Reviewing and Managing Vulnerabilities

The Vulnerabilities page provides a focused view of the impact vulnerabilities have on your environments that are connected to InsightCloudSec, including:

  • Search functionality and filtering to narrow the list of resources to only the most critical or vulnerable
  • Comprehensive assessment and visibility including:
    • All detected vulnerabilities plus CVSS score, Active Risk score, and number of impacted resources
    • All software plus their number of vulnerabilities and impacted resources
    • All containers and instances that are affected by a vulnerability, plus the scanned artifact and last scanned time
  • Recommended solutions for each vulnerability as software and OSS version updates
  • Actions and automation that trigger alerts, ticketing, remediation workflows, and data exports
  • Assessment coverage and health monitoring to identify any errors or access issues impacting feature operations

Explore Vulnerabilities

In InsightCloudSec, navigate to Security > Vulnerabilities to start viewing high risk vulnerabilities and their impact on your environment.

Filter

The Vulnerabilities feature includes filtering functionality to effectively narrow the scope of and navigate the data.

Filter Containers or Instances

You can use the Resource Type filter to only display Containers or Instances

Add Filter

Filtering allows for narrowing the scope of the resources list using properties like cloud accounts, clusters, resource groups, etc. Some things to note about filtering behavior:

  • Each selected filter updates dynamically with options appropriate for the property selected.
  • After selecting an initial property, click + Add Filter to add an additional filter and further narrow the scope.
  • If filtering on a Resource Tag:
    • Searching for a tag is case insensitive.
    • New tags are harvested every 12 hours by the ResourceTypeTrigramsProcess background job (see System Settings for more information).

To add a filter:

  1. Click the Add Filters button to open the side panel.
  2. Select and configure a property to get started.
  3. After configuring your desired filters, click Apply to update the scope for the feature.
Save Filters (Optional)

After Adding a Filter, you can save it so that it can easily be reused the next time you access the feature. Saved filters are feature-specific (since options vary between features), i.e., a saved filter in Feature "A" will only be available in Feature "A" and will not be available in Feature "B".

To save a filter:

  1. Once filter(s) have been applied, ensure the filters list is expanded by clicking the arrow (>)
  2. Click the ellipsis (...) button, then click Save Filter.
  3. Provide a name for the filter and an optional description.
  4. Select the checkbox for Set as Default Filter to set this filter as the default for the feature. This only applies to your user account and will not affect other users' default filter.
  5. Select the checkbox for Make this a Public Filter to allow other users to use and see the filter.
  6. Click OK.

Once a filter has been successfully saved, it can be accessed (along with other saved filters) or edited from the same ellipsis menu.

Data Display

The display presents all of the data analyzed within the Vulnerabilities feature as well as the total number of scanned vulnerabilities, software, and resources, but this value will update to reflect the number of items scoped by any configured filters. Details of the data reflected here are explored in the Frequently Asked Questions (FAQ). The data display is split across three tabs: Vulnerabilities, Software, and Resources. When combined with filtering, these scoping capabilities enable you to quickly navigate to specific areas that you want to evaluate for risk. There is some common functionality across the tabs:

  • Search - Type into the search bar and the data will automatically filter to match the criteria.
  • Download - You have two options for downloading Vulnerabilities data:
    • To download a CSV copy of the data currently displayed on the selected tab, navigate to the desired view (Vulnerabilities, Software, or Resources) and click Download. The file is prepared in the background until it is ready to be downloaded by your web browser. If the file preparation takes longer than 10 minutes, it will time out, so it's best to narrow the scope using filters prior to downloading.
    • To download the unified Vulnerability Report that contains details, proof, and remediation for selected vulnerabilities, navigate to the Resources view and click Download Vulnerability Report. The file is prepared in the background until it is ready to be downloaded by your web browser. The report is limited to one million records, so you may need to narrow the scope using filters prior to downloading.
  • Column Sort - To sort the data by a particular column, click the column header.
  • Settings - To access configuration settings for host and container vulnerability assessment capabilities, click Settings. Explore Configuring Host Vulnerability Assessment (HVA) and Configuring Container Vulnerability Assessment (CVA) for details.
  • Column Options (Resources tab only) - To alter the columns displayed in the results table, click Column Options to open a drop-down menu containing all available columns. Some columns are off by default (for example: Kubernetes Cluster).

Sample Use Cases

Assessing the Impact of a Specific Vulnerability

  1. Navigate to Security > Vulnerabilities > Vulnerabilities.
  2. Using the search or filters capability, search for a particular CVE ID.
  3. Click the Action menu (...) and click View Resource(s) Scan List.

The Resources tab will load and be automatically filtered to only include the selected vulnerability. From this point, you could filter on a particular resource type (host instance or container) to narrow your focus and download the result set.

Assessing a Zero-Day Vulnerability

Often when a zero-day vulnerability occurs, there is no CVE and the best way to determine surface area is a search by software and version. In these scenarios, you can focus on a specific software (like log4j) and see the impact of that software across your environment.

  1. Navigate to Security > Vulnerabilities > Software.
  2. Using the filters capability, add the Software Name contains condition and add the name as the condition value (e.g., log4j).
  3. Click Apply. The Software tab will load and be automatically filtered to only include software with a name containing the value you specified.
  4. Navigate to the particular software of focus and click the Software Name to open the Software Details blade. The default tab for this blade is Resources, where you can see all of the resources that currently are associated with this software.

From this point, you could download the result set or utilize Query Filters and Insights to take action on the result set.