management adds the service source ID to the target if necessary. Although Elements Vulnerability Management cannot undo this change, it does not affect any functionality of Windows Update Service or the settings for automatic updates on a scanned machine.", "content.p_0F51933FE58A474DBE62AF0DEC86A780": "The third option (Windows Updates database file) can be used as a failover option if the target Windows systems do not have network access to Windows Update Service or WSUS. If it is taken into use, WithSecure Elements Vulnerability Management can check for missing Windows patches by uploading the Windows Updates database file (wsusscn2.cab) onto the target system's temp folder (%SystemRoot%\\Temp\\MBSA\\Cache\\). Once uploaded, WUA uses this file to check for missing Windows patches without accessing the internet.", "content.p_DDB2A493285E476081042F1A1D24A84C": "Besides checking for missing Windows patches, WithSecure Elements Vulnerability Management also detects vulnerabilities related to common third-party software. WinRM fetches the list of third-party software from Windows Registry.", "desc": [ "content.p_C79835A7846F494A9D54337BA0701471", { "choices.ul_83376B234C854E3E8130B66139A04236": [ "choice.choice_3DF8717DD616461BBF6215812679004D", "choice.choice_C4771B08467D4F7EB0B4FA574219A33F" ] }, "content.p_137991BB3A204B479137FD8D05A10C01", { "choices.ul_696CEB14B40D4A7DAE33C9C9BB965CFD": [ "choice.choice_F6D8A8AE206D4891AE9A8462F68FFB2F", "choice.choice_D61BA3AC80874F45A29A6812DC651927", "choice.choice_4D408D447ECF4101BE67D6CC9CDB6FE1" ] }, "content.p_4ED993E492D9472DB94AED03225B26CC", "content.p_51B2E3A101554C55808CD298864F9F9B", { "content.note_9D0620B46549407E8E43545D5D7AAB1A": [ "content.p_9D0620B46549407E8E43545D5D7AAB1A" ] }, "content.p_0F51933FE58A474DBE62AF0DEC86A780", "content.p_DDB2A493285E476081042F1A1D24A84C" ] }, "concept_E357586713E6478995E3F8E980FF2B65-4.0-en.json": { "title": "title_8C42644D1E234900AED05E727F109D7D", "title_8C42644D1E234900AED05E727F109D7D": "Configuring Windows authenticated scanning (WinRM)", "shortdesc": "shortdesc_3FEA685762E94CCB91E3A75C12AA9662", "shortdesc_3FEA685762E94CCB91E3A75C12AA9662": "Before applying changes, WithSecure recommends that you discuss all potential changes with your network administrator. ", "content.p_97BFECA2675944F4A379F4EA89C1C578": "The following summarizes the requirements for enabling WinRM authenticated scanning for Windows:", "subchoice.choice_5F6A647590BF4A5F86E112C0DFCE95B4": "Local user account added to the Administrators group", "choice.choice_EC21677655984055B9E9C28EA7DC9FDF": "If a Linux scan node is in use, a user account must meet the following requirement:", "subchoice.choice_D1A3E009CC9045CD9E2BABF92E015855": "An Active Directory user account added to the Administrators group", "subchoice.choice_3C7986107DF74A22AC37261364D5C5A1": "Local user account added to the Administrators group", "choice.choice_CBD5699B5004442BA660DF5A9C8D3352": "If a Windows scan node is in use, there are two options for user accounts:", "content.p_087EE55E91824D5D9C4FA5162BA41DE1": "Note: When a scan node that is deployed on Linux is in use, we highly recommend that you use the HTTPS option only because of known authentication issues for unencrypted connections between Linux and Windows.", "subchoice.choice_CDDCD91EAA8C4890A35FBED213323CDD": "WinRM service is running and WinRM HTTP or HTTPS listener is created", "subchoice.choice_99C7EA1745A44F2990921F57246338F4": "Operating systems with Windows Firewall with Advanced Security component installed (introduced in Windows Vista), where a firewall exception for WinRM traffic is enabled", "subchoice.choice_54514AF9A69E480986BF6BEB79BB0CF1": "Basic authentication allowed on the WinRM service (for scan nodes deployed on Linux only)", "choice.choice_4B64D06D6DA548BDBB4946326E3C80BE": "Target host configuration requirements:", "subchoice.choice_B64222CC5E1C445783BE709DEE6F8A7C": "For HTTP protocol only: target host is added to the TrustedHosts list", "choice.choice_E726592EBADE48E5A78F0FCDD80982A4": "Scan node configuration requirements:", "content.p_539F495C780A4994A5C8598211A8E335": "", "content.p_B028434791014A11B14A7CEEE0ED57D5": "Note: When a Windows Updates database file is used for scanning, the scan node will copy the database file to the %SystemRoot%\\Temp\\MBSA\\Cache\\ folder during the scan and delete it once the scan has completed (for scan nodes deployed on Windows only).", "content.p_F8B7C1F08653477B9F690A131564C64A": "Most of the configuration commands require a PowerShell console run with administrative privileges.", "desc": [ "content.p_97BFECA2675944F4A379F4EA89C1C578", { "choices.ul_1FB64377E3744F2DACB629E211FEF0CC": [ "choice.choice_EC21677655984055B9E9C28EA7DC9FDF", { "subchoices.ul_30B49592CB6E4A15AD1B3394BCFFBB15": [ "subchoice.choice_5F6A647590BF4A5F86E112C0DFCE95B4" ] }, "choice.choice_CBD5699B5004442BA660DF5A9C8D3352", { "subchoices.ul_D16A9C6DF3BC48BD8299CE450BB838C2": [ "subchoice.choice_D1A3E009CC9045CD9E2BABF92E015855", "subchoice.choice_3C7986107DF74A22AC37261364D5C5A1" ] }, "choice.choice_4B64D06D6DA548BDBB4946326E3C80BE", { "subchoices.ul_502D902C08B44EB589320FE31D5D13A9": [ "subchoice.choice_CDDCD91EAA8C4890A35FBED213323CDD", { "content.note_087EE55E91824D5D9C4FA5162BA41DE1": [ "content.p_087EE55E91824D5D9C4FA5162BA41DE1" ] }, "subchoice.choice_99C7EA1745A44F2990921F57246338F4", "subchoice.choice_54514AF9A69E480986BF6BEB79BB0CF1" ] }, "choice.choice_E726592EBADE48E5A78F0FCDD80982A4", { "subchoices.ul_751B8398F6714E76B6ADB1C1F74825FC": [ "subchoice.choice_B64222CC5E1C445783BE709DEE6F8A7C" ] } ] }, { "content.note_B028434791014A11B14A7CEEE0ED57D5": [ "content.p_B028434791014A11B14A7CEEE0ED57D5" ] }, "content.p_F8B7C1F08653477B9F690A131564C64A" ] }, "task_10E95595046447678BE6D03F597D3BD3-4.0-en.json": { "title": "title_53F19B34AFA64FF990FAA7319124498A", "title_53F19B34AFA64FF990FAA7319124498A": "Updating PowerShell", "shortdesc": "shortdesc_4CB016E11DFD41BAB6DE66AF2A9E13D1", "shortdesc_4CB016E11DFD41BAB6DE66AF2A9E13D1": "The configuration requires PowerShell version 5.0 or newer, although we recommend updating PowerShell to the latest version. ", "content.p_26C6863A6736471D9292BF37A7959B76": "To check the PowerShell version and update it:", "step.step_52463DF215454979BA50567490999E92": "Open a PowerShell console with administrative privileges.", "content.p_5AB1AA08F7C34A2B9808C7C71813DA79": "Get-Host | Select-Object Version", "step.step_9718719748F94A2EBACDF223E27E9521": "Run the following command to check the installed version of PowerShell:", "step.step_BFE4FE8ED46D4B4297129D60D0BEED92": "If necessary, download the required version of PowerShell from Microsoft Download Center and install it.", "step.step_0FD7C356BFDF4410A906B9449A72AEBE": "Restart the computer.", "desc": [ "content.p_26C6863A6736471D9292BF37A7959B76", { "steps.steps_C7924AE985EE4149838F7AE354A91A91": [ "step.step_52463DF215454979BA50567490999E92", "step.step_9718719748F94A2EBACDF223E27E9521", "content.p_5AB1AA08F7C34A2B9808C7C71813DA79", "step.step_BFE4FE8ED46D4B4297129D60D0BEED92", "step.step_0FD7C356BFDF4410A906B9449A72AEBE" ] } ] }, "task_262B96902BA049B786390108BAE67D8F-4.0-en.json": { "title": "title_F0BD4318A8E2491695EF9FB4EAF59EB4", "title_F0BD4318A8E2491695EF9FB4EAF59EB4": "Create a dedicated user account", "shortdesc": "shortdesc_E20BDDEA28A34C639A3C5CA650C1D95E", "shortdesc_E20BDDEA28A34C639A3C5CA650C1D95E": "We recommend that you create a dedicated user account for Elements Vulnerability Management with access to WinRM. ", "content.p_A5906A50BD1B4435BF0F1B46FBF73758": "To create a new user account:", "step.step_6B2FD66DDDCD4F54BF1D869FFC860ABA": "Go to Control Panel > Administrative Tools > Computer Management > Local Users and Groups > Users.", "step.step_09D6E66E0653426EBCC5500FCCF844A5": "Add a new user account.", "step.step_EABB41FCB28542F0A413854AD085735C": "Add the new user account to the Administrators group.", "desc": [ "content.p_A5906A50BD1B4435BF0F1B46FBF73758", { "steps.steps_C77DC8AFFB174F0893105C9C9ACBA75B": [ "step.step_6B2FD66DDDCD4F54BF1D869FFC860ABA", "step.step_09D6E66E0653426EBCC5500FCCF844A5", "step.step_EABB41FCB28542F0A413854AD085735C" ] } ] }, "task_5901D72CCEAB44529CAE857EF344FBFF-4.0-en.json": { "title": "title_12AFE4229E8E4EC4AC9BA2FDF3703534", "title_12AFE4229E8E4EC4AC9BA2FDF3703534": "Configuring the WinRM service to use HTTP on individual hosts", "shortdesc": "shortdesc_2064A50E8E444BF3AE5B16AFA64DCA2B", "shortdesc_2064A50E8E444BF3AE5B16AFA64DCA2B": "You can configure the WinRM service used for authenticated scanning to handle network traffic over HTTP. ", "content.p_F18B549733594968B59CD965568BCDA9": "", "content.p_http_recommendation": "Note: Using HTTP for WinRM is not recommended outside a domain environment where the NTLM protocol does not provide a sufficient level of protection for credentials. This also means that using HTTP is particularly inadequate when using scan nodes that are deployed on Linux computers.", "content.p_CC627333808B4D49AF85C1B60F602371": "", "content.p_D9619FFA9FAF4EEBB140AFFF83EBDA4D": "Note: In larger domain environments, it is highly recommended to configure the WinRM service via Group Policy.", "content.p_35E0F0A9A7D64B8ABB18A4CBD5A7970F": "Set-WSManQuickConfig –Force", "content.p_226422AC701D46E6BE36FFCA9F20488F": "Note: If the computer is on a public network, use the additional -SkipNetworkProfileCheck parameter, which enables a firewall rule for public networks.", "content.p_4F1D82CEBF024EC0BC36BAC71E25C8DF": "This command ensures that the WinRM service is running and is set up to start automatically, creates an HTTP listener to accept WinRM requests, and creates a firewall exception for WinRM traffic.", "step.step_5C8BC3A811F444E2AF34FFF4BFB0C41D": "On the target computer where you want to run the WinRM service, run the following command to set up the remote management configuration:", "content.p_AEC5A97F92BD4775A05509D5B242A965": "Set-Item WSMan:\\localhost\\Client\\TrustedHosts -Value '{IpAddress}'", "content.p_93D8BF649F0949629225336E95A246D0": "Note: Use the IP address of the target computer. Use the wildcard character (*) instead of an IP address to add all computers.", "step.step_scan_node_trustedhosts": "On the scan node, run the following command to add the target host to the TrustedHosts list:", "desc": [ { "content.note_http_recommendation": [ "content.p_http_recommendation" ] }, { "content.note_D9619FFA9FAF4EEBB140AFFF83EBDA4D": [ "content.p_D9619FFA9FAF4EEBB140AFFF83EBDA4D" ] }, { "steps.steps_825EF93718C54578A8ED6241506210F8": [ "step.step_5C8BC3A811F444E2AF34FFF4BFB0C41D", "content.p_35E0F0A9A7D64B8ABB18A4CBD5A7970F", { "content.note_226422AC701D46E6BE36FFCA9F20488F": [ "content.p_226422AC701D46E6BE36FFCA9F20488F" ] }, "content.p_4F1D82CEBF024EC0BC36BAC71E25C8DF", "step.step_scan_node_trustedhosts", "content.p_AEC5A97F92BD4775A05509D5B242A965", { "content.note_93D8BF649F0949629225336E95A246D0": [ "content.p_93D8BF649F0949629225336E95A246D0" ] } ] } ] }, "task_E5747A58DFFD4A1C95D52FC162DB777C-4.0-en.json": { "title": "title_7195EF2328A14EF3A15C59A3D14335AB", "title_7195EF2328A14EF3A15C59A3D14335AB": "Configuring the WinRM service to use HTTP through GPO", "shortdesc": "shortdesc_653DC5F89A7B44B588B51E8E8189993F", "shortdesc_653DC5F89A7B44B588B51E8E8189993F": "For larger domain environments, we recommend that you configure the WinRM service via Group Policy. ", "content.p_96B3F097AC924CE5BF869FEFBE369A3B": "", "content.p_http_recommendation": "Note: Using HTTP for WinRM is not recommended outside a domain environment where the NTLM protocol does not provide a sufficient level of protection for credentials. This also means that using HTTP is particularly inadequate when using scan nodes that are deployed on Linux computers.", "substep.substep_7299DB8955B74E51B2FFB68C1613FEC7": "Select Start > Administrative Tools > Group Policy Management.", "substep.substep_D93CDCCE03BC4377A75580E701DAE1E2": "Right-click Domains and select Create a GPO in this domain, and link it here.", "substep.substep_62E86C101C4C4D2F9751929F198306A9": "Enter Elements Vulnerability Management as the required name and click OK.", "substep.substep_9162DC146BBC4227B77AC06DD3D4E9A7": "Right-click the GPO that you just created (Elements Vulnerability Management) and select Edit.", "step.step_C8C77E6C6C9341149DB6CAC9812A8474": "Create a new Group Policy object:", "substep.substep_B8BCDB18BDDC4719B8CF32664388D313": "Select Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service.", "substep.substep_3F4610DDFD7245F5A21D29C9B0F1A8A3": "Right-click Allow remote server management through WinRM, select Enabled, and enter suitable IPv4 and IPv6 filters.", "step.step_371027B289FC4126A35B2D8AC64318E1": "Allow remote server management through WinRM:", "substep.substep_543FDC71452F46AA93157DEBEB826F0E": "Select Computer Configuration > Preferences > Control Panel Settings.", "substep.substep_52D40F1AECC547B6A76D349B946615C2": "Right-click Services and select New > Service.", "substep.substep_EC4CD9AE3A994DA7B9B1A951A22422F9": "Select Automatic as the Startup type and WinRM as the ServiceName.", "step.step_B9E5DB09AF5447DBA6DA4AC82F81C355": "Switch on the WinRM service:", "substep.substep_3B7A97A5309C4D1D904D0653C7C0A542": "Select Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security.", "substep.substep_359E595E33AF4CE388B75B1DEF1A60D9": "Right-click Inbound Rules and select New Rule.", "substep.substep_741E815F0AB84DDEA611AEE5A4229A04": "Select Windows Remote Management as the Predefined rule type and click Next.", "substep.substep_38CCC51C6C38486298298BBBF2347474": "Select the appropriate rule for your network profile and click Next.", "substep.substep_46056920ECCD4D78BDEC814AB3480436": "Select Allow the connection and click Finish.", "step.step_72AB2831D63F415D967B3949009B86DB": "Add a firewall rule to allow traffic:", "content.p_AEC5A97F92BD4775A05509D5B242A965": "Set-Item WSMan:\\localhost\\Client\\TrustedHosts -Value '{IpAddress}'", "content.p_93D8BF649F0949629225336E95A246D0": "Note: Use the IP address of the target computer. Use the wildcard character (*) instead of an IP address to add all computers.", "step.step_scan_node_trustedhosts": "On the scan node, run the following command to add the target host to the TrustedHosts list:", "desc": [ { "content.note_http_recommendation": [ "content.p_http_recommendation" ] }, { "steps.steps_BA6D5CA06F6D465C98DC907DDCA4FCAC": [ "step.step_C8C77E6C6C9341149DB6CAC9812A8474", { "substeps.substepsalpha_BD6D57DA8D194D339C7C70BAF2F374A0": [ "substep.substep_7299DB8955B74E51B2FFB68C1613FEC7", "substep.substep_D93CDCCE03BC4377A75580E701DAE1E2", "substep.substep_62E86C101C4C4D2F9751929F198306A9", "substep.substep_9162DC146BBC4227B77AC06DD3D4E9A7" ] }, "step.step_371027B289FC4126A35B2D8AC64318E1", { "substeps.substepsalpha_C1C5269A5A744F60BE4E6BE38E66B66A": [ "substep.substep_B8BCDB18BDDC4719B8CF32664388D313", "substep.substep_3F4610DDFD7245F5A21D29C9B0F1A8A3" ] }, "step.step_B9E5DB09AF5447DBA6DA4AC82F81C355", { "substeps.substepsalpha_0A8696FF55B043F180E22DE0FF026D45": [ "substep.substep_543FDC71452F46AA93157DEBEB826F0E", "substep.substep_52D40F1AECC547B6A76D349B946615C2", "substep.substep_EC4CD9AE3A994DA7B9B1A951A22422F9" ] }, "step.step_72AB2831D63F415D967B3949009B86DB", { "substeps.substepsalpha_A045B762414A4223B1F44A2260951F5E": [ "substep.substep_3B7A97A5309C4D1D904D0653C7C0A542", "substep.substep_359E595E33AF4CE388B75B1DEF1A60D9", "substep.substep_741E815F0AB84DDEA611AEE5A4229A04", "substep.substep_38CCC51C6C38486298298BBBF2347474", "substep.substep_46056920ECCD4D78BDEC814AB3480436" ] }, "step.step_scan_node_trustedhosts", "content.p_AEC5A97F92BD4775A05509D5B242A965", { "content.note_93D8BF649F0949629225336E95A246D0": [ "content.p_93D8BF649F0949629225336E95A246D0" ] } ] } ] }, "task_DA407D9B14D44F58886BD1AD22E73C53-4.0-en.json": { "title": "title_C12E7AA9219246B8A44F3535511C2388", "title_C12E7AA9219246B8A44F3535511C2388": "Configuring the WinRM service to use HTTPS with a publicly signed certificate", "shortdesc": "shortdesc_200981F9868D4692874362A08A51D423", "shortdesc_200981F9868D4692874362A08A51D423": "After creating the dedicated WinRM user account for Elements Vulnerability Management, you need to configure the WinRM service on the machine where you want to run it. ", "content.p_8852095539ED40D295950F204B640661": "To set up the remote management configuration on a computer that uses a publicly signed certificate:", "content.p_62F418F3E5AD4FFBA304A8DF090EC4B3": "Set-WSManQuickConfig -UseSSL -Force", "content.p_D17FB127317B4827B48CFAFE636DC886": "Note: When the computer is on a public network, use the additional -SkipNetworkProfileCheck parameter , which enables a firewall rule for public networks as well.", "content.p_694BCB4503D748FDB54C7BA38EA0066E": "This command ensures that the WinRM service is running and is set up to start automatically, creates an HTTPS listener to accept WinRM requests, and creates a firewall exception for WinRM traffic.", "step.step_E672B8FF9D974D13BAFAC0152961BDBD": "Run the following command:", "content.p_23D9D254ACCF48E2B5E38045AA3D8301": "winrm set winrm/config/service/auth '@{Basic=\"true\"}'", "step.step_B66F2B66F31945E68B550B85E83CA82C": "If you are using Linux scan nodes, enable WinRM basic authentication:", "desc": [ "content.p_8852095539ED40D295950F204B640661", { "steps.steps_01A06A6CBFED4F4988687F4A5B91CB67": [ "step.step_E672B8FF9D974D13BAFAC0152961BDBD", "content.p_62F418F3E5AD4FFBA304A8DF090EC4B3", { "content.note_D17FB127317B4827B48CFAFE636DC886": [ "content.p_D17FB127317B4827B48CFAFE636DC886" ] }, "content.p_694BCB4503D748FDB54C7BA38EA0066E", "step.step_B66F2B66F31945E68B550B85E83CA82C", "content.p_23D9D254ACCF48E2B5E38045AA3D8301" ] } ] }, "task_8772A6A76D994406B4809EB264EB51EE-4.0-en.json": { "title": "title_EFC27ECC4760463D85531363E16A091F", "title_EFC27ECC4760463D85531363E16A091F": "Configuring the WinRM service to use HTTPS without a publicly signed certificate", "shortdesc": "shortdesc_8449C0F4DB694A539DCEF23032016877", "shortdesc_8449C0F4DB694A539DCEF23032016877": "If the computer does not use a publicly signed certificate, you need to perform some additional steps. ", "content.p_D29F755A52494612A80EB140E8B75B01": "If you are using a Windows version older than Windows 8/Windows Server 2012, you need to create a certificate on a separate, newer computer and then export the certificate to a file. Use the following commands to do this:", "content.p_E406AAA0C01C40D6B9FED2AC19427A12": "$cert = New-SelfSignedCertificate -CertstoreLocation ^
Cert:\\LocalMachine\\My -DnsName \"{ipAddress}\"
$password = ConvertTo-SecureString -String \"{password}\" -Force ^
-AsPlainText
Export-PfxCertificate -Cert $cert -FilePath \"{filePath}\" -Password ^
$password", "content.p_5FB22526CDD74929BB3898252E3E4D87": "", "content.p_6126EFEF35CA442EA91E1A1256CBDFEF": "Note: Use the IP address of the target computer.", "content.p_A8DF9370F3884D169CEE341A1E5E387F": "To set up the remote management configuration on a computer that does not use a publicly signed certificate, do all the following steps on the target Windows computer using PowerShell:", "content.p_A4F412CBA96F44C7B837B957E9DFECEB": "Set-Service -Name \"WinRM\" -StartupType Automatic -Status Running", "step.step_2F31E20D4E4D46B4ABBFE4AB23FE1425": "Start the WinRM service and set it to start automatically:", "content.p_31A8D7356F9E4372BC928A40542FD048": "For Windows 8/Windows Server 2012 and newer systems:", "content.p_C26F7ECF0E9B4A7BAD36BA53AB2DF93A": "$Cert = New-SelfSignedCertificate -CertstoreLocation ^
Cert:\\LocalMachine\\My -DnsName \"{ipAddress}\"", "substep.substep_38C1690EFD774F869A13FEA6536DDD5D": "Use the following PowerShell command to create the certificate:", "content.p_E09D8560857C4F0A9FCD7A9E126D4400": "$cert.Thumbprint", "substep.substep_4C69A0FDFB9A4279ADD5F878E2BB0D4D": "Use the following command to check the certificate's thumbprint, which you need when creating the WSMan HTTPS listener:", "content.p_0202CAFC61724C6E876E40981A232D13": "For older Windows OS versions, copy the previously exported certificate to the target computer and import it to a Personal certificate store:", "content.p_B07C49C0B5C24F539E3182FAF38A4B8C": "Note: To view certificates in the local machine store, you must use administrator privileges.", "substep.substep_083A70263FA5403B99CE0B4E622B6E5B": "Type mmc and press Enter.", "substep.substep_78E5C4702E5C4DF7A3FE72AD14577A89": "Select File > Add/Remove Snap In.", "substep.substep_C32E832EDD2444B7A286AC7D348AB462": "In the Available snap-ins dialog box, select Certificates.", "substep.substep_378C989953F244C49202EB2E6F41EBB8": "Click Add.", "substep.substep_318935E9243D4F279D2149B2F07526CB": "In the Certificates snap-in dialog box, select Computer account and then click Next.", "substep.substep_10AC789D8CEB40B4831EC12F37CA5561": "In the Select Computer dialog box, click Finish.", "substep.substep_51C8397817A44A1C8CF77E44D991B7FD": "In the Add/Remove Snap-in dialog box, click OK.", "substep.substep_B8AAF657EA654937A6E76AAAEBEB1B9F": "Select Certificates (Local Computer) > Personal, right-click and select All Tasks > Import.", "substep.substep_CB5BF67CDC144F69928574102D23F51A": "Browse for the copied certificate, then click Next.", "substep.substep_BFC7B7B1FE464548AD4B8FCF6970ADA9": "Enter the password for the certificate, then click Next.", "substep.substep_05678128AB4C4FF58DAE97F9FEA6BA68": "Click Finish.", "step.step_1D629A6A629441BC9AE0CD2DE38C93A2": "Generate a new self-signed certificate:", "content.p_76EB9380A0FC42B9B4564A8CD80EEC18": "New-Item -Path WSMan:\\LocalHost\\Listener -Transport HTTPS -Address * ^
-CertificateThumbPrint $Cert.Thumbprint –Force", "step.step_D338B0FE0E054CD7AC8103686047EA75": "Add a new WSMan HTTPS listener:", "content.p_B085F6EE5D4C467FA9913AB069CB0744": "For Windows 8/Windows Server 2012 and newer systems, use the following PowerShell command to create the firewall rule:", "content.p_6D47324BBDE04E40B3F0940E37089987": "New-NetFirewallRule -DisplayName \"Windows Remote Management ^
(HTTPS-In)\" -Name \"Windows Remote Management (HTTPS-In)\" -Profile ^
Any -LocalPort 5986 -Protocol TCP", "content.p_DC83DA264A874C54A58214B5FB862295": "For older Windows OS versions:", "substep.substep_2B06B8E88EBD4AD88F0F5A93DB3629DB": "Go to Control Panel > Windows Firewall > Advanced settings.", "substep.substep_F7BA97F54F4B44E2B949557F1A940ADF": "Add a new rule for inbound traffic that allows TCP port 5986 for the selected network profiles.", "step.step_9729F765135B4059A031C31B5202C46C": "Add a new firewall rule to allow WinRM HTTPS traffic:", "content.p_BB9CDCB8F77E43BEA238C27047681A87": "winrm set winrm/config/service/auth '@{Basic=\"true\"}'", "step.step_B66F2B66F31945E68B550B85E83CA82C": "If you are using Linux scan nodes, run the following PowerShell command on the target Windows computer to allow basic WinRM authentication:", "desc": [ "content.p_D29F755A52494612A80EB140E8B75B01", "content.p_E406AAA0C01C40D6B9FED2AC19427A12", { "content.note_6126EFEF35CA442EA91E1A1256CBDFEF": [ "content.p_6126EFEF35CA442EA91E1A1256CBDFEF" ] }, "content.p_A8DF9370F3884D169CEE341A1E5E387F", { "steps.steps_C87360AF17DA4F96A3FF89DFFBDD2665": [ "step.step_2F31E20D4E4D46B4ABBFE4AB23FE1425", "content.p_A4F412CBA96F44C7B837B957E9DFECEB", "step.step_1D629A6A629441BC9AE0CD2DE38C93A2", "content.p_31A8D7356F9E4372BC928A40542FD048", { "substeps.substepsalpha_785A187FAF6B487DB25018F8C4DFF6ED": [ "substep.substep_38C1690EFD774F869A13FEA6536DDD5D", "content.p_C26F7ECF0E9B4A7BAD36BA53AB2DF93A", "substep.substep_4C69A0FDFB9A4279ADD5F878E2BB0D4D", "content.p_E09D8560857C4F0A9FCD7A9E126D4400" ] }, "content.p_0202CAFC61724C6E876E40981A232D13", { "content.note_B07C49C0B5C24F539E3182FAF38A4B8C": [ "content.p_B07C49C0B5C24F539E3182FAF38A4B8C" ] }, { "substeps.substepsalpha_87462C24DAC641B68164CEBF5A8AB40E": [ "substep.substep_083A70263FA5403B99CE0B4E622B6E5B", "substep.substep_78E5C4702E5C4DF7A3FE72AD14577A89", "substep.substep_C32E832EDD2444B7A286AC7D348AB462", "substep.substep_378C989953F244C49202EB2E6F41EBB8", "substep.substep_318935E9243D4F279D2149B2F07526CB", "substep.substep_10AC789D8CEB40B4831EC12F37CA5561", "substep.substep_51C8397817A44A1C8CF77E44D991B7FD", "substep.substep_B8AAF657EA654937A6E76AAAEBEB1B9F", "substep.substep_CB5BF67CDC144F69928574102D23F51A", "substep.substep_BFC7B7B1FE464548AD4B8FCF6970ADA9", "substep.substep_05678128AB4C4FF58DAE97F9FEA6BA68" ] }, "step.step_D338B0FE0E054CD7AC8103686047EA75", "content.p_76EB9380A0FC42B9B4564A8CD80EEC18", "step.step_9729F765135B4059A031C31B5202C46C", "content.p_B085F6EE5D4C467FA9913AB069CB0744", "content.p_6D47324BBDE04E40B3F0940E37089987", "content.p_DC83DA264A874C54A58214B5FB862295", { "substeps.substepsalpha_C93B2C58590B487D9996FFD82057AF49": [ "substep.substep_2B06B8E88EBD4AD88F0F5A93DB3629DB", "substep.substep_F7BA97F54F4B44E2B949557F1A940ADF" ] }, "step.step_B66F2B66F31945E68B550B85E83CA82C", "content.p_BB9CDCB8F77E43BEA238C27047681A87" ] } ] }, "task_74CC24D34E374B59B3A64740A7C919E3-4.0-en.json": { "title": "title_62589795601E4AA081D168829F288B7E", "title_62589795601E4AA081D168829F288B7E": "Troubleshooting Windows authenticated scanning (WinRM)", "shortdesc": "shortdesc_C64B64A664EF4C9BAE73AB04ACA5CEA5", "shortdesc_C64B64A664EF4C9BAE73AB04ACA5CEA5": "It is recommended that you verify the functionality of the new account from a remote host before using the account for Windows authenticated scanning. ", "content.p_51F843A8559E468BB62C33EB447CA6EB": "", "content.p_0E460C3F62B442FEB1F467FB6C029F94": "Note: Run the commands described in steps 1 - 5 directly on the target machine. This verifies that Windows Remote Management (WinRM) is configured properly on that machine and has sufficient permissions so that Windows is ready for the authenticated scan.", "content.p_FB705F7E8919405DA2BCB1ECA3915BF8": "Get-Host | Select-Object Version", "step.step_FAFF22A415EE4A049F984B2F06EA415B": "Make sure that PowerShell 5 or newer is installed:", "content.p_BDEAFC8BE1C34A398005CC288A1FD983": "(Get-PSSessionConfiguration -Name Microsoft.PowerShell).Permission", "step.step_5ED8F91E9FD8490AAD0AD04F3CBB55B0": "Check the WinRM permissions for user groups or the individual user account:", "content.p_C664E81E26EB44B8B2CD85C3F9A88DD5": "Get-Service -Name \"WinRM\"", "step.step_E3C091C5AE1146FAAC44EA4130FBF1B1": "Make sure that the WinRM service is running:", "content.p_B49EC18ECD9E4284A7C97EBAF36A2354": "winrm enumerate winrm/config/listener", "step.step_DB823730526947D1A27A7FC082EA9497": "Make sure that the WinRM HTTPS listener is configured:", "content.p_76271146E6E24C5CA7879EF7454D7DA9": "winrm get winrm/config/service", "step.step_F1FF1F99EA24423FAA3D53AB3CD7DB25": "Check the detailed WinRM configuration:", "content.p_F181287C55D3406CB34031A16AEAA743": "Note: If possible, run this command on a machine with Scan Node Agent installed. This shows you if it is possible to set the remote session and run the command from a Scan Node to a target Windows IP ($ip) using the credentials for the authenticated scan account.", "content.p_052FC47845344B7A99A80A7932980E3B": "$ip = \"{ip}\"
$user = \"{username}\"
$pass = \"{password}\" | ConvertTo-SecureString -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential ($user, $pass)

$pso = New-PSSessionOption -SkipCACheck -SkipCNCheck
Invoke-Command -ComputerName $ip -Credential $cred -Authentication Negotiate -Port 5986 -UseSSL -SessionOption $pso {
if ((Get-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').Property.Contains('ProductName'))
{
(Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name 'ProductName').ProductName
}
}", "subchoice.choice_F5B09C4CAA8F45D08157B5589754DFEA": "Windows scan node with explicit credentials and WinRM HTTPS listener in use:", "content.p_BE8998F38C044F0B90D48F16B1423358": "$ip = \"{ip}\"
$user = \"{username}\"
$pass = \"{password}\" | ConvertTo-SecureString -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential ($user, $pass)

$pso = New-PSSessionOption -SkipCACheck -SkipCNCheck
Invoke-Command -ComputerName $ip -Credential $cred -Authentication Basic -Port 5986 -UseSSL -SessionOption $pso {
if ((Get-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').Property.Contains('ProductName'))
{
(Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name 'ProductName').ProductName
}
}", "subchoice.choice_49A4F5407394403F90A8393D840C819E": "Linux scan node with explicit credentials and WinRM HTTPS listener in use:", "content.p_D285D8D75FBA4DF4A191408A6F3DE448": "$ip = \"{ip}\"
$user = \"{username}\"
$pass = \"{password}\" | ConvertTo-SecureString -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential ($user, $pass)

$pso = New-PSSessionOption -SkipCACheck -SkipCNCheck
Invoke-Command -ComputerName $ip -Credential $cred -Authentication Negotiate -Port 5985 -SessionOption $pso {
if ((Get-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').Property.Contains('ProductName'))
{
(Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name 'ProductName').ProductName
}
}", "subchoice.choice_CE85D3702A36400E810101EB20AD19C9": "Windows scan node with explicit credentials and WinRM HTTP listener in use:", "content.p_6C143EB114CE4A76B11FC34D187DE929": "$ip = \"{ip}\"

$pso = New-PSSessionOption -SkipCACheck -SkipCNCheck
Invoke-Command -ComputerName $ip -Authentication NegotiateWithImplicitCredential -Port 5986 -UseSSL -SessionOption $pso {
if ((Get-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').Property.Contains('ProductName'))
{
(Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name 'ProductName').ProductName
}
}", "subchoice.choice_FDED8FDE782E4C07BA0F5B0BA4BCC5BE": "Windows scan node with scan node service account credentials and WinRM HTTPS listener in use:", "content.p_15C1E0D93FD44C2BA04DCF73BAB3B9EB": "$ip = \"{ip}\"

$pso = New-PSSessionOption -SkipCACheck -SkipCNCheck
Invoke-Command -ComputerName $ip -Authentication NegotiateWithImplicitCredential -Port 5985 -SessionOption $pso {
if ((Get-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').Property.Contains('ProductName'))
{
(Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name 'ProductName').ProductName
}
}", "subchoice.choice_872AA105619F4C25B0EC7FC284E7CE92": "Windows scan node with scan node service account credentials and WinRM HTTP listener in use:", "content.p_DC6AD2619BB3432389F1D54D93B53A6C": "Each of these scripts outputs the OS version of the target host.", "step.step_591A392687A8449AB225127871FE0E93": "Run the corresponding PowerShell script for your configuration from a remote host (for example, from the WithSecure Elements VM Scan Node if possible):", "content.p_7BB1482665F1485798663AA993A4150E": "Known issues:", "choice.choice_724F36BCF0884F1494050EF0F063E7D9": "Scanning for Windows updates fails on Windows 10 (versions 1703, 1709 and 1803) - Due to a bug related to accessing WMI remotely in these versions of Windows 10, scanning for Windows updates may fail. It results in the Microsoft Windows updates scanning failed (1023713) finding in the System Scan report and Access is denied (0x80070005) errors in the System Scan log file. To solve the issue, install the recent cumulative update on the target machine. The issue is not present in the earlier and later versions of Windows 10.", "choice.choice_A995ECEE941C425499FF2367FA9740D4": "While connecting to a target machine if the Access is denied error is logged when scanning Windows Server 2019 or newer machine (older versions should not be affected by this issue) by using a local administrator account and Windows Scan Node Agent is in use, make sure that HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\SystemLocalAccountTokenFilterPolicy is set to value 1 in the target system registry.", "desc": [ { "content.note_0E460C3F62B442FEB1F467FB6C029F94": [ "content.p_0E460C3F62B442FEB1F467FB6C029F94" ] }, { "steps.steps_1B508147055442FDAA27A4CAE6435D3F": [ "step.step_FAFF22A415EE4A049F984B2F06EA415B", "content.p_FB705F7E8919405DA2BCB1ECA3915BF8", "step.step_5ED8F91E9FD8490AAD0AD04F3CBB55B0", "content.p_BDEAFC8BE1C34A398005CC288A1FD983", "step.step_E3C091C5AE1146FAAC44EA4130FBF1B1", "content.p_C664E81E26EB44B8B2CD85C3F9A88DD5", "step.step_DB823730526947D1A27A7FC082EA9497", "content.p_B49EC18ECD9E4284A7C97EBAF36A2354", "step.step_F1FF1F99EA24423FAA3D53AB3CD7DB25", "content.p_76271146E6E24C5CA7879EF7454D7DA9", "step.step_591A392687A8449AB225127871FE0E93", { "content.note_F181287C55D3406CB34031A16AEAA743": [ "content.p_F181287C55D3406CB34031A16AEAA743" ] }, { "subchoices.choices_EC2D379C800B4D2EAB52A81AD62F0DF4": [ "subchoice.choice_F5B09C4CAA8F45D08157B5589754DFEA", "content.p_052FC47845344B7A99A80A7932980E3B", "subchoice.choice_49A4F5407394403F90A8393D840C819E", "content.p_BE8998F38C044F0B90D48F16B1423358", "subchoice.choice_CE85D3702A36400E810101EB20AD19C9", "content.p_D285D8D75FBA4DF4A191408A6F3DE448", "subchoice.choice_FDED8FDE782E4C07BA0F5B0BA4BCC5BE", "content.p_6C143EB114CE4A76B11FC34D187DE929", "subchoice.choice_872AA105619F4C25B0EC7FC284E7CE92", "content.p_15C1E0D93FD44C2BA04DCF73BAB3B9EB" ] }, "content.p_DC6AD2619BB3432389F1D54D93B53A6C" ] }, "content.p_7BB1482665F1485798663AA993A4150E", { "choices.ul_D984069D83094066A932402990E0E07D": [ "choice.choice_724F36BCF0884F1494050EF0F063E7D9", "choice.choice_A995ECEE941C425499FF2367FA9740D4" ] } ] }, "concept_C349B433D1FB4AF0B9F6326ADC5B59E5-4.0-en.json": { "title": "title_69FA017165B24E13B25C8390EAC96D13", "title_69FA017165B24E13B25C8390EAC96D13": "Windows authenticated scanning (RPC)", "shortdesc": "shortdesc_49FBC5E391E1412A8A2D5EB9E1806C02", "shortdesc_49FBC5E391E1412A8A2D5EB9E1806C02": "This section provides instructions on how to prepare your internal network for authenticated scanning using Remote Procedure Call (RPC). ", "content.p_F661DDBFE8DF49B3824F3B620A0EFBB5": "", "content.p_F0F0157F1B4B4B288548D69393E5A166": "Warning: The authenticated scanning using RPC is a deprecated method for Windows authenticated scanning. This authentication method will be decommissioned soon, and we do not recommend its use any more. We suggest that you start using Windows authenticated scanning (WinRM) instead.", "content.p_4C0EBE3F49C4409E8D2237B2E7AB2BA8": "WithSecure Elements Vulnerability Management support two ways of authenticating to Windows systems:", "choice.choice_3DF8717DD616461BBF6215812679004D": "Use the scan node service account credentials (recommended)", "choice.choice_C4771B08467D4F7EB0B4FA574219A33F": "Specify credentials explicitly in the WithSecure Elements portal", "content.p_FE116EBDE1AF4F3BBA8590C1C47B7D68": "WithSecure Elements Vulnerability Management uses Windows Update Agent API (WUA) to check for missing Windows patches. To check which patches are missing, WUA must get the list of available patches from one of the following sources:", "choice.choice_F6D8A8AE206D4891AE9A8462F68FFB2F": "Microsoft's own Windows Update Service (internet access required)", "choice.choice_D61BA3AC80874F45A29A6812DC651927": "An internal network WSUS service", "choice.choice_4D408D447ECF4101BE67D6CC9CDB6FE1": "A Windows Updates database file", "content.p_C1A498B921D34F3AB9B1D02CB3F03190": "The first two options (Windows Update Service and WSUS) can be turned on or off in the WithSecure Elements Vulnerability Management scan templates. If allowed, the scanned Windows system will decide (based on its configuration) which of the two methods to use.", "content.p_0F551099582D4354868FE81668DD5DB9": "The third option (Windows Updates database file) can be used as a failover option if the target Windows systems do not have network access to Windows Update Service or WSUS. When it is on, WithSecure Elements Vulnerability Management can check for missing Windows patches by uploading the Windows Updates database file (wsusscn2.cab) onto the target system's temp folder (%SystemRoot%\\Temp\\MBSA\\Cache\\). Once uploaded, WUA uses this file to check for missing Windows patches without accessing the internet.", "content.p_029F36433CCD444298BAA74E15619F17": "Besides checking for missing Windows patches, WithSecure Elements Vulnerability Management can also detect vulnerabilities related to common third-party software. The list of third-party software is fetched from Windows Registry. You must give the scan node the permission to read registry keys and turn on Remote Registry Service on the target Windows systems to use this feature.", "desc": [ { "content.note_F0F0157F1B4B4B288548D69393E5A166": [ "content.p_F0F0157F1B4B4B288548D69393E5A166" ] }, "content.p_4C0EBE3F49C4409E8D2237B2E7AB2BA8", { "choices.ul_83376B234C854E3E8130B66139A04236": [ "choice.choice_3DF8717DD616461BBF6215812679004D", "choice.choice_C4771B08467D4F7EB0B4FA574219A33F" ] }, "content.p_FE116EBDE1AF4F3BBA8590C1C47B7D68", { "choices.ul_696CEB14B40D4A7DAE33C9C9BB965CFD": [ "choice.choice_F6D8A8AE206D4891AE9A8462F68FFB2F", "choice.choice_D61BA3AC80874F45A29A6812DC651927", "choice.choice_4D408D447ECF4101BE67D6CC9CDB6FE1" ] }, "content.p_C1A498B921D34F3AB9B1D02CB3F03190", "content.p_0F551099582D4354868FE81668DD5DB9", "content.p_029F36433CCD444298BAA74E15619F17" ] }, "concept_23D8AE9ED39742308E4F3E35E540CF0C-4.0-en.json": { "title": "title_6623CD6774BD4E08BC05426C21DEA9B8", "title_6623CD6774BD4E08BC05426C21DEA9B8": "Configuring Windows authenticated scanning (RPC)", "shortdesc": "shortdesc_8C0DA838B8EC479E8102E19122D6D460", "shortdesc_8C0DA838B8EC479E8102E19122D6D460": "Before applying changes, WithSecure recommends that you discuss all potential changes to the Group Policy with your network administrator. For more information about Group Policy, refer to your Microsoft documentation on Group Policy deployment. ", "content.p_9EC8C5E8F83F4207A5B4D6D87DFEBF7F": "The following summarizes the requirements for enabling authenticated scanning for Windows:", "subchoice.choice_D1A3E009CC9045CD9E2BABF92E015855": "An Active Directory user account added to the local administrators group (recommended)", "subchoice.choice_2643F97F63BA4281B5077E801B82B71D": "Built-in administrator user account", "subchoice.choice_3C7986107DF74A22AC37261364D5C5A1": "Local user account added to local administrators group with Admin Approval Mode disabled", "choice.choice_CBD5699B5004442BA660DF5A9C8D3352": "A user account must meet one of the following requirements:", "subchoice.choice_E5A8650CB4884E5BB3C50412AF706668": "Inbound network traffic to the RPC Endpoint Mapper", "subchoice.choice_485A99A0CDE14562AAA9EDCFAC6024C8": "Inbound network traffic to the RPC Dynamic Ports", "subchoice.choice_B1412B8F34D3410DB85A4AC8E28AA725": "Inbound network traffic to TCP 445 (SMB / CIFS) and TCP 135 (RPC)", "subsubchoice.choice_B19558CDDC5447E8A2454B475CB7FE37": "Enable Remote Registry Service (or allow the scan node to start the service automatically during the scan)", "subsubchoice.choice_97BE3EF3C0534CBE87CF841381270CD4": "Grant read access to registry keys", "subchoice.choice_8587ACCBA8AD469FA8961F41F6F93B89": "Optional (only required to check for vulnerabilities in third-party software):", "content.p_802A9769A8F445E7874457F3B7BE1E96": "Note: During the scan, the scan node will copy the database file to the %SystemRoot%\\Temp\\MBSA\\Cache\\ folder and delete it once the scan has completed.", "subsubchoice.choice_6A48DBA0535542258CCD8DDBAC8B6314": "The network share name ADMIN$ must point to %SystemRoot% (e.g. C:\\Windows). Use the net share command to verify this.", "subchoice.choice_7E681E8FABEF4FF7BC5FFAAF2B694A1F": "Optional (only required when a Windows Updates database file is used for scanning):", "choice.choice_4B64D06D6DA548BDBB4946326E3C80BE": "Windows configuration requirements (preferably managed via GPOs)", "desc": [ "content.p_9EC8C5E8F83F4207A5B4D6D87DFEBF7F", { "choices.ul_1FB64377E3744F2DACB629E211FEF0CC": [ "choice.choice_CBD5699B5004442BA660DF5A9C8D3352", { "subchoices.ul_D16A9C6DF3BC48BD8299CE450BB838C2": [ "subchoice.choice_D1A3E009CC9045CD9E2BABF92E015855", "subchoice.choice_2643F97F63BA4281B5077E801B82B71D", "subchoice.choice_3C7986107DF74A22AC37261364D5C5A1" ] }, "choice.choice_4B64D06D6DA548BDBB4946326E3C80BE", { "subchoices.ul_502D902C08B44EB589320FE31D5D13A9": [ "subchoice.choice_E5A8650CB4884E5BB3C50412AF706668", "subchoice.choice_485A99A0CDE14562AAA9EDCFAC6024C8", "subchoice.choice_B1412B8F34D3410DB85A4AC8E28AA725", "subchoice.choice_8587ACCBA8AD469FA8961F41F6F93B89", { "subsubchoices.ul_E47B30DDB00C42CFB2B985C9EAAA542E": [ "subsubchoice.choice_B19558CDDC5447E8A2454B475CB7FE37", "subsubchoice.choice_97BE3EF3C0534CBE87CF841381270CD4" ] }, "subchoice.choice_7E681E8FABEF4FF7BC5FFAAF2B694A1F", { "subsubchoices.ul_9A5FF65211334EF08406552773FFCEF8": [ "subsubchoice.choice_6A48DBA0535542258CCD8DDBAC8B6314", { "content.note_802A9769A8F445E7874457F3B7BE1E96": [ "content.p_802A9769A8F445E7874457F3B7BE1E96" ] } ] } ] } ] } ] }, "task_0514B7D0D4CD4C92939A92892FF47C8D-4.0-en.json": { "title": "title_CCFD16D756E3462093B944D51CA22D02", "title_CCFD16D756E3462093B944D51CA22D02": "Create a Windows domain account", "shortdesc": "shortdesc_1EC124E5FA624948AE1B4000EE11B48E", "shortdesc_1EC124E5FA624948AE1B4000EE11B48E": "To create a new domain account, you may use the command given here, which must be executed using administrator credentials. ", "step.step_8E8ADB10C5BE43A7A8694056BCB6D2A3": "Log in as an administrator and open a command prompt with administrative privileges.", "content.p_0708A4FD1DAF43D2BA705F74813852DA": "dsadd user \"cn=radar_account,cn=users,dc=ORGANIZATION,dc=COM\" -samid \\
radar_account -upn radar_account@ORGANIZATION.COM -pwd PASSWORD \\
-pwdneverexpires yes -mustchpwd no -fn radar_account -ln \\
fsecure_radar -display \"Radar Account\" -disabled no", "step.step_F90F520CE3444D2984B0E96B57926078": "Adjust the following command so it fits your organization and execute it:", "step.step_A7218C85E94A40229151B5C5FB1F48E3": "If possible, configure the user account so that the password does not expire.", "content.p_949BDAFF8ABC40B3917EEE940A8A3A4D": "It is recommended that you use this domain account to run the Windows Service (WithSecure Elements VM Scan Node Agent) and authenticate to the scanned Windows systems.", "desc": [ { "steps.steps_E9B25E6CCFDA408FB73B88D308867661": [ "step.step_8E8ADB10C5BE43A7A8694056BCB6D2A3", "step.step_F90F520CE3444D2984B0E96B57926078", "content.p_0708A4FD1DAF43D2BA705F74813852DA", "step.step_A7218C85E94A40229151B5C5FB1F48E3" ] }, "content.p_949BDAFF8ABC40B3917EEE940A8A3A4D" ] }, "task_9A0EB476D36946E3A1E46099C47B1866-4.0-en.json": { "title": "title_D0CE42DF645A4B1A96CBBAD0D0E1D59A", "title_D0CE42DF645A4B1A96CBBAD0D0E1D59A": "Disable Admin Approval Mode", "shortdesc": "shortdesc_3529E1BB4A0641DEADDC06DB3D0CCDCF", "shortdesc_3529E1BB4A0641DEADDC06DB3D0CCDCF": "This step can be skipped if you are using a domain account (recommended) or a built-in local administrator account to authenticate to Windows systems. ", "content.p_CF3B282F234844B7A7DEFF2498D34696": "This step is only required if WithSecure Elements Vulnerability Management is configured to use a local user account and added to the local administrator’s group. To disable the Admin Approval Mode, do the following:", "step.step_DBB9D07573704CFAB045989D1922AFB8": "Start secpol.msc.", "step.step_CB186056C16C48A1A06FDD8BF65DA240": "Go to Security Settings > Local Policies > Security Options and disable the User Account Control: Run all administrators in the Admin Approval Mode policy.", "step.step_5DA73F14FC504582B220CFF2FC296C4A": "Restart the computer.", "desc": [ "content.p_CF3B282F234844B7A7DEFF2498D34696", { "steps.steps_D5AB7E97BD4848A385F34DC595AE4FC1": [ "step.step_DBB9D07573704CFAB045989D1922AFB8", "step.step_CB186056C16C48A1A06FDD8BF65DA240", "step.step_5DA73F14FC504582B220CFF2FC296C4A" ] } ] }, "concept_F882E4ED4830486FBC501356153DDB93-4.0-en.json": { "title": "title_B1E018F5CEA949D9B0A20A863BDC1F2B", "title_B1E018F5CEA949D9B0A20A863BDC1F2B": "Configure GPO policy", "shortdesc": "shortdesc_E8C7DCDC77BB4C02A202210E8D6D1B4C", "shortdesc_E8C7DCDC77BB4C02A202210E8D6D1B4C": "The best practice Group Policy settings for authenticated scanning of Windows systems are described in this section. ", "content.p_F80C6774792B4AA38260E3DA1FD672A3": "Please consult your network administrator before making any changes to the Group Policy, as changes may have an adverse impact on your network operations, depending on your network configuration and security policy. Note that detailed documentation for many of the Group Policy settings listed below are available online when using the Group Policy Editor.", "content.p_3440E02E110F442DB8596FA7825829CB": "", "content.p_0CA3D3FA24DF49D1B86C2E97DE6DC2CD": "Important: We highly recommended that you discuss any potential changes to the Group Policy with your network administrator before implementing any alterations, as your local network configurations may depend on certain settings being in place. This service does not verify that these settings are appropriate for your network. If you do make any Group Policy changes, it may take several hours before the changes take effect on the client.", "content.p_4CB6C673767E46A3B706AB425D5DC8F4": "For more information, please refer to your Microsoft documentation on Group Policy deployment.", "content.p_06126326509C449D87BD8258C7261133": "It is recommended that you create a dedicated Windows user account (such as \"WithSecure_Elements_Vulnerability_Management_account\") to be used solely by WithSecure VM scan nodes.", "desc": [ "content.p_F80C6774792B4AA38260E3DA1FD672A3", { "content.note_0CA3D3FA24DF49D1B86C2E97DE6DC2CD": [ "content.p_0CA3D3FA24DF49D1B86C2E97DE6DC2CD" ] }, "content.p_4CB6C673767E46A3B706AB425D5DC8F4", "content.p_06126326509C449D87BD8258C7261133" ] }, "task_FAF42EBFA66D4DC89392EC38024BD6DE-4.0-en.json": { "title": "title_B7689FA2C16845D4BEC72BF566440229", "title_B7689FA2C16845D4BEC72BF566440229": "Create a new Group Policy object", "shortdesc": "shortdesc_23B11425FECC4EC78D21F9E61ACB08C4", "shortdesc_23B11425FECC4EC78D21F9E61ACB08C4": "", "step.step_DBBCC5AB607D42B483804CB1B792E3FA": "Go to Start > Administrative Tools > Group Policy Management.", "step.step_007C6EF8E7AE4C5280A2DEBE04BE76A1": "Right-click Domains and select Create a GPO in this domain, and link it here.", "step.step_61C188ADD96349CCBB0C0D81EFBEF429": "Enter Elements Vulnerability Management as the required name and click OK.", "content.p_2672CFB9341E4BDEA318C23029DC4BED": "You can now edit this GPO in the Group Policy Management Editor, where you should perform the next steps.", "step.step_19707DB8C2384335AC3571A3AC32A6AE": "Right-click the created GPO (Elements Vulnerability Management) and select Edit.", "content.p_2F5B502D88134DCB9EC15062AA9877A8": "Remember to add all computers to be scanned to your security filtering.", "desc": [ { "steps.steps_7193FE57205C4C34A7B3ED2EFE934F55": [ "step.step_DBBCC5AB607D42B483804CB1B792E3FA", "step.step_007C6EF8E7AE4C5280A2DEBE04BE76A1", "step.step_61C188ADD96349CCBB0C0D81EFBEF429", "step.step_19707DB8C2384335AC3571A3AC32A6AE", "content.p_2672CFB9341E4BDEA318C23029DC4BED" ] }, "content.p_2F5B502D88134DCB9EC15062AA9877A8" ] }, "task_2F652F974F4A41B79E3EB4E367CD3E8A-4.0-en.json": { "title": "title_D89A6C414FAC4F499E6853DB7AD66164", "title_D89A6C414FAC4F499E6853DB7AD66164": "Add rule to allow traffic to the RPC Endpoint Mapper", "shortdesc": "shortdesc_06068BC96CC6499D985904C1FBF402BD", "shortdesc_06068BC96CC6499D985904C1FBF402BD": "", "step.step_A57B511E667141488BE84379B6651D58": "Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall with Advanced Security - LDAP > Inbound Rules.", "step.step_099B262758FA4E699B612B98D2C35B7C": "Right-click and choose New Rule.", "step.step_379705C871E04EE3A478D01D17685930": "Choose Custom and click Next.", "step.step_6257512EC2CA44DBB69E421D5A1FE35E": "Choose This Program Path and enter %systemroot%\\system32\\svchost.exe.", "step.step_3878C8F5FF42402F9FE1A8922F9E235B": "Choose Customize.", "step.step_211F31840F5F46E9AAEF1F9CC51B9635": "Choose Apply to this service, then select Remote Procedure Call (RPC) with the short name RpcSs and click OK.", "step.step_3DF3EAF3C9464EA39053D505336055B5": "Click Next and accept the pop-up warning.", "step.step_699E81F4062C4BDFABEAB1B9D8D1D5A7": "Select TCP as the Protocol type.", "step.step_DB6022D62E8F413AB1881117822B777C": "Select RPC Endpoint Mapper as the Local Port and click Next.", "step.step_8D1678CD00BA4C82970C45EEAFDDBAC1": "Specify the IP address of the scan node on the remote IP addresses list or choose Any IP address and then click Next.", "step.step_624FEAF4D26F400FB5C3EFD5C8976F6C": "Select Allow the connection and click Next.", "step.step_A9FC8A7148C54988BCC71336E862D1F9": "Select the checkboxes that fulfill the machine connection conditions and click Next.", "step.step_895352DE5B0E4C1CACC62BC5636F5D10": "Specify Radar RPC Endpoint Mapper as the name and click Finish.", "desc": [ { "steps.steps_38F30967E51E488C998CFA20B133798A": [ "step.step_A57B511E667141488BE84379B6651D58", "step.step_099B262758FA4E699B612B98D2C35B7C", "step.step_379705C871E04EE3A478D01D17685930", "step.step_6257512EC2CA44DBB69E421D5A1FE35E", "step.step_3878C8F5FF42402F9FE1A8922F9E235B", "step.step_211F31840F5F46E9AAEF1F9CC51B9635", "step.step_3DF3EAF3C9464EA39053D505336055B5", "step.step_699E81F4062C4BDFABEAB1B9D8D1D5A7", "step.step_DB6022D62E8F413AB1881117822B777C", "step.step_8D1678CD00BA4C82970C45EEAFDDBAC1", "step.step_624FEAF4D26F400FB5C3EFD5C8976F6C", "step.step_A9FC8A7148C54988BCC71336E862D1F9", "step.step_895352DE5B0E4C1CACC62BC5636F5D10" ] } ] }, "task_634DEC31FB56434D8692BFEACB77829D-4.0-en.json": { "title": "title_CA101E4F94E242DFA6E4ABFF362C1BE8", "title_CA101E4F94E242DFA6E4ABFF362C1BE8": "Add rule to allow traffic to the RPC Dynamic Ports", "shortdesc": "shortdesc_0200422DA5754C328CA330EEDCDA1985", "shortdesc_0200422DA5754C328CA330EEDCDA1985": "", "step.step_8AE6872E308B44908C2F706CFF2317FD": "Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall with Advanced Security - LDAP > Inbound Rules.", "step.step_4664D746E91D43288DC21F9DD2A8D2A6": "Right-click and choose New Rule.", "step.step_E936D58E37C94DC5B4F084CF21897B49": "Choose Custom and click Next.", "step.step_BA61EDFF68D44DFE9E200D79990BF9BA": "Choose All programs and click Next.", "step.step_573D5CB2323D47EABF24442870CFE31F": "Select TCP as the Protocol type.", "step.step_8C1F456C525F48FF9F4F2C500AE429EB": "Select RPC Dynamic Ports as the Local Port and click Next.", "step.step_3C747202946D4B6E993D2915D2003696": "Specify the IP address of the scan node on the remote IP addresses list or choose Any IP address and then click Next.", "step.step_6DEFB31508474857A0CA993F1EAB23C5": "Select Allow the connection and click Next.", "step.step_F150FC866E934CED87F21F78266576C6": "Select the checkboxes that fulfill the machine connection conditions and click Next.", "step.step_69144157DF92476C9BC86324AC153072": "Specify Radar RPC Dynamic Ports as the name and click Finish.", "desc": [ { "steps.steps_3ECA2232464F40E880CB095BABD58592": [ "step.step_8AE6872E308B44908C2F706CFF2317FD", "step.step_4664D746E91D43288DC21F9DD2A8D2A6", "step.step_E936D58E37C94DC5B4F084CF21897B49", "step.step_BA61EDFF68D44DFE9E200D79990BF9BA", "step.step_573D5CB2323D47EABF24442870CFE31F", "step.step_8C1F456C525F48FF9F4F2C500AE429EB", "step.step_3C747202946D4B6E993D2915D2003696", "step.step_6DEFB31508474857A0CA993F1EAB23C5", "step.step_F150FC866E934CED87F21F78266576C6", "step.step_69144157DF92476C9BC86324AC153072" ] } ] }, "task_CFF0E38A5A6647B8969E6B696DA6F447-4.0-en.json": { "title": "title_0CBE9597E54A4FEE85015DEAF9E15874", "title_0CBE9597E54A4FEE85015DEAF9E15874": "Add rule to allow traffic to SMB/CIFS and RPC", "shortdesc": "shortdesc_E998A41C787A438C82F85DB94131FC1E", "shortdesc_E998A41C787A438C82F85DB94131FC1E": "", "content.p_4E850F1EAA4A4BD2A5D94BD2017B93EE": "To add a firewall rule to allow TCP/445 (SMB/CIFS) and TCP/135 (RPC):", "step.step_DAF746D3D811400B9B3F47443CA72E65": "Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall with Advanced Security - LDAP > Inbound Rules.", "step.step_61CD80659C184C24B2F27B061CBB4A40": "Right-click and choose New Rule.", "step.step_07BA9C817BAE4E0E983DCB114027DD2C": "Choose Port and click Next.", "step.step_DDD88556F10A4DC4859F3008C317D6A3": "Choose TCP and at specific local ports enter 135, 445, then click Next.", "step.step_5B3861DA252E4D06B392071819D399DA": "Select Allow the connection and click Next.", "step.step_D902DB93C750448E8ECCB67DA5964D72": "Choose Domain (or other, depending on your knowledge), then click Next.", "step.step_28F4C499ED4146B49E13E0833AD4A88B": "Specify Radar Scanning as the name and click Finish.", "desc": [ "content.p_4E850F1EAA4A4BD2A5D94BD2017B93EE", { "steps.steps_BF62CDD90E1F4E3B8F741A22F4F5C370": [ "step.step_DAF746D3D811400B9B3F47443CA72E65", "step.step_61CD80659C184C24B2F27B061CBB4A40", "step.step_07BA9C817BAE4E0E983DCB114027DD2C", "step.step_DDD88556F10A4DC4859F3008C317D6A3", "step.step_5B3861DA252E4D06B392071819D399DA", "step.step_D902DB93C750448E8ECCB67DA5964D72", "step.step_28F4C499ED4146B49E13E0833AD4A88B" ] } ] }, "task_61831539482F4EF29030013104D5CFFC-4.0-en.json": { "title": "title_95F2DC4695D8442BA785565B33A6E7A9", "title_95F2DC4695D8442BA785565B33A6E7A9": "Enable Remote Registry service", "shortdesc": "shortdesc_3A16BF29862341DA895E4690AF895770", "shortdesc_3A16BF29862341DA895E4690AF895770": "", "content.p_D4C44482E37546FFAA73F979C61FED07": "To configure the Remote Registry service:", "step.step_008823D82345418E9E9EA4456EDA36C5": "Log on using an account with local administrator rights.", "step.step_77CD488AF7F841ED94BAA7CED184D245": "Press the Windows key + R to open the Run command window.", "step.step_1395DCB6C6AA485191191DEF8DA32582": "Type services.msc and press Enter.", "step.step_DE8281F8695343A1AD1DEEFE1EE26DE2": "Right-click Remote Registry service and then select Properties from the menu", "step.step_39947ADBF5E746AF9B586423EAE99EA4": "In the General tab, open the Startup Type drop-down menu and select Automatic.", "step.step_A385B3B334E64EF8A3FB8BC3D72B4F18": "Select Apply and then select Start.", "content.p_E8FD824B9E3C421F9E72F2A1DB5EF2C2": "", "step.step_06E15BEE87324A898BCA0B62149EC433": "Click OK after the Remote Registry service has started.", "desc": [ "content.p_D4C44482E37546FFAA73F979C61FED07", { "steps.steps_16D540ECF1E545948F99E2192A6CC48C": [ "step.step_008823D82345418E9E9EA4456EDA36C5", "step.step_77CD488AF7F841ED94BAA7CED184D245", "step.step_1395DCB6C6AA485191191DEF8DA32582", "step.step_DE8281F8695343A1AD1DEEFE1EE26DE2", "step.step_39947ADBF5E746AF9B586423EAE99EA4", "step.step_A385B3B334E64EF8A3FB8BC3D72B4F18", "step.step_06E15BEE87324A898BCA0B62149EC433", "content.p_E8FD824B9E3C421F9E72F2A1DB5EF2C2" ] } ] }, "task_37AF1029EF4544148A6ED02B15A5A6EE-4.0-en.json": { "title": "title_5EC16F5238804BB196DD930C9F494475", "title_5EC16F5238804BB196DD930C9F494475": "Grant read access to registry keys", "shortdesc": "shortdesc_875D2D3644FC439B9B91DBBB0BA104CE", "shortdesc_875D2D3644FC439B9B91DBBB0BA104CE": "", "step.step_54015CBC50FC41B5B3D5FC4FA4620F2D": "Go to Computer Configuration > Policies > Windows Settings > Security Settings > Registry.", "step.step_79B659F2E6B14449AAF54159D1F27E6A": "Right-click and select Add.", "step.step_C2B73D1DA41F498E866FCC444139330E": "Select MACHINE\\System\\CurrentControlSet\\Control\\SecurePipeServers\\winreg.", "step.step_B132B586AEC2467DB1AEBD029E917904": "Add read permission for the previously selected (domain or local) user account used to authenticate to Windows systems.", "step.step_D592FF0EE0A94865A817DB523EF45392": "Click OK and select Propagate inheritable permissions to all sub keys.", "step.step_A206D1467699477E82A7F58FD467A2A6": "Click OK.", "desc": [ { "steps.steps_90EAC63E398C401CAE9E099E353BE453": [ "step.step_54015CBC50FC41B5B3D5FC4FA4620F2D", "step.step_79B659F2E6B14449AAF54159D1F27E6A", "step.step_C2B73D1DA41F498E866FCC444139330E", "step.step_B132B586AEC2467DB1AEBD029E917904", "step.step_D592FF0EE0A94865A817DB523EF45392", "step.step_A206D1467699477E82A7F58FD467A2A6" ] } ] }, "task_BDECF665F06E40ACA1C45FCA919D708B-4.0-en.json": { "title": "title_DEBC8C143BCD45EDB5876F890838FF0C", "title_DEBC8C143BCD45EDB5876F890838FF0C": "Adding a scan node to the domain", "shortdesc": "shortdesc_BDC6366A0EB74BB0914992D492C7174C", "shortdesc_BDC6366A0EB74BB0914992D492C7174C": "", "content.p_56889FECE0024239B1381E9F33B797A8": "The scan node must be a part of your domain and the Radar_account must be set as a local administrator on the scan node.", "content.p_24D36DF125A24E94AD91EC50D443F6AF": "To do this, enable the following settings:", "step.step_9C2AB72E2E9D4D7ABF6F4927C8ABAB77": "Open Administrative Tools > Group Policy Management and select your domain.", "step.step_4B7E244F02304F998D68197968BAB941": "Right-click and select Create a GPO in this domain, and link it here.", "step.step_B601ADCFFF8B4500B9A30ACE9D43D785": "Enter a name, for example Scannode-Admin, and click OK.", "step.step_2931D10E58CF4E29B0BA2D1BB7BC7773": "Select the created GPO and add the computer on which the scan node will be running to the proper Security Filtering.", "step.step_263F2281FCF44484936555BC5EA203ED": "Right-click and select Edit.", "substep.substep_B60ABE99A6AE4C4F9156987286F908F1": "Go to Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups.", "substep.substep_FF024615565E47258DBD55727D7A148B": "Right-click and select Add Group.", "substep.substep_7073A3EE0ED145669949959704B256CF": "Select Administrators and click OK.", "substep.substep_09CA4CE6A91146A08DE16EBCDF028772": "Next to Members of this group, click Add.", "substep.substep_B6EF8FA16DC0429D80ACE2A88781EDE9": "Browse for the user to be used for running the scan node and accept it.", "substep.substep_5F13590345F749C5B1C96B124C6F5A3F": "Refresh the GPO by running gpupdate.exe.", "step.step_85075E5B679D42BDB69973FA9C83FB13": "Edit the GPO in the Group Policy Management Editor:", "desc": [ "content.p_56889FECE0024239B1381E9F33B797A8", "content.p_24D36DF125A24E94AD91EC50D443F6AF", { "steps.steps_DCD4A27493C04132858B85F48C1461C8": [ "step.step_9C2AB72E2E9D4D7ABF6F4927C8ABAB77", "step.step_4B7E244F02304F998D68197968BAB941", "step.step_B601ADCFFF8B4500B9A30ACE9D43D785", "step.step_2931D10E58CF4E29B0BA2D1BB7BC7773", "step.step_263F2281FCF44484936555BC5EA203ED", "step.step_85075E5B679D42BDB69973FA9C83FB13", { "substeps.substepsalpha_F8CAF12B36D74064A20295D128490DEC": [ "substep.substep_B60ABE99A6AE4C4F9156987286F908F1", "substep.substep_FF024615565E47258DBD55727D7A148B", "substep.substep_7073A3EE0ED145669949959704B256CF", "substep.substep_09CA4CE6A91146A08DE16EBCDF028772", "substep.substep_B6EF8FA16DC0429D80ACE2A88781EDE9", "substep.substep_5F13590345F749C5B1C96B124C6F5A3F" ] } ] } ] }, "task_D223ACFED597400E9524B5028F1C28A7-4.0-en.json": { "title": "title_7A7298159E604C479EF6ECEC35E23B52", "title_7A7298159E604C479EF6ECEC35E23B52": "Configure the WithSecure Elements portal", "shortdesc": "shortdesc_D090C3D485D349058F9D0CA9B25877BC", "shortdesc_D090C3D485D349058F9D0CA9B25877BC": "", "step.step_B98FA6795C9945E78C2282F8164B89DD": "Log in to the WithSecure Elements portal.", "step.step_330C1606F0F54F848057A8ACB1A60F47": "Go to Security Configurations > Scan Templates > Network scan templates.", "step.step_13FF4443E7CA461AA67CA9C855349DF1": "Click Add network scan template or click the menu icon in the Actions column and select Edit to edit an existing template.", "step.step_B54CE5ABD92C43B48C3C65C7C6672EEA": "Select Windows credentials from the Authentication method drop-down menu.", "subchoice.choice_BEE6624D90914E3FA8D4514FEE8BCF7C": "Use the scan node's service account", "subchoice.choice_89668590BB59472FB05C38F9A0AF8589": "Specify credentials explicitly", "step.step_27E7847BB0EA41C7B76AFB967F3C1634": "Specify which credentials should be used:", "subchoice.choice_EFACE1E9D744494FB301C631D9483A79": "Microsoft Update Server or Windows Server Update Services (WSUS)", "subchoice.choice_A63941ABDDBD4C989CA954D44B4F6CC4": "Windows Updates database file", "content.p_E96C0958746C4DBAAA2D0DD071667326": "If Windows Updates database file is enabled, you must also specify a network share where the Windows patch database can be uploaded.", "step.step_84677D9AE7494E09AB11EBD23B5B200C": "Choose which sources the WUA can use when checking the Windows system for missing patches:", "step.step_51A0701532824604878F1E6AFAD4D692": "Apply the scan configuration to a scan group or an individual scan target and run the scan.", "desc": [ { "steps.steps_F07C658318FC4CA5B1DBD431ADBAD412": [ "step.step_B98FA6795C9945E78C2282F8164B89DD", "step.step_330C1606F0F54F848057A8ACB1A60F47", "step.step_13FF4443E7CA461AA67CA9C855349DF1", "step.step_B54CE5ABD92C43B48C3C65C7C6672EEA", "step.step_27E7847BB0EA41C7B76AFB967F3C1634", { "subchoices.choices_1EA23DBA796F42819E62A21CF739847F": [ "subchoice.choice_BEE6624D90914E3FA8D4514FEE8BCF7C", "subchoice.choice_89668590BB59472FB05C38F9A0AF8589" ] }, "step.step_84677D9AE7494E09AB11EBD23B5B200C", { "subchoices.choices_9BFCA08FE462486CA9F8A5EF588217EA": [ "subchoice.choice_EFACE1E9D744494FB301C631D9483A79", "subchoice.choice_A63941ABDDBD4C989CA954D44B4F6CC4" ] }, "content.p_E96C0958746C4DBAAA2D0DD071667326", "step.step_51A0701532824604878F1E6AFAD4D692" ] } ] }, "task_A0869486023948BEA1B6720CA2C986B9-4.0-en.json": { "title": "title_91C288DCF5D14E21BEF778E90703EDAF", "title_91C288DCF5D14E21BEF778E90703EDAF": "Troubleshooting Windows authenticated scanning (RPC)", "shortdesc": "shortdesc_E403F91276624837827BAD09FBFD88DB", "shortdesc_E403F91276624837827BAD09FBFD88DB": "It is recommended that you verify the functionality of the new account from a remote host before using the account for Windows authenticated scanning (RPC). ", "content.p_D38D932B950A4670BA2DE354F37DE108": "The scanning engine requires access to the network share and the registry to perform authenticated scanning of Windows hosts.", "content.p_0B9B38DBE7CB476DB656B2A5969BE9A2": "", "content.p_F545B620D9004281AF757E7D270852BF": "Note: It may take several hours before Group Policy changes take effect.", "content.p_BA9E74969F074E6D87259413A149CB21": "telnet TARGET_IP 135
telnet TARGET_IP 445", "content.p_D142797CB213450893EC9C84C1426AB1": "When a connection is made, you can send any information and the connection will be closed.", "step.step_BFF665E0C6C543A4B9D1CE089C3561E8": "Run the following command from the scan node to verify connectivity to the target system that you are trying to scan:", "content.p_CCF69A759C9B436BBB223848E4F442C9": "Before testing access to the Remote Registry service, ensure that you have already tested the access to the network shares. Run the following PowerShell script to test the Remote Registry access:", "content.p_A92AA9154F0E47A09C494768468CD64B": "$Target = \"IP_ADDRESS\"
$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $Target)
$RegKey= $Reg.OpenSubKey(\"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\")
$Result = $RegKey.GetValue(\"ProductName\")
echo $Result", "content.p_6CE7634E08B94CDC85B0F5B64CB32380": "If the test was successful, the command should return the operating system name.", "step.step_26DD18C7AB124B9BB988F5B4181803C3": "Test access to the Remote Registry service.", "content.p_66C7820E3BB64659837326CD7C66A132": "When the authenticated scan has finished, it is possible to check if authentication was successful or not by reviewing the informational finding named Microsoft Windows authentication succeeded/failed. The Findings field displays useful information if the authentication failed.", "step.step_F32253F8D938426E84DA85F58ADD4561": "Test the authenticated scan.", "content.p_D94F5EF78EB44466ABDED2F53E28CF46": "Known issues:", "step.step_724F36BCF0884F1494050EF0F063E7D9": "Scanning for Windows updates fails on Windows 10 (versions 1703, 1709 and 1803) - Due to a bug related to accessing WMI remotely in these versions of Windows 10, scanning for Windows updates may fail. It results in the Microsoft Windows authentication failed (1013914) finding in the System Scan report and Access is denied (0x80070005) errors in the System Scan log file. To solve the issue, install the recent cumulative update on the target machine. The issue is not present in the earlier and later versions of Windows 10.", "desc": [ "content.p_D38D932B950A4670BA2DE354F37DE108", { "content.note_F545B620D9004281AF757E7D270852BF": [ "content.p_F545B620D9004281AF757E7D270852BF" ] }, { "steps.steps_8E0F3F9AD2C844E6AD2C7F1DEB538A3D": [ "step.step_BFF665E0C6C543A4B9D1CE089C3561E8", "content.p_BA9E74969F074E6D87259413A149CB21", "content.p_D142797CB213450893EC9C84C1426AB1", "step.step_26DD18C7AB124B9BB988F5B4181803C3", "content.p_CCF69A759C9B436BBB223848E4F442C9", "content.p_A92AA9154F0E47A09C494768468CD64B", "content.p_6CE7634E08B94CDC85B0F5B64CB32380", "step.step_F32253F8D938426E84DA85F58ADD4561", "content.p_66C7820E3BB64659837326CD7C66A132" ] }, "content.p_D94F5EF78EB44466ABDED2F53E28CF46", { "steps.ul_D984069D83094066A932402990E0E07D": [ "step.step_724F36BCF0884F1494050EF0F063E7D9" ] } ] }, "concept_304E8DF61107461B88A04680DACA32B4-4.0-en.json": { "title": "title_09789EEB50A049569E712D750613F83B", "title_09789EEB50A049569E712D750613F83B": "Linux authenticated scanning", "shortdesc": "shortdesc_15DEF5A3814B46919D46A7D53FF81903", "shortdesc_15DEF5A3814B46919D46A7D53FF81903": "This section provides a step-by-step guide to configuring WithSecure Elements Vulnerability Management to run Linux authenticated scans. ", "content.p_BB8CD9B835DD49DEA26373885C367701": "By default, WithSecure Elements Vulnerability Management runs scans over the network in an unauthenticated context and detects issues based on the exposed services on a given host. Although a lot of information can be collected over the network, it is not as detailed as gathering information from a so-called authenticated context. With Linux authenticated scanning, WithSecure Elements Vulnerability Management is able to authenticate using SSH and gather more detailed information about the system.", "content.title_2025AF5ADE824B6FB692597D05C6F0C8": "Prerequisites", "content.p_8A6F6A25C448471D8B58A2B30EA942C0": "The following WithSecure Elements Vulnerability Management components are required to perform Linux authenticated scanning:", "choice.choice_295E4A6522C2469A8542450A90710270": "WithSecure Elements Vulnerability Management portal 2.3.4 or higher. To check the version number, go to the WithSecure Elements Vulnerability Management web page. The version number is at the top of the page - next to the WithSecure Elements Vulnerability Management logo.", "choice.choice_71DA0932597B484DA96AD2DCD53AC5B4": "WithSecure Elements VM Scan Node version 2.3.2.646 or higher. To check the version number, go to the tray application of the scan node, go to Management > Vulnerability settings and find the SCANNODE.ScanNodeVersion key. You can also check the version number in the WithSecure Elements Vulnerability Management portal by going to Security Configurations > Scans > Scan nodes and expanding the details for a scan node.", "content.p_A815FC263486454C9EE99370D578805C": "Linux authenticated scanning in WithSecure Elements Vulnerability Management supports the following distributions:", "choice.choice_21115A4E40654FD2913C53101B789E0B": "CentOS", "subchoice.choice_E74A350EE5FB4A6A9C5A8923BD02E469": "Testing release (bookworm)", "subchoice.choice_C619DCA24D2B42B5BAF45F24C697D3CD": "Unstable release (sid)", "subchoice.choice_832F1B150523402E81EC8DD79BD20BCF": "Debian 11 (bullseye)", "subchoice.choice_32B40EF4FE5E4BF3AE5A7B1E0CEB5B0A": "Debian 10 (buster)", "subchoice.choice_CE3DCC7E1BB6461D8C764308A48F478C": "Debian 9 (stretch)", "subchoice.choice_6FDEABED91B34080BAF7199675B432AB": "Debian 8 (jessie)", "subchoice.choice_9B1C4CCAA0AE489AA4873351E71DBF89": "Debian 7 (wheezy)", "choice.choice_ED39689AA0604AABB48BD447DEDDBBC3": "Debian", "choice.choice_4EFAF1F4D3174B80AB8A556752344DA6": "Oracle Linux (version 5 and higher)", "choice.choice_78ADF5F778D14FC8962E8CBBC41B4E49": "Red Hat", "choice.choice_BB036C8050C84094AC6BE6112D1FA029": "Ubuntu 6.06 LTS and above", "choice.choice_0D0F94DF112F490BAEC3AF64D5B6ADA2": "Amazon Linux", "choice.choice_EA1759864801406BA5C2E22DE3D2A1EB": "SUSE Linux 10 and above", "choice.choice_C032FB36A00F49B7B4B2DC1F523ADC82": "AlmaLinux", "desc": [ "content.p_BB8CD9B835DD49DEA26373885C367701", "content.title_2025AF5ADE824B6FB692597D05C6F0C8", "content.p_8A6F6A25C448471D8B58A2B30EA942C0", { "choices.ul_1F52FAC7E0F9449D90C955F67DC06ADB": [ "choice.choice_295E4A6522C2469A8542450A90710270", "choice.choice_71DA0932597B484DA96AD2DCD53AC5B4" ] }, "content.p_A815FC263486454C9EE99370D578805C", { "choices.ul_D826065FB00842D48527F5A15CFC0C4A": [ "choice.choice_21115A4E40654FD2913C53101B789E0B", "choice.choice_ED39689AA0604AABB48BD447DEDDBBC3", { "subchoices.ul_70B0497E1B304E8793050865F11FECF2": [ "subchoice.choice_E74A350EE5FB4A6A9C5A8923BD02E469", "subchoice.choice_C619DCA24D2B42B5BAF45F24C697D3CD", "subchoice.choice_832F1B150523402E81EC8DD79BD20BCF", "subchoice.choice_32B40EF4FE5E4BF3AE5A7B1E0CEB5B0A", "subchoice.choice_CE3DCC7E1BB6461D8C764308A48F478C", "subchoice.choice_6FDEABED91B34080BAF7199675B432AB", "subchoice.choice_9B1C4CCAA0AE489AA4873351E71DBF89" ] }, "choice.choice_4EFAF1F4D3174B80AB8A556752344DA6", "choice.choice_78ADF5F778D14FC8962E8CBBC41B4E49", "choice.choice_BB036C8050C84094AC6BE6112D1FA029", "choice.choice_0D0F94DF112F490BAEC3AF64D5B6ADA2", "choice.choice_EA1759864801406BA5C2E22DE3D2A1EB", "choice.choice_C032FB36A00F49B7B4B2DC1F523ADC82" ] } ] }, "concept_60A1B817C5A64A3197F0C361DE46DBAB-4.0-en.json": { "title": "title_CAD8C431DE024A4D95C6BD77EEEB920D", "title_CAD8C431DE024A4D95C6BD77EEEB920D": "Preparation steps", "shortdesc": "shortdesc_F9CBCA2D7B3742C5AA9D563998C3FFDE", "shortdesc_F9CBCA2D7B3742C5AA9D563998C3FFDE": "WithSecure Elements Vulnerability Management ensures that the credentials needed to perform authenticated scans are stored in a safe manner. ", "content.p_911BF482921E4FE184902EB199FA4143": "Note that the steps in this section are solely for setting up the secure credentials flow within WithSecure Elements Vulnerability Management; that is between the portal and a scan node. Credentials used for authentication to a target Linux system are described elsewhere in this documentation. Therefore, apart from this, you need to configure the authentication method as well.", "content.p_29ED14A4AE5041FE9492ECE52DC81C83": "", "content.p_09345B7CDE2E4B59A0BE0E572C7A440C": "Note: While using the recommended key-based authentication, you need to secure a private key along with an optional passphrase. In an authenticated Linux scan, two key pairs are used: the first one is used to authenticate to the target system and the second one to secure the flow of the first key pair with the WithSecure Elements Vulnerability Management parts.", "content.p_78F96A9ACCB24DD59D9898C0F4BDF898": "Once credentials are sent to WithSecure Elements Vulnerability Management, they are encrypted with a public key and can only be decrypted directly on the scan node with a counterpart private key. This section describes how to configure the custom public/private keys.", "desc": [ "content.p_911BF482921E4FE184902EB199FA4143", { "content.note_09345B7CDE2E4B59A0BE0E572C7A440C": [ "content.p_09345B7CDE2E4B59A0BE0E572C7A440C" ] }, "content.p_78F96A9ACCB24DD59D9898C0F4BDF898" ] }, "task_A923BA7A5BB9453FA21E2C16D631A853-4.0-en.json": { "title": "title_96D765EE6D6240D09FAF6D68098F6C2E", "title_96D765EE6D6240D09FAF6D68098F6C2E": "Create new encryption keys", "shortdesc": "shortdesc_00723B34F9CC4864936B72953C81C523", "shortdesc_00723B34F9CC4864936B72953C81C523": "First, a public/private key pair has to be created and subsequently installed in the WithSecure Elements portal and the scan node. ", "content.p_AF7EFBEA0348494880A984F3F17AC4DC": "The keys are used to establish an encrypted communication channel between the WithSecure Elements portal and the scan node in question.", "content.p_3D40FA53991F431B894D3907E60954B4": "", "content.p_AF97A88FA0A849AD86B57AEB4387AAC0": "Note: The steps given here are for creating the encryption keys on Windows computers. However, the same openssl commands for generating the keys should also work on Linux systems.", "step.step_6C40346D45E0470792A4B3D3BA980DB4": "Download the OpenSSL toolkit for Windows at http://gnuwin32.sourceforge.net/packages/openssl.htm.", "step.step_01A478547A7C4739A6C4757A37EDA239": "Extract the zip file.", "content.p_E9D0D959F426410A8C575D67070CB395": "For example: cd x:\\openssl-{version}\\bin", "step.step_44BCC0FAF80B407DAE246CBC0F5286AA": "From the Windows command prompt, navigate to the bin directory inside the OpenSSL folder.", "content.p_28BE3FEBD455450BB583B580EC61DFD8": "Generate the private key:", "content.p_8DDB58533A69432BB55FD667F7A68DA5": "openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:4096", "content.p_2AB7DA07BA354644810BAAFF5ADEA082": "For older versions of OpenSSL, use the following command:", "content.p_24E6D43FE33544E19AC763319761A3EE": "openssl genrsa -out private_key.pem 4096", "content.p_0428E54C5BC44A56AF1C55E229F7AAF9": "Extract the public key:", "content.p_C2B4DFC1773E44D98D7155DB30E7B7D1": "openssl rsa -pubout -in private_key.pem -out public_key.pem", "step.step_1A605E4CF43541D4A255F544C8507516": "Generate a public/private key pair by running the following commands:", "desc": [ "content.p_AF7EFBEA0348494880A984F3F17AC4DC", { "content.note_AF97A88FA0A849AD86B57AEB4387AAC0": [ "content.p_AF97A88FA0A849AD86B57AEB4387AAC0" ] }, { "steps.steps_8FD754F15F344C6D89731C363C4B07F2": [ "step.step_6C40346D45E0470792A4B3D3BA980DB4", "step.step_01A478547A7C4739A6C4757A37EDA239", "step.step_44BCC0FAF80B407DAE246CBC0F5286AA", "content.p_E9D0D959F426410A8C575D67070CB395", "step.step_1A605E4CF43541D4A255F544C8507516", "content.p_28BE3FEBD455450BB583B580EC61DFD8", "content.p_8DDB58533A69432BB55FD667F7A68DA5", "content.p_2AB7DA07BA354644810BAAFF5ADEA082", "content.p_24E6D43FE33544E19AC763319761A3EE", "content.p_0428E54C5BC44A56AF1C55E229F7AAF9", "content.p_C2B4DFC1773E44D98D7155DB30E7B7D1" ] } ] }, "task_5062E43944804E6F9B64ACEBA81FE4BB-4.0-en.json": { "title": "title_A8877E29DEF34D9E9C7465AADF4056D0", "title_A8877E29DEF34D9E9C7465AADF4056D0": "Upload encryption keys to WithSecure Elements portal", "shortdesc": "shortdesc_0A84648F32D04BF39B36569F98AA350F", "shortdesc_0A84648F32D04BF39B36569F98AA350F": "Once the public/private key pair has been created, the public key can be uploaded to the WithSecure Elements portal. ", "step.step_B98FA6795C9945E78C2282F8164B89DD": "Log in to the WithSecure Elements portal.", "step.step_1BA3F55FACB149B8820692D68F18C56B": "Go to Management > Vulnerability settings > General settings.", "step.step_866B9FA73928490FA6F6CB427FA9409D": "Open Encryption keys and click Add encryption key.", "content.p_6B09BA551A024F489CAFF2216B306C45": "Note: The public key name that you enter in the WithSecure Elements portal must match the name entered for the private key name on the scan node. Moreover, the entered name can only be a combination of numbers, letters and underscore characters (\"_\"). Other types of characters are not allowed. The key filenames do not need to match the entered name value. However, the extension .pem is obligatory for both.", "content.p_A1AB9E09B9A745EAA8CB5CEE1C9C66B0": "This information is needed whenever you upload a new public key. The name value is used to identify which public and private keys belong together. We recommend using a descriptive name, as it helps you to distinguish the keys from other key pairs that you may want to use for other purposes.", "step.step_88157B1B0B4449F292D34EB094C463D7": "Specify a name and a description (optional) for the public key.", "step.step_2C99E852E29E4BACAB804296E75EFE9D": "Click Browse and select the file to upload.", "desc": [ { "steps.steps_425F6398E92B47AE95DAFDFE0E2F9FBE": [ "step.step_B98FA6795C9945E78C2282F8164B89DD", "step.step_1BA3F55FACB149B8820692D68F18C56B", "step.step_866B9FA73928490FA6F6CB427FA9409D", "step.step_88157B1B0B4449F292D34EB094C463D7", { "content.note_6B09BA551A024F489CAFF2216B306C45": [ "content.p_6B09BA551A024F489CAFF2216B306C45" ] }, "content.p_A1AB9E09B9A745EAA8CB5CEE1C9C66B0", "step.step_2C99E852E29E4BACAB804296E75EFE9D" ] } ] }, "task_C8641322AEAD472999D0B7D9F5C3CFF6-4.0-en.json": { "title": "title_2CEEFA34F94A46B6BDB817FB1116BAEE", "title_2CEEFA34F94A46B6BDB817FB1116BAEE": "Upload encryption keys to WithSecure Elements VM scan node", "shortdesc": "shortdesc_3793009F36B24EAB8387DDCA28EC0C0F", "shortdesc_3793009F36B24EAB8387DDCA28EC0C0F": "After uploading the public key, you also need to upload the private key to the scan node that you want to use. ", "content.p_BFDC5FB4120749FCB87BAFE6E604BFAD": "For Windows scan nodes:", "content.p_0CFB0A27B2A746F4A9EC95DAED31453E": "You can find this via the Start Menu after unfolding the WithSecure group, or by launching F-Secure Radar.Scan.Daemon.Tray.exe, located in the scan node installation directory.", "content.p_A2A2E5580C5642E2B6D84B311A3A3FBE": "Warning: Control Center has to be opened by a local administrator or have at least a SeImpersonatePrivilege to encrypt the private key.", "substep.substep_8FDB0B3C3DA84BEA9EA827758E6C3799": "Start the WithSecure Elements VM Scan Node - Control Center.", "substep.substep_D01D802FFE42467F86B7529D38D36A07": "Go to the Encryption Keys tab and click Add.", "content.p_2E2D72E5FA3C473B953ADCF3D1B217CB": "Note: The names of the public key and private key must match for the authentication to work.", "content.p_7FD7F6EC94964BA6AE077858BF20760A": "Note: Encryption keys are stored safely in a user account context. You will be asked for credentials to the account on which the scan node service is running, as this account might be different from the account that the Scan Node Control Center is running.", "substep.substep_07DB51305E41418EBAA5EA9C73843577": "Enter the same key name as used in the WithSecure Elements portal, upload the private key and click Save.", "content.p_74483275B4CD4E9CBBEB34A46CA562C6": "For Linux scan nodes:", "content.p_F5735BF360B843CBB10A228BCF418243": "Note: Replace NameOfTheKeyPair with the name of your encryption keys from the WithSecure Elements portal.", "content.p_548AC5DF642D43369CA482F5260DC8A9": "cd /opt/f-secure/radar-scannodeagent
sudo ./ScanNodeAgent add-private-key NameOfTheKeyPair ./private_key.pem", "substep.substep_4DEF4B1D22C442D0B56F715A37875944": "Run the following commands to apply a previously generated private key, saved as ./private_key.pem:", "step.step_F2C559BB8DC44178B87A2138CD880CF4": "Log in to the WithSecure Elements Vulnerability Management scan node.", "desc": [ { "steps.steps_6CB14C9BD1DB47328DED98C536BDF8B5": [ "step.step_F2C559BB8DC44178B87A2138CD880CF4", "content.p_BFDC5FB4120749FCB87BAFE6E604BFAD", { "substeps.substepsalpha_07A4680E3085433C827CFE56A95BC6C2": [ "substep.substep_8FDB0B3C3DA84BEA9EA827758E6C3799", "content.p_0CFB0A27B2A746F4A9EC95DAED31453E", { "content.note_A2A2E5580C5642E2B6D84B311A3A3FBE": [ "content.p_A2A2E5580C5642E2B6D84B311A3A3FBE" ] }, "substep.substep_D01D802FFE42467F86B7529D38D36A07", "substep.substep_07DB51305E41418EBAA5EA9C73843577", { "content.note_2E2D72E5FA3C473B953ADCF3D1B217CB": [ "content.p_2E2D72E5FA3C473B953ADCF3D1B217CB" ] }, { "content.note_7FD7F6EC94964BA6AE077858BF20760A": [ "content.p_7FD7F6EC94964BA6AE077858BF20760A" ] } ] }, "content.p_74483275B4CD4E9CBBEB34A46CA562C6", { "substeps.substepsalpha_CBD82ECA6A2E42818C93E0B01859C989": [ "substep.substep_4DEF4B1D22C442D0B56F715A37875944", { "content.note_F5735BF360B843CBB10A228BCF418243": [ "content.p_F5735BF360B843CBB10A228BCF418243" ] }, "content.p_548AC5DF642D43369CA482F5260DC8A9" ] } ] } ] }, "task_C67FFD61EF1244C1BA926C549584EB54-4.0-en.json": { "title": "title_013BF42792E84196B75A3BB1384AE33D", "title_013BF42792E84196B75A3BB1384AE33D": "Prepare the user account for Linux authenticated scanning", "shortdesc": "shortdesc_C6B0BE8F4F3B464591D3BF7D582D836C", "shortdesc_C6B0BE8F4F3B464591D3BF7D582D836C": "To allow WithSecure Vulnerability Management to log on to a target Linux system, it is recommended to create a specific user account on each target to be scanned. ", "content.p_74E806CC4A814D2AA149636D9D08DB59": "This means that such a user account would be used only for scanning purposes.", "content.p_846FF6D4CEFC47D089AA60E438751666": "To create the user account:", "content.p_934005C06A694C42BBE3444B282B4B6D": "sudo useradd radar-user -m", "step.step_A38B64DD4250462D865F036C69A148F9": "Run the following command to create a new account:", "content.p_EFAAB92106A04A038E4636B5F2B0048D": "radar-user ALL=(ALL) NOPASSWD: ALL", "step.step_20C4290E397346E7B5A52230DDCE1D8D": "Add the following line to the /etc/sudoers file to avoid the user form asking for a password:", "content.p_9E53072B447D48049F5E713A8D1D6963": "Defaults:radar-user !requiretty", "step.step_35F435275DFA4841BE862E1CFF2B5D37": "Disable the requiretty option by adding the following line to the /etc/sudoers file:", "step.step_34F9A794484A45A7ACDC9242E1C01D96": "Start the SSH service.", "desc": [ "content.p_74E806CC4A814D2AA149636D9D08DB59", "content.p_846FF6D4CEFC47D089AA60E438751666", { "steps.steps_C2D194BE3FC2481794872D720471CAA3": [ "step.step_A38B64DD4250462D865F036C69A148F9", "content.p_934005C06A694C42BBE3444B282B4B6D", "step.step_20C4290E397346E7B5A52230DDCE1D8D", "content.p_EFAAB92106A04A038E4636B5F2B0048D", "step.step_35F435275DFA4841BE862E1CFF2B5D37", "content.p_9E53072B447D48049F5E713A8D1D6963", "step.step_34F9A794484A45A7ACDC9242E1C01D96" ] } ] }, "concept_727882A5552547F3AD371F4D5B4803D3-4.0-en.json": { "title": "title_8269A57343064985AF17FD53FEA40BDD", "title_8269A57343064985AF17FD53FEA40BDD": "Authentication methods", "shortdesc": "shortdesc_E2324BA247734B54809027E431D92C28", "shortdesc_E2324BA247734B54809027E431D92C28": "The scan nodes can log on to Linux systems using passwords or keys (recommended). The different authentication methods, and how to configure them, are described in the following sections. ", "desc": [] }, "task_ACAA4EFEB6074BDA8A490235FA72BEA8-4.0-en.json": { "title": "title_FD5A79103EAA44A68FEFD612DAAE5DB4", "title_FD5A79103EAA44A68FEFD612DAAE5DB4": "Password-based authentication", "shortdesc": "shortdesc_A9EA9352DAC6472DB22CC358A28A5566", "shortdesc_A9EA9352DAC6472DB22CC358A28A5566": "You need to configure all the Linux systems that should be scanned to allow password authentication over SSH. ", "content.p_7F197FE7BF5F4C9AA41420E05061B145": "PasswordAuthentication yes", "step.step_930D766B929A4DE2BE5133EC21A27819": "Make sure that the following line is present in the /etc/ssh/sshd_config file:", "content.p_B64276A5C8BA40A687060122328F2F82": "sudo passwd radar-user", "step.step_B2E3841A143C4C0C978A50B3866819FA": "Run the following command:", "step.step_4274CF61AEB549AF80B9AC4E28E9211F": "In the WithSecure Elements portal, go to Security Configurations > Scan Templates and open the Network scan templates tab.", "step.step_A5B812E5C7694053A83D49358D60339D": "Create a new scan template or edit an existing one.", "step.step_D93E094E6F994E87A3C267BA0B84878C": "Enable Linux authenticated scanning using a password as authentication method by selecting SSH with password and entering the target SSH port. Then, specify the credential encryption key, username and password that were set up in section Preparation steps.", "step.step_C808681FDBBD46D3B866C98E7BFAF8CD": "Save the template.", "step.step_vuln_scans_group": "In the WithSecure Elements portal, go to Security Configurations > Scans > Network scans and in the Group view, find the scan group that you want to set up for authenticated scanning.", "step.step_vuln_scans_group_edit": "Click the menu icon and select Edit scan group.", "step.step_vuln_scans_group_auth": "Configure the scan group to use the scan node and template that has been prepared for Linux authenticated scanning.", "step.step_vuln_scans_group_save": "Save the changes.", "content.p_result": "If everything has been configured correctly, it is now possible to scan Linux systems using an authenticated context.", "desc": [ { "steps.steps_9699730606624C17A1CF70F356E34EA1": [ "step.step_930D766B929A4DE2BE5133EC21A27819", "content.p_7F197FE7BF5F4C9AA41420E05061B145", "step.step_B2E3841A143C4C0C978A50B3866819FA", "content.p_B64276A5C8BA40A687060122328F2F82", "step.step_4274CF61AEB549AF80B9AC4E28E9211F", "step.step_A5B812E5C7694053A83D49358D60339D", "step.step_D93E094E6F994E87A3C267BA0B84878C", "step.step_C808681FDBBD46D3B866C98E7BFAF8CD", "step.step_vuln_scans_group", "step.step_vuln_scans_group_edit", "step.step_vuln_scans_group_auth", "step.step_vuln_scans_group_save" ] }, "content.p_result" ] }, "task_E8B6320224864E2BACE58C50834A2294-4.0-en.json": { "title": "title_708208FF020146BD91C8857B4ACC22DB", "title_708208FF020146BD91C8857B4ACC22DB": "Key-based authentication (recommended)", "shortdesc": "shortdesc_3F77B2344DBA4019A9A8307D7F87566F", "shortdesc_3F77B2344DBA4019A9A8307D7F87566F": "The recommended way of authenticating to Linux systems is by using public/private keys. The following instructions describe how to create keys for authenticating and configure the WithSecure Elements portal for Linux authenticated scanning using keys. ", "content.p_B40E08D2CE0348099A76705400793F48": "", "content.p_9C6DD6F24EFF4EF29CE65CDEB0B519FD": "Note: With OpenSSH version 7.8 or newer, use following command:", "step.step_DA4682DFBD684BABBD4ABE8A95E8AB69": "Log on to the Linux system with the WithSecure Elements Vulnerability Management user account and create a new key pair using the following command: ssh-keygen -t rsa -b 4096 -f targetKey", "content.p_A3F7CC565DA64064B2B1575D08F46B63": "cd /home/radar-user/.ssh", "content.p_8CE446C57A5447BC8283195658FC8C1D": "touch authorized_keys", "content.p_CE2C8F90D6D54D8D929AD5B4B5134367": "chmod 600 authorized_keys", "content.p_CEF32E1563154E03A6BB12500DD89DF3": "cat targetKey.pub >> authorized_keys", "content.p_9DEBE1480B8A46E492359A32553CC49F": "Note: To use the same key on several systems, you need to copy targetKey.pub there and repeat this step on each target.", "step.step_3A7F41927AEF4E2881B03CE28CFC1F38": "Use the following command to add the new public key to the authorized_keys file:", "content.p_10D503F1F40E4719A5247F062C82C474": "You can do this on Windows machines with the PuTTY app or on Linux by running the following command: ssh -i targetKey.pem radar-user@<target-ip>.", "content.p_B7003283802048708FE4F92F84B0965A": "Assuming the Linux systems have been configured to allow authentication by keys, you only need to configure the WithSecure Elements Security Center to use the keys.", "step.step_1B82FC1086174D3E9DEFCB9978B5246F": "Verify that the key-based authentication works by logging in from a different system using the private key targetKey.pem.", "step.step_21C3560F09644ECBB740F8D1C6B85175": "In the WithSecure Elements portal, go to Security Configurations > Scan Templates and open the Network scan templates tab.", "step.step_65C97694E6434F589BEA5EC2469F9EEB": "Create a new scan template or edit an existing one.", "step.step_B1BE7E276B244844874858553A4CD50C": "Enable Linux authenticated scanning using keys as authentication method by selecting SSH with keys and entering the target SSH port. Then, specify the credential encryption key and the username that were set up in section Preparation steps. Finally, upload the private key created in step 1 and enter its passphrase if available (in the SSH key password field).", "step.step_76E87DCACF604B709BF834062D5CD7E1": "Save the template.", "step.step_vuln_scans_group": "In the WithSecure Elements portal, go to Security Configurations > Scans > Network scans and in the Group view, find the scan group that you want to set up for authenticated scanning.", "step.step_vuln_scans_group_edit": "Click the menu icon and select Edit scan group.", "step.step_vuln_scans_group_auth": "Configure the scan group to use the scan node and template that has been prepared for Linux authenticated scanning.", "step.step_vuln_scans_group_save": "Save the changes.", "content.p_8695400F1B7D4D3FBBE16827CFFB3F08": "The file name of the private key must include the .pem extension. The key is generated in the correct format, so you only have to rename the file to add the extension: mv targetKey targetKey.pem.", "content.p_9311558627DE4CF3AAE3DCD697CF5107": "We recommend protecting the key with a passphrase.", "content.p_C7ED98FC10B340489E4DC28BEECE1989": "Tip: Alternatively, you can use the openssl command to create the encryption keys.", "content.p_33B6E101FE7B4A17BBCAE6C3DCE3984C": "ssh-keygen -t rsa -b 4096 -m PEM -f targetKey", "content.p_result": "If everything has been configured correctly, it is now possible to scan Linux systems using an authenticated context.", "desc": [ { "steps.steps_B34D309261D04A97B2D23F2B33C85AC0": [ "step.step_DA4682DFBD684BABBD4ABE8A95E8AB69", "content.p_B40E08D2CE0348099A76705400793F48", { "content.note_9C6DD6F24EFF4EF29CE65CDEB0B519FD": [ "content.p_9C6DD6F24EFF4EF29CE65CDEB0B519FD" ] }, "step.step_3A7F41927AEF4E2881B03CE28CFC1F38", "content.p_A3F7CC565DA64064B2B1575D08F46B63", "content.p_8CE446C57A5447BC8283195658FC8C1D", "content.p_CE2C8F90D6D54D8D929AD5B4B5134367", "content.p_CEF32E1563154E03A6BB12500DD89DF3", { "content.note_9DEBE1480B8A46E492359A32553CC49F": [ "content.p_9DEBE1480B8A46E492359A32553CC49F" ] }, "step.step_1B82FC1086174D3E9DEFCB9978B5246F", "content.p_10D503F1F40E4719A5247F062C82C474", "content.p_B7003283802048708FE4F92F84B0965A", "step.step_21C3560F09644ECBB740F8D1C6B85175", "step.step_65C97694E6434F589BEA5EC2469F9EEB", "step.step_B1BE7E276B244844874858553A4CD50C", "step.step_76E87DCACF604B709BF834062D5CD7E1", "step.step_vuln_scans_group", "step.step_vuln_scans_group_edit", "step.step_vuln_scans_group_auth", "step.step_vuln_scans_group_save" ] }, "content.p_8695400F1B7D4D3FBBE16827CFFB3F08", "content.p_9311558627DE4CF3AAE3DCD697CF5107", { "content.note_C7ED98FC10B340489E4DC28BEECE1989": [ "content.p_C7ED98FC10B340489E4DC28BEECE1989" ] }, "content.p_33B6E101FE7B4A17BBCAE6C3DCE3984C", "content.p_result" ] }, "concept_20C9AA54C85B4C6BA26943D5A0D918FE-4.0-en.json": { "title": "title_091CB52A89654BE587AD4CB0373D637C", "title_091CB52A89654BE587AD4CB0373D637C": "Troubleshooting", "shortdesc": "shortdesc_034D11750E27463EAED646CC0FD2FBBC", "shortdesc_034D11750E27463EAED646CC0FD2FBBC": "After a scan has completed with Linux authenticated scanning turned on, the scan report will contain an Informational finding, stating whether the scanning succeeded or failed. ", "content.p_FB4FA26FE69B4FBF818D4926A6C4F68F": "In the event of a failure, the Findings shows details about why the authenticated scanning failed.", "desc": [ "content.p_FB4FA26FE69B4FBF818D4926A6C4F68F" ] }, "concept_AE0AB741890740AD90C8BB7DC25BD63B-4.0-en.json": { "title": "title_E5B573CBB7F04876B905BC29C1D877A8", "title_E5B573CBB7F04876B905BC29C1D877A8": "Reporting", "shortdesc": "shortdesc_0D8134847C994A2A99E55ABAC54548ED", "shortdesc_0D8134847C994A2A99E55ABAC54548ED": "Reporting is an extremely vital part of the Elements Vulnerability Management portal. With Elements Vulnerability Management, you can generate customized reports that suit the needs of your manager, system administrator, or your third-party service provider. ", "content.p_A48A4324A5154D7BB7655609D0818A44": "You can start creating reports as soon as your scans are completed. Vulnerabilities detected during multiple scans can be combined into one report.", "content.p_B9472D56A4744E4B9F05B4DC8505FB65": "To view the vulnerability report for a single scan in the WithSecure Elements Security Center, select Security Configurations > Scans and open Security Configurations > Scans > Network scans. Then, select the name of the desired completed scan.", "content.p_vuln_open_network_scans": "Note: If you are using WithSecure Vulnerability Management only, go to the Network scans page.", "content.p_9911E4F8D09F4470A2FC88FC04A7A386": "", "content.p_2DB97DBB3A3C4EC6989DC4EDF5F2543D": "Note: If there are no scans run yet, you can start your first agent-based scan on the Device discovery page, or go to Security Configurations > Scans > Network scans and start a network-based scan.", "content.p_B10F630E48A749868CEEE63614EA939C": "Once the report is created, it is added to the list on the Reports > Vulnerability reports page. As soon as reports are run, they appear as report instances under the report on Reports > Vulnerability reports. Only 10 latest report instances can be downloaded from the portal. This means that generating a new report removes the oldest report instance from the list.", "content.p_8E0B002EC1AC4739AD75F722031F98C2": "You can download the reports to your computer in the following formats:", "choice.choice_77DE6A9AD35B438180EB7E9234348599": "XML report grouped by hosts: Download the raw report data in XML format, organized by host.", "choice.choice_5ECFDC15DF3249EFB040F80F08BEF9DC": "Excel report grouped by vulnerabilities: Contains all the technical details of the hosts in scope and gives you the freedom to use the features available in Excel.", "choice.choice_CFF40953541446E8B42B732CFB1D3176": "Word report grouped by hosts: Contains all the technical details of the hosts in scope, organized by host. This is useful when your scope does not cover a large number of hosts.", "choice.choice_3FE964561BDD497388E968DC7AAC56F3": "Word report grouped by vulnerabilities: Contains all the technical details of the hosts in scope, organized by vulnerability type. This gives you a smaller report if the scope is very large.", "choice.choice_3BE23C4158EC4C37980D94850F92D079": "Word report, executive summary: Designed to be a light-weight report with few pages even if the report scope covers thousands of hosts.", "choice.choice_07C2F1D6C0834988836E6440297E23DA": "Word report, preliminary PCI: This report helps your organization to proactively identify issues that need to be addressed to ensure the compliance state of your systems with the Payment Card Industry (PCI) standards.", "desc": [ "content.p_A48A4324A5154D7BB7655609D0818A44", "content.p_B9472D56A4744E4B9F05B4DC8505FB65", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, { "content.note_2DB97DBB3A3C4EC6989DC4EDF5F2543D": [ "content.p_2DB97DBB3A3C4EC6989DC4EDF5F2543D" ] }, "content.p_B10F630E48A749868CEEE63614EA939C", "content.p_8E0B002EC1AC4739AD75F722031F98C2", { "choices.ul_48F9C8921A8F4359A3C89143165BCAA5": [ "choice.choice_77DE6A9AD35B438180EB7E9234348599", "choice.choice_5ECFDC15DF3249EFB040F80F08BEF9DC", "choice.choice_CFF40953541446E8B42B732CFB1D3176", "choice.choice_3FE964561BDD497388E968DC7AAC56F3", "choice.choice_3BE23C4158EC4C37980D94850F92D079", "choice.choice_07C2F1D6C0834988836E6440297E23DA" ] } ] }, "task_BEF04F4BD2504F7E8D1A6DF12097824A-4.0-en.json": { "title": "title_483ED783BD8C4967A614BC9CE0F96E1A", "title_483ED783BD8C4967A614BC9CE0F96E1A": "Creating reports", "shortdesc": "shortdesc_9526F068489F45579ADB0AFCDD37483D", "shortdesc_9526F068489F45579ADB0AFCDD37483D": "You can create your own report on the Reports page. ", "content.p_8D1352425AD24B9A825A5F0BE4025C7C": "You can start creating reports once your scans are completed. If there are no scans run yet, you can start your first agent-based scan on the Environment > Devices > Device Discovery page, or in the WithSecure Elements Security Center, go to Security Configurations > Scans > Network scans start a network-based scan.", "content.p_vuln_open_network_scans": "Note: If you are using WithSecure Vulnerability Management only, go to the Network scans page.", "content.p_BF5C82FBB7E94BF48D728924696DD369": "To create a report:", "step.step_select_reports": "From the left navigation pane, select Reports > Vulnerability reports.", "content.p_49837BD469AE435199FC37EDF455A830": "The Report details page opens.", "step.step_C9C07D0511014C0791FEC9E520E2A775": "Select Add report.", "step.step_6F6C5D04BCE14FEC852D787B08F4156E": "Give the report a descriptive name (required) and a description.", "subchoice.choice_52C115D535B64B23BDAA5289970E75BF": "Report frequency - Based on the values you select, the time of the next report is shown beneath the report frequency fields.", "subchoice.choice_F7F28F05CCFC4E37958EF250290FDE68": "Time Zone - The time zone comes from your profile. If you wish, you can change it for this report.", "subsubchoice.choice_6D44377F1EB24612B5E105D4CF0C82F6": "Report format shared via email - Select the format of the report (.xml, .xlsx or .docx) and how the data is presented on the report.", "subsubchoice.choice_863BB718704149469ECB1424FD58250F": "Link to the report expires after - Define when the link to the report in the email expires.", "subchoice.choice_D02B11D3858744B9928EF657C9A78722": "Email notifications (optional) - If you wish, you can specify that the report is automatically sent to email addresses of your choice. Separate the email addresses by commas.", "content.p_13EBD95229EC4A8B9C70179946E23612": "Note: If you wish, you can later disable the schedule for the report by clicking its Scheduler column on the Reports > Vulnerability reports page.", "step.step_2243D2D755754A518B0CBAB9A4E1DBA1": "If you want to define a schedule for the report, turn on Schedule and enter the following details:", "content.p_1E4412FD7A954E458953E1E7752538A7": "The Scan scope page opens.", "step.step_D8AA32F09BDE492A9D8FC5DA21BBD618": "Select Next.", "subchoice.choice_2FE3EC5DEC2746B3A853D366315B8FCF": "Assets - Note that this is the primary choice if you mainly run agent-based scans. Not valid for network scans nor network scan groups.", "subchoice.choice_6182A6BEAE38496E927A38B68EA9D85A": "Network vulnerability scan groups", "subchoice.choice_EF2313A3743F4396A870DE526E89D90E": "Tags", "subchoice.choice_84C4728A9DEF4ACEBE56B2744522CA99": "Individual network vulnerability scans", "content.p_E7CBB8570F1F4A35BCCEFBF881D1157F": "Note: If you wish, you can also use tags assigned to the scan type or group to narrow down the scan scope of the report.", "step.step_892959FDD41C4ED79DD4E25B0B376800": "Select the report scope from one of the following options (at least one scan or asset must be chosen):", "content.p_E3D437FD4F00472F935C635A045464A8": "The Include vulnerabilities with page opens.", "step.step_96484F22D17141B994F5A614B8437B30": "Select Next.", "substep.substep_F511D236F9DC4A67AE4BF781C533D973": "Select the statuses and severities of the vulnerabilities to be included in the report.", "substep.substep_C77A74EBAFA14541AFEFD8EAF71735AC": "Under System scan vulnerabilities, select the categories and attack vector types of vulnerabilities to be included in the report.", "substep.substep_90B13076A87B4B2AA7823CB17775C29C": "Under Web scan vulnerabilities, select the categories of vulnerabilities to be included in the report.", "content.p_83011EC46AAE4741851FFD4254C9B3C7": "Note: If you wish, you can also use tags to narrow down the vulnerabilities included in the report.", "step.step_B9B954F505E8418AA4107FEB5C0809D5": "Define the vulnerability scope of the report:", "content.p_FBDB379ACE8F4A53A2A7CF63E64E3B2F": "The Report options page opens.", "step.step_BE0928A1F36145EFBA87E566589A2190": "Select Next.", "content.p_CBAF1F9EBF88440EB9871D70342BEE9E": "The report Summary page opens.", "step.step_3EC6579810114E0388C7FA806AB418CA": "Select what information is shown on the report and then select Next.", "content.p_DB35F1D271D641F8A52EB0CA54A4CF81": "", "step.step_8DDAF56C62E54758BE5C354F5602C900": "Review the report details. You can still go back and make changes to the report settings by selecting Previous.", "step.step_7E3659CB12D24CA39200DB85424C63DA": "To complete the report wizard, select Finish.", "content.p_8104873761C444BB9F7C2F79423AF95C": "Note: By default, the Generate a report now checkbox is ticked. This means that the new report is generated as soon as you have selected Finish. If you don't want to generate the report immediately but according to the schedule that you have defined, untick the Generate a report now checkbox before selecting Finish. However, if you later edit the report settings, you need to tick the Generate a report now checkbox if you want that the report is generated immediately.", "content.p_49283762150F451A963E2910A88D2AA5": "The report is added to the list of reports on the Reports > Vulnerability reports page. As soon as the report is run and complete, a snapshot of the current state of vulnerabilities, or report instance, is shown under the report on the Reports > Vulnerability reports page. If you wish, you can immediately download the report in desired format to your computer.", "desc": [ "content.p_8D1352425AD24B9A825A5F0BE4025C7C", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, "content.p_BF5C82FBB7E94BF48D728924696DD369", { "steps.steps_13E0059777E04F0BB5CB10D09D3993D6": [ "step.step_select_reports", "step.step_C9C07D0511014C0791FEC9E520E2A775", "content.p_49837BD469AE435199FC37EDF455A830", "step.step_6F6C5D04BCE14FEC852D787B08F4156E", "step.step_2243D2D755754A518B0CBAB9A4E1DBA1", { "subchoices.choices_885797B5301D4DB083975DE85260D626": [ "subchoice.choice_52C115D535B64B23BDAA5289970E75BF", "subchoice.choice_F7F28F05CCFC4E37958EF250290FDE68", "subchoice.choice_D02B11D3858744B9928EF657C9A78722", { "subsubchoices.ul_989CAE4C20B64EE2BFBCDD9F6BF77359": [ "subsubchoice.choice_6D44377F1EB24612B5E105D4CF0C82F6", "subsubchoice.choice_863BB718704149469ECB1424FD58250F" ] } ] }, { "content.note_13EBD95229EC4A8B9C70179946E23612": [ "content.p_13EBD95229EC4A8B9C70179946E23612" ] }, "step.step_D8AA32F09BDE492A9D8FC5DA21BBD618", "content.p_1E4412FD7A954E458953E1E7752538A7", "step.step_892959FDD41C4ED79DD4E25B0B376800", { "subchoices.choices_4B16EE93E1FB4BB7A968FBBF72B40F86": [ "subchoice.choice_2FE3EC5DEC2746B3A853D366315B8FCF", "subchoice.choice_6182A6BEAE38496E927A38B68EA9D85A", "subchoice.choice_EF2313A3743F4396A870DE526E89D90E", "subchoice.choice_84C4728A9DEF4ACEBE56B2744522CA99" ] }, { "content.note_E7CBB8570F1F4A35BCCEFBF881D1157F": [ "content.p_E7CBB8570F1F4A35BCCEFBF881D1157F" ] }, "step.step_96484F22D17141B994F5A614B8437B30", "content.p_E3D437FD4F00472F935C635A045464A8", "step.step_B9B954F505E8418AA4107FEB5C0809D5", { "substeps.substepsalpha_5CE2CDBF5840467E9EB88631D3B95759": [ "substep.substep_F511D236F9DC4A67AE4BF781C533D973", "substep.substep_C77A74EBAFA14541AFEFD8EAF71735AC", "substep.substep_90B13076A87B4B2AA7823CB17775C29C" ] }, { "content.note_83011EC46AAE4741851FFD4254C9B3C7": [ "content.p_83011EC46AAE4741851FFD4254C9B3C7" ] }, "step.step_BE0928A1F36145EFBA87E566589A2190", "content.p_FBDB379ACE8F4A53A2A7CF63E64E3B2F", "step.step_3EC6579810114E0388C7FA806AB418CA", "content.p_CBAF1F9EBF88440EB9871D70342BEE9E", "step.step_8DDAF56C62E54758BE5C354F5602C900", "content.p_DB35F1D271D641F8A52EB0CA54A4CF81", "step.step_7E3659CB12D24CA39200DB85424C63DA" ] }, { "content.note_8104873761C444BB9F7C2F79423AF95C": [ "content.p_8104873761C444BB9F7C2F79423AF95C" ] }, "content.p_49283762150F451A963E2910A88D2AA5" ] }, "task_9B77F79B56C442D2B7721AE29168574A-4.0-en.json": { "title": "title_9697A9489D7E4AD59BC379221CB7F226", "title_9697A9489D7E4AD59BC379221CB7F226": "Editing the settings of an existing report", "shortdesc": "shortdesc_E75F0C702A4A407BA822FA853194B7BD", "shortdesc_E75F0C702A4A407BA822FA853194B7BD": "You can easily edit the settings of an existing report. ", "content.p_5EE0C661A5E54FB089B158A37A60F3EC": "To edit the report settings:", "step.step_select_reports": "From the left navigation pane, select Reports > Vulnerability reports.", "step.step_D53B51FCF3964C08AE35771684E55545": "Select the report whose settings you want to edit.", "content.p_A1AEF94FF01A4861A1D7BB1E7C3147BD": "The Report details page opens.", "step.step_36FAD9643DCE4E458E53FF868D697F35": "In the Actions column of the selected report, click the menu button and select Edit.", "step.step_A50A8B1A6E624C0D8A1426538BB530C1": "Follow the steps in the wizard and make the desired changes to the report settings until the Summary page opens.", "step.step_5DAA00B19FC1493CA1DCBDDC0FAFE6F8": "If you want to run the report with the edited settings immediately, tick the Generate a report now checkbox and select Save and close.", "content.p_CD4311FC16404C26BC8E766C93635AD7": "The report settings have now been saved.", "content.p_03CDF83C46AD456E8E14FE31140D1DE6": "Next time when the report is run, the report instance is based on the new settings. The report instances with the old settings will still remain downloadable on the Reports > Vulnerability reports page until they are gradually replaced by the new report instances as each report can have up to 10 instances at a time.", "desc": [ "content.p_5EE0C661A5E54FB089B158A37A60F3EC", { "steps.steps_E5492C4DA1554615B2FF18446DB98A5B": [ "step.step_select_reports", "step.step_D53B51FCF3964C08AE35771684E55545", "step.step_36FAD9643DCE4E458E53FF868D697F35", "content.p_A1AEF94FF01A4861A1D7BB1E7C3147BD", "step.step_A50A8B1A6E624C0D8A1426538BB530C1", "step.step_5DAA00B19FC1493CA1DCBDDC0FAFE6F8" ] }, "content.p_CD4311FC16404C26BC8E766C93635AD7", "content.p_03CDF83C46AD456E8E14FE31140D1DE6" ] }, "task_733B65EDB98F4E4B87BC584C1528F8CB-4.0-en.json": { "title": "title_D905D1FD3D5042C4B68979569C7D07DA", "title_D905D1FD3D5042C4B68979569C7D07DA": "Cloning an existing report", "shortdesc": "shortdesc_74549F33D9BE48DAB8E0C1167BCBA9C0", "shortdesc_74549F33D9BE48DAB8E0C1167BCBA9C0": "You can clone a report to reuse the settings of an existing report. ", "content.p_6DA5164C3DFE4B0F87AF08303D525F23": "", "content.p_245DCB6196694C48866C7ACBCD389C5D": "Note: The report instances, however, are not cloned.", "content.p_58E849E47E9747C280EC4E58C62EC0E4": "To clone an existing report:", "step.step_select_reports": "From the left navigation pane, select Reports > Vulnerability reports.", "step.step_8745F4B960F64E42A51E010DA01DA1CE": "Select the report that you want to clone.", "content.p_A2AFC1EF9EA9453D97120F56A13C1C5A": "The report is added to the list of reports on the Reports page.", "step.step_D53B51FCF3964C08AE35771684E55545": "In the Actions column of the selected report, click the menu button and select Clone.", "step.step_283BE4D456DA4FA19E5AFBA2E63C73B3": "If you want to make changes to the settings of this report, click the menu button in the Actions column and select Edit.", "desc": [ { "content.note_245DCB6196694C48866C7ACBCD389C5D": [ "content.p_245DCB6196694C48866C7ACBCD389C5D" ] }, "content.p_58E849E47E9747C280EC4E58C62EC0E4", { "steps.steps_D1B5C918AEB0474E8D0D5C0CE6349796": [ "step.step_select_reports", "step.step_8745F4B960F64E42A51E010DA01DA1CE", "step.step_D53B51FCF3964C08AE35771684E55545", "content.p_A2AFC1EF9EA9453D97120F56A13C1C5A", "step.step_283BE4D456DA4FA19E5AFBA2E63C73B3" ] } ] }, "task_80F81A48A63F439EA45927048BBE681A-4.0-en.json": { "title": "title_1B516493DB424A148333CEE3DA4FE5DE", "title_1B516493DB424A148333CEE3DA4FE5DE": "Updating contents of existing reports", "shortdesc": "shortdesc_918BDF73BC954E6B984B8FA0C9A27014", "shortdesc_918BDF73BC954E6B984B8FA0C9A27014": "You can easily refresh the contents of existing reports to reflect the current state of vulnerabilities. ", "content.p_D40E76FFF5EF49D9916D4773100E4054": "To update existing reports:", "step.step_select_reports": "From the left navigation pane, select Reports > Vulnerability reports.", "content.p_62C17354E1284148AA5FE1878AFD25B2": "The action bar opens.", "step.step_D53B51FCF3964C08AE35771684E55545": "Select the report(s) whose data you want to refresh.", "step.step_6F56D95A137142D3A8D498D4C35F35D6": "Select Generate a report now, and to confirm the action, select Generate a report now.", "content.p_ECF0C602B61C43CD8AD08FDE96F97AE3": "The data of the selected report or reports are refreshed to reflect the current state of vulnerabilities.", "desc": [ "content.p_D40E76FFF5EF49D9916D4773100E4054", { "steps.steps_6792FD7055A64828B3F9BAEDFAF7BD79": [ "step.step_select_reports", "step.step_D53B51FCF3964C08AE35771684E55545", "content.p_62C17354E1284148AA5FE1878AFD25B2", "step.step_6F56D95A137142D3A8D498D4C35F35D6" ] }, "content.p_ECF0C602B61C43CD8AD08FDE96F97AE3" ] }, "task_9C4EB7DCC33B4A909982712BBF0D16EE-4.0-en.json": { "title": "title_A4CA7E1C13EB450E98704D50A63B7563", "title_A4CA7E1C13EB450E98704D50A63B7563": "Deleting reports", "shortdesc": "shortdesc_40B30DF67AD24ABAA24A8B02134E0770", "shortdesc_40B30DF67AD24ABAA24A8B02134E0770": "You can delete reports that you don't need any more. ", "content.p_7521C90B7C2B45EB8606F6F65D24A3BD": "To delete reports:", "step.step_select_reports": "From the left navigation pane, select Reports > Vulnerability reports.", "content.p_62C17354E1284148AA5FE1878AFD25B2": "The action bar opens.", "step.step_D53B51FCF3964C08AE35771684E55545": "Select reports that you want to delete.", "step.step_D08F5844012C4D41AEC1611E2C38EEA2": "Select Delete, and to confirm the action, select Remove.", "content.p_2290F00EDAE74FB989933F1BE31D3CE9": "The selected report or reports disappear from the Reports > Vulnerability reports page.", "desc": [ "content.p_7521C90B7C2B45EB8606F6F65D24A3BD", { "steps.steps_29C3A1B572A446FE82F0E03765EE8497": [ "step.step_select_reports", "step.step_D53B51FCF3964C08AE35771684E55545", "content.p_62C17354E1284148AA5FE1878AFD25B2", "step.step_D08F5844012C4D41AEC1611E2C38EEA2" ] }, "content.p_2290F00EDAE74FB989933F1BE31D3CE9" ] }, "concept_F65600FF150F458496007F49B4818004-4.0-en.json": { "title": "title_56FC5B9E5F0C485FB6D66B50809F9B3F", "title_56FC5B9E5F0C485FB6D66B50809F9B3F": "Management", "shortdesc": "shortdesc_860381B8B17B42B5A2EB784649C85A04", "shortdesc_860381B8B17B42B5A2EB784649C85A04": "This section gives you information on how to manage both the vulnerabilities that Elements Vulnerability Management discovers within your network, and the users within your organization who can access Elements Vulnerability Management. ", "desc": [] }, "concept_A23DF092A2DA477BAF195609C51E4870-4.0-en.json": { "title": "title_747E78D070E64966A70C74A78981EBF8", "title_747E78D070E64966A70C74A78981EBF8": "Vulnerabilities", "shortdesc": "shortdesc_CAD79132F414408AAC1045DB6C98027A", "shortdesc_CAD79132F414408AAC1045DB6C98027A": "Vulnerability management is a core element of ensuring the security of your organization's network. ", "content.p_3DB2D1C930F6449CBD919F6E1A057F0E": "In Elements Vulnerability Management, you can view and manage detected vulnerabilities on the Environment > Exposure > Vulnerabilities page. Instead of listing vulnerabilities per host, the page lists the vulnerability types and shows the number of affected hosts for each vulnerability type. This gives you a quick overview of the most common vulnerabilities across all scanned systems and helps you decide which vulnerabilities to prioritize.", "content.p_59ED71B55602438486E2796F71FE5111": "Filtering the list of vulnerabilities gives you a quick overview of the most common and critical vulnerabilities within your network, making it easier for you to decide which vulnerabilities you need to focus on.", "content.p_992666BC469C4ABA832116357DC4FD9A": "You can create tickets and add vulnerabilities to them. This allows you to assign and track specific vulnerabilities or groups of vulnerabilities.", "desc": [ "content.p_3DB2D1C930F6449CBD919F6E1A057F0E", "content.p_59ED71B55602438486E2796F71FE5111", "content.p_992666BC469C4ABA832116357DC4FD9A" ] }, "task_7CC59C0CA86A41CA9C4E3224AE0A8885-4.0-en.json": { "title": "title_F120BF81CB914EA8BD38C7E062296F05", "title_F120BF81CB914EA8BD38C7E062296F05": "Viewing tickets", "shortdesc": "shortdesc_1B4F583B619F41B58AE7FB225522B5E2", "shortdesc_1B4F583B619F41B58AE7FB225522B5E2": "You can filter, sort, and view ticket details on the Management > Vulnerability Tickets page. ", "content.p_ADC234E38A494565A2C6C150A598DA04": "Tip: You can filter the tickets that you want to see listed on the page to get a more relevant view.", "step.step_0BBC779CB9B94AB0BEA487C84C426C20": "Go to Management > Vulnerability Tickets.", "subchoice.choice_B1CFAD746EEC4430825B6D2FEDC0F956": "Ticket properties contains general information about the ticket, such as name, description, status, priority, deadline and the responsible person. All details can be updated whenever needed as work on the ticket progresses.", "subchoice.choice_CD824F7F238B494E8F4E721245649418": "Tags include both any tags found in the ticket's vulnerabilities and manually added tags. Click Add if you want to enter a new tag for the ticket.", "subchoice.choice_C2F6CF395E5E44AEA572070A7688E132": "Followers contains a list of Elements Vulnerability Management users and external users that should receive notifications about changes in this ticket. Note that external users only receive notifications but cannot log in or view the ticket itself.", "subchoice.choice_128ED01F361644499E5643454333A0CF": "The next two sections, Vulnerabilities on hosts and Vulnerabilities on sites, list the vulnerabilities assigned to the ticket, split into system scan and web scan vulnerabilities. You can expand each vulnerability category to view the number of affected hosts and see their vulnerability status. Most importantly, you can change their vulnerability status.", "subchoice.choice_12B76BAB04F84F6D91ADFE7E6F79AB8D": "Change log contains a full log of activities relating to the ticket and a comment area for any notes that you want to add to the ticket.", "content.p_342BF80B86BE4412B96D8E7007C3DB3D": "Each ticket contains several details:", "step.step_C638C2DECD9842EC9C690B66C0DF9082": "Click the name of the ticket that you want to view.", "desc": [ { "steps.steps_6C01FD380670417398385CA4188233F9": [ "step.step_0BBC779CB9B94AB0BEA487C84C426C20", { "content.note_ADC234E38A494565A2C6C150A598DA04": [ "content.p_ADC234E38A494565A2C6C150A598DA04" ] }, "step.step_C638C2DECD9842EC9C690B66C0DF9082", "content.p_342BF80B86BE4412B96D8E7007C3DB3D", { "subchoices.ul_C2BC0F2103BB4EE1AF189426BE77DDDA": [ "subchoice.choice_B1CFAD746EEC4430825B6D2FEDC0F956", "subchoice.choice_CD824F7F238B494E8F4E721245649418", "subchoice.choice_C2F6CF395E5E44AEA572070A7688E132", "subchoice.choice_128ED01F361644499E5643454333A0CF", "subchoice.choice_12B76BAB04F84F6D91ADFE7E6F79AB8D" ] } ] } ] }, "task_0F3497976DE84688AA5D8CAB84ED0A22-4.0-en.json": { "title": "title_393D40A5BB474E24AE8376F03590FB15", "title_393D40A5BB474E24AE8376F03590FB15": "Creating a ticket", "shortdesc": "shortdesc_89519279ABE04EAF82A1D38906F810D7", "shortdesc_89519279ABE04EAF82A1D38906F810D7": "You can create tickets on the Environment > Exposure > Vulnerabilities page, as well as from the results of a system scan or web scan. ", "content.p_E77903AC2A8E4C83B755E2C5EDC22A1E": "Tickets in Elements Vulnerability Management allow you to track how the detected vulnerabilities are handled and mitigated. Each ticket can contain multiple vulnerabilities, which can be grouped, for example, based on either the target network segment or the type of vulnerability.", "content.p_3AD045EFAA204CCFB00AA69DA685C66C": "To create a ticket:", "content.p_1965461B0EEE44969153CB4323ACBA22": "On the Environment > Exposure > Vulnerabilities page:", "substep.substep_49B67975662A441EBD90EC88BC018D11": "Select one or more of the listed vulnerabilities.", "substep.substep_449F52AC0AFF4CCFA4284D27FDB6A618": "Click Create new ticket.", "content.p_ED927EBC1C0E4EB08813315829489A20": "From the results of a network vulnerability scan:", "content.p_vuln_open_network_scans": "Note: If you are using WithSecure Vulnerability Management only, go to the Network scans page.", "substep.substep_8D3A58C6A829415AA56FA314D6786392": "In the WithSecure Elements Security Center, select Security Configurations > Scans > Network scans.", "substep.substep_8225ABF6DDA24E9A86232A6E7AE9831E": "In the List view click the menu icon in the Actions column.", "substep.substep_5A7FA13F6ECE424B9CE5DB8190E46F11": "Select View scan results.", "substep.substep_38E6AD2741254AEDA494AED7894848E4": "Open Scan results > Vulnerabilities and findings and select any of the listed vulnerabilities.", "substep.substep_F2C404815E8045A5ADAAFB6BCC671218": "Click Create new ticket.", "content.p_24BF5C1412EC480EA27CC840120DDFA9": "Both of these options open the Create new ticket wizard. All instances of the selected vulnerabilities are automatically included in the Vulnerabilities list for the new ticket.", "step.step_C0581975F9D34DE091C43B1095E15771": "Select the vulnerabilities that you want to include in the ticket.", "content.p_23FE43C6A272488580AFDDC7B9030BEB": "By default, all vulnerabilities are selected.", "step.step_7BFEE9C14CC443299514220438691046": "If you want to deselect any vulnerabilities from the ticket, click the Grouped by vulnerability switch to expand the listed items and clear the selection for that vulnerability.", "step.step_FBCCE5BFFCCC4BE5897AFB79CE312001": "Click Next.", "content.p_89192F2F7BC94AACB113C31DD725386D": "You can set a deadline for when the ticket should be resolved and provide an estimate of the amount of work involved.", "step.step_5C0682523D0548BCB45D4A6160DCE205": "Enter a name and description for the ticket.", "step.step_FECEBEED32A6493A87CF4E08A8975E8A": "Assign a user to the ticket and set the priority.", "content.p_5AA4CD73EFC14F4C8A229C40239D56EA": "The ticket is added to the list on Management > Vulnerability Tickets.", "step.step_FE96C24542B146888505436BE2898A77": "Click Finish.", "desc": [ "content.p_E77903AC2A8E4C83B755E2C5EDC22A1E", "content.p_3AD045EFAA204CCFB00AA69DA685C66C", { "steps.steps_6D5EB128157141AABE6E7C83F4CDB0AA": [ "step.step_C0581975F9D34DE091C43B1095E15771", "content.p_1965461B0EEE44969153CB4323ACBA22", { "substeps.substepsalpha_D134B04B5609470BBA468A1DFAFD6A44": [ "substep.substep_49B67975662A441EBD90EC88BC018D11", "substep.substep_449F52AC0AFF4CCFA4284D27FDB6A618" ] }, "content.p_ED927EBC1C0E4EB08813315829489A20", { "substeps.substepsalpha_FA3DCC1FAB3541E1A9211B9E7333A5F6": [ "substep.substep_8D3A58C6A829415AA56FA314D6786392", { "content.note_vuln_open_network_scans": [ "content.p_vuln_open_network_scans" ] }, "substep.substep_8225ABF6DDA24E9A86232A6E7AE9831E", "substep.substep_5A7FA13F6ECE424B9CE5DB8190E46F11", "substep.substep_38E6AD2741254AEDA494AED7894848E4", "substep.substep_F2C404815E8045A5ADAAFB6BCC671218" ] }, "content.p_24BF5C1412EC480EA27CC840120DDFA9", "step.step_7BFEE9C14CC443299514220438691046", "content.p_23FE43C6A272488580AFDDC7B9030BEB", "step.step_FBCCE5BFFCCC4BE5897AFB79CE312001", "step.step_5C0682523D0548BCB45D4A6160DCE205", "content.p_89192F2F7BC94AACB113C31DD725386D", "step.step_FECEBEED32A6493A87CF4E08A8975E8A", "step.step_FE96C24542B146888505436BE2898A77", "content.p_5AA4CD73EFC14F4C8A229C40239D56EA" ] } ] }, "task_F151009F910A436ABD713F199715DB29-4.0-en.json": { "title": "title_EFDB9AAFB45F4F65848757D897E2B899", "title_EFDB9AAFB45F4F65848757D897E2B899": "Adding a vulnerability to an existing ticket", "shortdesc": "shortdesc_DDBFE08FDBC74734A6609035D4824629", "shortdesc_DDBFE08FDBC74734A6609035D4824629": "You can add vulnerabilities to an existing ticket on the Environment > Exposure > Vulnerabilities page, as well as from the results of a system scan or web scan. ", "step.step_E3F04742D9EC4F508029C0718EF6BCF7": "On the Environment > Exposure > Vulnerabilities page, click the Actions button for the vulnerability that you want to add and select Add to existing ticket.", "step.step_55B6936001AA4F6CAD93AD43AC16A08E": "Select the ticket that you want to add the vulnerability to from the drop-down menu.", "content.p_8526D2432770450A983B794127319BFC": "The ticket opens, with the new vulnerability included in either the Vulnerabilities on hosts or Vulnerabilities on sites list, depending on its type.", "step.step_DE4B224C781348FC91C356CD065E0429": "Select the vulnerability on the list, then click Add.", "desc": [ { "steps.steps_8127FD6AFFB94FF5AAAE23A04E812D6F": [ "step.step_E3F04742D9EC4F508029C0718EF6BCF7", "step.step_55B6936001AA4F6CAD93AD43AC16A08E", "step.step_DE4B224C781348FC91C356CD065E0429", "content.p_8526D2432770450A983B794127319BFC" ] } ] }, "concept_4B8B8CC26B9F439FBDC23378A76816D1-4.0-en.json": { "title": "title_CB5280C3C1CA433AB4ED9A28A9865C3D", "title_CB5280C3C1CA433AB4ED9A28A9865C3D": "Assets", "shortdesc": "shortdesc_BC37CE418A43481EB29D4B096C47C57F", "shortdesc_BC37CE418A43481EB29D4B096C47C57F": "Elements Vulnerability Management keeps an inventory of all the assets, such as servers, computers, printers, routers, IoT devices, etc. within your network environment, discovered by Elements Vulnerability Management during the Discovery scan or a network as well as agent-based vulnerability scan. ", "content.p_03E625B36CFC4CB1BC5364CAB88B2DB5": "The Discovery scan maps your whole network and all its assets.", "content.p_5003CD8BBF8441E68AEBBE6C3CF822E8": "You get the full benefit from the assets inventory with Authenticated scanning; the non-authenticated scans will provide only a limited set of information about each asset.", "content.p_C211A2BFDF7340B4983F3A1B16AD31B6": "On the Environment > Devices > Vulnerability assets page, you can:", "choice.choice_DAB1EF7B238342E4BEEB857CFE59C937": "view the complete list of assets discovered in your environment;", "choice.choice_FB13A53A051A46BEAB1ECD169EE3C42D": "filter the list of assets to see the asset data that is most relevant to you;", "choice.choice_9D17E0E127704750A6A64F55CEB1E53A": "see detailed information about individual assets, such as the device's hardware details and the software installed on it;", "choice.choice_3DE35DDB5A424FF180C85E1F471AE31A": "assign custom tags and criticality rating for each asset for improved prioritization of vulnerabilities.", "content.p_1D2C16DD567742A6AA57C9A1A56CAB81": "To view the data of an individual asset, go to the Environment > Devices > Vulnerability assets page and click the asset name.", "desc": [ "content.p_03E625B36CFC4CB1BC5364CAB88B2DB5", "content.p_5003CD8BBF8441E68AEBBE6C3CF822E8", "content.p_C211A2BFDF7340B4983F3A1B16AD31B6", { "choices.ul_C772F6FDCF924E78876F54B522DC6649": [ "choice.choice_DAB1EF7B238342E4BEEB857CFE59C937", "choice.choice_FB13A53A051A46BEAB1ECD169EE3C42D", "choice.choice_9D17E0E127704750A6A64F55CEB1E53A", "choice.choice_3DE35DDB5A424FF180C85E1F471AE31A" ] }, "content.p_1D2C16DD567742A6AA57C9A1A56CAB81" ] }, "task_2467648C40CA4688913D8B08817F1C54-4.0-en.json": { "title": "title_F260409F1C774E93971AB8B8C98A92A1", "title_F260409F1C774E93971AB8B8C98A92A1": "Viewing assets", "shortdesc": "shortdesc_8257FB0D8A2545698507B4CEED2B1730", "shortdesc_8257FB0D8A2545698507B4CEED2B1730": "There are several ways to view the assets in your network, and you can use filters to see the data that is most relevant to you. ", "content.p_03E625B36CFC4CB1BC5364CAB88B2DB5": "On the Environment > Devices > Vulnerability assets page, you can view the data in the following two modes:", "choice.choice_713986BF518D4EFB8C4AAEE5853551BE": "List view - Shows all assets in a flat list which can be sorted by various criteria, such as asset name, vulnerability, criticality, etc.", "content.p_C904F9E5513743C3BF29D13F937C9586": "Note: You can group assets by manually-added asset tags only.", "choice.choice_BDE45322709F4C01A28424A22C136FA1": "Grouped by - Allows you to group the assets by one of the following attributes: Department, Business owner, Hardware type, Operating system, Country, or Asset tags.", "content.p_69CE8BB5FC77422E9B5989B434FB2FA1": "The standard Elements Vulnerability Management filtering can be used to filter the assets. Click the chevron next to Filter to see the available options for filtering the assets. For example, the Asset source option allows you to filter the assets to see only the assets which have been scanned by the authenticated network vulnerability scan.", "content.p_9700EF25E22248189541BCC7DD4DB2B4": "To view the data of an individual asset:", "content.p_3B62263127D244099042322A909C5EDA": "The Asset details page opens, with all available information about the asset.", "step.step_44BB6ABE675947CFB2650A9F6DD2D389": "On the Environment > Devices > Vulnerability assets page, click the asset name.", "step.step_404B70360D69444882FBA9E01728C11C": "If you want to manually edit or add data to the asset details, the various attributes assigned to the asset in the Description tab, or the data in the Notes tab, click the pen icon in the top-right corner of the respective tab, edit or add the desired data and select Save.", "content.p_179C371A36194ABE99530ADD1C0BCDA8": "Note: To see the latest network vulnerability scan report for the asset in question, click the link icon next to the vulnerability ratings.", "desc": [ "content.p_03E625B36CFC4CB1BC5364CAB88B2DB5", { "choices.ul_27A7C384AFE5453395672934DBD751DB": [ "choice.choice_713986BF518D4EFB8C4AAEE5853551BE", "choice.choice_BDE45322709F4C01A28424A22C136FA1", { "content.note_C904F9E5513743C3BF29D13F937C9586": [ "content.p_C904F9E5513743C3BF29D13F937C9586" ] } ] }, "content.p_69CE8BB5FC77422E9B5989B434FB2FA1", "content.p_9700EF25E22248189541BCC7DD4DB2B4", { "steps.steps_41EEB1FF96A249BFB41D1D205373F02A": [ "step.step_44BB6ABE675947CFB2650A9F6DD2D389", "content.p_3B62263127D244099042322A909C5EDA", "step.step_404B70360D69444882FBA9E01728C11C" ] }, { "content.note_179C371A36194ABE99530ADD1C0BCDA8": [ "content.p_179C371A36194ABE99530ADD1C0BCDA8" ] } ] }, "concept_16CD5239A54347588045034CCB9A0F67-4.0-en.json": { "title": "title_6A8381CC22B14D08B398A362F0756BE4", "title_6A8381CC22B14D08B398A362F0756BE4": "Tracking asset changes", "shortdesc": "shortdesc_4BA2FCC6C00643CBBB855405E94EEC98", "shortdesc_4BA2FCC6C00643CBBB855405E94EEC98": "Assets can be filtered also by the following attributes: First discovered, Last seen, Last scanned and Last updated. ", "content.p_3A5BA4468DE2493CA85269972D79D8A3": "Use these attributes together with scheduled Discovery scans to see the changes, if any, that have taken place in an asset in your network.", "content.p_8BFDA047DFAB498FB4281AAFBCE9E7E8": "", "cell.entry_A48CFD03EF61429FB6C9F284DF5D17BB": "Attribute", "cell.entry_37C82502B8C4440E8DB2BD9EEE29E63F": "Meaning", "cell.entry_2C2D00EEFBF440BEA2EEC0C776361D94": "First discovered", "cell.entry_7B5B02F19E5B4F5284A3EC1509568DA1": "Indicates when the asset in question was detected by the system for the very first time. The source of information can be any type of scan, including a Discovery scan.", "cell.entry_FC48CEBC30B343A983D20B51702D1A9B": "Last seen", "cell.entry_4977A7C8519C459CA7F2B1E99631DDA0": "Indicates when the asset in question was last seen. The source of information can be any type of scan, including a Discovery scan.", "cell.entry_1E7007D97CC64F38A87C612C2C1CBA1B": "Last scanned", "cell.entry_A6E850C1D3024DEA888A5E26592C7AE8": "Indicates when the asset in question was last scanned for vulnerabilities.", "cell.entry_495454F91340437E84818079A0D155CF": "Last updated", "cell.entry_1A80A409EB214F84BD9612FA258AB416": "Indicates when the information about the asset in question was last updated in Elements Vulnerability Management. This takes place once the system detects new information about the asset and the reliability of the information source is high enough. For example, information gathered during the port scan of the asset is less reliable than that collected during an authenticated network scan.", "desc": [ "content.p_3A5BA4468DE2493CA85269972D79D8A3", { "table.table_29F442DC171F4CBB9088816ADBA1A0DB": [ { "thead.thead_5326CB54B7164EE9ABB182B67339438D": [ "cell.entry_A48CFD03EF61429FB6C9F284DF5D17BB", "cell.entry_37C82502B8C4440E8DB2BD9EEE29E63F" ] }, { "row.row_5EFB763C06DD448EBB8F94328A3BC7C8": [ "cell.entry_2C2D00EEFBF440BEA2EEC0C776361D94", "cell.entry_7B5B02F19E5B4F5284A3EC1509568DA1" ] }, { "row.row_B4F0B1A20B3347DC8837D34AD9A79A7E": [ "cell.entry_FC48CEBC30B343A983D20B51702D1A9B", "cell.entry_4977A7C8519C459CA7F2B1E99631DDA0" ] }, { "row.row_1F60865908424A17B34E5151F28E4350": [ "cell.entry_1E7007D97CC64F38A87C612C2C1CBA1B", "cell.entry_A6E850C1D3024DEA888A5E26592C7AE8" ] }, { "row.row_00BBFE3A954443E795F8F849A2246BF1": [ "cell.entry_495454F91340437E84818079A0D155CF", "cell.entry_1A80A409EB214F84BD9612FA258AB416" ] } ] } ] }, "task_5D3BB3F42ED1439C9D1DCC70F32AD63B-4.0-en.json": { "title": "title_3D0AEFC9B5D84DFBBDCB0C2228E40748", "title_3D0AEFC9B5D84DFBBDCB0C2228E40748": "Managing asset attributes", "shortdesc": "shortdesc_AEE6188CB1004E838D2AEC5973BB8734", "shortdesc_AEE6188CB1004E838D2AEC5973BB8734": "On the Environment > Devices > Vulnerability assets page, you can manually supplement the asset data with various attributes. ", "content.p_E274006A2A5C498DA59A25DD80A0993E": "Once an asset is discovered by a scan, all available data about the asset will be obtained automatically. Later on, you can manually edit the data or add more details to the asset.", "content.p_7226CFEA887B4AB58E5990A6FD97F40B": "To manage attributes related to an asset:", "content.p_7A5A6BB450C9444895DA24943418F83D": "The action bar appears at the bottom of the page.", "step.step_4A8ED31B2C98493E827B2D4566D3182B": "On the Environment > Devices > Vulnerability assets page, select the checkbox of the asset (or assets) whose data you want to manage.", "step.step_8E7680B1028A4A058599441F85F85B8F": "Select Manage attributes from the action bar.", "content.p_45D72B38D1BE407196047CA4C5AFF54F": "Depending on the type of attribute, a field or set of fields is displayed.", "step.step_BBBE47219A3341A9A556A2C5AF1EF854": "From the drop-down, select the attribute you want to manage.", "step.step_F873498AEF16408BBF5F3FD6C11AFDF5": "Enter the data you want to add.", "step.step_BAD9F6EC11FC4A99BF4FFE7B484F6571": "Select Save.", "content.p_4443E20AB9DA4FDF8187BF2CCE4B4398": "The data can now be seen in the asset details in the Description tab where the data can also be edited.", "desc": [ "content.p_E274006A2A5C498DA59A25DD80A0993E", "content.p_7226CFEA887B4AB58E5990A6FD97F40B", { "steps.steps_8F030A49E2B644099C42A46B0878D426": [ "step.step_4A8ED31B2C98493E827B2D4566D3182B", "content.p_7A5A6BB450C9444895DA24943418F83D", "step.step_8E7680B1028A4A058599441F85F85B8F", "step.step_BBBE47219A3341A9A556A2C5AF1EF854", "content.p_45D72B38D1BE407196047CA4C5AFF54F", "step.step_F873498AEF16408BBF5F3FD6C11AFDF5", "step.step_BAD9F6EC11FC4A99BF4FFE7B484F6571" ] }, "content.p_4443E20AB9DA4FDF8187BF2CCE4B4398" ] }, "task_68720EBE3D184EA4A10D40A58A5EFA65-4.0-en.json": { "title": "title_5D4CBC0CBE1043D6BFB1DB4BBBEAFA42", "title_5D4CBC0CBE1043D6BFB1DB4BBBEAFA42": "Managing asset tags", "shortdesc": "shortdesc_22E213B230B44CB8AC038332A7450153", "shortdesc_22E213B230B44CB8AC038332A7450153": "On the Environment > Devices > Vulnerability assets page, you can add tags to assets and remove tags from them. ", "content.p_7226CFEA887B4AB58E5990A6FD97F40B": "To add or remove tags related to an asset or assets:", "content.p_7A5A6BB450C9444895DA24943418F83D": "The action bar appears at the bottom of the page.", "step.step_4A8ED31B2C98493E827B2D4566D3182B": "On the Environment > Devices > Vulnerability assets page, select the checkbox of the asset (or assets) whose tags you want to manage.", "step.step_8E7680B1028A4A058599441F85F85B8F": "Select Manage tags from the action bar.", "substep.substep_40A9250F471E49BB925FB9DECFEE8D3B": "Select Add the following tags to assets and select Next.", "substep.substep_BE86322594C24D5984BD8420F83491FD": "Click the field and either select an existing tag from the tags list displayed or enter a new tag to add it to the assets and select Add.", "step.step_BBBE47219A3341A9A556A2C5AF1EF854": "If you want to add tags to the assets:", "substep.substep_6166E74C12E546F1B63C5BBE95F618BB": "Select Remove the following tags from assets and select Next.", "substep.substep_182ECE6BFF914EA0BD0B33115D5FE550": "Click the field and, from the tags list displayed, select the tag that you want to remove from the assets, and then select Remove.", "step.step_F873498AEF16408BBF5F3FD6C11AFDF5": "If you want to remove tags from the assets:", "content.p_AC289DC67A854C97A3D9A8501B630A1E": "Note: You can add tags to an individual asset also through the Asset details page.", "desc": [ "content.p_7226CFEA887B4AB58E5990A6FD97F40B", { "steps.steps_8F030A49E2B644099C42A46B0878D426": [ "step.step_4A8ED31B2C98493E827B2D4566D3182B", "content.p_7A5A6BB450C9444895DA24943418F83D", "step.step_8E7680B1028A4A058599441F85F85B8F", "step.step_BBBE47219A3341A9A556A2C5AF1EF854", { "substeps.substepsalpha_33769F0D27D442B4AA9DFB398E41A02C": [ "substep.substep_40A9250F471E49BB925FB9DECFEE8D3B", "substep.substep_BE86322594C24D5984BD8420F83491FD" ] }, "step.step_F873498AEF16408BBF5F3FD6C11AFDF5", { "substeps.substepsalpha_19C88FA021984ECABD162C556FE60025": [ "substep.substep_6166E74C12E546F1B63C5BBE95F618BB", "substep.substep_182ECE6BFF914EA0BD0B33115D5FE550" ] } ] }, { "content.note_AC289DC67A854C97A3D9A8501B630A1E": [ "content.p_AC289DC67A854C97A3D9A8501B630A1E" ] } ] }, "task_891FAB89028144F2B58A8DE945787C6E-4.0-en.json": { "title": "title_851E319CD2BE4B398BF8E7F3A4935C33", "title_851E319CD2BE4B398BF8E7F3A4935C33": "Updating notes", "shortdesc": "shortdesc_8D3C05E516BE41BC8137F4F85FB05E3E", "shortdesc_8D3C05E516BE41BC8137F4F85FB05E3E": "If you wish, you can add notes to the selected assets. ", "content.p_044497DF35DF4605966B1BD4EECA921C": "", "content.p_8B10CEE3561D485595FC932987E30FD2": "Note: When you update notes, the existing notes already assigned to the selected assets will be overwritten.", "content.p_35837B1212A247488411205972C1C70D": "There are two ways you can add notes to an asset:", "choice.choice_2A2D1CCA3C1D47D6A19F7F8B601FDA27": "On the Asset details page of the selected asset, select the Notes tab and click the pen icon in the top-right corner of the tab, enter the desired data and select Save.", "choice.choice_DCCC0A9A18F34A08BE9A2BEEF4C0433A": "On the Environment > Devices > Vulnerability assets page:", "content.p_7A5A6BB450C9444895DA24943418F83D": "The action bar appears at the bottom of the page.", "step.step_4A8ED31B2C98493E827B2D4566D3182B": "Select the checkbox of the asset (or assets) whose notes you want to update.", "step.step_8E7680B1028A4A058599441F85F85B8F": "Select Update notes from the action bar.", "step.step_FDBF9B6B304F4762A880CD1E4F04CA46": "Enter the data you want to add to notes and select Save.", "content.p_5102942025C9445A8AD8AD6CE8290282": "You can view the notes in the Notes tab in the Asset details page.", "desc": [ { "content.note_8B10CEE3561D485595FC932987E30FD2": [ "content.p_8B10CEE3561D485595FC932987E30FD2" ] }, "content.p_35837B1212A247488411205972C1C70D", { "choices.ul_165AEFF4F4CA44E296BD6898B10FD976": [ "choice.choice_2A2D1CCA3C1D47D6A19F7F8B601FDA27", "choice.choice_DCCC0A9A18F34A08BE9A2BEEF4C0433A" ] }, { "steps.steps_369429F86C8947BE84CE5E962D477294": [ "step.step_4A8ED31B2C98493E827B2D4566D3182B", "content.p_7A5A6BB450C9444895DA24943418F83D", "step.step_8E7680B1028A4A058599441F85F85B8F", "step.step_FDBF9B6B304F4762A880CD1E4F04CA46" ] }, "content.p_5102942025C9445A8AD8AD6CE8290282" ] }, "task_951C9ED9227D4D578D4FDBC1A1056F07-4.0-en.json": { "title": "title_E3776B0E6FCD46D59DAFF970ED080720", "title_E3776B0E6FCD46D59DAFF970ED080720": "Deleting assets", "shortdesc": "shortdesc_3D65D4DF40BD4B6B8630E323EE7C5DE9", "shortdesc_3D65D4DF40BD4B6B8630E323EE7C5DE9": "On the Assets page, you can immediately delete assets from your inventory. ", "content.p_D6981246E8254194854D9EDB36A710E9": "", "content.p_E0FF95556D0C4835A1E845EE47515611": "Note: When you delete an asset, it will also remove the network vulnerability scans associated with the asset.", "content.p_7226CFEA887B4AB58E5990A6FD97F40B": "To remove an asset or assets:", "content.p_7A5A6BB450C9444895DA24943418F83D": "The action bar appears at the bottom of the page.", "step.step_4A8ED31B2C98493E827B2D4566D3182B": "On the Environment > Devices > Vulnerability assets page, select the checkbox of the asset (or assets) that you want to delete.", "step.step_8E7680B1028A4A058599441F85F85B8F": "Select Delete assets from the action bar.", "step.step_AA25599BD52248A18AF5053908A374D4": "Select Delete.", "content.p_A5369215271E4C72BCA9ACCA21FF4D6E": "The selected asset or assets together with the associated vulnerability scans are deleted from Elements Vulnerability Management.", "content.p_DD06DC9B3F0848998200413B2C9B134C": "You can also configure Elements Vulnerability Management to delete archived assets automatically after a specified time.", "desc": [ { "content.note_E0FF95556D0C4835A1E845EE47515611": [ "content.p_E0FF95556D0C4835A1E845EE47515611" ] }, "content.p_7226CFEA887B4AB58E5990A6FD97F40B", { "steps.steps_983DB7D3423A4FE2B6D7AC4CBEA54585": [ "step.step_4A8ED31B2C98493E827B2D4566D3182B", "content.p_7A5A6BB450C9444895DA24943418F83D", "step.step_8E7680B1028A4A058599441F85F85B8F", "step.step_AA25599BD52248A18AF5053908A374D4" ] }, "content.p_A5369215271E4C72BCA9ACCA21FF4D6E", "content.p_DD06DC9B3F0848998200413B2C9B134C" ] }, "task_A0E5E3B26F5747588E50F4E71E1A2C78-4.0-en.json": { "title": "title_3E94EA8EF2A2403C8D9516390E8B33AF", "title_3E94EA8EF2A2403C8D9516390E8B33AF": "Deleting archived assets", "shortdesc": "shortdesc_0231C29B07FF45939B1246A50D048681", "shortdesc_0231C29B07FF45939B1246A50D048681": "If you have configured Elements Vulnerability Management to archive old assets, you can configure it also to delete the archived assets automatically after a specified time. ", "content.p_28E86CFA8F104270A40CB031A5256446": "If you have configured Elements Vulnerability Management to archive old assets, they are archived based on the time they were last seen by any of type of scan.", "content.p_EC35964B6736438497D0BBC879B094CC": "To delete the archived assets automatically:", "step.step_86A1FF8CE4FA4F9CA89D27BFEF0BDADD": "Go to Management > Vulnerability settings > General settings > Miscellaneous.", "content.p_C8E0C5E9EB07403DB967176181753F7F": "The options are: Never, 1 month, 1 quarter, Half a year, 1 year, or 2 years.", "step.step_8975494A4D014D988B67DA5E6C09E348": "Under Archive assets, use the drop-down to specify when assets will be archived based on the time last seen.", "content.p_CD251CFB802E4DF1A93C55A9CA706818": "The options are: Forever, 1 month, 1 quarter, Half a year, 1 year, or 2 years.", "step.step_D47D02D3867B488096FB48741A97F757": "Under Store assets, use the drop-down to specify for how long the archived assets are stored before they are automatically deleted.", "step.step_62690A04E9AB42C0B943CAA9B8CD55D2": "Select Save.", "content.p_CE78A339F6144375BFD26F787F092923": "All assets that meet the specified criteria will be deleted automatically from Elements Vulnerability Management.", "desc": [ "content.p_28E86CFA8F104270A40CB031A5256446", "content.p_EC35964B6736438497D0BBC879B094CC", { "steps.steps_B43A2A904F1647EB85482E17E9A204C5": [ "step.step_86A1FF8CE4FA4F9CA89D27BFEF0BDADD", "step.step_8975494A4D014D988B67DA5E6C09E348", "content.p_C8E0C5E9EB07403DB967176181753F7F", "step.step_D47D02D3867B488096FB48741A97F757", "content.p_CD251CFB802E4DF1A93C55A9CA706818", "step.step_62690A04E9AB42C0B943CAA9B8CD55D2" ] }, "content.p_CE78A339F6144375BFD26F787F092923" ] }, "concept_E571188FA85B4E539D32B947CDD20895-4.0-en.json": { "title": "title_A2E8BA135BE54749A964877E27A7573A", "title_A2E8BA135BE54749A964877E27A7573A": "Scan nodes", "shortdesc": "shortdesc_19CB71B2C60B411580EBBB0956CF2E90", "shortdesc_19CB71B2C60B411580EBBB0956CF2E90": "Security Configurations > Scans > Scan nodes is used to manage all scan nodes available in your Elements Vulnerability Management account. ", "content.p_3E9C98A909164F28BEE6E735C5A15C70": "The table shows the following information for each listed scan node:", "choice.choice_B624E0E748CB4759BB81E78201424687": "Type indicates the type of scan associated with the scan node (discovery scan, system scan, or web scan).", "choice.choice_FA973AB648D843F28F4251F017E30041": "Name contains a descriptive text for the node. You can hover over the name to see more details.", "choice.choice_0BE2F7984F074A01A31AC99D5268F78E": "Current load tells the maximum capacity of the scan node and how many scans are currently running on the node.", "choice.choice_B583C45AACE54CFDBA1409F236D57852": "Engine update tells when the scanning engine itself was last updated. Note that some scanning engines are updated more often than others. For example, you should expect daily updates for System Scan, but less frequent updates for the other engines.", "choice.choice_97129FE0C49C4A508ED2B4403728517B": "Last seen shows when the scan node last contacted the Elements Security Center. By default, the scan nodes are configured to connect every 60 seconds.", "choice.choice_BCD63A3DD83547ACA242D6ACD4770048": "Status indicates whether the node is Active or Inactive.", "content.p_18F50234E83E43509E2D42E72AE8BD67": "", "content.p_1A29166B7C9840BAB3EA4EF6E1BB6C16": "Tip: Click the arrow down icon to view more details for the scan node.", "desc": [ "content.p_3E9C98A909164F28BEE6E735C5A15C70", { "choices.ul_438B026B59BD42D49C4CF163E50B1A50": [ "choice.choice_B624E0E748CB4759BB81E78201424687", "choice.choice_FA973AB648D843F28F4251F017E30041", "choice.choice_0BE2F7984F074A01A31AC99D5268F78E", "choice.choice_B583C45AACE54CFDBA1409F236D57852", "choice.choice_97129FE0C49C4A508ED2B4403728517B", "choice.choice_BCD63A3DD83547ACA242D6ACD4770048" ] }, { "content.note_1A29166B7C9840BAB3EA4EF6E1BB6C16": [ "content.p_1A29166B7C9840BAB3EA4EF6E1BB6C16" ] } ] }, "task_B9679B13BA454AB08BAB49EF2C78164B-4.0-en.json": { "title": "title_56B4BA7D60F6483085391939FA6628F0", "title_56B4BA7D60F6483085391939FA6628F0": "Adding new scan nodes", "shortdesc": "shortdesc_346B190A95C14AA4BBE2809127387C1F", "shortdesc_346B190A95C14AA4BBE2809127387C1F": "To use a new scan node, you need to either request a new license or register an already installed scan node in the WithSecure Elements portal. ", "step.step_8312C909795E477D99187240CA25C40A": "Go to Security Configurations > Scans > Scan nodes.", "content.p_9F3E804953A14222A8D23F5629148099": "If you need a new scan node license:", "substep.substep_D13255B6B82A4758A85495D2C4D17C7F": "Select Request a new scan node and click Next.", "content.p_3F41A780E3E44927AE356FFE2E58C630": "When your request is approved, the license file automatically starts to download. Follow the steps on the Summary page to install the scan node.", "substep.substep_2F7EEF54FA724A55B7AA8FE0A908BEEA": "Enter a name and description (optional) for the scan node and click Request.", "substep.substep_CC21BFEAB71E4DC7BA817A6EB58F0849": "Click Done.", "content.p_64D76F8427E74683AF5FD6AB6767BB38": "If you already have a scan node license file:", "substep.substep_E40D7DC7957F473AB38D3E9FFE8F0EAE": "Select Register a previously requested scan node and click Next.", "content.p_1325D4906ADB44699ED4A4052200D4CE": "Use a name that identifies the scan node server such as a hostname and preferably the source IP, so that other Elements Vulnerability Management users can easily see from which IP the node will be scanning.", "substep.substep_2C0003BCD12C47B7AD0D1A8B3E952ACB": "Enter a name and description (optional) for the scan node.", "content.p_12EA124EFBD84AA18E2CBA23F705C9BD": "Log in to the scan node server and open the scan node control center application. Under the Settings tab, you will find the scan node identifier.", "content.p_095B414F3F5444E6B3E5B8C7C466F034": "For more information, see how to install a scan node.", "content.p_A35A1A8E7FEE4CD88B8A5058EBFC4ACD": "Make sure the scan node type matches the node identifier.", "substep.substep_CEFEE992F3F64338AA8F518BA406DC95": "Use the switches to select the node types that you want to register and enter the corresponding module identifiers.", "content.p_462BE98B87A04BFA82C0AE9683170093": "By default, the scan node initiates the connection. If a so-called \"reverse connection scan node\" has been installed, the WithSecure Elements portal must initiate the connection.", "substep.substep_015CF76E6EF1405C86A3C2CDF66CFD76": "Connection type. Defines how the scan node and the WithSecure Elements portal communicate.", "step.step_383F354F5DC141429F1F0CF495512D14": "Click New scan node.", "desc": [ { "steps.steps_4E650C8D9DF24E9994A5974D2FA71F75": [ "step.step_8312C909795E477D99187240CA25C40A", "step.step_383F354F5DC141429F1F0CF495512D14", "content.p_9F3E804953A14222A8D23F5629148099", { "substeps.substepsalpha_1E80F107AE59417A810DED88BD62644B": [ "substep.substep_D13255B6B82A4758A85495D2C4D17C7F", "substep.substep_2F7EEF54FA724A55B7AA8FE0A908BEEA", "content.p_3F41A780E3E44927AE356FFE2E58C630", "substep.substep_CC21BFEAB71E4DC7BA817A6EB58F0849" ] }, "content.p_64D76F8427E74683AF5FD6AB6767BB38", { "substeps.substepsalpha_F8D54A724F954E0887612197182DE2CE": [ "substep.substep_E40D7DC7957F473AB38D3E9FFE8F0EAE", "substep.substep_2C0003BCD12C47B7AD0D1A8B3E952ACB", "content.p_1325D4906ADB44699ED4A4052200D4CE", "substep.substep_CEFEE992F3F64338AA8F518BA406DC95", "content.p_12EA124EFBD84AA18E2CBA23F705C9BD", "content.p_095B414F3F5444E6B3E5B8C7C466F034", "content.p_A35A1A8E7FEE4CD88B8A5058EBFC4ACD", "substep.substep_015CF76E6EF1405C86A3C2CDF66CFD76", "content.p_462BE98B87A04BFA82C0AE9683170093" ] } ] } ] }, "concept_A0EBC0F9B11E4CD792470692CBF61BF5-4.0-en.json": { "title": "title_391B84D1793545BBB16618CB19552D71", "title_391B84D1793545BBB16618CB19552D71": "Users", "shortdesc": "shortdesc_9574BF5A330249E7A947ADC1F1874D17", "shortdesc_9574BF5A330249E7A947ADC1F1874D17": "Management > Organization Settings > Vulnerability users allows you to control user access to Elements Vulnerability Management using Role-Based Access Control (RBAC) principles. ", "content.p_4B8FD650575E4760ACAD94EE7659983F": "User management in Elements Vulnerability Management involves three concepts: Users, User groups, and Roles.", "content.title_A7E6E2AC7B694FB783AB80586D80BF76": "Users", "content.p_2219A621C3E148BCBA655F52D2611F09": "The Management > Organization Settings > Vulnerability users page shows you a list of all users with access to your Elements Vulnerability Management account. On this page you can review the users and what they have access to, and of course add and remove users.", "content.title_EBB37B4B09414998A7856C7D796AAE6B": "User groups", "content.p_F2CFB60484E2433A9CC8485990CAA591": "User groups act as containers for one or more users. With groups, you can control the permissions (roles) for the set of users. The User groups column shows you which groups each listed user belongs to.", "content.title_84BC0A91C0A34E7E8B7DBC29A65951AD": "Roles", "content.p_C212B7984A6B4EFAA4B00891FF882C34": "Roles are used to define what a user can access. For example, you can create roles like: View only, System owner, Administrator. To view and edit the roles for your Elements Vulnerability Management account, go to Management > Organization Settings > Vulnerability users and select Manage roles.", "desc": [ "content.p_4B8FD650575E4760ACAD94EE7659983F", "content.title_A7E6E2AC7B694FB783AB80586D80BF76", "content.p_2219A621C3E148BCBA655F52D2611F09", "content.title_EBB37B4B09414998A7856C7D796AAE6B", "content.p_F2CFB60484E2433A9CC8485990CAA591", "content.title_84BC0A91C0A34E7E8B7DBC29A65951AD", "content.p_C212B7984A6B4EFAA4B00891FF882C34" ] }, "concept_E995B8F17D6940188AADF8892B993A89-4.0-en.json": { "title": "title_BDB556EBCA494A27B82E82446BF230DA", "title_BDB556EBCA494A27B82E82446BF230DA": "Settings", "shortdesc": "shortdesc_1C79A05A83C448359ED917B4C1C07BA3", "shortdesc_1C79A05A83C448359ED917B4C1C07BA3": "You can control how your Elements Vulnerability Management account behaves across all users on the Management > Vulnerability settings page. ", "content.title_86B44245DAB34E63810883819769CA45": "General settings", "content.dt_CBB1E96C37BB46B1BAFD9E0587EE2DF2": "Contact details ", "content.dd_9B7F7E89BD5148C0A349367349FAA73D": "This sections contains the contact details of the selected organization.", "content.dt_F7BD27790553475AAB4673D0B86442DE": "Subscription details ", "content.dd_776FB4EB9E364F26AF8F7F4165B2984F": "This section provides information about the subscription of the selected organization.", "content.dt_FA499B7D88714B35A75C65F7ED8B738E": "Product customization ", "content.dd_F745E6612FC24B77B9C97A950AC7CA04": "This section is used to manage the product customization if it is enabled.", "content.dt_16B21BCBE75649AABD73AC671F59A1F7": "Scanning restrictions ", "content.dd_3E1A3A72F36849EB9FBF30E806E2B3AE": "This section can be used to control what IP ranges Elements Vulnerability Management is allowed to scan, and also to control when starting certain scans is allowed or denied.", "content.dt_0B5DE34516C9400D808733038ED001AE": "Encryption keys ", "content.dd_ED75EF309EF04F979B339989DDF2C0B0": "This section is used to manage the encryption keys that are used as a part of the Linux authenticated scanning feature.", "content.dt_3C955361F6414708A60AD707BB571A9D": "Vulnerability statuses ", "content.dd_6F4DD52411CD4B4DA34686837BCE4F75": "This section can be used to define whether or not open and closed vulnerability statuses are taken into account for example when determining the PCI compliance status, or whether or not to include them in the vulnerability counts, statistics on the Home > Vulnerabilities page.", "content.dt_A73F8FE3AF0E413AAD4A1DAD3E0C5D13": "Workflow ", "content.dd_876F15C0502140B18221CCCCE46361BE": "This section can be used to define what to do with tickets that have been automatically closed or reopened, whether or not to notify participants about ticket deadlines, when to notify participants about ticket deadlines, whether or not to flag new assets for internet exposure, and whether or not to mark duplicate findings as duplicates automatically.", "content.dt_F90E72B3C2084C03B667654CC1681B9A": "Miscellaneous ", "content.dd_BE9AC7D075724503BDBCA3CC9A747648": "This section can be used to define the default time zone for the organization, to specify for how long reports are stored, to define when to mark assets as archived, to specify for how long archived assets are stored, and to define how often vulnerability scans are triggered on endpoints.", "content.title_855C899F61744E8792643327BAAAB89A": "Security settings", "content.dt_4AEA5E5A4DA0403F854489BDBDE96F6E": "Isolate my organization ", "content.dd_841CEC0E0D2641249B0B08A08103F4ED": "When enabled, users that belong to the upper entities in the organization hierarchy will not be able to access this organization. Only users present in the Account Management list will be able to see data from this organization.", "content.dt_8EEC14229A254CD4892BA7AE8B8B5B1B": "Restrict login based on IP address ", "content.dd_C7E213BCEF4B40EA8E706D00F399BF73": "This setting can be used to control who has permission to authenticate to your Elements Vulnerability Management account based on the source IP address. For example, you can enhance the security of your account by only permitting a list of trusted IP addresses.", "content.dt_221B3E4FA7F746D3AE1A5C372EF7E646": "Force two-factor authentication ", "content.p_79EFEA4E79BC4AF4A11037B8937829B1": "Note: Two-factor authentication supports Google Authenticator, Microsoft Authenticator, and any other mobile authentication app that supports the TOTP (Time-based One-Time Password) algorithm.", "content.p_CA1012B8981E4DDBB31BBD9A033360FA": "", "content.dd_A6D1C77E2F76415DBCD85D8E17236D29": "If enabled, this enforces two-factor authentication for all users. If disabled, two-factor authentication becomes optional. Users can choose to enable two-factor authentication manually via the My profile page.", "content.dt_B72DDE18742A464581105272825E296E": "User can reset password without login ", "content.dd_8305B9B4B1DE491D869F97D2793B0023": "If enabled, unauthenticated users are allowed to reset their password with the Forgot password? link. If disabled, only existing (authenticated) users and administrators can reset the password of another user.", "content.dt_EA54D582730843AE98486BC42C7B4C03": "Default security stance ", "choice.choice_71B751BF118D40BF8C2AEF0395FE2CE0": "Permit means that everything that is not explicitly forbidden is permitted.", "choice.choice_AD9BE56742C8490793A56718F8FA6DA2": "Deny (default) means that everything that is not explicitly permitted is forbidden.", "content.dd_EB62B6C96FAE4C0F916FBB2EBF16AC5D": "This setting affects the default permissions of newly created users:", "content.dt_9F119739EF4549F1993AE7882B0630F1": "Email notifications include ", "content.dd_87E90384467842F6AE12F445F160870B": "This setting defines how many details are allowed to be communicated via email, which is often unencrypted and in general considered unsafe.", "content.title_8ECA5DCD14824061B4C32B8C1FDC8E79": "Notification settings", "content.p_D51CD55C177D41A599DC4BE6597CE63B": "", "content.p_1880FFDD1C1149D2A785AFB4AE0C285F": "Note: Notification settings apply to your personal user account only. In other words, they do not apply to the entire organization.", "content.title_58E7173A92E34E77854A66D1710D9416": "Event log", "content.p_ED3A9EC6526A404B95F591DD8E230831": "The event log allows you to review all the events performed by any user. You can use the filter to view only events of a specific type, for a specific date range, or a specific user. The event log is very useful to track who started or deleted specific scans, or made certain changes in the Elements Vulnerability Management.", "desc": [ "content.title_86B44245DAB34E63810883819769CA45", { "dl.dl_35305ACDC9984DD492D0519A5A101475": [ { "dlentry.dlentry_E0D0F1C9BCD34858B8CDC3F06791A2BB": [ "content.dt_CBB1E96C37BB46B1BAFD9E0587EE2DF2", "content.dd_9B7F7E89BD5148C0A349367349FAA73D" ] }, { "dlentry.dlentry_9B6AA5C673A549B3ACA604BA677F3C5F": [ "content.dt_F7BD27790553475AAB4673D0B86442DE", "content.dd_776FB4EB9E364F26AF8F7F4165B2984F" ] }, { "dlentry.dlentry_418E3333C3E6468881EA76C6B314A55E": [ "content.dt_FA499B7D88714B35A75C65F7ED8B738E", "content.dd_F745E6612FC24B77B9C97A950AC7CA04" ] }, { "dlentry.dlentry_67A62B8AD1D9491788C51BEA7ED25BD1": [ "content.dt_16B21BCBE75649AABD73AC671F59A1F7", "content.dd_3E1A3A72F36849EB9FBF30E806E2B3AE" ] }, { "dlentry.dlentry_D498C175D81946D4B2815A34BE055D09": [ "content.dt_0B5DE34516C9400D808733038ED001AE", "content.dd_ED75EF309EF04F979B339989DDF2C0B0" ] }, { "dlentry.dlentry_F65B17628C454595927E19F36B03A686": [ "content.dt_3C955361F6414708A60AD707BB571A9D", "content.dd_6F4DD52411CD4B4DA34686837BCE4F75" ] }, { "dlentry.dlentry_6171DD1A21BF4958B17E01C11EA160DE": [ "content.dt_A73F8FE3AF0E413AAD4A1DAD3E0C5D13", "content.dd_876F15C0502140B18221CCCCE46361BE" ] }, { "dlentry.dlentry_A00CD6A6038843D2BC4B9E8E361D8C11": [ "content.dt_F90E72B3C2084C03B667654CC1681B9A", "content.dd_BE9AC7D075724503BDBCA3CC9A747648" ] } ] }, "content.title_855C899F61744E8792643327BAAAB89A", { "dl.dl_3B6151C7914644C0B750AC6A607E6FBE": [ { "dlentry.dlentry_3880BEC0CCE54F9DBD387E7B1DA33D5B": [ "content.dt_4AEA5E5A4DA0403F854489BDBDE96F6E", "content.dd_841CEC0E0D2641249B0B08A08103F4ED" ] }, { "dlentry.dlentry_CA6E87FA00344AB0B6E39EEF335515B0": [ "content.dt_8EEC14229A254CD4892BA7AE8B8B5B1B", "content.dd_C7E213BCEF4B40EA8E706D00F399BF73" ] }, { "dlentry.dlentry_D7BB07BA141449DA937FBC2A08BA53D4": [ "content.dt_221B3E4FA7F746D3AE1A5C372EF7E646", "content.dd_A6D1C77E2F76415DBCD85D8E17236D29", { "content.note_79EFEA4E79BC4AF4A11037B8937829B1": [ "content.p_79EFEA4E79BC4AF4A11037B8937829B1" ] }, "content.p_CA1012B8981E4DDBB31BBD9A033360FA" ] }, { "dlentry.dlentry_8E723AAF77E1439A8F920F9A46577620": [ "content.dt_B72DDE18742A464581105272825E296E", "content.dd_8305B9B4B1DE491D869F97D2793B0023" ] }, { "dlentry.dlentry_4767E0E828D54BCC8771F5F0C517B444": [ "content.dt_EA54D582730843AE98486BC42C7B4C03", "content.dd_EB62B6C96FAE4C0F916FBB2EBF16AC5D", { "choices.ul_AA9CF9737506432F8EF108F23E839C09": [ "choice.choice_71B751BF118D40BF8C2AEF0395FE2CE0", "choice.choice_AD9BE56742C8490793A56718F8FA6DA2" ] } ] }, { "dlentry.dlentry_45A4A2C84AC64FC6BE6DC90A5C4AB72D": [ "content.dt_9F119739EF4549F1993AE7882B0630F1", "content.dd_87E90384467842F6AE12F445F160870B" ] } ] }, "content.title_8ECA5DCD14824061B4C32B8C1FDC8E79", { "content.note_1880FFDD1C1149D2A785AFB4AE0C285F": [ "content.p_1880FFDD1C1149D2A785AFB4AE0C285F" ] }, "content.title_58E7173A92E34E77854A66D1710D9416", "content.p_ED3A9EC6526A404B95F591DD8E230831" ] }, "concept_35AD9E6374114D41B56275182796EE1A-4.0-en.json": { "title": "title_12AF845ADC464DBC9C432E7E256B4102", "title_12AF845ADC464DBC9C432E7E256B4102": "Elements Vulnerability Management API", "shortdesc": "shortdesc_D1F3710AE15844B6A2E785FF59EF790A", "shortdesc_D1F3710AE15844B6A2E785FF59EF790A": "The WithSecure Elements Vulnerability Management API is intended for developers who want to integrate WithSecure Elements Vulnerability Management with third-party applications. ", "content.p_C7B0F0619A51437DB19F822577702FD4": "This documentation gives a quick introduction to the WithSecure Elements Vulnerability Management API and discusses its conventions and best practices. You can find the full reference manual for WithSecure Elements Vulnerability Management API here: https://api.radar-prd.fsapi.com/apidoc/integration/index.html.", "content.title_F574C2875A474D24A683F2687523AA43": "URI structure", "content.p_CF1DF59AC8984B52966E24C1B1A922A7": "WithSecure Elements Vulnerability Management API provides access to resources (data entities) via URI paths. By default, the WithSecure Elements Vulnerability Management API uses JSON as its communication format and standard HTTP methods like GET, PUT, POST, and DELETE, most often in the following way:", "choice.choice_5838A99664CC442094B4F3521D41270C": "GET - for reading resources", "choice.choice_FBAB73DB9E794C7A9467DAEC75108EB5": "POST - for creating new resources", "choice.choice_E9A3AD39FEC445BD813885A81CEC1A66": "PUT - for updating existing resources", "choice.choice_BB831B06C90F49E1AD5017232501EB81": "DELETE - for removing resources", "content.p_1625EC31BF9F458DBBD5C011664B27A6": "WithSecure Elements Vulnerability Management provides two types of API channels (they may be regarded as two API versions serving different purposes):", "choice.choice_87C0802E777049B59EA861B2BB3A15F3": "latest channel - up-to-date API development. May introduce breaking changes without prior notice.", "choice.choice_6770A1DE82D24968A7836D021ADD937B": "integration channel - designated for developers wanting to integrate with WithSecure Elements Vulnerability Management. Will preserve existing endpoints for the time being if a breaking change is introduced in the 'latest' channel.", "content.p_7CE4C9CF80C840DD82C73CB80376EB47": "Access to most resources via WithSecure Elements Vulnerability Management API requires user authentication, see the Authentication section for details. However there are several API actions that can be performed anonymously.", "content.p_A02227F6EFDD4D809E7F34655263F19C": "All sample requests in this documentation are performed towards the integration channel of the API located on https://api.radar-prd.fsapi.com. If you are using a different instance of WithSecure Elements Vulnerability Management, replace it with the appropriate server URL.", "content.title_25C4E814404D48E38987F3A5E207FB67": "Deprecated endpoints", "content.p_233943DD8FF64780A948CAA36C81E911": "Existing API endpoints are marked as deprecated before they are removed permanently. These deprecated endpoints return the following HTTP header, containing a date of permanent removal (by default, after 30 days): deprecated: This endpoint is deprecated and will be removed on {date}. Please see the 'latest' channel of the API documentation to find the endpoint replacement.;", "content.title_C8C98890BA58484C983F7F65E4A67348": "Request headers and parameters", "content.p_935A2AC05B8F4A46906CBBC6AA90FD3C": "To follow best practices and to ensure that all requests work correctly, apply the following HTTP header to all API requests: Content-Type: application/json;", "content.p_4EF6949C8FBA4CEA8239769D8404BBE9": "The request authentication headers (ApiAccessKey and ApiAccessKey) together with their values are case-sensitive.", "content.p_16B4E28D1A0F4A7697F1D8992F35FDAD": "The parameter names in the request body are also case-sensitive.", "desc": [ "content.p_C7B0F0619A51437DB19F822577702FD4", "content.title_F574C2875A474D24A683F2687523AA43", "content.p_CF1DF59AC8984B52966E24C1B1A922A7", { "choices.ul_DC73130EC46F4E4380E364A83902E26D": [ "choice.choice_5838A99664CC442094B4F3521D41270C", "choice.choice_FBAB73DB9E794C7A9467DAEC75108EB5", "choice.choice_E9A3AD39FEC445BD813885A81CEC1A66", "choice.choice_BB831B06C90F49E1AD5017232501EB81" ] }, "content.p_1625EC31BF9F458DBBD5C011664B27A6", { "choices.ul_4FF581BA8BCA4E5AB2C839B4B657A02B": [ "choice.choice_87C0802E777049B59EA861B2BB3A15F3", "choice.choice_6770A1DE82D24968A7836D021ADD937B" ] }, "content.p_7CE4C9CF80C840DD82C73CB80376EB47", "content.p_A02227F6EFDD4D809E7F34655263F19C", "content.title_25C4E814404D48E38987F3A5E207FB67", "content.p_233943DD8FF64780A948CAA36C81E911", "content.title_C8C98890BA58484C983F7F65E4A67348", "content.p_935A2AC05B8F4A46906CBBC6AA90FD3C", "content.p_4EF6949C8FBA4CEA8239769D8404BBE9", "content.p_16B4E28D1A0F4A7697F1D8992F35FDAD" ] }, "task_E974D4465373492480A62E0D65BAD5E2-4.0-en.json": { "title": "title_6275029617DF4FC3A179D5858704371C", "title_6275029617DF4FC3A179D5858704371C": "Authentication", "shortdesc": "shortdesc_385BDC81D604452699ECD72ECCE6BF70", "shortdesc_385BDC81D604452699ECD72ECCE6BF70": "WithSecure Elements Vulnerability Management API uses API keys for authentication. ", "content.p_C7FA398C585540E3A88E4BC4707DAE0A": "An API key consists of an access key (for example, PA3IAKNANLM9) and a secret key (for example, UO9mkDEHFGa1Vau6o#1AfxwRmBQW@!qV). Note that the sample requests in this documentation show access and secret keys enclosed in brackets, which must be omitted when you submit requests.", "content.p_CA318E7F9AFC428D9ED24B64AFCBF86E": "To create an API key:", "step.step_B98FA6795C9945E78C2282F8164B89DD": "Log in to the WithSecure Elements portal.", "step.step_0193C6CA783249DA81988BDFE04EB02F": "Click the user icon in the top-right corner of the page and select My profile.", "step.step_6A6416BC3995493187978D97D0BFC9FA": "Scroll down to the Configure API Keys section.", "content.p_C4BCB0E5D90646E09B52B1B77DD34C7F": "Apply the created API key to the HTTP header of every API request that requires authentication.", "step.step_7EDDB1E783E94C268727A8848E4B7902": "Add a new API key and store it safely.", "content.p_6C4FE633E53D4957AE9025BE8F103E03": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/authenticationcheck
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "content.p_2F723163047E4B81BA1C1F20C215C73A": "If authentication was successful, you will get a HTTP response with status code 200 Authenticated.", "step.step_1CBC711985DF4D2BAA304C7B3EA30970": "Run a simple request to check the authentication:", "desc": [ "content.p_C7FA398C585540E3A88E4BC4707DAE0A", "content.p_CA318E7F9AFC428D9ED24B64AFCBF86E", { "steps.steps_329DCC2D3F2C495BAB3729F81FE01F41": [ "step.step_B98FA6795C9945E78C2282F8164B89DD", "step.step_0193C6CA783249DA81988BDFE04EB02F", "step.step_6A6416BC3995493187978D97D0BFC9FA", "step.step_7EDDB1E783E94C268727A8848E4B7902", "content.p_C4BCB0E5D90646E09B52B1B77DD34C7F", "step.step_1CBC711985DF4D2BAA304C7B3EA30970", "content.p_6C4FE633E53D4957AE9025BE8F103E03", "content.p_2F723163047E4B81BA1C1F20C215C73A" ] } ] }, "task_72F55B520A654BFE9F6F70A864D12381-4.0-en.json": { "title": "title_30316F2891B24303B8A5F77D86A95898", "title_30316F2891B24303B8A5F77D86A95898": "Use case: retrieve product information", "shortdesc": "shortdesc_6D1B67DA4B9A469D99BAB856BF1F6F58", "shortdesc_6D1B67DA4B9A469D99BAB856BF1F6F58": "This example describes how to fetch general information about WithSecure Elements Vulnerability Management. ", "content.p_9CD7370882154AD29E8881B7DC201142": "This is a simple request to WithSecure Elements Vulnerability Management API that does not require authentication.", "content.p_3AF7BAF1658C4D7EAE5CC16DF2054AA1": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/productinfo
-H 'Content-Type: application/json'", "content.p_3F62C7099A3F44099189C4C0948AC4CF": "A HTTP response with status code 200 contains general information about WithSecure Elements Vulnerability Management.", "step.step_5D282843B2044909BAB9841937D850F6": "Run the following request:", "desc": [ "content.p_9CD7370882154AD29E8881B7DC201142", { "steps.steps_DABDE3B494EB46BEAADC49C3DF5E6A8B": [ "step.step_5D282843B2044909BAB9841937D850F6", "content.p_3AF7BAF1658C4D7EAE5CC16DF2054AA1", "content.p_3F62C7099A3F44099189C4C0948AC4CF" ] } ] }, "task_601E636C6A5C4EFB8C684A23339B088D-4.0-en.json": { "title": "title_439A0E2E4D234631B58ABEC504AA408D", "title_439A0E2E4D234631B58ABEC504AA408D": "Use case: check for vulnerabilities", "shortdesc": "shortdesc_C0B21D7C41F64FD6849435CA9BD951FB", "shortdesc_C0B21D7C41F64FD6849435CA9BD951FB": "This example describes how to check if there are any vulnerabilities in the current organization. ", "content.p_D805F39A7CB5476B8BBF63BC152A378E": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/vulnerabilities/any
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "content.p_25E15655706142FCAFD39DE8E455C0F0": "A HTTP boolean response with status code 200 indicates if there are any vulnerabilities found within the current organization.", "step.step_53A258FC2EA249228C61B403D100E2F3": "Run the following request:", "desc": [ { "steps.steps_CDB070D5DE0D4C28B893B1E74D53E618": [ "step.step_53A258FC2EA249228C61B403D100E2F3", "content.p_D805F39A7CB5476B8BBF63BC152A378E", "content.p_25E15655706142FCAFD39DE8E455C0F0" ] } ] }, "task_305CB881586F4BEAA15DF7B28E251EA4-4.0-en.json": { "title": "title_2146FB6264E347B7A2124AE10C0EB43A", "title_2146FB6264E347B7A2124AE10C0EB43A": "Use case: export system scan findings in XML format", "shortdesc": "shortdesc_D1556100601D4F7CB153F088F73AA065", "shortdesc_D1556100601D4F7CB153F088F73AA065": "This example describes how to export system scan reports from the latest scans as files in XML format. ", "content.p_FC616DCA0D9A465EA9E4E48B0F0AC361": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/scangroups/simple
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "step.step_02B2F0F9410A476E9AEF3B0A02EAD2E6": "Get a list of scan groups within the current organization:", "step.step_5F95F00CDB5C43C08B9DAD980412A71B": "Extract the unique Id identifier from each of the returned scan groups.", "content.p_3F826586C3AC469F9E8EB2759F96AA3E": "Use the previously extracted scan group Id as a parameter.", "content.p_988E0E88A6824F01A4A335924CB83275": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/scangroups\\
/{scanGroupId}/systemscans
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "step.step_0B44A99C0D674002B15E436819502C06": "Get a list of system scans assigned to each scan group:", "step.step_AD5D1F835E3E4193BDB9190B2AA35D1C": "Extract the Id from each of the returned system scans.", "content.p_EB3BC5D31DD34C0D92AEA7CDC2A69C04": "Use the previously extracted system scan Id as a parameter.", "content.p_DF7B1D7DD3A5469E915EBE12B0971C82": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/systemscans\\
/{scanId}/reports/latest
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "content.p_643DD92505B44F3EBBD93554B2EAB641": "Note: You can also export the system scan report in docx format:", "content.p_11298CC916FC41EFBA8B2BFBA71D775E": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/systemscans\\
/{scanId}/reports/latest?fileType=docx
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "step.step_36431F83AE91405F86E0F85213C621DE": "Get a list of findings:", "desc": [ { "steps.steps_DD4C610B6C784F4C88108628600533A2": [ "step.step_02B2F0F9410A476E9AEF3B0A02EAD2E6", "content.p_FC616DCA0D9A465EA9E4E48B0F0AC361", "step.step_5F95F00CDB5C43C08B9DAD980412A71B", "step.step_0B44A99C0D674002B15E436819502C06", "content.p_3F826586C3AC469F9E8EB2759F96AA3E", "content.p_988E0E88A6824F01A4A335924CB83275", "step.step_AD5D1F835E3E4193BDB9190B2AA35D1C", "step.step_36431F83AE91405F86E0F85213C621DE", "content.p_EB3BC5D31DD34C0D92AEA7CDC2A69C04", "content.p_DF7B1D7DD3A5469E915EBE12B0971C82", { "content.note_643DD92505B44F3EBBD93554B2EAB641": [ "content.p_643DD92505B44F3EBBD93554B2EAB641" ] }, "content.p_11298CC916FC41EFBA8B2BFBA71D775E" ] } ] }, "task_31CC28651CB442DEAE4A8488FEF154B3-4.0-en.json": { "title": "title_CCCDA7BF7617496F8ABB8758FF7FB863", "title_CCCDA7BF7617496F8ABB8758FF7FB863": "Use case: export system scan findings", "shortdesc": "shortdesc_24FA294FD09E481D8315D39D05345825", "shortdesc_24FA294FD09E481D8315D39D05345825": "This example describes how to export all system scan findings from the latest scans. ", "content.p_D42835DB0F6544C8BE59A56C1889BDE6": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/scangroups/simple
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "step.step_F6CE45D2EC8C4E498215D9E0EBF887CE": "Get a list of scan groups within the current organization:", "step.step_85109EED1DCD469791B650CA49165001": "Extract the unique Id identifier from each of the returned scan groups.", "content.p_BA24951802F64C149FB9212AA5C65AC9": "Use the previously extracted scan group Id as a parameter.", "content.p_B82BADBFF3BF4D28938149A8A019F651": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/scangroups/{scanGroupId}/systemscans
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "step.step_ADE5FF98EC8248EA891CEF2B615966F5": "Get a list of system scans assigned to each scan group:", "step.step_ACBE089247BA410686291D3A541E6B59": "Extract the Id from each of the returned system scans.", "content.p_CA3B024086B5459683F3E441CBA37DC0": "Use the previously extracted system scan Id as a parameter.", "content.p_0E03B716204E49EFBF23BE211A9B6CB4": "curl -X POST https://api.radar-prd.fsapi.com/api/integration/systemscans/{scanId}\\
/reports/latest/vulnerabilitiesandfindings/withstartindex/0/andpagesize/1000
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'
-d ''", "step.step_70F121A2BB91406C81910B6FC4DD906B": "Get a list of findings:", "step.step_A9473BA05E6B4F8AB67450E0460F2E13": "Extract the required data such as Title or RiskLevel from each of the returned findings.", "desc": [ { "steps.steps_9259D616018B482283202252478EC3A1": [ "step.step_F6CE45D2EC8C4E498215D9E0EBF887CE", "content.p_D42835DB0F6544C8BE59A56C1889BDE6", "step.step_85109EED1DCD469791B650CA49165001", "step.step_ADE5FF98EC8248EA891CEF2B615966F5", "content.p_BA24951802F64C149FB9212AA5C65AC9", "content.p_B82BADBFF3BF4D28938149A8A019F651", "step.step_ACBE089247BA410686291D3A541E6B59", "step.step_70F121A2BB91406C81910B6FC4DD906B", "content.p_CA3B024086B5459683F3E441CBA37DC0", "content.p_0E03B716204E49EFBF23BE211A9B6CB4", "step.step_A9473BA05E6B4F8AB67450E0460F2E13" ] } ] }, "task_709ED3C1789248D2A9CBB84F5E4CF512-4.0-en.json": { "title": "title_8F6E45C81EBE4D63A7409B44B204393A", "title_8F6E45C81EBE4D63A7409B44B204393A": "Use case: export web scan findings", "shortdesc": "shortdesc_947C1683DA084935859FED991062DAD8", "shortdesc_947C1683DA084935859FED991062DAD8": "This example describes how to export all web scan findings from the latest scans. ", "content.p_AAC49FB83FE24CC89C58D0BC770F3863": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/scangroups/simple
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "step.step_0FD4676580C2461DAB62040B6BBEE81D": "Get a list of scan groups within the current organization:", "step.step_54209D816F874BC8A74B88F8E5DE1A9E": "Extract the unique Id identifier from each of the returned scan groups.", "content.p_FB7D21F0FD1A4FC9A51E607BA7A8D2E7": "Use the previously extracted scan group Id as a parameter.", "content.p_850B776B33D34C4DB8E085D2D49E7534": "curl -X GET https://api.radar-prd.fsapi.com/api/integration/scangroups/{scanGroupId}/webscans
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'", "step.step_4226255FEE8048C184BB9E3FE2509944": "Get a list of web scans assigned to each scan group:", "step.step_F728C458463A48F49026C525D2AA296E": "Extract the Id from each of the returned web scans.", "content.p_A5691B890DB1478F83647755F251C1A4": "Use the previously extracted web scan Id as a parameter.", "content.p_04EECD54F8484BC2BC5913A95D3A0037": "curl -X POST https://api.radar-prd.fsapi.com/api/integration/webscans/{scanId}\\
/reports/latest/vulnerabilitiesandfindings/withstartindex/0/andpagesize/1000
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'
-d ''", "step.step_0B8C00119C7940FE9F615B0F37C84C15": "Get a list of findings:", "step.step_F34A10CD2AA34E3FAD2835909C51A36D": "Extract the required data such as Title or RiskLevel from each of the returned findings.", "desc": [ { "steps.steps_2057BA49577F488A9F94AEF683A1F550": [ "step.step_0FD4676580C2461DAB62040B6BBEE81D", "content.p_AAC49FB83FE24CC89C58D0BC770F3863", "step.step_54209D816F874BC8A74B88F8E5DE1A9E", "step.step_4226255FEE8048C184BB9E3FE2509944", "content.p_FB7D21F0FD1A4FC9A51E607BA7A8D2E7", "content.p_850B776B33D34C4DB8E085D2D49E7534", "step.step_F728C458463A48F49026C525D2AA296E", "step.step_0B8C00119C7940FE9F615B0F37C84C15", "content.p_A5691B890DB1478F83647755F251C1A4", "content.p_04EECD54F8484BC2BC5913A95D3A0037", "step.step_F34A10CD2AA34E3FAD2835909C51A36D" ] } ] }, "task_3CD70C44CCE646648B627F0273BDF3D7-4.0-en.json": { "title": "title_7DC24AA936A04E89A6EB4E87F8EF2464", "title_7DC24AA936A04E89A6EB4E87F8EF2464": "Use case: search discovered hosts", "shortdesc": "shortdesc_5B84E0CC1C8C4A67828A9E167501317A", "shortdesc_5B84E0CC1C8C4A67828A9E167501317A": "This example describes how to search for discovered hosts where given TCP/UDP ports are open, and see if they have already been scanned for vulnerabilities. ", "content.p_9F77F0C2C69743AEA249A8B8F2B2922E": "curl -X POST https://api.radar-prd.fsapi.com/api/integration/discoveryscans\\
/withstartindex/0/andpagesize/1000
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'
-d ''
", "step.step_227E989D3DC34AAF94631DFE58B8577B": "Get a list of discovery scans within the current organization:", "step.step_1E36C00BC67D4222B8CB72ACFE2C3900": "Extract the unique Id identifier from each of the returned discovery scans.", "content.p_74402E16D2DC49EBAAB522E170C22710": "Use the previously extracted discovery scan Id as a parameter.", "content.p_B219F2212C324B74A83D7DF5731B3796": "curl -X POST https://api.radar-prd.fsapi.com/api/integration/discoveryscans\\
/{discoveryScanId}/reports/latest/hosts/withstartindex/0/andpagesize/100
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'
-d ''
", "step.step_306E877FC447444587A75C3583DADBFF": "Get a list of hosts assigned to each discovery scan:", "content.p_0D1D1CBAF02D4225A7B025458DE1C284": "A unique SystemScanLastReportId identifier for the selected host indicates that it has already been scanned for vulnerabilities.", "step.step_AF32CFB89EA9461780CEA5F28ED85822": "Extract Ports from each of the returned hosts and take into account only those where the given TCP/UDP ports were found open.", "desc": [ { "steps.steps_B88759D05B304833ABFEA50B372078C8": [ "step.step_227E989D3DC34AAF94631DFE58B8577B", "content.p_9F77F0C2C69743AEA249A8B8F2B2922E", "step.step_1E36C00BC67D4222B8CB72ACFE2C3900", "step.step_306E877FC447444587A75C3583DADBFF", "content.p_74402E16D2DC49EBAAB522E170C22710", "content.p_B219F2212C324B74A83D7DF5731B3796", "step.step_AF32CFB89EA9461780CEA5F28ED85822", "content.p_0D1D1CBAF02D4225A7B025458DE1C284" ] } ] }, "task_FA668184AF2847A6BCC8FE21C857F23C-4.0-en.json": { "title": "title_B5085F74FACD497899B9914746164EE6", "title_B5085F74FACD497899B9914746164EE6": "Use case: track assets coming from a custom source (for example Active Directory)", "shortdesc": "shortdesc_B8237848B8334CDE9DAE93FBAFC04372", "shortdesc_B8237848B8334CDE9DAE93FBAFC04372": "WithSecure Elements Vulnerability Management has a built-in mechanism to bind and track assets coming from different sources to network vulnerability scans inside a specific scan group. ", "content.p_2E67A1756AB54DDD8A61D1506542F4E9": "This means that if the new asset is discovered in a given asset source, it will be created or deleted as a network vulnerability scan (web scan or system scan) inside a scan group. Currently, the supported built-in asset sources are discovery scans and internet discovery, which are both supported via API and the user interface. Uploading a custom asset endpoint is also supported, but only via API.", "content.p_4D839027D77D4338BC815FDC2982F152": "curl -X POST https://api.radar-prd.fsapi.com/api/integration/assetMonitoring/withStartIndex/0/andPageSize/250
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'
-d '{\"AssetSourceType\": \"Custom\"}'", "step.step_CF3A504282F844418136D325BC91E0FC": "List the currently configured custom asset sources:", "content.p_DE0ED2CC9A5341AE993E793EB39D5FC1": "Replace the parameters marked with {} with your own values.", "content.p_0AE9AAC222B2453299E75B025010FA9F": "curl -X POST https://api.radar-prd.fsapi.com/api/integration/assetmonitoring/custom
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'
-d '{
\"ScanGroupId\": \"{ScanGroupId}\",
\"TrackSystemScans\": true,
\"TrackWebScans\": true,
\"AlwaysAddNewSystemScans\": false,
\"AlwaysAddNewWebScans\": false,
\"RemoveSystemScanWhenUndiscovered\": true,
\"RemoveWebScanWhenUndiscovered\": true,
\"AssetSourceType\": \"Custom\",
\"TrackedHttpPortRangeForWebScan\": \"80\",
\"TrackedHttpsPortRangeForWebScan\": \"443\",
\"RunSystemScanImmediatelyAfterAdd\": false,
\"RunWebScanImmediatelyAfterAdd\": false,
\"ScheduleId\": null,
\"RunSystemScanImmediatelyIfNewServicesDiscovered\": false,
\"TrackedSystemScanByHostname\": true
}'", "content.p_15E0C1616C5740389484CEF8A7C8B50E": "The response will give you the unique identifier for the asset update source configuration.", "step.step_CFDF74B398EE4FEEB2FE7F76D5F90371": "Create a new custom asset source.", "step.step_4EAA86BF7F14440D8CA32755C2712294": "Retrieve a list of machines from Active Directory, for example using the ldapsearch command on Linux, and convert it to JSON format.", "content.p_09A05AC42DD64FE78FB476E84FAAD216": "curl -X POST https://api.radar-prd.fsapi.com/api/integration/assetmonitoring/custom/{AssetSourceId}/assets
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'
-d '[
{
\"IPAddress\": \"192.168.1.1\"
},
{
\"IPAddress\": \"192.168.1.2\",
\"HostName\": \"domain2.com\"
},
{
\"IPAddress\": \"192.168.1.3\",
\"HostName\": \"domain3.com\",
\"DiscoveredAssetPorts\": [
{
\"Port\": \"80\",
\"Protocol\": \"TCP\",
\"Service\": \"https\"
}
]
}
]'", "content.p_E108A1B0C6394E88A6657A4F65B3E1D2": "The upload triggers the addition of a new scan definition only if it was not uploaded before. Therefore, uploading the same list again does not change the list of network vulnerability scans within the defined scan group.", "step.step_CD043BAE7B6B414887155BE8C5CCD156": "Upload the list of machines that should use the custom asset source update configuration and verify that the scans have been created inside the defined scan group:", "content.p_D158C88AF7444790AB67E92732DF7ECB": "Typically, you should set the task to be triggered at an interval of several hours. For more information on scheduling a task, see: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc748993(v=ws.11).", "content.p_C6C58D89E94D43CFBB793FBD83C5AF32": "Note: Make sure that the task runs the script with sufficient access rights so that it can write to log files and access WithSecure Elements Vulnerability Management API.", "step.step_651870C30B91417BA62EDF8027092E8B": "Create a Windows Scheduled Task to run the WithSecure Elements Vulnerability Management asset monitoring script.", "desc": [ "content.p_2E67A1756AB54DDD8A61D1506542F4E9", { "steps.steps_D7BAAE574E5946C0B8707F2A60E1406A": [ "step.step_CF3A504282F844418136D325BC91E0FC", "content.p_4D839027D77D4338BC815FDC2982F152", "step.step_CFDF74B398EE4FEEB2FE7F76D5F90371", "content.p_DE0ED2CC9A5341AE993E793EB39D5FC1", "content.p_0AE9AAC222B2453299E75B025010FA9F", "content.p_15E0C1616C5740389484CEF8A7C8B50E", "step.step_4EAA86BF7F14440D8CA32755C2712294", "step.step_CD043BAE7B6B414887155BE8C5CCD156", "content.p_09A05AC42DD64FE78FB476E84FAAD216", "content.p_E108A1B0C6394E88A6657A4F65B3E1D2", "step.step_651870C30B91417BA62EDF8027092E8B", "content.p_D158C88AF7444790AB67E92732DF7ECB", { "content.note_C6C58D89E94D43CFBB793FBD83C5AF32": [ "content.p_C6C58D89E94D43CFBB793FBD83C5AF32" ] } ] } ] }, "concept_D2768003DBDF40E2B44C51531B91D4AE-4.0-en.json": { "title": "title_D5D6D53DEC434F119A66D33B7563059C", "title_D5D6D53DEC434F119A66D33B7563059C": "Security description", "shortdesc": "shortdesc_EB42212114A14BC6993F25CA1F574CA9", "shortdesc_EB42212114A14BC6993F25CA1F574CA9": "", "content.p_901363AAF78D4EC882D9344C34E00D6A": "WithSecure Elements Vulnerability Management is a vulnerability scanning and management service operated by WithSecureTM. WithSecure Elements Vulnerability Management is available as a cloud-based service (SaaS) solution. Elements Vulnerability Management consists of the following components:", "choice.choice_C80A2B7E038143D9BB7C0435EB643F43": "Scan nodes", "choice.choice_05B67DB6DF1D40D788DF29225CF9982D": "The WithSecure Elements portal", "content.p_647F4458CAFA4C6C9114C0EC7D167F98": "The scan nodes perform the actual scanning. The WithSecure Elements portal manages and coordinates the scan nodes, collects the results and provides reports of findings.", "content.p_BA209B71960A44E587C20CB50C903D5A": "The purpose of this document is to describe the high-level security controls that WithSecure uses in Elements Vulnerability Management, and to describe the handling of customer data.", "desc": [ "content.p_901363AAF78D4EC882D9344C34E00D6A", { "choices.ul_2D4DFFC072544B11BD4EB9AF61510AFD": [ "choice.choice_C80A2B7E038143D9BB7C0435EB643F43", "choice.choice_05B67DB6DF1D40D788DF29225CF9982D" ] }, "content.p_647F4458CAFA4C6C9114C0EC7D167F98", "content.p_BA209B71960A44E587C20CB50C903D5A" ] }, "concept_3C9EB670F50D4061B3FCAA4C9EC3EC2C-4.0-en.json": { "title": "title_A57338ED95144259BDFDA52648151355", "title_A57338ED95144259BDFDA52648151355": "Customer data", "content.dt_6C1D9A82CF1647068A23DDEADE63A399": "Data ownership ", "content.dd_1D0C5B9DD433422E81B21F26787DB118": "All data submitted for analysis by a customer is owned by the customer. For European customers, WithSecure uses data centers within the EU.
", "content.dd_B2D1F742D3A14CEA9A0C361191D8A5AC": "You can read the Elements Vulnerability Management privacy policy here.", "content.dt_F1DEF591792F4207876F94AFA5F24221": "Encryption of transferred data ", "content.dd_2AB3CADCCAC644DA8FB3F1B010C89AC2": "All metadata, files, and other content are transferred securely using TLS 1.2 encryption.", "content.dt_34FCA8D996394D09B9E8C1A32D7DD857": "Access to data ", "content.dd_1379F39707594915B0DF88A61172E095": "WithSecure access to customer data is limited to authorized security personnel to perform quality assurance, customer support, or enhanced security analysis. Anonymized customer data might also be used for statistical purposes.
", "content.dd_7E5A341033984BD6BFAA04E8C3E6D061": "WithSecure follows recommended, industry-standard best practices in controlling access to all company networks, and updates access controls according to the prevalent industry recommendations.", "desc": [ { "dl.dl_0A92DC98FEB3415E9AB73B5F9BB68113": [ { "dlentry.dlentry_0A347E8466D149799994182DF849C4CF": [ "content.dt_6C1D9A82CF1647068A23DDEADE63A399", "content.dd_1D0C5B9DD433422E81B21F26787DB118", "content.dd_B2D1F742D3A14CEA9A0C361191D8A5AC" ] }, { "dlentry.dlentry_A5AD43E7CD9644BB897CDD22C2979148": [ "content.dt_F1DEF591792F4207876F94AFA5F24221", "content.dd_2AB3CADCCAC644DA8FB3F1B010C89AC2" ] }, { "dlentry.dlentry_2D61F975C07C4595983A5642A3A46AC7": [ "content.dt_34FCA8D996394D09B9E8C1A32D7DD857", "content.dd_1379F39707594915B0DF88A61172E095", "content.dd_7E5A341033984BD6BFAA04E8C3E6D061" ] } ] } ] }, "concept_24BC0BD70396420991904B86E551C17F-4.0-en.json": { "title": "title_3BFDB0B876E9475AB4B352295F4B36C0", "title_3BFDB0B876E9475AB4B352295F4B36C0": "Information Security Management System", "shortdesc": "shortdesc_AE6E8A28AA2D4EA4B8C0A8735391D9E2", "shortdesc_AE6E8A28AA2D4EA4B8C0A8735391D9E2": "WithSecure has an ISO 27001 certified Information Security Management System. The Elements Vulnerability Management service is currently not included in the scope of certification, meaning there are no regular independent third-party audits conducted on the Elements Vulnerability Management service regarding ISO 27001 conformity. However, Elements Vulnerability Management follows the same ISMS polices, processes, and procedures as the operations within the scope of ISO 27001 certification. ", "content.dt_200BE7144D72405E8A332903D26E6B84": "Information security policies ", "content.dd_8A0C91E44F8541F2A5478AF347C654F2": "WithSecure maintains a security policy framework compliant with ISO 27001. Our top-level policy, Cyber Security Principles, is a PUBLIC document and Elements Vulnerability Management customers can request it for review. The policies are reviewed at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy, and effectiveness.", "content.dt_3382FA09F62447B0B8330852CFD9015C": "Organization of information security ", "content.dd_B0CB43D8EDB049A088906097EDCAB9C1": "WithSecure security policies define the responsibilities for information security in the organization, and WithSecure has a CISO Office tasked to lead and coordinate internal cyber security.
", "content.dd_FF4E15407CE64F2F8F15D15F8888B840": "Managers are responsible for ensuring that information security is properly executed, identifying key information assets and systems that are essential to the continuous operation of their service, information security planning, management, and reporting.", "content.dt_05FB09B58C1B4706B8E33E435A30EE3A": "Asset management ", "content.dd_3E1B546EF0EA4E85920A2F901EC35895": "The WithSecure Acceptable Use and Information Security Classification Policies set the rules for the use of assets under WithSecure control during the entire lifespan of information assets.
", "content.dd_B607F81D58244A4680C1AE19238E6D81": "Security controls include rules for, among others: responsibility for assets, prohibited activities, taking assets off-site, use of removable media and mobile devices, remote and mobile work, information storage, use of personal devices, return of assets, user account and password guidance, clear desk and clear screen policy; and rules for email, internet use, and social media.", "content.dt_9BA6DD2900614B0DA2350DA09E708CEC": "Human resources security ", "content.dd_478D353871CB4F93A27B73B33A53DAF1": "WithSecure maintains a procedure for background checks for staff. Employees sign confidentiality agreements as part of their employment contracts. We have defined procedures covering the lifecycle of employment from onboarding to the end of employment. All employees are required to complete mandatory security training during their onboarding. WithSecure has a standard process for managing the creation of new accounts, changes in responsibilities, and the termination of employment. Employees who need to access production systems are required to participate in mandatory training, which includes training in security controls and procedures. WithSecure has defined a disciplinary procedure, which is utilized in cases of security violations.", "content.dt_BEC818D5AA6B46278D7B8A84437C802C": "Access control ", "content.dd_9FF7B95912B149A18873975B5306D709": "Access to services
", "content.dd_5E4D35662268425C92ACA08837B86B1C": "Access to WithSecure hosted services is restricted to the WithSecure Elements Vulnerability Management team. The SOC team has only limited access rights allowing around-the-clock monitoring services.
", "content.dd_C64BFD3D4E6343BDB267A2CC2B1F2BC2": "Service operating roles and service accounts have the minimum possible set of Identity and Access Management (IAM) permissions enabled.
", "content.dd_A1BED213798047C996FF37D7BFCD9E10": "Access to data
", "content.dd_5117660985C841028640F0392F1A7A91": "Access to customer data is restricted to selected Elements Vulnerability Management team members. The access is primarily used for maintenance purposes and for handling support cases. When a support case has been completed, the access is revoked.
", "content.dd_3992818559D142009C6E2789596AA705": "Elements Vulnerability Management comes with detailed audit trail capabilities that record every single event such as data or configuration changes and the starting, stopping, and completion of scan jobs. These events contain timestamps, user IDs, and details about the actions performed. These event logs are all available from the Elements Vulnerability Management user interface.
", "content.dd_F36EAA69FBFB48EDB74CFF1007848A9D": "For more information, see the Elements Vulnerability Management privacy policy.", "content.dt_4DBC007B868840D695AF47E1DCAC607B": "Cryptographic controls ", "content.dd_C6FF0EE0D68444558673C23479921357": "WithSecure maintains an Encryption Standard, which defines the requirements for cryptographic algorithms and key lengths.
", "content.dd_DEEEA9CE9F4847EC80CF11913FC5DABA": "We also maintain guidelines for recommended configurations for TLS, and obtain public server certificates from reputable approved Certificate Authorities. Applications for public certificates are controlled and managed according to defined procedures. Private keys are handled with care and access to private keys is restricted to authorized personnel only. All Elements Vulnerability Management internal traffic is encrypted, and data at rest is also encrypted.", "content.dt_FAEAF7D9D9864D0F8748FA917575766C": "Physical security ", "content.dd_C8B8EA28870242199BEAC67BE67CE2C8": "WithSecure has a physical security policy, which defines the control requirements related to physical security for different types of facilities. The physical security of ISO 27001 certified offices is periodically audited by the certification body.
", "content.dd_B1B7FE3A7F7443C79683C1BB3F532D9F": "The production infrastructure for WithSecure Elements Vulnerability Management is running in Amazon Web Services (AWS). For information on the physical security controls of AWS data centers, see the AWS Compliance site.", "content.dt_1A272AE395C143718E20D887B07D6049": "Operations security ", "content.dd_55C19E061D5F43DFB8E4F725CB0A2008": "WithSecure maintains a baseline security policy, which identifies the relevant security requirements based on the risk level of the system or component.
", "content.dd_4A76228E0C6448FAAB718C0A8B2ABBFF": "Operating procedures are documented. Development, test, and production environments are separated to reduce the risk of unauthorized or uncontrolled changes to production systems.
", "content.dd_6D3BF3E3401940FDA2A504E2C9B2F265": "Incident management
", "content.dd_35A1F84BAA2B456281476C7533869CB6": "The health of service is monitored around the clock by the WithSecure Service Operations Center (SOC) using multiple monitoring systems. Alerts are escalated when needed according to pre-defined criteria, based on alert severity and potential security impact, supported by expert on-call availability. We also gather monitoring data for the purpose of predictive analysis.
", "content.dd_F3FFABE652AE41B4BDB4D168DE436B99": "Change management
", "content.dd_F7F8F8293B014162AFFB26C158E68472": "The WithSecure Elements Vulnerability Management team uses a DevOps approach in development work and service deployment. Changes follow the WithSecure change management process and all changes in the service code are peer-reviewed. All changes in the code and infrastructure are recorded in WithSecure version control systems.
", "content.dd_0428133E0CE74D4A92D84FA79EF138D5": "Software updates for scan nodes are delivered through automatic updates, assuming the scan nodes have internet access to the Elements Vulnerability Management Update Service. Alternatively, updates can be performed manually by using a software installation package (exe). Updating an on-premise installation of the Radar Security Center is currently only possible by using a software installation package. These installation packages are delivered by WithSecure. On-premise Radar Security Center customers are automatically notified as soon as a new version is available.
", "content.dd_21DAD1CBC31C4B7EB7AC01C83AFE1FF7": "Problem management
", "content.dd_F556AEA7C33B45E7AEC21A956CA2B713": "The Elements Vulnerability Management team review unexpected events detected in the service regularly. If incidents are detected, a root cause analysis (RCA) is conducted to work out a plan for preventing similar issues in the future. RCA findings are documented for future reference.
", "content.dd_A8C8C5F6EBAC4CC190C93D030354EA97": "Service availability
", "choice.choice_14D078CC7A9B4AC3A2CF39B1C2C22F86": "The WithSecure Elements portal (elements.withsecure.com)", "choice.choice_4B99299639684CA6A64BA45F46930CED": "Elements Vulnerability Management update service (sn-api.radar-prd.fsapi.com)", "choice.choice_B058F41197BA428EB6F18D2D76E66313": "Cloud scan nodes", "content.p_DE7210416DC54389B2E5FF085B398E12": "", "content.dd_E2866AAFEADA4C08A61332495F7969E6": "The availability of WithSecure Elements Vulnerability Management cannot exceed that promised for the services that it depends on or is built on. The cloud-based scanning engines hosted by WithSecure are clustered to decrease downtime. The expected availability for the core Elements Vulnerability Management components is 99%:", "content.dd_274BC656B5174557882F723E11911949": "The resilience of the Elements Vulnerability Management cloud service is improved by using Content Delivery Network (CDN) services.
", "content.dd_710E24187F394D33BA03173CA15B858A": "For the components hosted by customers, WithSecure is unable to provide other than best-effort availability.
", "content.dd_3D3FF4E95F7249A1BC4897D25C5A8DE0": "Any excess, large-scale downtime is treated as a high-priority issue that requires immediate attention. The WithSecure Service Operations Center monitors the health and condition of the Elements Vulnerability Management service around the clock and alerts the service team of any potential issues at once. WithSecure support services respond to any reported customer issues within two business days.
", "content.dd_3CDE4F2B583C4CC2A8ADFB1E9DB7E2AA": "All updates to the services are planned so that they should not cause any unscheduled downtime. There may not be any separate notification of upcoming updates in cases where the updates do not deprecate existing functionality.", "content.dt_6FFA2A85384E44B999254B5F5655EB6F": "Communications security ", "content.dd_A8D0486190F348C8A88BA47E3C4D70AA": "Service components are segregated to separate network segments, allowing only pre-defined traffic between segments. All unexpected requests are dropped and logged. All outbound traffic is blocked, unless explicitly approved.
", "content.dd_EB05CE32A36E41818BF04CE71121F4DC": "Access to network security gateways is strictly controlled.
", "content.dd_4D0073845AE1436F8A9673984E976AD7": "Information retrieved from external systems is protected in transit, and the correctness of the information received is verified using digital signatures where applicable.
", "content.dd_0960DDD0B77E4AA4831C4D7D539A60CE": "Elements Vulnerability Management network security
", "content.dd_3CA7D3E3D7464206A7AFE059A2D1ED74": "The public scan nodes hosted by WithSecure perform the scans over the public internet. We advise that you inform your Security Operations Center and personnel that are responsible for your upstream network connectivity about planned scanning activity to avoid triggering unnecessary alerts.
", "content.dd_0CAFA21381284815827FF5BAA344FEA1": "For scan targets that are behind a filtering device such as a firewall and are not accessible from the internet, one or more on-site scan nodes need to be placed in a customer-controlled network segment that has access to the target networks. The private scan nodes need to have HTTPS access to an update server and the Radar Security Center to get software updates, coordinate the scans, and collect results.
", "content.dd_E1D6A384FF224A31B06783C942668959": "In a cloud-based configuration, WithSecure hosts the update server and the WithSecure Elements portal. In a private configuration, the Radar Security Center will be a host within the customer’s network.
", "content.dd_C59C0EAAFB6D4F1C9C7EBBB56646366C": "WithSecure protects the hosted components with firewalls and intrusion detection systems. Only components that need to be accessed from the internet are placed on public networks.", "content.dt_72C4910D7FF6441681D7A454F58AE172": "System development security ", "content.dd_C0CDE838FABB42A487D0E1BD41ADE41D": "Architectural threat modelling is a mandatory software engineering practice. Threat modelling activities are triggered by changes that are either big enough or have an identified security impact.
", "content.dd_98564E1DA0054F5A8E008A8DA5FCD54F": "Security testing is performed based on threats and attack surfaces identified during threat modelling. For selected subcomponents identified as critical to security, automated security testing is performed.
", "content.dd_E6B25240F16D46F8976B98DB6C833D60": "WithSecure is continuously developing its lifecycle security policy and software security engineering practices.
", "content.dd_29590A3558B043FC94CDEE62D42596B8": "If software development subcontracting is used, contractors are required to follow applicable WithSecure security policies and standards.
", "content.dd_30B54A8F47C641398BB211EB986BBDB3": "At the moment, WithSecure Elements Vulnerability Management is not included in the WithSecure public Vulnerability Reward Program (“bug bounty”). Nonetheless, WithSecure welcomes vulnerability reports and commits to investigate them. Vulnerability findings can be sent either via normal support channels or to security@withsecure.com.", "content.dt_C26CCE6D2C324BBAA211277998C7008D": "Supplier relationships ", "choice.choice_0EDD605E3150414AB2038467A354F5D2": "method of identification of the other party", "choice.choice_8549EE198ADA4E35B13095D0D1A1CC53": "authorizations to access information", "choice.choice_73294062A3AF45169CF55B37F06787FE": "technical standards for data transfer", "choice.choice_17593A3BA78E4FFA9A2BABBB5B8D65D9": "incident response", "choice.choice_1DA813D3B2854599AEFAD2B3E75BE005": "labelling and handling sensitive information", "choice.choice_DED9BE4B476449BFA1DCFB236B694951": "copyright", "content.p_BDDD1C558E6E4D6DABAEBDD8BD437988": "", "content.dd_B4869392735D4687A529D7CA37050D81": "Supplier agreements include security requirements to address potential risks identified in relation to the supplier relationship. Depending on the risk, arrangements may include clauses for the following:", "content.dd_E4BD5CFFFE184B3CA4FBED34A883C327": "Service owners are responsible for ensuring that the services, reports, and records provided by the third party are regularly monitored and reviewed, and audits are carried out when necessary. Changes to the provision of services by suppliers, including maintaining and improving existing information security policies, procedures, and controls, is managed.", "content.dt_E3461AEE01EB4BF7B2914FBE04700107": "Information security incident management ", "content.dd_4F218FC4485B47E7A07890FE6EA4197C": "WithSecure maintains a standard procedure for security incident management, involving the assessment of the severity of a security event and responsibilities for responding to a suspected security incident. In addition, we maintain around-the-clock readiness to respond to any suspected major security incidents, including the ability to collect potential forensic evidence. Analysis of lessons learned is a mandatory part of the major security incident procedure.
", "content.dd_D6F49F98D7644B8E8EE0216DAA40419B": "Staff is instructed to report suspicious observations or activities to management.", "content.dt_50B465FF9B9840D09452458A3366F2A7": "Security in business continuity ", "content.dd_F4EC54E8171B4B499909591E0F7BA14A": "Information security is embedded in the business continuity process, including planning for sufficient redundancy to meet availability requirements.", "content.dt_017BF15C564E4D3689138C7346E56814": "Compliance ", "content.dd_9E7B6766DF604F748A8FE40EE6320542": "WithSecure monitors relevant statutory, regulatory, and contractual requirements to ensure the ability to meet these requirements.
", "content.dd_2E337F76C5174E20BCE377FE06A638BE": "Managers are responsible for regularly reviewing compliance within their area of responsibility with the appropriate security policies, standards, and any other security requirements.
", "content.dd_2B0E1D70B9CF44828EE01C006948107A": "Actions set out in this description may be subject to limitations by applicable laws.
", "content.dd_F09E573EBDEC46969B35B9519DC77624": "Information security reviews
", "content.dd_CB25DAA0EF7A45E4AABA079B2526A1A3": "We also conduct security audits and process reviews regularly to monitor and improve our internal network security and access controls. Elements Vulnerability Management is included in the WithSecure Internal Bug Bounty Program.
", "content.dd_BF906640339648C88FA2579E704A4993": "WithSecure utilizes Elements Vulnerability Management for vulnerability scanning internally. WithSecure Consulting is PCI ASV (Approved Scanning Vendor) using WithSecure Elements Vulnerability Management.", "desc": [ { "dl.dl_91637085CF4746178EA79A5C926EAB12": [ { "dlentry.dlentry_ECD975F74FE848108EB26E299A58426A": [ "content.dt_200BE7144D72405E8A332903D26E6B84", "content.dd_8A0C91E44F8541F2A5478AF347C654F2" ] }, { "dlentry.dlentry_C7C282F186374326B79EE9067FB3632E": [ "content.dt_3382FA09F62447B0B8330852CFD9015C", "content.dd_B0CB43D8EDB049A088906097EDCAB9C1", "content.dd_FF4E15407CE64F2F8F15D15F8888B840" ] }, { "dlentry.dlentry_E2B837947DA146BC8F3FD5093018329D": [ "content.dt_05FB09B58C1B4706B8E33E435A30EE3A", "content.dd_3E1B546EF0EA4E85920A2F901EC35895", "content.dd_B607F81D58244A4680C1AE19238E6D81" ] }, { "dlentry.dlentry_7916365D6EBD46809BCBCB176355A11F": [ "content.dt_9BA6DD2900614B0DA2350DA09E708CEC", "content.dd_478D353871CB4F93A27B73B33A53DAF1" ] }, { "dlentry.dlentry_AE5CEB43D6384541ABEFE9EE23EADB33": [ "content.dt_BEC818D5AA6B46278D7B8A84437C802C", "content.dd_9FF7B95912B149A18873975B5306D709", "content.dd_5E4D35662268425C92ACA08837B86B1C", "content.dd_C64BFD3D4E6343BDB267A2CC2B1F2BC2", "content.dd_A1BED213798047C996FF37D7BFCD9E10", "content.dd_5117660985C841028640F0392F1A7A91", "content.dd_3992818559D142009C6E2789596AA705", "content.dd_F36EAA69FBFB48EDB74CFF1007848A9D" ] }, { "dlentry.dlentry_C00A9FF11A3A4646B4C72E3DB294BE87": [ "content.dt_4DBC007B868840D695AF47E1DCAC607B", "content.dd_C6FF0EE0D68444558673C23479921357", "content.dd_DEEEA9CE9F4847EC80CF11913FC5DABA" ] }, { "dlentry.dlentry_68DC79FD53A84712A2F0825F816D5415": [ "content.dt_FAEAF7D9D9864D0F8748FA917575766C", "content.dd_C8B8EA28870242199BEAC67BE67CE2C8", "content.dd_B1B7FE3A7F7443C79683C1BB3F532D9F" ] }, { "dlentry.dlentry_FCF1FD7D600A499DBFCEF4D935F3E165": [ "content.dt_1A272AE395C143718E20D887B07D6049", "content.dd_55C19E061D5F43DFB8E4F725CB0A2008", "content.dd_4A76228E0C6448FAAB718C0A8B2ABBFF", "content.dd_6D3BF3E3401940FDA2A504E2C9B2F265", "content.dd_35A1F84BAA2B456281476C7533869CB6", "content.dd_F3FFABE652AE41B4BDB4D168DE436B99", "content.dd_F7F8F8293B014162AFFB26C158E68472", "content.dd_0428133E0CE74D4A92D84FA79EF138D5", "content.dd_21DAD1CBC31C4B7EB7AC01C83AFE1FF7", "content.dd_F556AEA7C33B45E7AEC21A956CA2B713", "content.dd_A8C8C5F6EBAC4CC190C93D030354EA97", "content.dd_E2866AAFEADA4C08A61332495F7969E6", { "choices.ul_82B05060EED44A21AC3E299126B03E5B": [ "choice.choice_14D078CC7A9B4AC3A2CF39B1C2C22F86", "choice.choice_4B99299639684CA6A64BA45F46930CED", "choice.choice_B058F41197BA428EB6F18D2D76E66313" ] }, "content.p_DE7210416DC54389B2E5FF085B398E12", "content.dd_274BC656B5174557882F723E11911949", "content.dd_710E24187F394D33BA03173CA15B858A", "content.dd_3D3FF4E95F7249A1BC4897D25C5A8DE0", "content.dd_3CDE4F2B583C4CC2A8ADFB1E9DB7E2AA" ] }, { "dlentry.dlentry_E68FE7D29451435589AF1EE5A61B0A52": [ "content.dt_6FFA2A85384E44B999254B5F5655EB6F", "content.dd_A8D0486190F348C8A88BA47E3C4D70AA", "content.dd_EB05CE32A36E41818BF04CE71121F4DC", "content.dd_4D0073845AE1436F8A9673984E976AD7", "content.dd_0960DDD0B77E4AA4831C4D7D539A60CE", "content.dd_3CA7D3E3D7464206A7AFE059A2D1ED74", "content.dd_0CAFA21381284815827FF5BAA344FEA1", "content.dd_E1D6A384FF224A31B06783C942668959", "content.dd_C59C0EAAFB6D4F1C9C7EBBB56646366C" ] }, { "dlentry.dlentry_FBABD06009634862940B99511D944345": [ "content.dt_72C4910D7FF6441681D7A454F58AE172", "content.dd_C0CDE838FABB42A487D0E1BD41ADE41D", "content.dd_98564E1DA0054F5A8E008A8DA5FCD54F", "content.dd_E6B25240F16D46F8976B98DB6C833D60", "content.dd_29590A3558B043FC94CDEE62D42596B8", "content.dd_30B54A8F47C641398BB211EB986BBDB3" ] }, { "dlentry.dlentry_A48F8EC947BC4638968131357CC9156B": [ "content.dt_C26CCE6D2C324BBAA211277998C7008D", "content.dd_B4869392735D4687A529D7CA37050D81", { "choices.ul_6753901C07C9492786510223901590A3": [ "choice.choice_0EDD605E3150414AB2038467A354F5D2", "choice.choice_8549EE198ADA4E35B13095D0D1A1CC53", "choice.choice_73294062A3AF45169CF55B37F06787FE", "choice.choice_17593A3BA78E4FFA9A2BABBB5B8D65D9", "choice.choice_1DA813D3B2854599AEFAD2B3E75BE005", "choice.choice_DED9BE4B476449BFA1DCFB236B694951" ] }, "content.p_BDDD1C558E6E4D6DABAEBDD8BD437988", "content.dd_E4BD5CFFFE184B3CA4FBED34A883C327" ] }, { "dlentry.dlentry_35C7208726554202B0F01A96D558ECE7": [ "content.dt_E3461AEE01EB4BF7B2914FBE04700107", "content.dd_4F218FC4485B47E7A07890FE6EA4197C", "content.dd_D6F49F98D7644B8E8EE0216DAA40419B" ] }, { "dlentry.dlentry_21AFD4717D1849FE9720953E20ACDA3A": [ "content.dt_50B465FF9B9840D09452458A3366F2A7", "content.dd_F4EC54E8171B4B499909591E0F7BA14A" ] }, { "dlentry.dlentry_9686A92E9B7A436EBC5E301DC1DB8659": [ "content.dt_017BF15C564E4D3689138C7346E56814", "content.dd_9E7B6766DF604F748A8FE40EE6320542", "content.dd_2E337F76C5174E20BCE377FE06A638BE", "content.dd_2B0E1D70B9CF44828EE01C006948107A", "content.dd_F09E573EBDEC46969B35B9519DC77624", "content.dd_CB25DAA0EF7A45E4AABA079B2526A1A3", "content.dd_BF906640339648C88FA2579E704A4993" ] } ] } ] }, "concept_7AAF1DE7C3204F8FBCB50E2F7B189619-4.0-en.json": { "title": "title_CE21EEC33B624C9FA5D942E447C260DE", "title_CE21EEC33B624C9FA5D942E447C260DE": "Archives", "shortdesc": "shortdesc_908D5A67820142A1BAB594DFC6BF1C76", "shortdesc_908D5A67820142A1BAB594DFC6BF1C76": "If you are using Elements Vulnerability Management as a WithSecure cloud service, you can ignore the topics in this section. ", "desc": [] }, "concept_9FB99DCC6CF949AFA72CE901505A4ED9-4.0-en.json": { "title": "title_C455D21C0ED248399AED737D8236BC49", "title_C455D21C0ED248399AED737D8236BC49": "Installing the Radar Security Center", "shortdesc": "shortdesc_C9D074653934486B9440C35E0931661E", "shortdesc_C9D074653934486B9440C35E0931661E": "The Radar Security Center is the web-based interface for managing all scans, vulnerabilities, and the scan nodes connected to it. ", "content.p_7CD027D8A5CD472486D6340E06746475": "", "content.p_3135E116FB64497EAD5B25CD33C694DE": "Note: If you are using Elements Vulnerability Management as a WithSecure cloud service, you can ignore the topics in this section.", "content.p_943C9000B9E04644B958504F4BC84BDB": "Radar uses a single application hosted with IIS Server that provides both the interface and API.", "content.p_87E5B0EF2D474AD7AC421E18F8A2E5CA": "This section is intended for users who need to set up their own, internal installation of Radar.", "desc": [ { "content.note_3135E116FB64497EAD5B25CD33C694DE": [ "content.p_3135E116FB64497EAD5B25CD33C694DE" ] }, "content.p_943C9000B9E04644B958504F4BC84BDB", "content.p_87E5B0EF2D474AD7AC421E18F8A2E5CA" ] }, "concept_82B04EFDB33B4E7EACFE298AAEFB3042-4.0-en.json": { "title": "title_2D643DE079564E55BC0A13581A861751", "title_2D643DE079564E55BC0A13581A861751": "Prerequisites", "shortdesc": "shortdesc_B3AC3387FFDF4C41BF2FF4C8412D097B", "shortdesc_B3AC3387FFDF4C41BF2FF4C8412D097B": "If you are installing an on-site version of Radar Security Center, check that the requirements listed here are met before installation. ", "subchoice.choice_sysreq_4gb": "Minimum 4 GB RAM (recommended: 8GB)", "subchoice.choice_sysreq_2ghz": "Minimum 2 GHz processor", "subchoice.choice_sysreq_30gb": "Minimum 30 GB disk space", "choice.choice_3AB01042B93346E7BC1C95B58DF5F75B": "Hardware:", "subchoice.choice_977BD0FCAF804377AC95C4B7F75D4B68": "Microsoft Internet Explorer (end of support 1st of May 2020)", "subchoice.choice_C950BFDB23554E5B86B41DD3109406EC": "Microsoft Edge", "subchoice.choice_273634CFD7424218ABA0D280991190D5": "Mozilla Firefox", "subchoice.choice_57DBD4520C744A738EC8C7E7522AB445": "Google Chrome", "subchoice.choice_F7FC00E7A7E44CC89862588254E77833": "Safari", "choice.choice_82402B1F579A4F6792EB597367A5DD42": "The following browsers are supported:", "subchoice.choice_req_admin_rights": "Local or Active Directory user with admin rights is required during installation", "subchoice.choice_D5C834CB74094842A567FDCB05C383EA": "The application is configured to use a default IIS Application Pool Identity. If you want to use another user, make sure that it has a \"Log on as a batch job\" policy in GPO.", "content.p_437C481E62AA49CB8DC64AE3BBB48F7B": "Note: We recommend using English versions of the operating system for installing Radar Security Center. For example, some required IIS features may not be properly detected in localized operating system versions.", "choice.choice_4CDF1C13EAE44A0AB24E8B676C97F863": "On-site installations of Radar Security Center require the following Windows operating system: Windows Server 2012 R2 or newer (full installation, not Server Core)", "subchoice.choice_BEB1C640D301493C8CB066ECB5BE7178": ".NET Framework 4.7.2 or later (/FeatureName:NetFx4)", "subchoice.choice_EA6DBC3B528342BDB7AA8EB9EEB57636": ".NET Core 5 - Windows Server Hosting", "choice.choice_8A8E8EA62DC848229B780250CC25E0C9": "Windows features (these can be enabled by Server Manager, using the Dism tool, or directly from the Radar Security Center installer):", "subchoice.choice_C0D2ECFDE8EB495BAE8BAB7F4E063508": "A valid SSL certificate must be installed. Alternatively, a self-signed certificate can be generated during the installation (not recommended).", "cell.entry_F0D4E38E35F5495D8188C84DB448B8CB": "Description", "cell.entry_A12CCF449415433798B27648498D3BA9": "Dism FeatureName", "cell.entry_64086DB6FE0C41E5BB9CD74B176F390B": "World Wide Web Services", "cell.entry_9C98F627471140C6BCD11CB9BA916107": "IIS-WebServer", "cell.entry_FB3A1D76E9964F6BADBF01C924D4FAE6": "Process Model", "cell.entry_5AE86D1FB70341C5A82DD254AFBBF8DB": "WAS-ProcessModel", "cell.entry_EC6F4F76CD3F4F75B7A7FEB63968AAD4": "Internet Information Services Hostable Web Core", "cell.entry_5CC95FD01E3043308D3C3B509A4FACF2": "IIS-HostableWebCore", "cell.entry_014BF1BBADD4478399E506A0247B529B": "Dynamic Content Compression", "cell.entry_3E060BB391E04875850A6B6D4AC86485": "IIS-HttpCompressionDynamic", "cell.entry_FE44F254620D47888485AEFD872A883A": "Static Content Compression", "cell.entry_BEAA75FA95CE43D79EB0B7FED3ECB635": "IIS-HttpCompressionStatic", "cell.entry_6AD58770FC8F4C83A7A8E166BA7C52EA": "Default Document", "cell.entry_AB9D5EBFA1E646A78AD6C7CADCDB3B46": "IIS-DefaultDocument", "cell.entry_2F905B3F75C14AF38386BD62066B5A2F": "Directory Browsing", "cell.entry_DD1B762C015A499EB722960FF2C2E861": "IIS-DirectoryBrowsing", "cell.entry_C3FD79B5A1AD499D9D830BDA3A75C7B0": "HTTP Redirection", "cell.entry_1DE9276706CC4FFBB18A8034DD41D70E": "IIS-HttpRedirect", "cell.entry_94EEAE18DD88450E85AA2B2FBC09F134": "Static Content", "cell.entry_841E86FB3A80471D87AC9AB5B29A4CB9": "IIS-StaticContent", "cell.entry_32A43A32CAE74558AA38DEF7DD0D27B7": "URL Authorization", "cell.entry_E2264CFD9EA74B168404E0AC47A6A91E": "IIS-URLAuthorization", "cell.entry_5E977303BE8647CDAB30B2ADA39043B4": "Basic Authentication", "cell.entry_11A98A2F09D0411DBA6DC59B917E5E69": "IIS-BasicAuthentication", "cell.entry_3FE776ED36824F77BBD8C0E75AAD6BAC": "Windows Authentication", "cell.entry_6C732F0CC21A46CEAD64E2FE82410182": "IIS-WindowsAuthentication", "cell.entry_5A9764EAAD4E4D31B5307C48762F95E5": "IP Security", "cell.entry_09B748B495584CC1A82A7F90C061D284": "IIS-IPSecurity", "cell.entry_83874CC861434856A624770DC1D0E109": "Request Filtering", "cell.entry_F6A67FFC57BA4208B626722132264EFE": "IIS-RequestFiltering", "cell.entry_EEF1CA9DC73445BDA1D77676041E41CE": "Custom Logging", "cell.entry_8C845A1F2A10485D82EF05D40869CF3D": "IIS-CustomLogging", "cell.entry_4BC254948AF64B8B9075D1FDA2A2D38E": "HTTP Errors", "cell.entry_AAA7482E97FB4F1D9639FA1DA01F87CA": "IIS-HttpErrors", "cell.entry_B72E6350A807430C8FDE4B7FDD358F3C": "Logging Tools", "cell.entry_893F3C37D32B496299473D87241D218B": "IIS-LoggingLibraries", "cell.entry_2C9086B45ECF4EAFA46440FD7117ACF0": "HTTP Logging", "cell.entry_CA0CB6D0720741158DC7731BE7B82812": "IIS-HttpLogging", "cell.entry_B5CCF5097C9642E98A3344FD4CE70ADC": "ISAPI Extensions", "cell.entry_6AFDD7B5087E48D5BD7DC2FCCCC95F42": "IIS-ISAPIExtensions", "cell.entry_EBF9591EE48749D8B7A072D989A79CEF": "ISAPI Filters", "cell.entry_90085DECB4D8408ABEFEB48FF9A26C23": "IIS-ISAPIFilter", "cell.entry_B03AF412A9D44448A918C509ED3B3816": "IIS Management Scripts and Tools", "cell.entry_AA29647DF51044729EB174846C3C0B19": "IIS-ManagementScriptingTools", "cell.entry_6565897665CE4616BAA9146407082187": "IIS Management Console", "cell.entry_7FAA7A24D7744D75B40EFC247A74032E": "IIS-ManagementConsole", "cell.entry_4DDED634716F435280CBF281C5390C0A": ".NET Environment 3.5", "cell.entry_FED81636510F448D9547D95CE8CC8827": "WAS-NetFxEnvironment", "cell.entry_5FB9E7E527374BFDACF9F6CFE295A5C0": ".NET Extensibility 3.5", "cell.entry_6D2993AB9B9A4323A57FE1F252291068": "IIS-NetFxExtensibility", "cell.entry_89C5C114609F4350BBE1A3B6A2F2D710": "ASP. NET 4.5", "cell.entry_2F26B382F1764B9E9029F52A06A5F133": "IIS-ASPNET45", "cell.entry_54BCC4DF476B4A0F8647550CCC8729E6": "Configuration APIs", "cell.entry_02CC1E083C1C4AB190F0DC9479F48550": "WAS-ConfigurationAPI", "subchoice.choice_7DBA2E6CDA514FDAAA6A381049BB43FE": "The following IIS features must be enabled:", "choice.choice_87446EBE9E654AE88606F9C7F2BC21E7": "IIS (Internet Information Services):", "content.p_0BF25E8774A7425D86AECB76C8AC9BF8": "Important: Only the English version of MS SQL Server is supported. The only supported database collation is SQL_Latin1_General_CP1_CI_AS, so other language versions will not work.", "subchoice.choice_2902C787F5124C309B1EE78654884CA0": "MS SQL Server 2012 or higher (Express edition can be used) and a compatibility level of 110 (see https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-database-transact-sql-compatibility-level?view=sql-server-ver15 for more information on compatibility levels)", "subchoice.choice_8111DE608B3740EE8CC483A1744455EA": "Database collation: SQL_Latin1_General_CP1_CI_AS", "subchoice.choice_B009C890A68D41909E2CF3E5319308D3": "The Default Full-Text Language or LCID (Locale ID) value for the Radar database has to be set to 1033 (English)", "subsubchoice.choice_2BA03C3381484829BB176CB6C0623941": "db_owner if Radar database exists; otherwise the sysadmin role", "subsubchoice.choice_BE67DE1F9064487BB592ECAE0D771A4C": "securityadmin - it is always necessary to check whether the application DB user exists and has the required privileges. The installer creates the user or grants the required privileges if needed.", "subchoice.choice_CDBC0F4D8D3D49F6913E4F98E5609E4F": "Radar installer requires the following database privileges:", "content.p_57C859CAE67E408BA470029D868CDFB2": "Warning: Installing Radar with Windows authentication mode selected for the application is not supported when the database server runs on another machine. The reason for this is that the application is configured with a default IIS Application Pool Identity that is a local user, not known in the remote database.", "content.p_8BF615C6915742669EDA9A197A544097": "There are two workarounds both of which require a running installer with the following command: Radar_Security_Center_installer.exe -ai -! \"-useValues=Installer.IgnoreRemoteServerWinAuthCheck:=<[@True@]>\"", "content.p_0C8CD47B152A44CDA0AF207222F357DB": "Option 1: You can perform the first installation with a standard database user (no Windows authentication). After the installation you have to change the identity for IIS Application Pool named \"Radar Security Center\" and run the Radar update with the same installer to be able to grant privileges.", "content.p_06B7E1D473AF4E8690ED5BEAEED8C850": "Option 2: You can perform the first installation without configuring IIS. After the installation, you have to configure the application in IIS manually and run the Radar update with the same installer to be able to grant privileges.", "subchoice.choice_D8D8EB2DF6E2489E979B7F553C0BFE4F": "A database user for an application has to have at least db_datareader and db_datawriter roles and an ALTER permission to a dbo.ScanNodeStatusEvent table. These privileges are automatically granted during the installation. The installer can also create a SQL user.", "choice.choice_8FB6616EA3C44819890205733B4EA2BA": "MS SQL database:", "subsubchoice.choice_CC89C6762BBE42A58AC98F82E106F995": "Radar requires a connection with Elements VM Update Service for various reasons, such as vulnerability definitions updates, vulnerability coverage, automatic updates, scan node ordering, license renewal, and Radar Endpoint Agent support.", "subchoice.choice_2EAC647983C84903B19444A6BB27E770": "Outbound access to https://updates-api.radar-prd.fsapi.com/, https://gateway.radar-prd.fsapi.com and https://sn-api.radar-prd.fsapi.com (Elements VM Update Service)", "subchoice.choice_DF2F84E5689044F0B97B22F7CF6F97D9": "If proxies are required to access the service, it must allow GET, HEAD, and POST HTTP methods", "choice.choice_23A533F75CC14679A23F6E6F9115E39A": "Network:", "subchoice.choice_DDEAEB32221441A3A04B37F71E576B0E": "SMTP server settings are required during installation (server, username, password)", "choice.choice_81FD131C13CA4162902A24F006A229B5": "Other:", "content.p_25DCBC0740CA4078B0C7DEE90C028FED": "", "desc": [ { "choices.ul_376C1312D11743A786B2E9A4D9E546BE": [ "choice.choice_3AB01042B93346E7BC1C95B58DF5F75B", { "subchoices.ul_8EAE47EE951A426481703AD2D520C266": [ "subchoice.choice_sysreq_4gb", "subchoice.choice_sysreq_2ghz", "subchoice.choice_sysreq_30gb" ] }, "choice.choice_82402B1F579A4F6792EB597367A5DD42", { "subchoices.ul_1FF643D9BD084B0CBF1489701C2605F1": [ "subchoice.choice_977BD0FCAF804377AC95C4B7F75D4B68", "subchoice.choice_C950BFDB23554E5B86B41DD3109406EC", "subchoice.choice_273634CFD7424218ABA0D280991190D5", "subchoice.choice_57DBD4520C744A738EC8C7E7522AB445", "subchoice.choice_F7FC00E7A7E44CC89862588254E77833" ] }, "choice.choice_4CDF1C13EAE44A0AB24E8B676C97F863", { "subchoices.ul_DADF8DB8E2D74FC6A001ECB5AA712CE7": [ "subchoice.choice_req_admin_rights", "subchoice.choice_D5C834CB74094842A567FDCB05C383EA" ] }, { "content.note_437C481E62AA49CB8DC64AE3BBB48F7B": [ "content.p_437C481E62AA49CB8DC64AE3BBB48F7B" ] }, "choice.choice_8A8E8EA62DC848229B780250CC25E0C9", { "subchoices.ul_BD1F8FCD692C4AC78ED7BA59E8AE6C48": [ "subchoice.choice_BEB1C640D301493C8CB066ECB5BE7178", "subchoice.choice_EA6DBC3B528342BDB7AA8EB9EEB57636" ] }, "choice.choice_87446EBE9E654AE88606F9C7F2BC21E7", { "subchoices.ul_FBF142C3A8B2475DB1041A9D6C15AF37": [ "subchoice.choice_C0D2ECFDE8EB495BAE8BAB7F4E063508", "subchoice.choice_7DBA2E6CDA514FDAAA6A381049BB43FE", { "table.table_3DE8BCF3DED140BDBA09E06C13E98F07": [ { "thead.thead_05D4E7FDE62C4CC0A5B8F7B57AA8EA09": [ "cell.entry_F0D4E38E35F5495D8188C84DB448B8CB", "cell.entry_A12CCF449415433798B27648498D3BA9" ] }, { "row.row_8DF19C5AC32940A988DE68434A8B1699": [ "cell.entry_64086DB6FE0C41E5BB9CD74B176F390B", "cell.entry_9C98F627471140C6BCD11CB9BA916107" ] }, { "row.row_EAB5414BAAA64465A24A3C3C9B85A234": [ "cell.entry_FB3A1D76E9964F6BADBF01C924D4FAE6", "cell.entry_5AE86D1FB70341C5A82DD254AFBBF8DB" ] }, { "row.row_1F683FBE6F2B461385C3D83D248C8E38": [ "cell.entry_EC6F4F76CD3F4F75B7A7FEB63968AAD4", "cell.entry_5CC95FD01E3043308D3C3B509A4FACF2" ] }, { "row.row_2985AAA29BCC469E85753A699BE734BE": [ "cell.entry_014BF1BBADD4478399E506A0247B529B", "cell.entry_3E060BB391E04875850A6B6D4AC86485" ] }, { "row.row_3078D3F62ECD4A9AB415993F3D3533E8": [ "cell.entry_FE44F254620D47888485AEFD872A883A", "cell.entry_BEAA75FA95CE43D79EB0B7FED3ECB635" ] }, { "row.row_EB56F74DDFC94C0A8B0C53FA3C15C12E": [ "cell.entry_6AD58770FC8F4C83A7A8E166BA7C52EA", "cell.entry_AB9D5EBFA1E646A78AD6C7CADCDB3B46" ] }, { "row.row_EDF00B1A51314325ADF0BC264D6A2865": [ "cell.entry_2F905B3F75C14AF38386BD62066B5A2F", "cell.entry_DD1B762C015A499EB722960FF2C2E861" ] }, { "row.row_EEDC503D984143D0948EF0BD47F37D0C": [ "cell.entry_C3FD79B5A1AD499D9D830BDA3A75C7B0", "cell.entry_1DE9276706CC4FFBB18A8034DD41D70E" ] }, { "row.row_EEFE6A8E14B045D4BC21771EA111AC20": [ "cell.entry_94EEAE18DD88450E85AA2B2FBC09F134", "cell.entry_841E86FB3A80471D87AC9AB5B29A4CB9" ] }, { "row.row_CE901C22ABB549D0A871E6DE4CE75DE8": [ "cell.entry_32A43A32CAE74558AA38DEF7DD0D27B7", "cell.entry_E2264CFD9EA74B168404E0AC47A6A91E" ] }, { "row.row_AE8DA0375DC3460BB5C9F18637B47FAA": [ "cell.entry_5E977303BE8647CDAB30B2ADA39043B4", "cell.entry_11A98A2F09D0411DBA6DC59B917E5E69" ] }, { "row.row_A9F1082EB3C04AF2A379332F1E1B4013": [ "cell.entry_3FE776ED36824F77BBD8C0E75AAD6BAC", "cell.entry_6C732F0CC21A46CEAD64E2FE82410182" ] }, { "row.row_0C0045A511C544A0A2F874601184AF8B": [ "cell.entry_5A9764EAAD4E4D31B5307C48762F95E5", "cell.entry_09B748B495584CC1A82A7F90C061D284" ] }, { "row.row_87AFA8D22F7D4D4F81D76BB140AB49AD": [ "cell.entry_83874CC861434856A624770DC1D0E109", "cell.entry_F6A67FFC57BA4208B626722132264EFE" ] }, { "row.row_133F2458B5D64F32AB214E31E183F17B": [ "cell.entry_EEF1CA9DC73445BDA1D77676041E41CE", "cell.entry_8C845A1F2A10485D82EF05D40869CF3D" ] }, { "row.row_2815EA9FE02F47D79E5D50ADA1F74427": [ "cell.entry_4BC254948AF64B8B9075D1FDA2A2D38E", "cell.entry_AAA7482E97FB4F1D9639FA1DA01F87CA" ] }, { "row.row_630C681506A04A6D9835F6204E194AA0": [ "cell.entry_B72E6350A807430C8FDE4B7FDD358F3C", "cell.entry_893F3C37D32B496299473D87241D218B" ] }, { "row.row_33605EAF21C24CD69049F5835BEE5A73": [ "cell.entry_2C9086B45ECF4EAFA46440FD7117ACF0", "cell.entry_CA0CB6D0720741158DC7731BE7B82812" ] }, { "row.row_8482BFFAFA4F46E99863D6C3B61BFC87": [ "cell.entry_B5CCF5097C9642E98A3344FD4CE70ADC", "cell.entry_6AFDD7B5087E48D5BD7DC2FCCCC95F42" ] }, { "row.row_E61254E4C8054884966FA999E3B3C7B8": [ "cell.entry_EBF9591EE48749D8B7A072D989A79CEF", "cell.entry_90085DECB4D8408ABEFEB48FF9A26C23" ] }, { "row.row_24ACA3CD530149D191684D615BF502F2": [ "cell.entry_B03AF412A9D44448A918C509ED3B3816", "cell.entry_AA29647DF51044729EB174846C3C0B19" ] }, { "row.row_21080055ABC84654924A109E429D0283": [ "cell.entry_6565897665CE4616BAA9146407082187", "cell.entry_7FAA7A24D7744D75B40EFC247A74032E" ] }, { "row.row_820DB2E7E7844FD8B8950D6D61741F72": [ "cell.entry_4DDED634716F435280CBF281C5390C0A", "cell.entry_FED81636510F448D9547D95CE8CC8827" ] }, { "row.row_8379D4A9D9634D9EAB881594DB42AF92": [ "cell.entry_5FB9E7E527374BFDACF9F6CFE295A5C0", "cell.entry_6D2993AB9B9A4323A57FE1F252291068" ] }, { "row.row_1564828CDF2444C28AB82B88D68560FA": [ "cell.entry_89C5C114609F4350BBE1A3B6A2F2D710", "cell.entry_2F26B382F1764B9E9029F52A06A5F133" ] }, { "row.row_3DEB3675C94C4B948AB9873323CB4AA9": [ "cell.entry_54BCC4DF476B4A0F8647550CCC8729E6", "cell.entry_02CC1E083C1C4AB190F0DC9479F48550" ] } ] } ] }, "choice.choice_8FB6616EA3C44819890205733B4EA2BA", { "subchoices.ul_B25231C6679147118F17768036EF2530": [ "subchoice.choice_2902C787F5124C309B1EE78654884CA0", { "content.note_0BF25E8774A7425D86AECB76C8AC9BF8": [ "content.p_0BF25E8774A7425D86AECB76C8AC9BF8" ] }, "subchoice.choice_sysreq_30gb", "subchoice.choice_8111DE608B3740EE8CC483A1744455EA", "subchoice.choice_B009C890A68D41909E2CF3E5319308D3", "subchoice.choice_CDBC0F4D8D3D49F6913E4F98E5609E4F", { "subsubchoices.ul_0425CC7040FC4572BA76283B6182EC86": [ "subsubchoice.choice_2BA03C3381484829BB176CB6C0623941", "subsubchoice.choice_BE67DE1F9064487BB592ECAE0D771A4C" ] }, "subchoice.choice_D8D8EB2DF6E2489E979B7F553C0BFE4F", { "content.note_57C859CAE67E408BA470029D868CDFB2": [ "content.p_57C859CAE67E408BA470029D868CDFB2" ] }, "content.p_8BF615C6915742669EDA9A197A544097", "content.p_0C8CD47B152A44CDA0AF207222F357DB", "content.p_06B7E1D473AF4E8690ED5BEAEED8C850" ] }, "choice.choice_23A533F75CC14679A23F6E6F9115E39A", { "subchoices.ul_F1EC172318B547D7A4076D631990F432": [ "subchoice.choice_2EAC647983C84903B19444A6BB27E770", { "subsubchoices.ul_6452333875FC4E519F184C5DD37E5A69": [ "subsubchoice.choice_CC89C6762BBE42A58AC98F82E106F995" ] }, "subchoice.choice_DF2F84E5689044F0B97B22F7CF6F97D9" ] }, "choice.choice_81FD131C13CA4162902A24F006A229B5", { "subchoices.ul_7AC09C4CD1594324A17283E58A1B6ECD": [ "subchoice.choice_DDEAEB32221441A3A04B37F71E576B0E" ] } ] } ] }, "task_7676E820390F49ABB7DA69334B950ED4-4.0-en.json": { "title": "title_B97DEFDC875E448E8C1ECD5A248F200C", "title_B97DEFDC875E448E8C1ECD5A248F200C": "Installing and upgrading the Radar Security Center", "shortdesc": "shortdesc_3DA211CEEB3E495393CDB9CB90FCD35F", "shortdesc_3DA211CEEB3E495393CDB9CB90FCD35F": "Follow these steps to install or upgrade an on-site version of the Radar Security Center. ", "content.p_DF8EB7AA374A477792B949BC8E4E52C0": "", "content.p_7A1226ADE3E040EFAF49A3B56087520D": "Note: If you are upgrading an existing installation, make sure that you back up the SQL database before you begin.", "content.p_FFFB6586D3CA46829B4865730A38725E": "", "content.p_D6D37D4A213D47FA926A469040E4F056": "Note: The installation wizard checks that all prerequisites are installed and installs any missing software if necessary.", "content.p_27CD561995C1405CA0214D6E38567B79": "Get your Radar Security Center installation package from your WithSecure Radar contact person.", "content.p_0EC805BB8E3E44C5BA13A600AE1548A9": "The installer will check if it was run with administrative privileges.", "step.step_7E8303F2B8C24141877E907623519E2D": "Run the installer (executable) and follow the installation wizard steps.", "step.step_5C22FF503BB348B7A420B5CA753FF806": "Wait for the installer to unpack itself and review the installation package summary.", "step.step_E33F0D861DE547B782555E4167C9A95F": "Read and accept the end user license agreement.", "content.p_59D82EF879A34FEB8161F078CB0C8CB4": "The installer guides you on how to fix any missing items.", "step.step_6E51F6D48FA04BB892370B1B37ECB4A7": "Make sure that all the prerequisites are met.", "step.step_DC0C6C8A536C464D889F355427CCD62A": "Enter the credentials for a user with administrative privileges.", "substep.substep_3F5E3D5B0616420DB8B70C01A501AF91": "Enter the server or instance name.", "content.p_345078948E434902BD708D71B9E65FF6": "If the database does not exist already, it is created automatically.", "substep.substep_1D7B8140F56C438B8FDDC19FBAA5E325": "Enter the database name used by Radar.", "substep.substep_9042D420010142278BF7D951940663FE": "Choose the database user to use to create or update the database during the installation.", "substep.substep_8732DF7F1D534FBA875F798FDBF8EDD8": "Choose the database user for the application to access the database after installation.", "step.step_AAC4AB7002AF42B591ED1D1E27330C96": "Configure the MS SQL database (for upgrades, the configuration is imported from the previous installation):", "step.step_6176BBF0949C44B0B3935333C151B1AE": "Configure SMTP settings for Radar email notifications.", "content.p_27F64377EAB74369A19DC3F9ABD6830D": "Note: The installer performs IIS hardening by default. This is recommended, but optional, as it may affect other services on the same server.", "step.step_00C752EE58DB4F3E95B06016C02D1255": "Verify the IIS configuration.", "step.step_5D5F2945A0434A26AC68434859A9A06A": "Review the installation configuration settings, then click Install.", "step.step_CDBE4E807EBA43B6AD7ADC299C056197": "Wait until the installation process finishes.", "step.step_F2F0B6EBB5F04DB1A61A737B9F4B290B": "Close the installer and open Radar in your web browser.", "desc": [ { "content.note_7A1226ADE3E040EFAF49A3B56087520D": [ "content.p_7A1226ADE3E040EFAF49A3B56087520D" ] }, { "content.note_D6D37D4A213D47FA926A469040E4F056": [ "content.p_D6D37D4A213D47FA926A469040E4F056" ] }, "content.p_27CD561995C1405CA0214D6E38567B79", { "steps.steps_85F7D3D8E22A4558B8EF555D23F2034C": [ "step.step_7E8303F2B8C24141877E907623519E2D", "content.p_0EC805BB8E3E44C5BA13A600AE1548A9", "step.step_5C22FF503BB348B7A420B5CA753FF806", "step.step_E33F0D861DE547B782555E4167C9A95F", "step.step_6E51F6D48FA04BB892370B1B37ECB4A7", "content.p_59D82EF879A34FEB8161F078CB0C8CB4", "step.step_DC0C6C8A536C464D889F355427CCD62A", "step.step_AAC4AB7002AF42B591ED1D1E27330C96", { "substeps.substepsalpha_43880C83D05640159E68620DABCE1A93": [ "substep.substep_3F5E3D5B0616420DB8B70C01A501AF91", "substep.substep_1D7B8140F56C438B8FDDC19FBAA5E325", "content.p_345078948E434902BD708D71B9E65FF6", "substep.substep_9042D420010142278BF7D951940663FE", "substep.substep_8732DF7F1D534FBA875F798FDBF8EDD8" ] }, "step.step_6176BBF0949C44B0B3935333C151B1AE", "step.step_00C752EE58DB4F3E95B06016C02D1255", { "content.note_27F64377EAB74369A19DC3F9ABD6830D": [ "content.p_27F64377EAB74369A19DC3F9ABD6830D" ] }, "step.step_5D5F2945A0434A26AC68434859A9A06A", "step.step_CDBE4E807EBA43B6AD7ADC299C056197", "step.step_F2F0B6EBB5F04DB1A61A737B9F4B290B" ] } ] }, "task_22DD703F98B943B6A1A166AF0CEADB8D-4.0-en.json": { "title": "title_10ABF17F79014C1AACBD75E10B0162BD", "title_10ABF17F79014C1AACBD75E10B0162BD": "Verifying the installation", "shortdesc": "shortdesc_DE778B6C9B8C4F23B03E0E4DC3117132", "shortdesc_DE778B6C9B8C4F23B03E0E4DC3117132": "Follow these steps to ensure that your on-site installation of Radar is working correctly. ", "step.step_D287B7665A70493E93EB6B242F1FB5CF": "Make sure that you can log in to the Radar Security Center through a browser.", "substep.substep_BD5164FCD1AA49F992D990FA6625EFD4": "Open Management > Organization Settings > Vulnerability users.", "substep.substep_61DDD605317746F183828126E0A4E01A": "When creating the user, enable the Send invitation e-mail option.", "content.p_FFC62D7C1CC042AC9D41043D9BB602EB": "This should trigger an email that is sent to the user with instructions on how to log in. If this does not work:", "substep.substep_9424D18F4475417292468156F00D57B4": "Check the Windows Event logs and SMTP logs.", "substep.substep_99AB2B4752A64DB4A20EF48B498F5335": "In Windows Services, find Karhu.Scheduler. Make sure that it is running and that the user account used is correct.", "content.p_49452FBB7B464B44A941B83C3BD2A74E": "SELECT * FROM [radar].[dbo].[KarhuConfiguration] WHERE KeyName LIKE '%SMTP%'", "substep.substep_F275C19391BF4A07B7D31B1C1F5C0207": "Check the SMTP settings stored in the MS SQL database using the following command:", "substep.substep_52EB423C6DBE4AAEBFA37CC318252A8A": "Test the network connectivity from the Radar server to the SMTP server.", "step.step_7C149B00F1734A65A3BCA082AF43BD9A": "Test the SMTP settings:", "step.step_6BAE4F16BDBC49C8BC4F8E2FC3375A21": "Run test scans for each scanning engine to ensure that the Radar Security Center has a connection to the scan nodes and that the scan results are delivered back to the Radar Security Center.", "desc": [ { "steps.steps_5198A334FD674291A28EBFAF95430C11": [ "step.step_D287B7665A70493E93EB6B242F1FB5CF", "step.step_7C149B00F1734A65A3BCA082AF43BD9A", { "substeps.substepsalpha_A13E5DF7C89C42CE8F2B2D204D430AED": [ "substep.substep_BD5164FCD1AA49F992D990FA6625EFD4", "substep.substep_61DDD605317746F183828126E0A4E01A" ] }, "content.p_FFC62D7C1CC042AC9D41043D9BB602EB", { "substeps.substepsalpha_5C882D20A5BA4531A390BC9342895E36": [ "substep.substep_9424D18F4475417292468156F00D57B4", "substep.substep_99AB2B4752A64DB4A20EF48B498F5335", "substep.substep_F275C19391BF4A07B7D31B1C1F5C0207", "content.p_49452FBB7B464B44A941B83C3BD2A74E", "substep.substep_52EB423C6DBE4AAEBFA37CC318252A8A" ] }, "step.step_6BAE4F16BDBC49C8BC4F8E2FC3375A21" ] } ] }, "toc-4.0-en.json": { "toc": [ "concept_BA55FDB13ABA44A8B16E9421713F4913-4.0-en", { "concept_97F5A4549C714718AF3531B7277FD698-4.0-en": [ "concept_8A8EE953B33045A6803988051D512055-4.0-en", "concept_1F3767DC287F404EB58EF95E2932BD9E-4.0-en", "task_0C713C0B795B4E21AF1F41ED2226E201-4.0-en", { "concept_8C98A83345D649658D8DE5B4623D56AC-4.0-en": [ "task_0873163434964380838C8481AAD08754-4.0-en" ] }, "concept_5655E157F4A14C7BB3C1A4CD71A1BB63-4.0-en", "task_E468293BDA7D41968696CCEB06A8278D-4.0-en", "concept_8E6DC73546CA43AFBF3FB3446A449616-4.0-en" ] }, { "concept_C0969FC4765744E4A6CD4DAD65D1E116-4.0-en": [ { "concept_AFCE4EB5D8434AEA9D6C79496D3609D4-4.0-en": [ "task_9346600FE057438F84A7CA8BAB2C1FFA-4.0-en", "task_78097642BD8641A8B54AE5EA6F8D5AFD-4.0-en", "task_82B78C67199740B3A28EC7FDF9E16FC1-4.0-en", "concept_F6FDEE68ABC547D68EBF7BB0311018A6-4.0-en", "task_12E07949BD0B480AB40CC1805F5BE3FE-4.0-en", "task_582ACF29209A4AACB35DFF1637AE5511-4.0-en" ] }, { "concept_9B2C05AAE1F34D358F21371C0FC2FEBD-4.0-en": [ "task_CE3186C99BF84BA289D58BA8A883DC40-4.0-en", "task_00FF3930408A49258B812B2C788E496A-4.0-en", "concept_46077DBADDFD4F6590716F445AAA8FD3-4.0-en", "task_EC1AA6BA87B549EEA34B3D370E149F9A-4.0-en", "task_FF0C947B25784E27AC97C16AEC212439-4.0-en", "task_3655E78C670D473FB3899E51211C1254-4.0-en", "task_422FDF8D227C4A8EB2FF5CC756637470-4.0-en", "task_F3A57DD6C8784F9FB7EA59A3B7FDF3DF-4.0-en", "task_40B8E66B46D6425D807B01FC959C8474-4.0-en", "task_C1F229503FF44C0C9F2424184A1A6C56-4.0-en", "task_B98C152AE41B49849B4A28CDEC1AA8A9-4.0-en", "task_60CF01CC7AFC4AD79AB1788923A682DB-4.0-en", "task_4E1AFA5375BF4378862BDC23AAEFDC78-4.0-en", "task_06098B970DE946A3AF6B0D01C4DB33D6-4.0-en" ] }, { "task_24CA2B7A08CE4D2FACE248941EC94CF3-4.0-en": [ "concept_0A6A4E352A814CC894A71AFED65C9CF3-4.0-en" ] } ] }, { "concept_A78B6C2F48B6485293F6BAEED93F22A0-4.0-en": [ { "concept_D97E26BCE08F41E2A5E1E58338765AA5-4.0-en": [ "task_4CDEE4FBD9AA4C63AB979B98F2DEE834-4.0-en", "task_65FC3338189F4A21A14F499E3B3247DA-4.0-en", "task_0DD2E426DC8146D295A90F2A8299BF37-4.0-en", "task_C70B7FCEC6D34C19B0CF926608B4CB41-4.0-en" ] }, { "concept_3E26C3913A984D538704BD8D35FB7B1D-4.0-en": [ "task_A5F8A59B22674478837EDE20E877312C-4.0-en", "task_69771361E7AD4470842EC68827095B5A-4.0-en", "task_F44EAC5C654F4E76B3233854CEE5BAA7-4.0-en", { "concept_B1820DD479FC4091812980DB77D06BA8-4.0-en": [ "task_F6DB4758776F46BB80EEE7D4F7F60307-4.0-en", { "task_77BEDB21F80C431ABB25DA958DBD6FFB-4.0-en": [ "concept_F39CF3A8148E4DDDA9E4A980078E489E-4.0-en" ] } ] }, { "concept_C93DD53B155E479090907499E59C8B4B-4.0-en": [ { "task_D1DE26DA9EC4422CABDD47BF4373D6F5-4.0-en": [ { "concept_0790FBBAA21C43E79C65D91E789C32BC-4.0-en": [ "task_B6DEFCA69B3E463EA91AD7803DA530B0-4.0-en", "task_6F2AE790998D4BFC8BEF37119C04BF07-4.0-en" ] } ] } ] } ] }, "task_58E5C812FE844227B1973ECA3E1D1273-4.0-en", { "task_11226CDD36C941E5B09F6AE63ABE9284-4.0-en": [ "task_1B8B9F58AD444648ACE88BD33AB4A048-4.0-en" ] }, { "concept_AB45C3CF1EE74D0699BB8BCFFA1C3BA1-4.0-en": [ { "concept_BA66387E71964C3DBA0DDBBFBC1DA023-4.0-en": [ { "concept_E357586713E6478995E3F8E980FF2B65-4.0-en": [ "task_10E95595046447678BE6D03F597D3BD3-4.0-en", "task_262B96902BA049B786390108BAE67D8F-4.0-en", "task_5901D72CCEAB44529CAE857EF344FBFF-4.0-en", "task_E5747A58DFFD4A1C95D52FC162DB777C-4.0-en", "task_DA407D9B14D44F58886BD1AD22E73C53-4.0-en", "task_8772A6A76D994406B4809EB264EB51EE-4.0-en" ] }, "task_74CC24D34E374B59B3A64740A7C919E3-4.0-en" ] }, { "concept_C349B433D1FB4AF0B9F6326ADC5B59E5-4.0-en": [ { "concept_23D8AE9ED39742308E4F3E35E540CF0C-4.0-en": [ "task_0514B7D0D4CD4C92939A92892FF47C8D-4.0-en", "task_9A0EB476D36946E3A1E46099C47B1866-4.0-en", { "concept_F882E4ED4830486FBC501356153DDB93-4.0-en": [ "task_FAF42EBFA66D4DC89392EC38024BD6DE-4.0-en", "task_2F652F974F4A41B79E3EB4E367CD3E8A-4.0-en", "task_634DEC31FB56434D8692BFEACB77829D-4.0-en", "task_CFF0E38A5A6647B8969E6B696DA6F447-4.0-en", "task_61831539482F4EF29030013104D5CFFC-4.0-en", "task_37AF1029EF4544148A6ED02B15A5A6EE-4.0-en", "task_BDECF665F06E40ACA1C45FCA919D708B-4.0-en" ] }, "task_D223ACFED597400E9524B5028F1C28A7-4.0-en" ] }, "task_A0869486023948BEA1B6720CA2C986B9-4.0-en" ] }, { "concept_304E8DF61107461B88A04680DACA32B4-4.0-en": [ { "concept_60A1B817C5A64A3197F0C361DE46DBAB-4.0-en": [ "task_A923BA7A5BB9453FA21E2C16D631A853-4.0-en", "task_5062E43944804E6F9B64ACEBA81FE4BB-4.0-en", "task_C8641322AEAD472999D0B7D9F5C3CFF6-4.0-en", "task_C67FFD61EF1244C1BA926C549584EB54-4.0-en" ] }, { "concept_727882A5552547F3AD371F4D5B4803D3-4.0-en": [ "task_ACAA4EFEB6074BDA8A490235FA72BEA8-4.0-en", "task_E8B6320224864E2BACE58C50834A2294-4.0-en" ] }, "concept_20C9AA54C85B4C6BA26943D5A0D918FE-4.0-en" ] } ] } ] }, { "concept_AE0AB741890740AD90C8BB7DC25BD63B-4.0-en": [ "task_BEF04F4BD2504F7E8D1A6DF12097824A-4.0-en", "task_9B77F79B56C442D2B7721AE29168574A-4.0-en", "task_733B65EDB98F4E4B87BC584C1528F8CB-4.0-en", "task_80F81A48A63F439EA45927048BBE681A-4.0-en", "task_9C4EB7DCC33B4A909982712BBF0D16EE-4.0-en" ] }, { "concept_F65600FF150F458496007F49B4818004-4.0-en": [ { "concept_A23DF092A2DA477BAF195609C51E4870-4.0-en": [ "task_7CC59C0CA86A41CA9C4E3224AE0A8885-4.0-en", "task_0F3497976DE84688AA5D8CAB84ED0A22-4.0-en", "task_F151009F910A436ABD713F199715DB29-4.0-en" ] }, { "concept_4B8B8CC26B9F439FBDC23378A76816D1-4.0-en": [ { "task_2467648C40CA4688913D8B08817F1C54-4.0-en": [ "concept_16CD5239A54347588045034CCB9A0F67-4.0-en" ] }, "task_5D3BB3F42ED1439C9D1DCC70F32AD63B-4.0-en", "task_68720EBE3D184EA4A10D40A58A5EFA65-4.0-en", "task_891FAB89028144F2B58A8DE945787C6E-4.0-en", "task_951C9ED9227D4D578D4FDBC1A1056F07-4.0-en", "task_A0E5E3B26F5747588E50F4E71E1A2C78-4.0-en" ] }, { "concept_E571188FA85B4E539D32B947CDD20895-4.0-en": [ "task_B9679B13BA454AB08BAB49EF2C78164B-4.0-en" ] }, "concept_A0EBC0F9B11E4CD792470692CBF61BF5-4.0-en", "concept_E995B8F17D6940188AADF8892B993A89-4.0-en" ] }, { "concept_35AD9E6374114D41B56275182796EE1A-4.0-en": [ "task_E974D4465373492480A62E0D65BAD5E2-4.0-en", "task_72F55B520A654BFE9F6F70A864D12381-4.0-en", "task_601E636C6A5C4EFB8C684A23339B088D-4.0-en", "task_305CB881586F4BEAA15DF7B28E251EA4-4.0-en", "task_31CC28651CB442DEAE4A8488FEF154B3-4.0-en", "task_709ED3C1789248D2A9CBB84F5E4CF512-4.0-en", "task_3CD70C44CCE646648B627F0273BDF3D7-4.0-en", "task_FA668184AF2847A6BCC8FE21C857F23C-4.0-en" ] }, { "concept_D2768003DBDF40E2B44C51531B91D4AE-4.0-en": [ "concept_3C9EB670F50D4061B3FCAA4C9EC3EC2C-4.0-en", "concept_24BC0BD70396420991904B86E551C17F-4.0-en" ] }, { "concept_7AAF1DE7C3204F8FBCB50E2F7B189619-4.0-en": [ { "concept_9FB99DCC6CF949AFA72CE901505A4ED9-4.0-en": [ "concept_82B04EFDB33B4E7EACFE298AAEFB3042-4.0-en", "task_7676E820390F49ABB7DA69334B950ED4-4.0-en", "task_22DD703F98B943B6A1A166AF0CEADB8D-4.0-en" ] } ] } ], "concept_8A8EE953B33045A6803988051D512055-4.0-en": "Main concepts and components", "concept_1F3767DC287F404EB58EF95E2932BD9E-4.0-en": "The WithSecure Elements portal", "task_0C713C0B795B4E21AF1F41ED2226E201-4.0-en": "Logging in", "task_0873163434964380838C8481AAD08754-4.0-en": "Adding widgets", "concept_8C98A83345D649658D8DE5B4623D56AC-4.0-en": "Using widgets", "concept_5655E157F4A14C7BB3C1A4CD71A1BB63-4.0-en": "My profile", "task_E468293BDA7D41968696CCEB06A8278D-4.0-en": "Using filters", "concept_8E6DC73546CA43AFBF3FB3446A449616-4.0-en": "Support", "concept_97F5A4549C714718AF3531B7277FD698-4.0-en": "Getting started", "task_9346600FE057438F84A7CA8BAB2C1FFA-4.0-en": "Installation steps", "task_78097642BD8641A8B54AE5EA6F8D5AFD-4.0-en": "Verify installation", "task_82B78C67199740B3A28EC7FDF9E16FC1-4.0-en": "Configuring scan nodes", "concept_F6FDEE68ABC547D68EBF7BB0311018A6-4.0-en": "Troubleshooting scan nodes issues", "task_12E07949BD0B480AB40CC1805F5BE3FE-4.0-en": "Using scan nodes in an offline environment", "task_582ACF29209A4AACB35DFF1637AE5511-4.0-en": "Uninstalling scan nodes", "concept_AFCE4EB5D8434AEA9D6C79496D3609D4-4.0-en": "Installing scan nodes (Windows)", "task_CE3186C99BF84BA289D58BA8A883DC40-4.0-en": "Installation steps", "task_00FF3930408A49258B812B2C788E496A-4.0-en": "Verify Linux scan node installation", "concept_46077DBADDFD4F6590716F445AAA8FD3-4.0-en": "Linux scan node paths", "task_EC1AA6BA87B549EEA34B3D370E149F9A-4.0-en": "Configuring Linux scan nodes", "task_FF0C947B25784E27AC97C16AEC212439-4.0-en": "Applying the scan node license manually", "task_3655E78C670D473FB3899E51211C1254-4.0-en": "Set up encryption keys for authenticated scanning", "task_422FDF8D227C4A8EB2FF5CC756637470-4.0-en": "Configuring communication for privately hosted Elements Vulnerability Management", "task_F3A57DD6C8784F9FB7EA59A3B7FDF3DF-4.0-en": "Redirecting traffic to a proxy server", "task_40B8E66B46D6425D807B01FC959C8474-4.0-en": "Disabling SSL certificate validation", "task_C1F229503FF44C0C9F2424184A1A6C56-4.0-en": "Installing a local CA certificate", "task_B98C152AE41B49849B4A28CDEC1AA8A9-4.0-en": "Limiting the maximum number of simultaneous scans", "task_60CF01CC7AFC4AD79AB1788923A682DB-4.0-en": "Updating scan engines manually", "task_4E1AFA5375BF4378862BDC23AAEFDC78-4.0-en": "Resetting scan engines", "task_06098B970DE946A3AF6B0D01C4DB33D6-4.0-en": "Uninstalling scan nodes", "concept_9B2C05AAE1F34D358F21371C0FC2FEBD-4.0-en": "Installing WithSecure Elements VM scan nodes (Linux)", "concept_0A6A4E352A814CC894A71AFED65C9CF3-4.0-en": "Command-line parameters", "task_24CA2B7A08CE4D2FACE248941EC94CF3-4.0-en": "Installing WithSecure Elements Agent with VM capabilities", "concept_C0969FC4765744E4A6CD4DAD65D1E116-4.0-en": "Deployment", "task_4CDEE4FBD9AA4C63AB979B98F2DEE834-4.0-en": "Adding a discovery scan", "task_65FC3338189F4A21A14F499E3B3247DA-4.0-en": "Configuring discovery scan templates", "task_0DD2E426DC8146D295A90F2A8299BF37-4.0-en": "Running a discovery scan", "task_C70B7FCEC6D34C19B0CF926608B4CB41-4.0-en": "Viewing the discovery scan results", "concept_D97E26BCE08F41E2A5E1E58338765AA5-4.0-en": "Discovery scan", "task_A5F8A59B22674478837EDE20E877312C-4.0-en": "Editing scan groups", "task_69771361E7AD4470842EC68827095B5A-4.0-en": "Running network vulnerability scans", "task_F44EAC5C654F4E76B3233854CEE5BAA7-4.0-en": "Viewing the scan results", "task_F6DB4758776F46BB80EEE7D4F7F60307-4.0-en": "Adding a system scan", "concept_F39CF3A8148E4DDDA9E4A980078E489E-4.0-en": "System scan configuration options", "task_77BEDB21F80C431ABB25DA958DBD6FFB-4.0-en": "Configuring system scans", "concept_B1820DD479FC4091812980DB77D06BA8-4.0-en": "System scan", "task_B6DEFCA69B3E463EA91AD7803DA530B0-4.0-en": "Generating recordings with Burp Proxy", "task_6F2AE790998D4BFC8BEF37119C04BF07-4.0-en": "Generating recordings with Fiddler", "concept_0790FBBAA21C43E79C65D91E789C32BC-4.0-en": "Web scan recordings", "task_D1DE26DA9EC4422CABDD47BF4373D6F5-4.0-en": "Adding a web scan", "concept_C93DD53B155E479090907499E59C8B4B-4.0-en": "Web scan", "concept_3E26C3913A984D538704BD8D35FB7B1D-4.0-en": "Network scan", "task_58E5C812FE844227B1973ECA3E1D1273-4.0-en": "Finding internet-facing systems", "task_1B8B9F58AD444648ACE88BD33AB4A048-4.0-en": "Changing the frequency for endpoint status updates", "task_11226CDD36C941E5B09F6AE63ABE9284-4.0-en": "Activating WithSecure Elements Agent scanning on devices", "task_10E95595046447678BE6D03F597D3BD3-4.0-en": "Updating PowerShell", "task_262B96902BA049B786390108BAE67D8F-4.0-en": "Create a dedicated user account", "task_5901D72CCEAB44529CAE857EF344FBFF-4.0-en": "Configuring the WinRM service to use HTTP on individual hosts", "task_E5747A58DFFD4A1C95D52FC162DB777C-4.0-en": "Configuring the WinRM service to use HTTP through GPO", "task_DA407D9B14D44F58886BD1AD22E73C53-4.0-en": "Configuring the WinRM service to use HTTPS with a publicly signed certificate", "task_8772A6A76D994406B4809EB264EB51EE-4.0-en": "Configuring the WinRM service to use HTTPS without a publicly signed certificate", "concept_E357586713E6478995E3F8E980FF2B65-4.0-en": "Configuring Windows authenticated scanning (WinRM)", "task_74CC24D34E374B59B3A64740A7C919E3-4.0-en": "Troubleshooting Windows authenticated scanning (WinRM)", "concept_BA66387E71964C3DBA0DDBBFBC1DA023-4.0-en": "Windows authenticated scanning (WinRM)", "task_0514B7D0D4CD4C92939A92892FF47C8D-4.0-en": "Create a Windows domain account", "task_9A0EB476D36946E3A1E46099C47B1866-4.0-en": "Disable Admin Approval Mode", "task_FAF42EBFA66D4DC89392EC38024BD6DE-4.0-en": "Create a new Group Policy object", "task_2F652F974F4A41B79E3EB4E367CD3E8A-4.0-en": "Add rule to allow traffic to the RPC Endpoint Mapper", "task_634DEC31FB56434D8692BFEACB77829D-4.0-en": "Add rule to allow traffic to the RPC Dynamic Ports", "task_CFF0E38A5A6647B8969E6B696DA6F447-4.0-en": "Add rule to allow traffic to SMB/CIFS and RPC", "task_61831539482F4EF29030013104D5CFFC-4.0-en": "Enable Remote Registry service", "task_37AF1029EF4544148A6ED02B15A5A6EE-4.0-en": "Grant read access to registry keys", "task_BDECF665F06E40ACA1C45FCA919D708B-4.0-en": "Adding a scan node to the domain", "concept_F882E4ED4830486FBC501356153DDB93-4.0-en": "Configure GPO policy", "task_D223ACFED597400E9524B5028F1C28A7-4.0-en": "Configure the WithSecure Elements portal", "concept_23D8AE9ED39742308E4F3E35E540CF0C-4.0-en": "Configuring Windows authenticated scanning (RPC)", "task_A0869486023948BEA1B6720CA2C986B9-4.0-en": "Troubleshooting Windows authenticated scanning (RPC)", "concept_C349B433D1FB4AF0B9F6326ADC5B59E5-4.0-en": "Windows authenticated scanning (RPC)", "task_A923BA7A5BB9453FA21E2C16D631A853-4.0-en": "Create new encryption keys", "task_5062E43944804E6F9B64ACEBA81FE4BB-4.0-en": "Upload encryption keys to WithSecure Elements portal", "task_C8641322AEAD472999D0B7D9F5C3CFF6-4.0-en": "Upload encryption keys to WithSecure Elements VM scan node", "task_C67FFD61EF1244C1BA926C549584EB54-4.0-en": "Prepare the user account for Linux authenticated scanning", "concept_60A1B817C5A64A3197F0C361DE46DBAB-4.0-en": "Preparation steps", "task_ACAA4EFEB6074BDA8A490235FA72BEA8-4.0-en": "Password-based authentication", "task_E8B6320224864E2BACE58C50834A2294-4.0-en": "Key-based authentication (recommended)", "concept_727882A5552547F3AD371F4D5B4803D3-4.0-en": "Authentication methods", "concept_20C9AA54C85B4C6BA26943D5A0D918FE-4.0-en": "Troubleshooting", "concept_304E8DF61107461B88A04680DACA32B4-4.0-en": "Linux authenticated scanning", "concept_AB45C3CF1EE74D0699BB8BCFFA1C3BA1-4.0-en": "Authenticated scanning", "concept_A78B6C2F48B6485293F6BAEED93F22A0-4.0-en": "Scanning", "task_BEF04F4BD2504F7E8D1A6DF12097824A-4.0-en": "Creating reports", "task_9B77F79B56C442D2B7721AE29168574A-4.0-en": "Editing the settings of an existing report", "task_733B65EDB98F4E4B87BC584C1528F8CB-4.0-en": "Cloning an existing report", "task_80F81A48A63F439EA45927048BBE681A-4.0-en": "Updating contents of existing reports", "task_9C4EB7DCC33B4A909982712BBF0D16EE-4.0-en": "Deleting reports", "concept_AE0AB741890740AD90C8BB7DC25BD63B-4.0-en": "Reporting", "task_7CC59C0CA86A41CA9C4E3224AE0A8885-4.0-en": "Viewing tickets", "task_0F3497976DE84688AA5D8CAB84ED0A22-4.0-en": "Creating a ticket", "task_F151009F910A436ABD713F199715DB29-4.0-en": "Adding a vulnerability to an existing ticket", "concept_A23DF092A2DA477BAF195609C51E4870-4.0-en": "Vulnerabilities", "concept_16CD5239A54347588045034CCB9A0F67-4.0-en": "Tracking asset changes", "task_2467648C40CA4688913D8B08817F1C54-4.0-en": "Viewing assets", "task_5D3BB3F42ED1439C9D1DCC70F32AD63B-4.0-en": "Managing asset attributes", "task_68720EBE3D184EA4A10D40A58A5EFA65-4.0-en": "Managing asset tags", "task_891FAB89028144F2B58A8DE945787C6E-4.0-en": "Updating notes", "task_951C9ED9227D4D578D4FDBC1A1056F07-4.0-en": "Deleting assets", "task_A0E5E3B26F5747588E50F4E71E1A2C78-4.0-en": "Deleting archived assets", "concept_4B8B8CC26B9F439FBDC23378A76816D1-4.0-en": "Assets", "task_B9679B13BA454AB08BAB49EF2C78164B-4.0-en": "Adding new scan nodes", "concept_E571188FA85B4E539D32B947CDD20895-4.0-en": "Scan nodes", "concept_A0EBC0F9B11E4CD792470692CBF61BF5-4.0-en": "Users", "concept_E995B8F17D6940188AADF8892B993A89-4.0-en": "Settings", "concept_F65600FF150F458496007F49B4818004-4.0-en": "Management", "task_E974D4465373492480A62E0D65BAD5E2-4.0-en": "Authentication", "task_72F55B520A654BFE9F6F70A864D12381-4.0-en": "Use case: retrieve product information", "task_601E636C6A5C4EFB8C684A23339B088D-4.0-en": "Use case: check for vulnerabilities", "task_305CB881586F4BEAA15DF7B28E251EA4-4.0-en": "Use case: export system scan findings in XML format", "task_31CC28651CB442DEAE4A8488FEF154B3-4.0-en": "Use case: export system scan findings", "task_709ED3C1789248D2A9CBB84F5E4CF512-4.0-en": "Use case: export web scan findings", "task_3CD70C44CCE646648B627F0273BDF3D7-4.0-en": "Use case: search discovered hosts", "task_FA668184AF2847A6BCC8FE21C857F23C-4.0-en": "Use case: track assets coming from a custom source (for example Active Directory)", "concept_35AD9E6374114D41B56275182796EE1A-4.0-en": "Elements Vulnerability Management API", "concept_3C9EB670F50D4061B3FCAA4C9EC3EC2C-4.0-en": "Customer data", "concept_24BC0BD70396420991904B86E551C17F-4.0-en": "Information Security Management System", "concept_D2768003DBDF40E2B44C51531B91D4AE-4.0-en": "Security description", "concept_82B04EFDB33B4E7EACFE298AAEFB3042-4.0-en": "Prerequisites", "task_7676E820390F49ABB7DA69334B950ED4-4.0-en": "Installing and upgrading the Radar Security Center", "task_22DD703F98B943B6A1A166AF0CEADB8D-4.0-en": "Verifying the installation", "concept_9FB99DCC6CF949AFA72CE901505A4ED9-4.0-en": "Installing the Radar Security Center", "concept_7AAF1DE7C3204F8FBCB50E2F7B189619-4.0-en": "Archives", "concept_BA55FDB13ABA44A8B16E9421713F4913-4.0-en": "Elements Vulnerability Management " } }