Assess

After you discover all the assets and vulnerabilities in your environment, it is important to parse this information to determine what the major security threats are, such as high-risk assets, vulnerabilities, potential malware exposures, or policy violations.

Assess gives you guidance on viewing and sorting your scan results to determine your security priorities. It includes the following sections:

Locating and working with assets: There are several ways to drill down through scan results to find specific assets. For example, you can find all assets that run a particular operating system or that belong to a certain site. This section covers these different paths. It also discusses how to sort asset data by different security metrics and how to look at the detailed information about each asset.

Working with vulnerabilities: Depending on your environment, your scans may discover thousands of vulnerabilities. This section shows you how to sort vulnerabilities based on various security metrics, affected assets, and other criteria, so that you can find the threats that require immediate attention. The section also covers how to exclude vulnerabilities from reports and risk score calculations.

Working with Policy Manager results: If you work for a U.S. government agency or a vendor that transacts business with the government, you may be running scans to verify that your assets comply with United States Government Configuration Baseline (USGCB) or Federal Desktop Core Configuration (FDCC) policies. Or you may be testing assets for compliance with customized policies based on USGCB or FDCC policies. This section shows you how to track your overall compliance, view scan results for policies and the specific rules that make up those policies, and override rule results.