IBM Security QRadar Vulnerability Manager

Version 7.2.4

User Guide

Note
Before using this information and the product that it supports, read the information in Notices on page 83.

Product information
This document applies to IBM QRadar Security Intelligence Platform V7.2.4 and subsequent releases unless
superseded by an updated version of this document.
Copyright IBM Corporation 2012, 2014.
US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract
with IBM Corp.

Contents
Introduction to IBM Security QRadar Vulnerability Manager . . . . . . . . . . . . . vii
Chapter 1. What's new for users in QRadar Vulnerability Manager V7.2.4. . . . . . . . 1
Chapter 2. QRadar Vulnerability Manager installations and deployments . . . . . . . . 3
Vulnerability processor and scanner appliance activation keys . . . . . . . . .
Vulnerability backup and recovery . . . . . . . . . . . . . . . . . .
Options for moving the vulnerability processor in your QRadar Vulnerability Manager
Deploying a dedicated QRadar Vulnerability Manager processor appliance . . .
Moving your vulnerability processor to a managed host or console . . . . . .
Verifying that a vulnerability processor is deployed . . . . . . . . . . .
Removing a vulnerability processor from your console or managed host . . . .
Options for adding scanners to your QRadar Vulnerability Manager deployment . .
Deploying a dedicated QRadar Vulnerability Manager scanner appliance . . . .
Deploying a vulnerability scanner to a QRadar console or managed host . . . .
Scanning the assets in your DMZ . . . . . . . . . . . . . . . . .
Verifying that a vulnerability scanner is added to your deployment. . . . . .
Supported web browsers . . . . . . . . . . . . . . . . . . . .
Supported web browsers . . . . . . . . . . . . . . . . . . . .

. . . . .
. . . . .
deployment .
. . . . .
. . . . .
. . . . .
. . . . .
. . . . .
. . . . .
. . . . .
. . . . .
. . . . .
. . . . .
. . . . .

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

. 4
. 4
. 5
. 5
. 6
. 7
. 7
. 7
. 8
. 9
. 10
. 11
. 11
. 12

Chapter 3. IBM Security QRadar Vulnerability Manager . . . . . . . . . . . . . . . 15

Vulnerability scanning . . . . . . . . . . . . . . . . . . . . . .
Vulnerability management dashboard . . . . . . . . . . . . . . . .
Reviewing vulnerability data on the default vulnerability management dashboard.
Creating a customized vulnerability management dashboard . . . . . . . .
Creating a dashboard for patch compliance . . . . . . . . . . . . . .

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

15
16
16
16
17

Chapter 4. Security software integrations . . . . . . . . . . . . . . . . . . . . . 19

IBM Security QRadar Risk Manager and IBM Security QRadar Vulnerability Manager integration
IBM Endpoint Manager integration . . . . . . . . . . . . . . . . . . . . .
Configuring SSL for IBM Endpoint Manager integration . . . . . . . . . . . . .
Integrating IBM Security QRadar Vulnerability Manager with IBM Endpoint Manager . . .
IBM Security SiteProtector integration . . . . . . . . . . . . . . . . . . . .
Connecting to IBM Security SiteProtector . . . . . . . . . . . . . . . . . .

.
.
.
.
.
.

.
.
.
.
.
.

.
.
.
.
.
.

.
.
.
.
.
.

.
.
.
.
.
.

.
.
.
.
.
.

19
19
20
21
21
22

Chapter 5. Vulnerability scanning . . . . . . . . . . . . . . . . . . . . . . . . 23

Creating a scan profile. . . . . . . . . . . .
Creating an external scanner scan profile . . . .
Creating a benchmark profile . . . . . . . .
Running a scan profile manually . . . . . . .
Rescanning an asset by using the right-click function
Scan profile details . . . . . . . . . . . .
Scan scheduling . . . . . . . . . . . . . .
Scanning domains monthly . . . . . . . . .
Scheduling scans of new unscanned assets . . . .
Reviewing your scheduled scans in calendar format .
Network scan targets and exclusions . . . . . . .
Excluding assets from all scans . . . . . . . .
Managing scan exclusions . . . . . . . . .
Scan protocols and ports . . . . . . . . . . .
Scanning a full port range . . . . . . . . .
Scanning assets with open ports . . . . . . .
Authenticated patch scans . . . . . . . . . .
Centralized credential sets . . . . . . . . .
Copyright IBM Corp. 2012, 2014

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

23
24
24
25
26
26
27
28
28
29
29
31
31
31
32
33
34
35

iii

Configuring Linux operating system public key authentication . . . . .

Configuring an authenticated scan of the Linux or UNIX operating systems .
Enabling permissions for Linux or UNIX patch scans . . . . . . . .
Configuring an authenticated scan of the Windows operating system . . .
Configuring a permitted scan interval . . . . . . . . . . . . . .
Scanning during permitted times . . . . . . . . . . . . . . .
Managing operational windows . . . . . . . . . . . . . . .
Disconnecting an operational window . . . . . . . . . . . . .
Dynamic vulnerability scans . . . . . . . . . . . . . . . . . .
Associating vulnerability scanners with CIDR ranges . . . . . . . .
Scanning CIDR ranges with different vulnerability scanners . . . . . .
Scan policies . . . . . . . . . . . . . . . . . . . . . . .
Modifying a pre-configured scan policy . . . . . . . . . . . . .
Configuring a scan policy to manage your vulnerability scans . . . . .

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.

36
37
38
39
45
45
46
46
46
47
48
48
49
49

Chapter 6. Vulnerability scan investigations . . . . . . . . . . . . . . . . . . . . 51

Searching scan results . . . . . . . . .
Including column headings in asset searches .
Managing scan results . . . . . . . . .
Asset risk levels and vulnerability categories .
Asset, vulnerability, and open services data. .
Viewing the status of asset patch downloads .
Vulnerability risk and PCI severity . . . .
Emailing asset owners when vulnerability scans

. .
. .
. .
. .
. .
. .
. .
start

. . .
. . .
. . .
. . .
. . .
. . .
. . .
and stop

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.

51
52
52
53
53
54
54
54

Chapter 7. Management of your vulnerabilities . . . . . . . . . . . . . . . . . . 57

Investigating vulnerability risk scores. . . . . . . . . .
Risk score details . . . . . . . . . . . . . . .
Searching vulnerability data . . . . . . . . . . . . .
Vulnerability search parameters. . . . . . . . . . .
Saving your vulnerability search criteria . . . . . . . .
Deleting saved vulnerability search criteria . . . . . . .
Vulnerability instances. . . . . . . . . . . . . . .
Network vulnerabilities . . . . . . . . . . . . . .
Asset vulnerabilities . . . . . . . . . . . . . . .
Open service vulnerabilities . . . . . . . . . . . . .
Investigating the history of a vulnerability . . . . . . . .
Reducing the number of false positive vulnerabilities . . . .
Investigating high risk assets and vulnerabilities . . . . . .
Prioritizing high risk vulnerabilities by applying risk policies. .
Configuring custom display colors for risk scores. . . . . .
Identifying vulnerabilities with an IBM Endpoint Manager patch
Identifying the patch status of your vulnerabilities . . . . .

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

57
57
58
59
61
61
62
62
62
63
63
63
64
65
66
66
67

Chapter 8. Vulnerability exception rules . . . . . . . . . . . . . . . . . . . . . 69

Applying a vulnerability exception rule .
Managing a vulnerability exception rule .
Searching vulnerability exceptions . . .

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

. 69
. 70
. 70

Chapter 9. Vulnerability remediation . . . . . . . . . . . . . . . . . . . . . . . 71

Assigning individual vulnerabilities to a technical user for remediation .
Assigning a technical user as the owner of asset groups . . . . . .
Configuring remediation times for the vulnerabilities on assigned assets .

Chapter 10. Vulnerability reports

QRadar Vulnerability Manager

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

.
.
.

. 71
. 71
. 73

. . . . . . . . . . . . . . . . . . . . . . . . 75

Running a default QRadar Vulnerability Manager report . . . .

Emailing assigned vulnerability reports to technical users . . . .
Generating PCI compliance reports . . . . . . . . . . .
Updating your asset compliance plans and software declarations
Creating a PCI compliance report . . . . . . . . . . .

iv

.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

.
.
.
.
.

75
75
77
77
77

Including column headings in asset searches .

. 78

Chapter 11. Vulnerability research, news, and advisories . . . . . . . . . . . . . . 81

Viewing detailed information about published vulnerabilities.
Remaining aware of global security developments . . . .
Viewing security advisories from vulnerability vendors. . .
Searching vulnerabilities, news, and advisories . . . . .

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

.
.
.
.

81
81
82
82

Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Trademarks . . . . . .
Privacy policy considerations

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

.
.

. 84
. 85

Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
A.
C.
D.
E.
F.
H.
I .
N.
O.
P.
R.
S.
T.
U.
V.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

87
87
87
87
87
87
88
88
88
88
88
88
88
88
89

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

Contents

vi

QRadar Vulnerability Manager

Introduction to IBM Security QRadar Vulnerability Manager

This information is intended for use with IBM Security QRadar Vulnerability
Manager. QRadar Vulnerability Manager is a scanning platform that is used to
identify, manage, and prioritize the vulnerabilities on your network assets.
This guide contains instructions for configuring and using QRadar Vulnerability
Manager on an IBM Security QRadar SIEM or IBM Security QRadar Log Manager
console.

Intended audience
System administrators responsible for configuring IBM Security QRadar
Vulnerability Manager must have administrative access to IBM Security QRadar
SIEM and to your network devices and firewalls. The system administrator must
have knowledge of your corporate network and networking technologies.

Technical documentation
For information about how to access more technical documentation, technical
notes, and release notes, see Accessing IBM Security Documentation Technical Note
(http://www.ibm.com/support/docview.wss?rs=0&uid=swg21612861).

Contacting customer support

For information about contacting customer support, see the Support and
Download Technical Note (http://www.ibm.com/support/docview.wss?rs=0
&uid=swg21612861).

Statement of good security practices

IT system security involves protecting systems and information through
prevention, detection and response to improper access from within and outside
your enterprise. Improper access can result in information being altered, destroyed,
misappropriated or misused or can result in damage to or misuse of your systems,
including for use in attacks on others. No IT system or product should be
considered completely secure and no single product, service or security measure
can be completely effective in preventing improper use or access. IBM systems,
products and services are designed to be part of a comprehensive security
approach, which will necessarily involve additional operational procedures, and
may require other systems, products or services to be most effective. IBM DOES
NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE
IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE
MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.

Copyright IBM Corp. 2012, 2014

vii

viii

QRadar Vulnerability Manager

Chapter 1. What's new for users in QRadar Vulnerability

Manager V7.2.4
IBM Security QRadar Vulnerability Manager V7.2.4 introduces enhancements to
CIS compliance scanning, patch compliance dashboards, access to patch
information for vulnerabilities and more.

Associate benchmark scan profiles with asset compliance

questions
Create CIS benchmark scan profiles that you can associate with asset compliance
policy questions in QRadar Risk Manager.

Learn more...

Use the patch compliance dashboard to identify quickly the most

significant patches that are missing in your environment
To identify easily which patches are missing in your environment, create a patch
compliance dashboard.

Learn more...

View detailed patch information for vulnerabilities

This feature provides information on how QRadar Vulnerability Manager checks
for vulnerability details during a patch scan. You can now access Oval Definitions,
Windows Knowledge Base entries, and UNIX Advisories for vulnerabilities from
the Research Vulnerability Details window.

Copyright IBM Corp. 2012, 2014

Learn more...

QRadar Vulnerability Manager

Chapter 2. QRadar Vulnerability Manager installations and

deployments
You access IBM Security QRadar Vulnerability Manager by using the
Vulnerabilities tab.

Access to the vulnerabilities tab

Depending on the product that you install and whether you upgrade QRadar or
install a new system, the Vulnerabilities tab might not be displayed.
v If you install QRadar SIEM, the Vulnerabilities tab is enabled by default with a
temporary license key.
v If you install QRadar Log Manager, the Vulnerabilities tab is not enabled.
v Depending on how you upgrade QRadar, the Vulnerabilities tab might not be
enabled.
To use QRadar Vulnerability Manager after an install or upgrade you must upload
and allocate a valid license key. For more information, see the Administration Guide
for your product.
For more information about upgrading, see the IBM Security QRadar Upgrade Guide.

Vulnerability processing and scanning deployments

When you install and license QRadar Vulnerability Manager, a vulnerability
processor is automatically deployed on your QRadar console. A processor is not
automatically deployed if you use a software activation key on your QRadar
console.
The vulnerability processor provides a scanning component by default. If required,
you can deploy more scanners, either on dedicated QRadar Vulnerability Manager
managed host scanner appliances or QRadar managed hosts. For example, you can
deploy a vulnerability scanner on an Event Collector or QRadar QFlow Collector.
You cannot deploy a vulnerability scanner on a high availability managed host.
If required, you can move the vulnerability processor to a different managed host
in your deployment. You might move the processor to preserve disk space on your
QRadar console.
Restriction: You can have only one vulnerability processor in your deployment
and you can move the processor only to a dedicated QRadar Vulnerability
Manager managed host processor appliance. When you move the vulnerability
processor between the console and a managed host, the system enforces validation
checks in the deployment editor.
Important: After you change your vulnerability processor deployment, you must
wait for your deployment to fully configure. In the Scan Profiles page, the
following message is displayed: QVM is in the process of being deployed.
To configure your vulnerability processing and scanning components, you must
use the QRadar deployment editor, which is on the Admin tab.
Copyright IBM Corp. 2012, 2014

Ensure that following applications are installed on all desktop systems that you
use to access the QRadar product user interface:
v Java Runtime Environment (JRE) version 1.7 or IBM 64-bit Runtime
Environment for Java V7.0
v Adobe Flash version 10.x
For more information about the deployment editor, see the Administration Guide for
your product.
Related concepts:
Options for adding scanners to your QRadar Vulnerability Manager deployment
on page 7
If you have a large network and require flexible scanning options, you can add
more scanners to your IBM Security QRadar Vulnerability Manager deployment.
Options for moving the vulnerability processor in your QRadar Vulnerability
Manager deployment on page 5
If required, you can move the vulnerability processor from your QRadar console to
a dedicated QRadar Vulnerability Manager managed host appliance.

Vulnerability processor and scanner appliance activation keys

You can scan and process your vulnerabilities by using dedicated QRadar
Vulnerability Manager managed host appliances.
When you install a processor or scanner managed host appliance, you must type a
valid activation key.
For more information about installing a managed host appliance, see the
Installation Guide for your product.
The activation key is a 24-digit, four part, alphanumeric string that you receive
from IBM. The activation key specifies which software modules apply for each
appliance type:
v The QRadar Vulnerability Manager processor appliance includes vulnerability
processing and scanning components.
v The QRadar Vulnerability Manager scanner appliance includes only a
vulnerability scanning component.
You can obtain the activation key from the following locations:
v If you purchased a QRadar Vulnerability Manager software or virtual appliance
download, a list of activation keys are included in the Getting Started document
that is attached in a confirmation email. You can use this document to
cross-reference the part number for the appliance that you are supplied with.
v If you purchased an appliance that is preinstalled with QRadar Vulnerability
Manager software, the activation key is included in your shipping box or CD.

Vulnerability backup and recovery

You can back up and recover your vulnerability data including vulnerability
configurations. For example, you can back up scan profiles.
QRadar Vulnerability Manager back up and recovery is managed by using the
Admin tab.

QRadar Vulnerability Manager

For more information about vulnerability backup and recovery, see the
Administration Guide for your product.

Options for moving the vulnerability processor in your QRadar

Vulnerability Manager deployment
If required, you can move the vulnerability processor from your QRadar console to
a dedicated QRadar Vulnerability Manager managed host appliance.
For example, you might move your vulnerability processing capability to a
managed host to minimize disk space impact on your QRadar console.
Restriction: You can have only one vulnerability processor in your deployment.
Also, you must deploy the vulnerability processor only on a QRadar console or
QRadar Vulnerability Manager managed host processor appliance.
To move the vulnerability processor, choose one of the following options:

Option 1: Deploy a dedicated QRadar Vulnerability Manager

processor appliance
To deploy a processor appliance you must complete the followings tasks:
1. Install a dedicated QRadar Vulnerability Manager managed host processor
appliance. For more information, see the Installation Guide for your product.
2. Add the managed host processor appliance to your deployment by using the
deployment editor.
When you select the managed host option in the deployment editor, the
processor is automatically removed from the QRadar console.

Option 2: Move the vulnerability processor from your console to

your managed host
If the vulnerability processor is on your QRadar console, then later you can move
your vulnerability processor to a previously installed QRadar Vulnerability
Manager managed host processor appliance.
At any time, you can move the vulnerability processor back to your QRadar
console.

Deploying a dedicated QRadar Vulnerability Manager

processor appliance
You can deploy a dedicated QRadar Vulnerability Manager managed host
processor appliance.
When you deploy your vulnerability processor to a managed host, all
vulnerabilities are processed on the managed host.
Restriction: After you deploy processing to a dedicated QRadar Vulnerability
Manager managed host, any scan profiles or scan results that are associated with a
QRadar console processor are not displayed. You can continue to search and view
vulnerability data on the Manage Vulnerabilities pages.

Chapter 2. QRadar Vulnerability Manager installations and deployments

Before you begin

Ensure that a dedicated QRadar Vulnerability Manager managed host is installed
and a valid processor appliance activation key is applied. For more information,
see the Installation Guide for your product.

Procedure
1. Click the Admin tab.
2. On toolbar, click Deployment Editor.
3. From the menu, select Actions > Add a Managed Host.
In the managed host wizard, ensure that you select the IP address of the
QRadar Vulnerability Manager managed host processor appliance.
You must wait several minutes while the managed host is added.
4. In the Validation Error window, select the QRadar Vulnerability Manager
managed host processor and click OK.
5. Click Yes.
6. In the deployment editor menu, select File > Save and close.
7. On the Admin tab toolbar, select Advanced > Deploy Full Configuration.
8. Click OK.
Related concepts:
Vulnerability processor and scanner appliance activation keys on page 4
You can scan and process your vulnerabilities by using dedicated QRadar
Vulnerability Manager managed host appliances.
Related tasks:
Verifying that a vulnerability processor is deployed on page 7
In IBM Security QRadar Vulnerability Manager, you can verify that your
vulnerability processor is deployed on a QRadar console or QRadar Vulnerability
Manager managed host.

Moving your vulnerability processor to a managed host or

console
If required, you can move your vulnerability processor between a QRadar
Vulnerability Manager managed host appliance and your QRadar console.

Before you begin

Ensure that a dedicated QRadar Vulnerability Manager managed host is installed
and a valid processor appliance activation key is applied.

Procedure
1. Click the Admin tab.
2. On the toolbar, click Deployment Editor.
3. Click the Vulnerability View tab.
4. In the Vulnerability Components pane click QVM Processor.
5. Type a memorable name for the QVM Processor that you want to add, then
follow the instructions in the user interface and click Next.
6. In the Adding a new component window, ensure that you select the host for
the console or managed host appliance.
If your processor is on the managed host, you can select only the QRadar
console.

QRadar Vulnerability Manager

7. Click Finish and Yes.

8. In the deployment editor menu, select File > Save and close.
9. In the Validation Error window, select the processor on the console or
managed host.
If you select the processor on the console, then the vulnerability processor on
the managed host is automatically removed during the deployment.
You must wait several minutes while the deployment completes.
10. On the Admin tab toolbar, select Advanced > Deploy Full Configuration.
11. Click OK.
Related concepts:
Vulnerability processor and scanner appliance activation keys on page 4
You can scan and process your vulnerabilities by using dedicated QRadar
Vulnerability Manager managed host appliances.

Verifying that a vulnerability processor is deployed

In IBM Security QRadar Vulnerability Manager, you can verify that your
vulnerability processor is deployed on a QRadar console or QRadar Vulnerability
Manager managed host.

Procedure
1. Log in to the QRadar console.
2. On the Admin tab, click the Deployment Editor.
3. Select the Vulnerability View tab.
4. Verify that the QVM Processor is displayed in the Vulnerability View pane.

Removing a vulnerability processor from your console or

managed host
If required, you can remove the vulnerability processor from a QRadar console or
QRadar Vulnerability Manager managed host.

Procedure
1.
2.
3.
4.

Log in to the QRadar console.

On the Admin tab, click Deployment Editor.
Select the Vulnerability View tab.
Select the QVM Processor on the Vulnerability View pane.

5. In the Warning window, click Yes.

6. From the Deployment Editor menu, select Edit > Delete.
7. From the Deployment Editor menu, select File > Save and close.
8. On the Admin tab toolbar, select Advanced > Deploy Full Configuration.
9. Click OK.

Options for adding scanners to your QRadar Vulnerability Manager

deployment
If you have a large network and require flexible scanning options, you can add
more scanners to your IBM Security QRadar Vulnerability Manager deployment.
Your QRadar Vulnerability Manager processor is automatically deployed with a
scanning component. By deploying more scanners you can increase the flexibility
Chapter 2. QRadar Vulnerability Manager installations and deployments

of your scanning operations. For example, you can scan specific areas of your
network with different scanners and at different scheduled times.

Dynamic vulnerability scans

The vulnerability scanners that you deploy might not have access to all areas of
your network. In QRadar Vulnerability Manager you can assign different scanners
to network CIDR ranges. During a scan, each asset in the CIDR range that you
want to scan is dynamically associated with the correct scanner.
To add more vulnerability scanners, choose any of the following options:
Deploy a dedicated QRadar Vulnerability Manager managed host scanner
appliance
You can scan for vulnerabilities by using a dedicated QRadar Vulnerability
Manager managed host scanner appliance.
To deploy a scanner appliance, you must complete the followings tasks:
1. Install a dedicated QRadar Vulnerability Manager managed host
scanner appliance.
2. Add the managed host scanner appliance to your deployment by using
the deployment editor.
Deploy a QRadar Vulnerability Manager scanner to your QRadar console or
managed host
If you move your vulnerability processor from your QRadar console to a
QRadar Vulnerability Manager managed host, you can add a scanner to
your console.
You can also add a vulnerability scanner to any preexisting QRadar
managed hosts in your deployment. For example, you can add a scanner
to an event collector, flow collector, or event processor.
Restriction: You cannot add a vulnerability scanner to a high availability
managed host.
Configure access to an IBM hosted scanner and scan your DMZ
You can configure access to an IBM hosted scanner and scan the assets in
your DMZ.
Related concepts:
Dynamic vulnerability scans on page 46
In IBM Security QRadar Vulnerability Manager, you can configure a scan to use
certain vulnerability scanners for specific CIDR ranges in your network. For
example, your scanners might have access only to certain areas of your network.
Related tasks:
Associating vulnerability scanners with CIDR ranges on page 47
In IBM Security QRadar Vulnerability Manager, to do dynamic scanning, you must
associate vulnerability scanners with different segments of your network.
Scanning CIDR ranges with different vulnerability scanners on page 48
In IBM Security QRadar Vulnerability Manager, you can scan areas of your
network with different vulnerability scanners.

Deploying a dedicated QRadar Vulnerability Manager scanner

appliance
You can deploy a dedicated QRadar Vulnerability Manager managed host scanner
appliance.

QRadar Vulnerability Manager

Before you begin

Ensure that a dedicated QRadar Vulnerability Manager managed host scanner
appliance is installed and a valid appliance activation key is applied.

Procedure
1. Click the Admin tab.
2. On the toolbar, click Deployment Editor.
3. From the menu, select Actions > Add a managed host.
In the managed host wizard, ensure that you select the IP address of the
QRadar Vulnerability Manager managed host scanner appliance.
You must wait several minutes while the deployment saves.
4. At the Adding Managed Host dialog box, click OK.
5. From the deployment editor menu, select File > Save and close.
6. On the Admin tab toolbar, select Advanced > Deploy Full Configuration..
7. Click OK.
Related concepts:
Vulnerability processor and scanner appliance activation keys on page 4
You can scan and process your vulnerabilities by using dedicated QRadar
Vulnerability Manager managed host appliances.
Related tasks:
Verifying that a vulnerability scanner is added to your deployment on page 11
Use QRadar Vulnerability Manager to verify that a vulnerability scanner is added
to your deployment.

Deploying a vulnerability scanner to a QRadar console or

managed host
You can deploy a QRadar Vulnerability Manager scanner to a QRadar console or
managed host. For example, you can deploy a scanner to a flow collector, flow
processor, event collector, or event processor.

Before you begin

To deploy a scanner on your QRadar console, ensure that the vulnerability
processor is moved to a dedicated QRadar Vulnerability Manager managed host
appliance.
To deploy scanners on QRadar managed hosts, ensure that you have existing
managed hosts in your deployment. For more information, see the Installation
Guide for your product.

Procedure
1. On the Admin tab, click Deployment Editor.
2. Select the Vulnerability View tab.
3. On the Vulnerability Components pane, click QVM Scanner.
4. Type a unique name for the QVM Scanner that you want to add.
Restriction: The name can be up to 20 characters in length and can include
underscores or hyphens.
5. Click Next.
Chapter 2. QRadar Vulnerability Manager installations and deployments

6. From the Select a host list box, select the IP address of the QRadar managed
host or console.
Restriction: You cannot add a scanner to a QRadar console when the
vulnerability processor is on the console. You must move the vulnerability
processor to a QRadar Vulnerability Manager managed host.
7.
8.
9.
10.
11.

Click Next.
Click Finish.
From the deployment editor menu, select File > Save and close.
On the Admin tab toolbar, select Advanced > Deploy Full Configuration..
Click OK.

What to do next
Run an automatic update after you add the scanner or other managed host with
scanning capabilities. Alternatively, you can scan after the default daily scheduled
automatic update runs.
Related tasks:
Moving your vulnerability processor to a managed host or console on page 6
If required, you can move your vulnerability processor between a QRadar
Vulnerability Manager managed host appliance and your QRadar console.
Verifying that a vulnerability scanner is added to your deployment on page 11
Use QRadar Vulnerability Manager to verify that a vulnerability scanner is added
to your deployment.

Scanning the assets in your DMZ

In IBM Security QRadar Vulnerability Manager, you can connect to an external
scanner and scan the assets in your DMZ for vulnerabilities.
If you want to scan the assets in the DMZ for vulnerabilities, you do not need to
deploy a scanner in your DMZ. You must configure QRadar Vulnerability Manager
with a hosted IBM scanner that is located outside your network.
Detected vulnerabilities are processed by the processor on either your QRadar
console or QRadar Vulnerability Manager managed host.

Procedure
1. Configure your network and assets for external scans.
2. Configure QRadar Vulnerability Manager to scan your external assets.

Configuring your network and assets for external scans

To scan the assets in your DMZ, you must configure your network and inform
IBM of the assets that you want to scan.

Procedure
1. Configure outbound internet access on port 443.
2. Send the following information to QRadar-QVM-HostedScanner@hursley.ibm.com:
v Your organization's external IP address.
Restriction: The IP address must be configured before you can run external
scans.

10

QRadar Vulnerability Manager

v The IP address range of the assets in your DMZ.

Configuring QRadar Vulnerability Manager to scan your external

assets
To scan the assets in your DMZ you must configure QRadar Vulnerability
Manager, by using the deployment editor.

Procedure
1.
2.
3.
4.

On the Admin tab, click Deployment Editor.

Click the Vulnerability View tab.
In the Vulnerability Components pane, click External Scanner.
Type a unique name for the External Scanner that you want to add.

5. Click Next.
6. Type your external IP address and click Next.
Restriction: You cannot scan external assets until your external IP address is
configured. Ensure that you email details of your external IP address to IBM.
7. Optional: If your network is configured to use a proxy server, then type the
details of your server, then click Next.
8.
9.
10.
11.

Click Finish.
From the deployment editor menu, select File > Save and close.
On the Admin tab toolbar, select Advanced > Deploy Full Configuration.
Click OK.

Verifying that a vulnerability scanner is added to your

deployment
Use QRadar Vulnerability Manager to verify that a vulnerability scanner is added
to your deployment.

Procedure
1. Click the Vulnerabilities tab.
2. On the navigation menu, select Administrative > Scan Profiles.
3. On the toolbar, click Actions > Create.
4. In the Details tab, click the Scan Server list and ensure that your scanner is
displayed.
If the scanner is not listed, open the deployment editor and verify that you
added the scanner.

Supported web browsers

For the features in IBM Security QRadar products to work properly, you must use
a supported web browser.
When you access the QRadar system, you are prompted for a user name and a
password. The user name and password must be configured in advance by the
administrator.
The following table lists the supported versions of web browsers.

Chapter 2. QRadar Vulnerability Manager installations and deployments

11

Table 1. Supported web browsers for QRadar products

Web browser

Supported versions

Mozilla Firefox

17.0 Extended Support Release

24.0 Extended Support Release

32-bit Microsoft Internet Explorer, with

document mode and browser mode enabled

9.0

Google Chrome

The current version as of the release date of

IBM Security QRadar V7.2.4 products

10.0

Enabling document mode and browser mode in Internet Explorer

If you use Microsoft Internet Explorer to access IBM Security QRadar products,
you must enable browser mode and document mode.

Procedure
1. In your Internet Explorer web browser, press F12 to open the Developer Tools
window.
2. Click Browser Mode and select the version of your web browser.
3. Click Document Mode.
v For Internet Explorer V9.0, select Internet Explorer 9 standards.
v For Internet Explorer V10.0, select Internet Explorer 10 standards.

Supported web browsers

For the features in IBM Security QRadar products to work properly, you must use
a supported web browser.
When you access the QRadar system, you are prompted for a user name and a
password. The user name and password must be configured in advance by the
administrator.
The following table lists the supported versions of web browsers.
Table 2. Supported web browsers for QRadar products
Web browser

Supported versions

Mozilla Firefox

17.0 Extended Support Release

24.0 Extended Support Release

32-bit Microsoft Internet Explorer, with

document mode and browser mode enabled

9.0

Google Chrome

The current version as of the release date of

IBM Security QRadar V7.2.4 products

10.0

Enabling document mode and browser mode in Internet Explorer

If you use Microsoft Internet Explorer to access IBM Security QRadar products,
you must enable browser mode and document mode.

Procedure
1. In your Internet Explorer web browser, press F12 to open the Developer Tools
window.

12

QRadar Vulnerability Manager

2. Click Browser Mode and select the version of your web browser.
3. Click Document Mode.
v For Internet Explorer V9.0, select Internet Explorer 9 standards.
v For Internet Explorer V10.0, select Internet Explorer 10 standards.

Chapter 2. QRadar Vulnerability Manager installations and deployments

13

14

QRadar Vulnerability Manager

Chapter 3. IBM Security QRadar Vulnerability Manager

IBM Security QRadar Vulnerability Manager is a network scanning platform that
detects vulnerabilities within the applications, systems, and devices on your
network or within your DMZ.
QRadar Vulnerability Manager uses security intelligence to help you manage and
prioritize your network vulnerabilities. For example, you can use QRadar
Vulnerability Manager to continuously monitor vulnerabilities, improve resource
configuration, and identify software patches. You can also, prioritize security gaps
by correlating vulnerability data with network flows, log data, firewall, and
intrusion prevention system (IPS) data.
You can maintain real-time visibility of the vulnerabilities that are detected by the
built-in QRadar Vulnerability Manager scanner and other third-party scanners.
Third-party scanners are integrated with QRadar and include IBM Security
EndPoint Manager, Guardium, AppScan, Nessus, nCircle, and Rapid 7.
Unless otherwise noted, all references to QRadar Vulnerability Manager refer to
IBM Security QRadar Vulnerability Manager. All references to QRadar refer to IBM
Security QRadar SIEM and IBM Security QRadar Log Manager and all references
to SiteProtector refer to IBM Security SiteProtector.

Vulnerability scanning
In IBM Security QRadar Vulnerability Manager, vulnerability scanning is controlled
by configuring scan profiles. Each scan profile specifies the assets that you want to
scan and the scan schedule.

Vulnerability processor
When you license QRadar Vulnerability Manager, a vulnerability processor is
automatically deployed on your QRadar console. The processor contains a QRadar
Vulnerability Manager scanning component.

Deployment options
Vulnerability scanning can be deployed in different ways. For example, you can
deploy your scanning capability to a QRadar Vulnerability Manager managed host
scanner appliance or a QRadar managed host.

Configuration options
Administrators can configure scans in the following ways:
v Schedule scans to run at times convenient for your network assets.
v Specify the times during which scans are not allowed to run.
v Specify the assets that you want to exclude from scans, either globally or for
each scan.
v Configure authenticated patch scans for Linux, UNIX, or Windows operating
systems.

Copyright IBM Corp. 2012, 2014

15

v Configure different scanning protocols or specify the port ranges that you want
to scan.
Related concepts:
Options for adding scanners to your QRadar Vulnerability Manager deployment
on page 7
If you have a large network and require flexible scanning options, you can add
more scanners to your IBM Security QRadar Vulnerability Manager deployment.
Options for moving the vulnerability processor in your QRadar Vulnerability
Manager deployment on page 5
If required, you can move the vulnerability processor from your QRadar console to
a dedicated QRadar Vulnerability Manager managed host appliance.

Vulnerability management dashboard

You can display vulnerability information on your QRadar dashboard.
IBM Security QRadar Vulnerability Manager is distributed with a default
vulnerability dashboard so that you can quickly review the risk to your
organization.
You can create a new dashboard, manage your existing dashboards, and modify
the display settings of each vulnerability dashboard item.
For more information about dashboards, see the Users Guide for your product.

Reviewing vulnerability data on the default vulnerability

management dashboard
You can display default vulnerability management information on the QRadar
dashboard.
The default vulnerability management dashboard contains risk, vulnerability, and
scanning information.
You can configure your own dashboard to contain different elements like saved
searches.

Procedure
1. Click the Dashboard tab.
2. On the toolbar, in the Show Dashboard list, select Vulnerability Management.

Creating a customized vulnerability management dashboard

In QRadar you can create a vulnerability management dashboard that is
customized to your requirements.

Procedure
1.
2.
3.
4.
5.

16

Click the Dashboard tab.

On the toolbar, click New Dashboard.
Type a name and description for your vulnerability dashboard.
Click OK.
Optional: On the toolbar select Add Item > Vulnerability Management and
choose from the following options:

QRadar Vulnerability Manager

v If you want to show default saved searches on your dashboard, select

Vulnerability Searches.
v If you want to show website links to security and vulnerability information,
select Security News, Security Advisories, or Latest Published
Vulnerabilities.
v If you want show information that is about completed or running scans,
select Scans Completed or Scans In Progress.
Related tasks:
Saving your vulnerability search criteria on page 61
In IBM Security QRadar Vulnerability Manager, you can save your vulnerability
search criteria for future use.

Creating a dashboard for patch compliance

Create a dashboard that shows the most effective patch to use to remediate
vulnerabilities that are found on the network.

Procedure
1. Click the Dashboard tab.
2. On the toolbar, click New Dashboard.
3. Type a name and description for your vulnerability dashboard.
4. Click OK.
5. On the toolbar, select Add Item > Vulnerability Management > Vulnerability
Searches and choose the default saved search that you want to show on your
dashboard.
6. On the header of the new dashboard item, click the yellow Settings icon.
7. Select Patch from the Group By list and then select one of the following
options from the Graph By list:
v If you want to see how many assets need to a have the patch applied, select
Asset Count.
v If you want to see the cumulative risk score by patch, select Risk Score.
v If you want to see the number of vulnerabilities that are covered by a patch,
select Vulnerability Count.
8. Click Save.
9. To view vulnerability details on the Manage Vulnerabilities > By Vulnerability
page on the Vulnerabilities tab, click the View in By Vulnerability link at the
bottom of the dashboard item.

Chapter 3. IBM Security QRadar Vulnerability Manager

17

18

QRadar Vulnerability Manager

Chapter 4. Security software integrations

IBM Security QRadar Vulnerability Manager integrates with other security
products to help you manage and prioritize your security risks.

IBM Security QRadar Risk Manager and IBM Security QRadar

Vulnerability Manager integration
IBM Security QRadar Vulnerability Manager integrates with QRadar Risk Manager
to help you prioritize the risks and vulnerabilities in your network.
QRadar Risk Manager is installed as a managed host and added to your QRadar
SIEM console by using the deployment editor.
For more information about installing QRadar Risk Manager, see the IBM Security
QRadar Risk Manager Installation Guide.

Risk policies and vulnerability prioritization

You can integrate QRadar Vulnerability Manager with QRadar Risk Manager by
defining and monitoring asset or vulnerability risk policies.
When the risk policies that you define in QRadar Risk Manager either pass or fail,
then the vulnerability risk scores in QRadar Vulnerability Manager are adjusted.
The adjustment levels depend on the risk policies in your organization.
When the vulnerability risk scores are adjusted in QRadar Vulnerability Manager,
administrators can do the following tasks:
v Gain immediate visibility of the vulnerabilities that failed a risk policy.
For example, new information might be displayed on the QRadar dashboard or
sent by using email.
v Re-prioritize the vulnerabilities that require immediate attention.
For example, an administrator can use the Risk Score to quickly identify high
risk vulnerabilities.
If you apply risk policies at an asset level in QRadar Risk Manager, then all the
vulnerabilities on that asset have their risk scores adjusted.
For more information about creating and monitoring risk policies, see the IBM
Security QRadar Risk Manager User Guide.
Related tasks:
Prioritizing high risk vulnerabilities by applying risk policies on page 65
In IBM Security QRadar Vulnerability Manager, you can alert administrators to
higher risk vulnerabilities by applying risk policies to your vulnerabilities.

IBM Endpoint Manager integration

IBM Security QRadar Vulnerability Manager integrates with IBM Endpoint
Manager to help you filter and prioritize the vulnerabilities that can be fixed.

Copyright IBM Corp. 2012, 2014

19

Integration components
A typical QRadar Vulnerability Manager IBM Endpoint Manager integration
consists of the following components:
v An IBM Security QRadar console.
v A licensed installation of QRadar Vulnerability Manager.
v An IBM Endpoint Manager server installation.
v An IBM Endpoint Manager agent installation on each of the scan targets in your
network.

Vulnerability remediation
Depending on whether you installed and integrated IBM Endpoint Manager,
QRadar Vulnerability Manager provides different information to help you
remediate your vulnerabilities.
v If IBM Endpoint Manager is not installed, then QRadar Vulnerability Manager
provides information about vulnerabilities for which a fix is available.
QRadar Vulnerability Manager maintains a list of vulnerability fix information.
Fix information is correlated against the known vulnerability catalog.
Using the QRadar Vulnerability Manager search feature, you can identify
vulnerabilities that have an available fix.
v If IBM Endpoint Manager is installed, then QRadar Vulnerability Manager also
provides specific details about the vulnerability fix process. For example, a fix
might be scheduled or an asset might be already fixed.
The IBM Endpoint Manager server gathers fix information from each of the IBM
Endpoint Manager agents. Fix status information is transmitted to QRadar
Vulnerability Manager at pre-configured time intervals.
Using the QRadar Vulnerability Manager search feature, you can quickly identify
those vulnerabilities that are scheduled to be fixed or are already fixed.
Related tasks:
Identifying the patch status of your vulnerabilities on page 67
In IBM Security QRadar Vulnerability Manager, you can identify the patch status
of your vulnerabilities.

Configuring SSL for IBM Endpoint Manager integration

You can configure secure socket layer (SSL) encryption to integrate QRadar
Vulnerability Manager with IBM Endpoint Manager.

Procedure
1. To download the public key certificate, open your web browser and type
https://IP address/webreports.
Remember: The IP address is the IP address of your IBM Endpoint Manager
server.
2. Click Add Exception.
3.
4.
5.
6.
7.

20

In the Add Security Exception window, click View.

Click the Details tab and click Export.
In the File name field, type iemserver_cert.der
In the Save as type field, select X.509 Certificate (DER).
Click Save.

QRadar Vulnerability Manager

8. Copy the public key certificate to your QRadar console.

9. Optional: To create a QRadar Vulnerability Manager truststore.
a. Using SSH, log in to the IBM Security QRadar SIEM console as the root
user.
b. Type the following command:
keytool -keystore /opt/qvm/iem/truststore.jks -genkey -alias iem.
c. At the prompts, type the appropriate information to create the truststore.
10. To import the public key certificate to your truststore, type the following
command:
keytool -importcert -file iemserver_cert.der -keystore truststore.jks
-storepass <your truststore password> -alias iem_crt_der
11. At the Trust this certificate? prompt, type Yes.

Integrating IBM Security QRadar Vulnerability Manager with

IBM Endpoint Manager
You can integrate IBM Security QRadar Vulnerability Manager, with IBM Endpoint
Manager.

Before you begin

The following components must be installed on your network:
v An IBM Endpoint Manager server.
v An IBM Endpoint Manager agent on each asset in your network that you scan.
If you use secure socket layer (SSL) encryption, ensure that you configure secure
socket layer (SSL) for IBM Endpoint Manager integration.

Procedure
1. Using SSH, log in to the IBM Security QRadar SIEM console as the root user.
2. Change directory to following location:
/opt/qvm/iem
3. To configure the QRadar Vulnerability Manager IBM Endpoint Manager
adapter, type the following commands:
a. Type ./iem-setup-webreports.pl
b. Type the IP address of the IBM Endpoint Manager server.
c. Type the User name of the IBM Endpoint Manager server.
d. Type the Password of the IBM Endpoint Manager server.
4. Optional: At the Use SSL encryption? prompt, type the appropriate response.
Important: If you type Yes, then ensure that the prerequisite conditions are
met.
5. Type the location of your truststore.
6. Type your truststore password.

IBM Security SiteProtector integration

QRadar Vulnerability Manager integrates with IBM Security SiteProtector to help
direct intrusion prevention system (IPS) policy.

Chapter 4. Security software integrations

21

When you configure SiteProtector, the vulnerabilities that are detected by scans are
automatically forwarded to SiteProtector.
SiteProtector receives vulnerability data from QRadar Vulnerability Manager scans
that are performed only after the integration is configured.

Connecting to IBM Security SiteProtector

You can forward vulnerability data to IBM Security SiteProtector to help direct
intrusion prevention system (IPS) policy.

Procedure
On the Admin tab, click Deployment Editor.
Select the Vulnerability View tab.
On the Vulnerability Components pane, click SiteProtector Adapter.
Type a unique name for the SiteProtector Adapter that you want to add and
click Next.
The name can be up to 20 characters in length and can include underscores or
hyphens.
5. Type the IP address of the IBM Security SiteProtector agent manager server.
6. Click Next.
7. Click Finish.
1.
2.
3.
4.

8. From the deployment editor menu, select File > Save and close.
9. On the Admin tab toolbar, select Advanced > Deploy Full Configuration.
10. Click OK.

What to do next
Scan your network assets to determine if the vulnerability data is displayed in
your SiteProtector installation.

22

QRadar Vulnerability Manager

Chapter 5. Vulnerability scanning

In IBM Security QRadar Vulnerability Manager, all network scanning is controlled
by the scan profiles that you create. You can create multiple scan profiles and
configure each profile differently depending on the specific requirements of your
network.

Scan profiles
Use scan profiles to do the following tasks:
v Specify the network nodes, domains, or virtual domains that you want to scan.
v Specify the network assets that you want to exclude from scans.
v Create operational windows, which define the times at which scans can run.
v Manually run scan profiles or schedule a scan to run at a future date.
v Use centralized credentials to run Windows, UNIX, or Linux operating systems.
v Scan the assets from a saved asset search.
Related concepts:
Centralized credential sets on page 35
When you run authenticated scans, you can use a central list that stores the login
credentials for your Linux, UNIX, or Windows operating systems. Your system
administrator must configure the list of credentials.

Creating a scan profile

In IBM Security QRadar Vulnerability Manager, you configure scan profiles to
specify how and when your network assets are scanned for vulnerabilities.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Administrative > Scan Profiles.
3. On the toolbar, click Actions > Create.
4. In the Details tab of the Scan Profile Configuration page, enter a name for the
scan profile in the Name field.
5. Enter the IP address, IP range, or CIDR range of the assets you want to scan
in the IP Addresses field and click >.
To create a scan profile, the only mandatory fields are the Name and IP
Addresses fields.
6. If you added more scanners to your QRadar Vulnerability Manager
deployment, select a different scanner from the Scan Server list.
7. To scan your network by using a predefined set of scanning criteria, select a
scan type from the Scan Policies list.
8. To specify which scanner to use for each CIDR range, click the Dynamic
server selection check box.
9. If you configured centralized credentials for assets, click the Use Centralized
Credentials check box. For more information, see the IBM Security QRadar
Administration Guide.
10. Click Save.
Related concepts:
Copyright IBM Corp. 2012, 2014

23

Options for adding scanners to your QRadar Vulnerability Manager deployment

on page 7
If you have a large network and require flexible scanning options, you can add
more scanners to your IBM Security QRadar Vulnerability Manager deployment.
Scan policies on page 48
In IBM Security QRadar Vulnerability Manager, a scan policy is associated with a
scan profile and is used to control a vulnerability scan. For example, you can
configure the scanning protocol, scanned ports, or the scan tools that are used
during a scan.
Dynamic vulnerability scans on page 46
In IBM Security QRadar Vulnerability Manager, you can configure a scan to use
certain vulnerability scanners for specific CIDR ranges in your network. For
example, your scanners might have access only to certain areas of your network.
Related tasks:
Associating vulnerability scanners with CIDR ranges on page 47
In IBM Security QRadar Vulnerability Manager, to do dynamic scanning, you must
associate vulnerability scanners with different segments of your network.
Configuring a scan policy to manage your vulnerability scans on page 49
In IBM Security QRadar Vulnerability Manager, you can configure a scan policy
and use the scan policy to control your vulnerability scans.

Creating an external scanner scan profile

In IBM Security QRadar Vulnerability Manager, you can configure scan profiles to
use an IBM hosted scanner to scan assets in your DMZ.

Before you begin

QRadar Vulnerability Manager must be configured with an IBM hosted scanner.
For more information, see Scanning the assets in your DMZ on page 10.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Administrative > Scan Profiles.
3. On the toolbar, click Actions > Create.
4. In the Details tab of the Scan Profile Configuration page, enter a name for the
Scan Profile in the Name field.
To create a scan profile, the only mandatory fields are the Name and IP
Addresses fields.
5.
6.
7.
8.

Select an external scanner from the Scan Server list.

Select Full Scan or Web Scan from the Scan Policies list.
In the IP Addresses field, enter the IP address, IP range, or CIDR range to scan.
Click the Domain and Web App tab. In the Virtual Webs pane, enter the
domain and IP address information for the websites and applications that you
want to scan.

9. Click Save.

Creating a benchmark profile

To create CIS compliance scans, you must configure benchmark profiles. You use
CIS compliance scans to test for Windows and Red Hat Enterprise Linux CIS
benchmark compliance.

24

QRadar Vulnerability Manager

Procedure
Click the Vulnerabilities tab.
In the navigation pane, click Administrative > Scan Profiles.
On the toolbar, click Actions > Create Benchmark Profile.
In the Details tab of the Benchmark Profile Configuration page, enter a name
for the scan profile in the Name field.
To create a scan profile, the only mandatory field in the Details tab is the
Name field.
5. If you want to use pre-defined centralized credentials, select the Use
Centralized Credentials check box.
Credentials that are used to scan Linux systems must have root privileges.
Credentials that are used to scan Windows systems must have administrator
privileges.
1.
2.
3.
4.

6. Select the QRadar Vulnerability Manager scanner from the Scan Server list.
7. In the When To Scan tab, set the run schedule, scan start time, and any
pre-defined operational windows.
8. In the Email tab, define what information to send about this scan and to
whom to send it.
9. If you are not using centralized credentials, add the credentials that the scan
requires in the Additional Credentials tab.
Credentials that are used to scan Linux systems must have root privileges.
Credentials that are used to scan Windows systems must have administrator
privileges.
10. Click Save.
Related concepts:
Centralized credential sets on page 35
When you run authenticated scans, you can use a central list that stores the login
credentials for your Linux, UNIX, or Windows operating systems. Your system
administrator must configure the list of credentials.

Running a scan profile manually

In IBM Security QRadar Vulnerability Manager you can run a scan profile
manually.
You can also schedule scans to run at a future date and time. For more
information, see Scan scheduling on page 27.

Before you begin

Ensure that a vulnerability processor is deployed. For more information, see
Verifying that a vulnerability processor is deployed on page 7.

Procedure
1.
2.
3.
4.

Click the Vulnerabilities tab.

In the navigation pane, select Administrative > Scan Profiles.
On the Scan Profiles page, click the scan profile that you want to run.
On the toolbar, select Actions > Run Now.
By default, scans complete a fast scan by using the Transmission Control
Protocol (TCP) and User Datagram Protocol (UDP) protocol. A fast scan
includes most ports in the range 1 - 1024.
Chapter 5. Vulnerability scanning

25

Related tasks:
Managing scan results on page 52
In IBM Security QRadar Vulnerability Manager, on the Scan Results page, you can
manage your scan results and manage the scans that are running.

Rescanning an asset by using the right-click function

In IBM Security QRadar Vulnerability Manager you can quickly rescan an asset by
using the right-click option.
The right-click scan option is available in other areas of the product where assets
are displayed. For example, on the QRadar Offenses tab, or the QRadar Risk
Manager sub-net asset view.
Fast path: By using the right-click scan you can avoid using the Scan Profiles page.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Manage Vulnerabilities > By Asset.
3. On the By Asset page, identify the asset that you want to rescan.
4. Right-click the IP Address and select Run QVM Scan.
5. In the Run QVM Scan window, select the scan profile that you want use when
the asset is rescanned.
The scanning process requires a scan profile. The scan profile determines the
scanning configuration options that are used when the scan runs.
Important: The scan profile that you select might be associated with multiple
scan targets or IP address ranges. However, when you use the right-click
option, only the asset that you select is scanned.
6. Click Scan Now.
7. Click Close Window.
8. To review the progress of your right-click scan, in the navigation pane, click
Scan Results.
Right-click scans are identified by the prefix RC:.
Related concepts:
Asset vulnerabilities on page 62
In IBM Security QRadar Vulnerability Manager, you can display summary
vulnerability data that is grouped by each scanned asset.

Scan profile details

In IBM Security QRadar Vulnerability Manager you can describe your scan, select
the scanner that you want to use, and choose from a number of scan policy
options.
Scan profile details are specified in the Scan Profile Details pane, in the Scan
Profile Configuration page.
You can configure the following options:

26

QRadar Vulnerability Manager

Table 3. Scan profile details configuration options

Options

Description

Active

Specifies whether you want to run the scan automatically at a

scheduled time in the future. By default this check box is selected.

Update asset
model

Specifies whether you want to send your scan results to the QRadar
asset model. When you configure a scan profile, this check box is
selected by default.
For more information about Assets and the QRadar asset model, see the
Users Guide for your product.

Scan Server

The scanner that is used to run the scan profile. The scanner that you
select depends on your network configuration. For example, to scan
DMZ assets, then select a scanner that has access to that area of your
network.
The Controller scan server corresponds to the scanner that is deployed
with the vulnerability processor on your QRadar console or QRadar
Vulnerability Manager managed host.
Restriction: You can have only one vulnerability processor in your
deployment. However, you can deploy multiple scanners either on
dedicated QRadar Vulnerability Manager managed host scanner
appliances or QRadar managed hosts.

Dynamic server
selection

Specifies whether you want to use a separate vulnerability scanner for

each CIDR range that you scan.
You can associate multiple CIDR ranges with separate vulnerability
scanners. During a scan, QRadar Vulnerability Manager automatically
distributes the scanning activity to the correct scanner for each CIDR
range that you specify.

Bandwidth Limit The scanning bandwidth. The default setting is medium.

Important: If you select a value greater than 1000 kbps, you can affect
network performance.
Scan Policies

The pre-configured scanning criteria about ports and protocols. For

more information, see Scan policies on page 48.

Related concepts:
Dynamic vulnerability scans on page 46
In IBM Security QRadar Vulnerability Manager, you can configure a scan to use
certain vulnerability scanners for specific CIDR ranges in your network. For
example, your scanners might have access only to certain areas of your network.
Scan policies on page 48
In IBM Security QRadar Vulnerability Manager, a scan policy is associated with a
scan profile and is used to control a vulnerability scan. For example, you can
configure the scanning protocol, scanned ports, or the scan tools that are used
during a scan.

Scan scheduling
In IBM Security QRadar Vulnerability Manager, you can schedule the dates and
times that it is convenient to scan your network assets for known vulnerabilities.
Scan scheduling is controlled by using the When To Scan pane, in the Scan Profile
Configuration page.

Chapter 5. Vulnerability scanning

27

A scan profile that is configured with a manual setting must be run manually.
However, scan profiles that are not configured as manual scans, can also be run
manually.
When you select a scan schedule, you can further refine your schedule by
configuring a permitted scan interval.
Related tasks:
Configuring a permitted scan interval on page 45
In IBM Security QRadar Vulnerability Manager, you can create an operational
window to specify the times that a scan can run.
Reviewing your scheduled scans in calendar format on page 29
In IBM Security QRadar Vulnerability Manager, the scheduled scan calendar
provides a central location where you can review information about scheduled
scans.

Scanning domains monthly

In IBM Security QRadar Vulnerability Manager, you can configure a scan profile to
scan the domains on your network each month.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Administrative > Scan Profiles.
3. On the toolbar, select Actions > Create.
4. In the Details tab of the Scan Profile Configuration page, enter a name for the
scan profile in the Name field.
5. Click the When To Scan tab.
6. From the Run Schedule list, select Monthly.
7. In the Start Time field, select a start date and time for your scan.
8. In the Day of the month field, select a day each month that your scan runs.
9. Click the Domain and Web App tab.
10. In the Domain field, type the URL of the asset that you want to scan and click
>.
11. Click Save.
12. Optional: During and after the scan, you can monitor scan progress and
review completed scans.

Scheduling scans of new unscanned assets

In IBM Security QRadar Vulnerability Manager, you can configure scheduled scans
of newly discovered, unscanned network assets.

Procedure
1. Click the Assets tab.
2. In the navigation pane, click Asset Profiles, then on the toolbar click Search >
New Search.
3. To specify your newly discovered, unscanned assets, complete the following
steps in the Search Parameters pane:
a. Select Days Since Asset Found, Less than 2 then click Add Filter.
b. Select Days Since Asset Scanned Greater than 2 then click Add Filter.
c. Click Search.

28

QRadar Vulnerability Manager

4. On the toolbar, click Save Criteria and complete the following steps:
a. In the Enter the name of this search field, type the name of your asset
search.
b. Click Include in my Quick Searches.
c. Click Share with Everyone.
d. Click OK.
5. Click the Vulnerabilities tab.
6. In the navigation pane, select Administrative > Scan Profiles.
7. On the toolbar, select Actions > Create.
8. In the Details tab, type a name for your scan profile in the Name field.
Restriction: The profile name must be greater than 4 characters.
9. Select your saved asset search from the Asset Saved Searches list.
When you include a saved asset search in your scan profile, the assets and IP
addresses associated with the saved search are scanned.
10. Click the When To Scan tab and in the Run Schedule list, select Weekly.
11. In the Start Time fields, type or select the date and time that you want your
scan to run on each selected day of the week.
12. Select the check boxes for the days of the week that you want your scan to
run.
13. Click Save.
For more information about using the Assets tab and saving asset searches,
see the Users Guide for your product.
Related tasks:
Searching vulnerability data on page 58
In IBM Security QRadar Vulnerability Manager, you can identify important
vulnerabilities by searching your vulnerability data.

Reviewing your scheduled scans in calendar format

In IBM Security QRadar Vulnerability Manager, the scheduled scan calendar
provides a central location where you can review information about scheduled
scans.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Administrative > Scheduled Scans.
3. Optional: Hover your mouse on the scheduled scan to display information
about the scheduled scan.
For example, you can show the time that a scan took to complete.
4. Optional: Double-click a scheduled scan to edit the scan profile.

Network scan targets and exclusions

In IBM Security QRadar Vulnerability Manager, you can provide information about
the assets, domains, or virtual webs on your network that you want to scan.
Use the What To Scan pane on the Scan Profile Configuration page to specify the
network assets that you want to scan.

Chapter 5. Vulnerability scanning

29

You can exclude a specific host or range of hosts that must never be scanned. For
example, you might restrict a scan from running on critical servers that are hosting
your production applications. You might also want to configure your scan to target
only specific areas of your network.
QRadar Vulnerability Manager integrates with QRadar by providing the option to
scan the assets that form part of a saved asset search. For more information, see
Scheduling scans of new unscanned assets on page 28.

Include network nodes

You can specify your scan targets by defining a CIDR range, IP address, IP address
range, or a combination of all 3.
For more information about scanning assets, see Scanning CIDR ranges with
different vulnerability scanners on page 48.

Domain scanning
You can add domains to your scan profile to test for DNS zone transfers on each of
the domains that you specify.
A host can use the DNS zone transfer to request and receive a full zone transfer for
a domain. Zone transfer is a security issue because DNS data is used to decipher
the topology of your network. The data that is contained in a DNS zone transfer is
sensitive and therefore any exposure of the data might be perceived as a
vulnerability. The information that is obtained might be used for malicious
exploitation such as DNS poisoning or spoofing.
For more information about configuring a Domain Scan, see Scanning domains
monthly on page 28

Scans that used saved asset searches

You can scan the assets and IP addresses that are associated with a QRadar saved
asset search.
Using the Assets tab, any saved searches are displayed in the Include Saved
Searches section of the What To Scan pane.
For more information about configuring a scan profile with a saved asset search,
see Scheduling scans of new unscanned assets on page 28
For more information about saving an asset search, see the Users Guide for your
product.

Exclude network scan targets

In the Exclude network nodes pane, you can specify the assets that must not be
scanned. For example, if you want to avoid scanning a highly loaded, unstable, or
sensitive server, exclude these assets.
When you configure a scan exclusion in a scan profile configuration, the exclusion
applies only to the scan profile.
For more information, see Excluding assets from all scans on page 31.

30

QRadar Vulnerability Manager

Virtual webs
You can configure a scan profile to scan different URLs that are hosted on the same
IP address.
When you scan a virtual web, QRadar Vulnerability Manager checks each web
page for SQL injection and cross site scripting vulnerabilities.

Excluding assets from all scans

In IBM Security QRadar Vulnerability Manager, scan exclusions specify the assets
in your network that are not scanned.
Scan exclusions apply to all scan profile configurations and might be used to
exclude scanning activity from unstable or sensitive servers.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Administrative > Scan Exclusions.
3. On the toolbar, select Actions > Add.
4. In the IP/IP Range field, type the IP address or range of IP addresses that you
want to exclude from all scanning.
Restriction: You cannot type the IP address of an asset that is already excluded
from scanning
5. In the Description field, type information about the scan exclusion.
Provide a description that it is identifiable in the future. The description must
contain at least 5 characters.

Managing scan exclusions

In IBM Security QRadar Vulnerability Manager you can update, delete, or print
scan exclusions.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Administrative > Scan Exclusions.
3. From the list on the Scan Exclusions page, click the Scan Exclusion that you
want to modify.
4. On the toolbar, select an option from the Actions menu.
5. Depending on your selection, follow the on-screen instructions to complete this
task.

Scan protocols and ports

In IBM Security QRadar Vulnerability Manager, you can choose different scan
protocols and scan various port ranges.
Use the How To Scan pane on the Scan Profile Configuration page to specify
scanning protocols and the ports that you want to scan.
You can configure your scan profile port protocols by using the following options:

Chapter 5. Vulnerability scanning

31

Table 4. scan protocol and port options

Protocol

Description

TCP and UDP

The default scan protocol that scans common ports in the range 1 1024.
Remember: Compared with other scanning protocols, TCP and UDP
might generate more network activity.

TCP

The most common scanning protocol. When TCP scanning is

combined with IP range scanning, you can locate a host that is
running services that are prone to vulnerabilities. The default port
range is 1 - 65535.

SYN

Sends a packet to all specified ports. If the target is listening, it

responds with a SYN and Acknowledgement (ACK). If the target is
not listening, it responds with an RST (reset). Normally, the
destination port is closed and an RST is returned. The default port
range is 1 - 65535.

ACK

Similar to SYN, but in this case an ACK flag is set. The ACK scan
does not determine whether the port is open or closed, but tests if the
port is filtered or unfiltered. Testing the port is useful when you probe
for the existence of a firewall and its rule sets. Simple packet filtering
enables established connections (packets with the ACK bit set),
whereas a more sophisticated stateful firewall might not. The default
port range is 1-65535.

FIN

A TCP packet that is used to terminate a connection, or it can be used

as a method to identify open ports. FIN sends erroneous packets to a
port and expects open listening ports to send back different error
messages than closed ports. The scanner sends a FIN packet, which
might close a connection that is open. Closed ports reply to a FIN
packet with an RST. Open ports ignore the packet in question. The
default port range is 1 - 65535.

Scanning a full port range

In IBM Security QRadar Vulnerability Manager, you can scan the full port range on
the assets that you specify.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Administrative > Scan Profiles.
3. On the toolbar, select Actions > Create.
4. In the Details tab of the Scan Profile Configuration page, enter a name for the
scan profile in the Name field.
Restriction: The profile name must be greater than 4 characters.
5. Enter the CIDR range of the assets you want to scan in the IP Addresses field
and click >
To create a scan profile, the only mandatory fields are the Name and IP
Addresses fields.
6. Click the How To Scan tab.
7. In the Protocol field, accept the default values of TCP & UDP.
8. In the Range field, type 1-65535.

32

QRadar Vulnerability Manager

Restriction: Port ranges must be configured in dash-separated,

comma-delimited, consecutive, ascending, and non-overlapping order.
Multiple port ranges must be separated by a comma. For example, the
following examples show the delimiters that are used to enter port
ranges:(1-1024, 1055, 2000-65535).
9. In the Timeout (m) field, type the time in minutes after which you want the
scan to cancel if no scan results are discovered.
Important: You can type any value in the range 1 - 500. Ensure that you do
not enter too short a time, otherwise the port scan cannot detect all running
ports. Scan results that are discovered before the timeout period are displayed.
10. Click Add.
11. Click Save.
12. In the Scan Profiles page, on the toolbar select Actions > Run Now.

Scanning assets with open ports

In IBM Security QRadar Vulnerability Manager, you can configure a scan profile to
scan assets with open ports.

Procedure
1. Click the Assets tab.
2. In the navigation pane, click Asset Profiles then on the toolbar, click Search >
New Search.
3. To specify assets with open ports, configure the following options in the
Search Parameters pane:
a. Select Assets With Open Port, Equals any of 80, and click Add Filter.
b. Select Assets With Open Port, Equals any of 8080, and click Add Filter.
c. Click Search.
4. On the toolbar, click Save Criteria and configure the following options:
a. In the Enter the name of this search field, type the name of your asset
search.
b. Click Include in my Quick Searches.
c. Click Share with Everyone and click OK.
5. Click the Vulnerabilities tab.
6. In the navigation pane, select Administrative > Scan Profiles.
7. On the toolbar, select Actions > Create.
8. In the Details tab, type a name for your scan profile in the Name field.
Restriction: The profile name must be greater than 4 characters.
9. Select your saved asset search from the Asset Saved Searches list.
When you include a saved asset search in your scan profile, the assets and IP
addresses associated with the saved search are scanned.
10. Click the When To Scan tab and select Manual from the Run Schedule list.
11. Click Save.
For more information about saving an asset search, see the Users Guide for
your product.

What to do next
Perform the steps in the procedure, Running a scan profile manually on page 25.
Chapter 5. Vulnerability scanning

33

Authenticated patch scans

In IBM Security QRadar Vulnerability Manager, you can scan for community
names and run authenticated patch scans for Windows, Linux, and UNIX
operating systems.

SNMP community names

You can scan your network assets by using SNMP community names.
When you scan assets, QRadar Vulnerability Manager authenticates by using the
SNMP services that are found and completes a more detailed vulnerability scan.

Windows patch scans

To scan Windows operating systems for missing patches, remote registry access
and Windows management interface (WMI) must be enabled. If your Windows
patch scan returns WMI connectivity issues, you must configure your windows
systems.
To read WMI data on a remote server, you must enable the connections between
your QRadar console and the server that you are monitoring. If the server is using
a Windows firewall, then you must configure the system to enable remote WMI
requests.
If you are use a non-administrator account to monitor the Windows server, then
you must enable the account to interact with Distributed Component Object Model
(DCOM).
If the patch scan tool cannot connect to a Windows asset, a yellow triangular
warning icon is displayed next to the asset in the scan results. The following
vulnerability is raised: Local Checks Error.
For more information, see: Configuring patch scanning permissions in QRadar
Vulnerability Manager.

Secure Linux operating system authenticated scanning

To scan Linux operating systems by using secure authentication, you can configure
public key encryption between your console or managed host and your scan
targets.
When secure authentication is configured, you do not need to specify a Linux
operating system password in your scan profile.
You must configure public key authentication on every Linux operating system
that you want to scan.
If you move your vulnerability processor to a dedicated vulnerability processor
appliance, you must reconfigure the secure authentication between the dedicated
vulnerability processor appliance and the scan target.
If the patch scan tool cannot connect to a Linux asset, a yellow triangular warning
icon is displayed next to the asset in the scan results. The following vulnerability is
raised: SSH Patch Scanning - Failed Logon.

34

QRadar Vulnerability Manager

For more information, see: Configuring patch scanning permissions in QRadar

Vulnerability Manager.
Related tasks:
Configuring Linux operating system public key authentication on page 36
To scan Linux operating systems using secure public key authentication, you must
configure your IBM Security QRadar console or managed host and the asset that
you want to scan. When authentication is configured you can do authenticated
scanning by specifying a Linux operating system username, and not specifying a
password. QRadar supports both rsa and dsa for ssh-keygen.
Configuring an authenticated scan of the Linux or UNIX operating systems on
page 37
In IBM Security QRadar Vulnerability Manager, you can configure an
authentication scan of the Linux or UNIX operating systems that are on your
network. You can manually specify the credentials in the scan profile or use a
credential set.

Centralized credential sets

When you run authenticated scans, you can use a central list that stores the login
credentials for your Linux, UNIX, or Windows operating systems. Your system
administrator must configure the list of credentials.
An administrator can specify credentials for SNMP network devices and Linux,
UNIX, or Windows operating systems. Therefore, a user who is responsible for
configuring a scan profile does not need to know the credentials of each asset that
is scanned. Also, if the credentials of an asset change, the credentials can be
modified centrally rather than updating the scan profile.
Related tasks:
Configuring an authenticated scan of the Linux or UNIX operating systems on
page 37
In IBM Security QRadar Vulnerability Manager, you can configure an
authentication scan of the Linux or UNIX operating systems that are on your
network. You can manually specify the credentials in the scan profile or use a
credential set.
Configuring an authenticated scan of the Windows operating system on page 39
In IBM Security QRadar Vulnerability Manager, you can configure a scan of the
Windows operating systems that are installed on your network. You can manually
specify the credentials in the scan profile or use a credential set.
Creating a benchmark profile on page 24
To create CIS compliance scans, you must configure benchmark profiles. You use
CIS compliance scans to test for Windows and Red Hat Enterprise Linux CIS
benchmark compliance.

Configuring a credential set

In IBM Security QRadar Vulnerability Manager, you can create a credential set for
the assets in your network. During a scan, if a scan tool requires the credentials for
a Linux, UNIX, or Windows operating system, the credentials are automatically
passed to the scan tool from the credential set.

Procedure
1. Click the Admin tab.
2. In the System Configuration pane, click Centralized Credentials.
3. In the Centralized Credentials window, on the toolbar, click Add.

Chapter 5. Vulnerability scanning

35

To configure a credential set, the only mandatory field in the Credential Set
window is the Name field.
4. In the Credential Set window, click the Assets tab.
5. Type a CIDR range for the assets that you want to specify credentials for and
click Add.
6. Optional: Click the Linux/Unix, Windows, or Network Devices (SNMP) tabs,
then type your credentials.
7. Click Save.

Configuring Linux operating system public key authentication

To scan Linux operating systems using secure public key authentication, you must
configure your IBM Security QRadar console or managed host and the asset that
you want to scan. When authentication is configured you can do authenticated
scanning by specifying a Linux operating system username, and not specifying a
password. QRadar supports both rsa and dsa for ssh-keygen.

Before you begin

You must configure your public key on the device where your vulnerability
processor is installed. For more information, see Verifying that a vulnerability
processor is deployed on page 7.

Procedure
1. Using SSH, log in to the QRadar console or managed host as the root user.
2. Generate a public DSA key pair by typing the following command:
su -m -c 'ssh-keygen -t dsa' qvmuser
3. Accept the default file by pressing Enter or type a file name.
4. Type a passphrase for the DSA key or accept the default by pressing the Enter
key.
5. Copy the public key to the scan target by typing the following command:
ssh-copy-id -i ~/.ssh/id_dsa.pub root@<IP address>
Where <IP address> is the scan target.
6. Type the password for the scan target.
7. To test that the encryption key is correctly configured, you can start an SSH
session with the scan target.
If the public key is correctly configured, you can SSH to the scan target without
typing a password.
Related tasks:
Configuring an authenticated scan of the Linux or UNIX operating systems on
page 37
In IBM Security QRadar Vulnerability Manager, you can configure an
authentication scan of the Linux or UNIX operating systems that are on your
network. You can manually specify the credentials in the scan profile or use a
credential set.

36

QRadar Vulnerability Manager

Configuring an authenticated scan of the Linux or UNIX

operating systems
In IBM Security QRadar Vulnerability Manager, you can configure an
authentication scan of the Linux or UNIX operating systems that are on your
network. You can manually specify the credentials in the scan profile or use a
credential set.

Before you begin

To scan by using a credential list, you must first define a central list of the
credentials that are required by your operating systems. For more information, see
Configuring a credential set on page 35.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Administrative > Scan Profiles.
3. On the toolbar, select Actions > Create.
4. In the Details tab of the Scan Profile Configuration page, enter a name for the
scan profile in the Name field.
5. Enter the IP address, IP range, or CIDR range of the assets you want to scan
in the IP Addresses field and click >.
To create a scan profile, the only mandatory fields are the Name and IP
Addresses fields.
6. Optional: Click Use Centralized Credentials to scan your Linux or UNIX
operating systems.
If a credential set is not configured and you do not manually specify the
credentials, the scan tools run but no credentials are passed in.
If a credential set exists for the hosts that you are scanning, any credentials
that you manually specify in the Scan Setup pane, override your credential
set.
7. Click the When To Scan tab.
8. In the Run Schedule list, select Manual.
9. Click the Additional Credentials tab.
10. In the Linux/Unix Patch Scanning area, type the user name and password for
the Linux or UNIX hosts that you want to scan.
You do not require a password if you configured secure public key
authentication between your console and your scan target.
11. Click Save.
12. In the Scan Profiles page, on the toolbar select Actions > Run Now.
Related concepts:
Centralized credential sets on page 35
When you run authenticated scans, you can use a central list that stores the login
credentials for your Linux, UNIX, or Windows operating systems. Your system
administrator must configure the list of credentials.
Related tasks:
Configuring a credential set on page 35
In IBM Security QRadar Vulnerability Manager, you can create a credential set for
the assets in your network. During a scan, if a scan tool requires the credentials for
a Linux, UNIX, or Windows operating system, the credentials are automatically
passed to the scan tool from the credential set.
Chapter 5. Vulnerability scanning

37

Configuring Linux operating system public key authentication on page 36

To scan Linux operating systems using secure public key authentication, you must
configure your IBM Security QRadar console or managed host and the asset that
you want to scan. When authentication is configured you can do authenticated
scanning by specifying a Linux operating system username, and not specifying a
password. QRadar supports both rsa and dsa for ssh-keygen.

Enabling permissions for Linux or UNIX patch scans

Non-root user accounts must have the permissions to run the commands that
QRadar Vulnerability Manager requires to scan for patches on Linux and UNIX
computers.

About this task

To assign the relevant permissions for Linux or UNIX patch scanning, use the
following procedure:

Procedure
1. SSH to the asset.
2. Run the following uname commands:
uname
uname
uname
uname
uname
uname
uname

-m
-n
-s
-r
-v
-p
-a

3. Depending on your operating system, run the following commands:

Operating
System
Linux

Commands
Read the contents of the following files that are relevant for your
distribution:
v

/etc/redhat-release

/etc/SuSE-release

/etc/debian-version

/etc/slackware-version

/etc/mandrake-version

/etc/gentoo-version

For example, on Red Hat Enterprise Linux, use the commands:

ls /etc/redhat-releasecat
/etc/redhat-release
rpm -qa --qf %{NAME}--%{VERSION}---%{RELEASE}
\|%{EPOCH}--%{ARCH}---%{FILENAMES}--%{SIGPGP}---%{SIGGPG}\n
rpm -qa --qf %{NAME}-%{VERSION}-%{RELEASE}|%{EPOCH}\n
Solaris

38

QRadar Vulnerability Manager

/usr/bin/svcs -a
/usr/bin/pkginfo -x \| awk { if ( NR % 2 ) { prev = \$1 }
else { print prev\" \"\$0 } }
/usr/bin/showrev -p
/usr/sbin/patchadd -p
/usr/bin/isainfo -b
/usr/bin/isainfo -k
/usr/bin/isainfo -n
/usr/bin/isainfo -v

Operating
System

Commands

HP-UX

/usr/sbin/swlist -l fileset -a revision

/usr/sbin/swlist -l patch

AIX

oslevel -r
lslpp -Lc

ESX

vmware -vesxupdate query --all

. /etc/profile ; /sbin/esxupdate query all

Configuring an authenticated scan of the Windows operating

system
In IBM Security QRadar Vulnerability Manager, you can configure a scan of the
Windows operating systems that are installed on your network. You can manually
specify the credentials in the scan profile or use a credential set.
If you scan without administrative privileges, QRadar Vulnerability Manager scans
the remote registry for each installation on the Windows operating system.
Scanning without administrative privileges is incomplete, prone to false positives,
and does not cover many third-party applications.

Before you begin

QRadar Vulnerability Manager uses standard Windows operating system remote
access protocols that are enabled by default in most windows deployments.
If your Windows scan results return a local checks error vulnerability, that
indicates Windows management interface (WMI) connectivity issues, then you
must configure your Windows systems.
For more information about Windows connectivity, see:
v Enabling remote registry access to assets on the Windows operating system on
page 41.
v Configuring Windows Management Instrumentation on page 42.

Procedure
Click the Vulnerabilities tab.
In the navigation pane, select Administrative > Scan Profiles.
On the toolbar, select Actions > Create.
In the Details tab of the Scan Profile Configuration page, enter a name for the
scan profile in the Name field.
5. Enter the IP range of the assets you want to scan in the IP Addresses field
and click >.

1.
2.
3.
4.

Restriction: The profile name must be greater than 4 characters.

6. Optional: Click Use Centralized Credentials to scan your Windows operating
systems.
If a credential set is not configured and you do not manually specify the
credentials for the hosts, the scan tools that require credentials cannot run.

Chapter 5. Vulnerability scanning

39

If a credential set exists for the hosts that you are scanning, any credentials
that you manually specify in the Scan Setup pane, override your credential
set.
Click the When To Scan tab.
In the Run Schedule list, select Manual.
Click the Additional Credentials tab.
In the Windows Patch Scanning area, type the Domain, Username, and
Password for the Windows hosts that you want to scan and click >.
11. Click Save.
12. In the Scan Profiles page, on the toolbar select Actions > Run Now.
Related concepts:
Centralized credential sets on page 35
When you run authenticated scans, you can use a central list that stores the login
credentials for your Linux, UNIX, or Windows operating systems. Your system
administrator must configure the list of credentials.

7.
8.
9.
10.

Windows patch scanning

Windows patch scanning is an authenticated network-based method that is used to
interrogate the target computer for missing security-related patches and updates.
Windows patch scanning requires access to 3 key Windows services:
v Remote Registry
v
v

WMI
Administrative Shares

It is possible scan computers for Windows patches without using WMI and
Administrative Shares but the results are not complete and are prone to false
positives.
Use complex passwords. However, some special characters can cause issues. Limit
the special characters to numbers, periods, colons, semi-colons, quotation marks,
percentage signs, and spaces.

Remote Registry
The Remote Registry service must be enabled and started and accessible from both
the QRadar Vulnerability Manager scanner appliance and the configured scanning
user used in the scan profile.
If the remote registry cannot be accessed, windows patch scanning fails completely.
If QRadar Vulnerability Manager cannot access the remote registry, the scan results
record the following error:
Local Checks Error Remote Registry Service Not Running
In QRadar Vulnerability Manager version 7.2.3 and later, a yellow triangle icon is
displayed next to the asset in the scan results.
The status of the remote registry service can be verified from the Administrative
Control Panel under Services. Ensure that the following dependent services are
started:
v Remote Procedure Call (RPC)
v DCOM Server Process Launcher

40

QRadar Vulnerability Manager

RPC EndPoint Manager

QRadar Vulnerability Manager can access the remote registry over the classic
NetBIOS (ports 135, 137, 139) or the newer NetBIOS over TCP (on port 445).
Network or personal firewalls that block access to either of these protocols
prevents access to Windows patch scans.
Administrative user accounts have access to the remote registry by default.
Non-administrative user accounts do not have access to the remote registry. You
must configure access.

Enabling remote registry access to assets on the Windows

operating system
To scan Windows-based systems, you must configure your registry.

Procedure
1. Log in to your Windows-based system.
2. Click Start.
3. In the Search programs and files field, type services and press Enter.
4. In the Services window, locate the Remote Registry service.
5. Right-click the Remote Registry service and click Start.
6. Close the Services window.

Assigning minimum remote registry permissions

Administrative user accounts have access to the remote registry by default.
Non-administrative user accounts do not have access to the remote registry. You
must configure access.

Procedure
1. On the target Windows computer, create or designate a Local or Global User
(example, "QVM_scan_user") and assign read-only Registry access to the
non-administrative user account.
2. Log on to your Windows computer by using an account that has administrator
privileges. Click Start > Run.
3. Type regedit.
4. Click OK.
5. Go to the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\
SecurePipeServers \winreg.
The permissions that are associated with this registry key control which users
or group can access the registry remotely from the network.
6. Highlight the winreg key and do one of the following steps:
v On Windows XP or later, click Edit > Permissions.
v On Windows 2000, click Security > Permissions.
7. Give read-only access to the designated "QVM_scan_user" account.
On Windows XP, the ForceGuest setting is enabled by default when in
workgroup mode. This setting might cause access problems for WMI
connections and shares access, other DCOM services, and RPC services. You
cannot disable the ForceGuest setting on Windows XP Home computers.

Chapter 5. Vulnerability scanning

41

Configuring Windows Management Instrumentation

QRadar Vulnerability Manager uses Windows Management Instrumentation (WMI)
to locate and identify versions of the installed .exe and .dll files on the target assets
that are scanned.

About this task

Without the information that is provided by WMI, many third-party applications
are missed. False positives that are detected during registry scanning (by using the
remote registry service) cannot be identified or removed by QRadar Vulnerability
Manager.
WMI is installed on all of modern Windows operating systems, such as Windows
Vista, Windows 2008, Windows 2012, Windows 7, Windows 8, and Windows 8.1).
Remote WMI requests must be enabled and accessible by the scanning user on
assets that are scanned. If WMI is not available, the following error is reported in
the scan results:
Local Checks Error Unable to Query WMI serviceMount Remote Filesystem
In QRadar Vulnerability Manager version 7.2.3 and above, a yellow triangle
warning icon appears next to the asset in the scan results.
If your patch scan is not successful, do the following steps.

Procedure
1. On the target server, go to Control Panel > Administrative Tools > Computer
Management.
Expand Services and Applications.
Right-click WMI Control and click Properties.
Click the Security tab.
Click Security.
Optional: If necessary, add the monitoring user, and click the Remote Enable
check box for the user or group that requests WMI data. To add a monitoring
user or group:
a. Click Add.
b. In the Enter the object names to select field, type the name of your group
or user name.
c. Click OK.
7. Click Advanced and apply to the root and sub name spaces.
2.
3.
4.
5.
6.

Note: In some cases, you might also need to configure the Windows firewall
and DCOM settings.
If you experience WMI issues, you can install the WMI Administrative tools
from the Microsoft website.
The tools include a WMI browser that helps you connect to a remote machine
and browse through the WMI information. These tools help you to isolate any
connectivity issues in a more direct and simpler environment.

42

QRadar Vulnerability Manager

Allow WMI requests through a Windows firewall

To read WMI data on a remote server, a connection must be made from your
management computer (where the monitoring software is installed) to the server
that you are monitoring. If the target server is running the Windows Firewall (also
called Internet Connection Firewall) which is installed on Windows XP and
Windows 2003computers, you must configure the firewall to allow remote WMI
requests through.
To configure Windows Firewall to allow remote WMI requests, open a command
prompt and enter the following command:
netsh firewall set service RemoteAdmin enable

Setting minimum DCOM permissions

To connect to a remote computer by using WMI, you must ensure that the correct
DCOM settings and WMI namespace security settings are enabled for the
connection.

About this task

To grant DCOM remote launch and activation permissions for a user or group, do
these steps.

Procedure
1. Click Start > Run, type DCOMCNFG, and then click OK.
2. In the Component Services dialog box, expand Component Services, expand
Computers, and then right-click My Computer and click Properties.
3. In the My Computer Properties dialog box, click the COM Security tab.
4. Under Launch and Activation Permissions, click Edit Limits.
5. In the Launch Permission dialog box, if your name or your group does not
appear in the Groups or user names list, follow these steps:
a. In the Launch Permission dialog box, click Add.
b. In the Select Users, Computers, or Groups dialog box, add your name and
the group in the Enter the object names to select box, and then click OK.
6. In the Launch Permission dialog box, select your user and group in the Group
or user names box.
7. In the Allow column under Permissions for User, select Remote Launch and
select Remote Activation, and then click OK.

Setting DCOM remote access permissions

You must grant DCOM remote access permissions for certain users and groups.

About this task

If Computer A is connecting remotely to Computer B, you can set these
permissions on Computer B to allow a user or group that is not part of the
Administrators group on Computer B to connect to Computer B.

Procedure
1. Click Start > Run, type DCOMCNFG, and then click OK.
2. In the Component Services dialog box, expand Component Services, expand
Computers, and then right-click My Computer and click Properties.
3. In the My Computer Properties dialog box, click the COM Security tab.
Chapter 5. Vulnerability scanning

43

4. Under Access Permissions, click Edit Limits.

5. In the Access Permission dialog box, select the ANONYMOUS LOGON name
in the Group or user names box. In the Allow column under Permissions for
User, select Remote Access, and then click OK.

Administrative shares
All Windows computers have administrative shares, \\machinename\driveletter$
enabled, especially when they are part of a domain.
QRadar Vulnerability Manager uses administrative shares to detect vulnerabilities
on the following limited set of applications:
v Mozilla Firefox
v Mozilla Thunderbird
v Java FX
v Apache Archiva
v Apache Continuum
v Google ChromePreferences
Administrative shares are not visible to non-administrative users, and some
organizations disable administrative shares or use non-administrative user accounts
to scan. If administrative shares are not accessible, QRadar Vulnerability Manager
might miss vulnerabilities in the products in the preceding list or produce false
positives. In general, QRadar Vulnerability Managervulnerability tests use only
administrative shares as a last resort, and use registry scans and WMI.

Enabling administrative shares

On Windows Vista or later, administrative shares are disabled by default when in
workgroup mode.

About this task

Enable administrative shares by using these steps:

Procedure
1. Click Start > Run and type regedit.
Go to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\System
3. Right-click WMI Control and click Properties.
2.

4. Add a new DWORD named: LocalAccountTokenFilterPolicy

5. Set the value to 1.

Disabling administrative shares

Some organizations do not want to enable administrative shares. However, when
enable the remote registry service, the server service is started and administrative
shares are enabled.

About this task

To disable administrative shares, modify the following registry key:

Procedure
1. Click Start > Run and type regedit.

44

QRadar Vulnerability Manager

Go to the key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Services\LanManServer\
3. Set the AutoShareWks parameter to 0.

2.

Note: This action does not disable the IPC$ share. Although this share is not
used to access files directly, ensure that anonymous access to this share is
disabled. Alternatively, you can remove the IPC$ share completely by deleting
it at start-up by using the following command:
net share IPC$ /delete
Use this method to remove the C$ and D$ shares also.

Configuring a permitted scan interval

In IBM Security QRadar Vulnerability Manager, you can create an operational
window to specify the times that a scan can run.
If you assign two operational windows to a scan profile, the scan profile executes
at the time intersection of the operational windows. If the operational windows are
not configured with an overlapping time schedule, then the scans do not run.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Administrative > Operational Window.
3.
4.
5.
6.
7.

On the toolbar, select Actions > Add.

Enter a name for the operational window in the Name field.
Choose an operational window schedule from the Schedule list.
Optional: Select the times when scanning is permitted.
Optional: Select your timezone.

8. Optional: If you selected Weekly from the Schedule list, then click the desired
days of the week check boxes in the Weekly area.
9. Optional: If you selected Monthly from the Schedule list, then select a day
from the Day of the month list.
10. Click Save.

Scanning during permitted times

In IBM Security QRadar Vulnerability Manager, you can schedule a scan of your
network assets at permitted times, by using an operational window.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Administrative > Operational Window.
3. On the toolbar, select Actions > Add.
4. Type a name for your operational window, then configure a permitted time
interval and click Save.
5. In the navigation pane, select Administrative > Scan Profiles.
6. On the toolbar, select Actions > Create.
7. In the Details tab of the Scan Profile Configuration page, enter a name for the
scan profile in the Name field.

Chapter 5. Vulnerability scanning

45

8.
9.
10.
11.
12.
13.

Restriction: The profile name must be greater than 4 characters.

Enter the IP range of the assets you want to scan in the IP Addresses field
and click >.
Click the When To Scan pane.
In the Run Schedule list, select Daily.
In the Start Time fields, type or select the date and time that you want your
scan to run each day.
From the Operational Windows list, select your operational window and click
Add.
Click Save.

Managing operational windows

In IBM Security QRadar Vulnerability Manager, you can edit, delete, and print
operational windows.
Remember: You can edit an operational window while it is associated with a scan
profile.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Administrative > Operational Window.
3. Select the operational window that you want to edit.
4. On the toolbar, select an option from the Actions menu.
5. Follow the instructions in the user interface.
Restriction: You cannot delete an operational window that is associated with a
scan profile. You must first disconnect the operational window from the scan
profile.

Disconnecting an operational window

If you want to delete an operational window that is associated with a scan profile,
you must disconnect the operational window from the scan profile.

Procedure
1. Click the Vulnerabilities tab.
In the navigation pane, select Administrative > Scan Profiles.
Select the scan profile that you want to edit.
On the toolbar, select Actions > Edit.
Click the When To Scan tab.
From the Name list in the Operational Windows area, select the operational
window that you want to disconnect and click <.
7. Click Save.

2.
3.
4.
5.
6.

Dynamic vulnerability scans

In IBM Security QRadar Vulnerability Manager, you can configure a scan to use
certain vulnerability scanners for specific CIDR ranges in your network. For
example, your scanners might have access only to certain areas of your network.

46

QRadar Vulnerability Manager

During a scan, QRadar Vulnerability Manager determines which scanner to use for
each CIDR, IP address, or IP range that you specify in your scan profile.
To use dynamic scanning, you must do the following actions:
1. Add vulnerability scanners to your QRadar Vulnerability Manager deployment.
For more information, see Options for adding scanners to your QRadar
Vulnerability Manager deployment on page 7.
2. Associate vulnerability scanners with CIDR ranges.
3. Configure a scan of multiple CIDR ranges and enable Dynamic server
selection in the Scan Profile Details pane.
Related concepts:
Options for adding scanners to your QRadar Vulnerability Manager deployment
on page 7
If you have a large network and require flexible scanning options, you can add
more scanners to your IBM Security QRadar Vulnerability Manager deployment.
Scan profile details on page 26
In IBM Security QRadar Vulnerability Manager you can describe your scan, select
the scanner that you want to use, and choose from a number of scan policy
options.

Associating vulnerability scanners with CIDR ranges

In IBM Security QRadar Vulnerability Manager, to do dynamic scanning, you must
associate vulnerability scanners with different segments of your network.

Before you begin

You must add extra vulnerability scanners to your deployment. For more
information, see Options for adding scanners to your QRadar Vulnerability
Manager deployment on page 7.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Administrative > Scanners.
Attention: By default, the Controller scanner is displayed. The Controller
scanner is part of the QRadar Vulnerability Manager processor that is deployed
on either your QRadar Console or on a dedicated QRadar Vulnerability
Manager processing appliance. You can assign a CIDR range to the Controller
scanner, but you must deploy extra scanners to use dynamic scanning.
3. Click a scanner on the Scanners page.
4. On the toolbar, click Edit.
Restriction: You cannot edit the name of the scanner. To edit a scanner name,
you must use the deployment editor.
5. In the CIDR field, type a CIDR range or multiple CIDR ranges that are
separated by commas.
6. Click Save.
Related concepts:
Options for adding scanners to your QRadar Vulnerability Manager deployment
on page 7
If you have a large network and require flexible scanning options, you can add
more scanners to your IBM Security QRadar Vulnerability Manager deployment.
Chapter 5. Vulnerability scanning

47

Scanning CIDR ranges with different vulnerability scanners

In IBM Security QRadar Vulnerability Manager, you can scan areas of your
network with different vulnerability scanners.

Before you begin

You must configure your network CIDR ranges to use the different vulnerability
scanners in your QRadar Vulnerability Manager deployment. For more
information, see Options for adding scanners to your QRadar Vulnerability
Manager deployment on page 7.

Procedure
1.
2.
3.
4.
5.
6.

7.
8.
9.
10.

Click the Vulnerabilities tab.

In the navigation pane, select Administrative > Scan Profiles.
On the toolbar, select Actions > Create.
In the Details tab of the Scan Profile Configuration page, enter a name for the
scan profile in the Name field.
Click the Dynamic server selection check box.
Enter the IP address, IP range, or CIDR range of the assets you want to scan
in the IP Addresses field and click >.
To create a scan profile, the only mandatory fields are the Name and IP
Addresses fields.
Optional: Add more CIDR ranges.
Click Save.
Select your scan from the Scan Profiles page.
On the toolbar select Actions > Run Now.

Scan policies
In IBM Security QRadar Vulnerability Manager, a scan policy is associated with a
scan profile and is used to control a vulnerability scan. For example, you can
configure the scanning protocol, scanned ports, or the scan tools that are used
during a scan.
You can create a new scan policy or copy and modify a pre-configured policy that
is distributed with QRadar Vulnerability Manager.
If your scanning requirements change, you can modify the scan policy in one
central location, rather than updating each scan profile.

Pre-configured scan policies

The following pre-configured scan policies are distributed with QRadar
Vulnerability Manager:
v Full scan
v
v
v
v
v

48

Discovery scan
Database scan
Patch scan
PCI scan
Web scan

QRadar Vulnerability Manager

A description of each pre-configured scan policy is displayed on the Scan Policies

page.

Modifying a pre-configured scan policy

In IBM Security QRadar Vulnerability Manager, you can copy a pre-configured
scan policy and modify the policy to your exact scanning requirements.

Procedure
1.
2.
3.
4.

Click the Vulnerabilities tab.

In the navigation pane, select Administrative > Scan Policies.
On the Scan Policies page, click a pre-configured scan policy.
On the toolbar, click Edit.

5. Click Copy.
6. In the Copy scan policy window, type a new name in the Name field and click
OK.
7. Click the copy of your scan policy and on the toolbar, click Edit.
8. In the Description pane, type new information about the scan policy.
Important: If you modify the new scan policy, you must update the
information in the description.
9. To modify your scan policy, use the Port Scan, Vulnerabilities, Tool Groups, or
Tools tabs.
Restriction: Depending on the Scan Type that you select, you cannot use all
the tabs on the New Scan Policy window.
Scan Type

Tabs Enabled

Discovery Only

Settings, Port Scan

Zero credentialled

Settings, Port Scan, Tool Groups, Tools

Patch

Settings, Port Scan, Vulnerabilities

Full

Settings, Port Scan, Tool Groups, Tools

Configuring a scan policy to manage your vulnerability scans

In IBM Security QRadar Vulnerability Manager, you can configure a scan policy
and use the scan policy to control your vulnerability scans.

Procedure
Click the Vulnerabilities tab.
In the navigation pane, select Administrative > Scan Policies.
On the toolbar, click New.
Type the name and description of your scan policy.
To configure a scan policy, the only mandatory fields in the New Scan Policy
window are the Name and Description fields.
5. Click a Scan Type, upon which to base your scan policy.

1.
2.
3.
4.

Restriction: Depending on the Scan Type that you select, you cannot use all
the tabs on the New Scan Policy window.

Chapter 5. Vulnerability scanning

49

Scan Type

Tabs Enabled

Discovery Only

Settings, Port Scan

Zero credentialed

Settings, Port Scan, Tool Groups, Tools

Patch

Settings, Port Scan, Vulnerabilities

Full

Settings, Port Scan, Tool Groups, Tools

6. Optional: To include specific vulnerabilities in your scan policy, do the

following steps:
a. On the New Scan Policy window, click the Patch check box.
b. Click the Vulnerabilities tab.
c. Click Add.
By default, all vulnerabilities discovered in the last year are displayed.
d. Filter the list of vulnerabilities.
e. Click the vulnerabilities that you want to include in your scan policy and
click Submit on the toolbar.
7. Optional: To include or exclude tool groups from a zero credentialed or full
scan policy, click the Tool Group tab.
8. Optional: To include or exclude tools from a zero credentialed or full scan
policy, click the Tools tab.
Important:
If you do not modify the tools or tool groups, and you selected the Full option
as your scan type, then all the tools and tool groups that are associated with a
full scan are included in your scan policy.
9. Click Save.

50

QRadar Vulnerability Manager

Chapter 6. Vulnerability scan investigations

In IBM Security QRadar Vulnerability Manager, you can investigate summary asset
and vulnerability data for each scan.
To investigate vulnerability scans, do the following tasks:
v Build and save complex vulnerability search criteria.
v Investigate exploitation risk levels at a network, asset, and vulnerability level.
v Prioritize your vulnerability remediation processes.

Scan results
You can use the Scan Results page to investigate the following information:
v The progress of a scan and the scanning tools that are queued and running.
v The status of a scan. For example, a scan with a status of Stopped indicates that
the scan completed successfully or was canceled.
v The degree of risk that is associated with each completed scan profile. Risk is
indicated by the Score column and shows the total Common Vulnerability
Scoring System (CVSS) score for the completed scan profile.
v The total number of assets that were found by the scan.
v The total number of vulnerabilities that were discovered by the completed scan
profile.
v The total number of open services that were discovered by the completed scan
profile.

Vulnerability counts
The Scan Results page shows Vulnerabilities and Vulnerabilities Instances.
v The Vulnerabilities column shows the total number of unique vulnerabilities
that were discovered on all the scanned assets.
v When you scan multiple assets, the same vulnerability might be present on
different assets. Therefore, the Vulnerability Instances column shows the total
number of vulnerabilities that were discovered on all the scanned assets.

Searching scan results

In IBM Security QRadar Vulnerability Manager, you can search and filter your scan
results.
For example, you might want to identify recent scans, scans on a specific IP
address, or scans that identified a specific vulnerability.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Scan Results.
3. On the toolbar, select Search > New Search.
To search your scan results, there are no mandatory fields. All parameters are
optional.

Copyright IBM Corp. 2012, 2014

51

4. To show scan results for scans that completed within a recent number of days,
type a value in the Scan Run in the last days field.
5. To show scan results for a specific vulnerability, click Browse in the Contains
Vulnerability field.
6. To show scan results for scans that were only scheduled, click Exclude on
demand scan.
7. Click Search.
Related concepts:
Scan scheduling on page 27
In IBM Security QRadar Vulnerability Manager, you can schedule the dates and
times that it is convenient to scan your network assets for known vulnerabilities.

Including column headings in asset searches

Limit asset searches with filters that include custom asset profiles, name,
vulnerability count, and risk score.

Procedure
1. Click the Assets tab.
2. In the navigation pane, click Asset Profiles, then on the toolbar click Search >
New Search.
3. In the field containing column names, in the field on the left, click the column
headings you want to include in your search, and click the arrow button to
move the selected headings to field on the right.
4. Click the up and down buttons to change the priority of the selected column
headings.
5. When the field on the right contains all the column heading that you want to
search on, click Search.

Managing scan results

In IBM Security QRadar Vulnerability Manager, on the Scan Results page, you can
manage your scan results and manage the scans that are running.
Depending on whether a scan is complete or running, the options that you can
select from the Actions menu are different.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Scan Results.
3. Optional: If you want to rerun a completed scan, select Actions > Run Now.
A completed scan has a status of Stopped.
4. Optional: To delete a set of completed scan results:
a. On the Scan Results page, select a set of completed scan results.
b. On the toolbar, select Actions > Delete.
If you delete a set of scan results, no warning is displayed. The scan results
are immediately deleted.
Remember: When you delete a set of scan results, neither the scan data in
the QRadar asset model or the scan profile are deleted.
5. Optional: To cancel a scan that is running:

52

QRadar Vulnerability Manager

a. On the Scan Results page, select a scan that is running.

b. On the toolbar, select Actions > Cancel.
You can cancel a scan that has a status of Running or Paused. After you
cancel a scan, the status of the scan is Stopped.

Asset risk levels and vulnerability categories

In IBM Security QRadar Vulnerability Manager, you can investigate the
exploitation risk level of your scanned assets on the Scan Results Hosts page.
The Scan Results Hosts page provides a risk and vulnerability summary for each
of the assets that you scanned by running a scan profile.

Risk score
Each vulnerability that is detected on your network has a risk score that is
calculated by using the Common Vulnerability Scoring System (CVSS) base score.
A high risk score provides an indication of the potential for a vulnerability
exploitation.
On the Scan Results Hosts page the Score column is an accumulation of the risk
score for each vulnerability on an asset. The accumulated value provides an
indication of the level of risk that is associated with each asset.
To quickly identify the assets that are most at risk to vulnerability exploitation,
click the Score column heading to sort your assets by the risk level.

Vulnerability counts and categories

The Scan Results Hosts page shows the total number of vulnerabilities and open
services that were discovered on every scanned asset.
To identify the assets with the highest number of vulnerabilities, click the
Vulnerability Instances column heading to order your assets.
The High, Medium, Low, and Warning columns group all vulnerabilities
according to their risk.
The Color column allows you to select or define a color for risk scores to
color-code risk scores in search results.

Asset, vulnerability, and open services data

In IBM Security QRadar Vulnerability Manager, the Hosts Details page shows
asset, vulnerability, and open services data.
By using the options on the toolbar, you can switch between viewing
vulnerabilities and open services.
The Host Details page provides the following information:
v Summary information about the asset that you scanned, including the operating
system and network group.
v A list of the vulnerabilities or open services that were discovered on the scanned
asset.

Chapter 6. Vulnerability scan investigations

53

v Various ways of categorizing and ordering your list of vulnerabilities or open

services for example, Risk, Severity, and Score.
v A quick way to view open service or vulnerability information. On the toolbar,
click Vulnerabilities or Open Services.
v An easy way to view detailed information about the asset that you scanned. On
the toolbar, click the Host Details.
v An alternative method of creating a vulnerability exception. On the toolbar, click
Actions > Exception.
The caution icon indicates that the scan failed. Hover over the icon for additional
details.
For more information about the Asset Details window, see the Users Guide for your
product.
Related concepts:
Chapter 8, Vulnerability exception rules, on page 69
In IBM Security QRadar Vulnerability Manager, you can configure exception rules
to minimize the number of false positive vulnerabilities.

Viewing the status of asset patch downloads

View whether an asset has a pending patch download. If there are no pending
downloads, the asset has all available patches.

Procedure
1. Search for the asset that you want to confirm the patch status for.
2. Click the Asset IP address to open the Asset Details window.
3. Click Details > Properties to open the Asset Properties window.
4. Click the Windows Patches arrow.
5. View the patch status in the Pending column.
v True - the asset has pending patches to download.
v False - the asset has no pending patch downloads.

Vulnerability risk and PCI severity

In IBM Security QRadar Vulnerability Manager, you can review the risk and
payment card industry (PCI) severity for each vulnerability that is found by a scan.
You can review the following information:
v The risk level that is associated with each vulnerability.
v The number of assets in your network on which the specific vulnerability was
found.
To investigate a vulnerability, you can click a vulnerability link in the
Vulnerability column.

Emailing asset owners when vulnerability scans start and stop

Email the configured asset technical owners to alert them of the scan schedule. You
can also email reports to asset owners.

54

QRadar Vulnerability Manager

Before you begin

Configure the system mail server and technical owners for assets. For more
information, see the IBM Security QRadar SIEM Administration Guide.

Procedure
1.
2.
3.
4.
5.

Click the Vulnerabilities tab.

Click Administrative > Scan Profiles.
Select the scan profile that you want to edit and click Actions > Edit.
Click the Edit tab.
In the What To Email area, select the check boxes for the information that you
want to email:
v Scan Start
v Scan Stop

v Reports
6. If you selected the Reports check box in the What To Email area, select the
reports that you want to email from the Available Reports field, and click the
arrow to move reports into the Selected Reports field.
Reports can be large. Confirm that the sent reports are not rejected by the
recipient's email provider.
7. In the Who to Email area, select the recipients that you want to receive the
emails:
v To email the configured technical owners of the scanned assets, select the
Technical Owners check box. Technical owners receive emails about their
assets only.
v To enter or select email addresses in the field, select the To Addresses check
box. Select emails in the field on the left, and click Add Me to email the
selected email addresses. Entered email addresses receive emails and reports
for all scanned assets.
8. Click Save.

Chapter 6. Vulnerability scan investigations

55

56

QRadar Vulnerability Manager

Chapter 7. Management of your vulnerabilities

In IBM Security QRadar Vulnerability Manager, you can manage, search, and filter
your vulnerability data to help you focus on the vulnerabilities that pose the
greatest risk to your organization.
The vulnerability data that is displayed is based on the vulnerability status
information that is maintained in the QRadar asset model. This information
includes vulnerabilities that are found by the QRadar Vulnerability Manager
scanner and the vulnerabilities that are imported from external scanning products.
Manage your vulnerabilities to provide the following information:
v A network view of your current vulnerability posture.
v Identify vulnerabilities that pose the greatest risk to your organization and
assign vulnerabilities to QRadar users for remediation.
v Establish how widely your network is impacted by vulnerabilities and display
detailed information about the network assets that contain vulnerabilities.
v Decide which vulnerabilities pose less risk to your organization and create
vulnerability exceptions.
v Display historical information about the vulnerabilities on your network.
v Display vulnerability data by network, asset, vulnerability, open service, or
vulnerability instance.

Investigating vulnerability risk scores

In IBM Security QRadar Vulnerability Manager, you can investigate vulnerability
risk scores and understand how each score is calculated.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Manage Vulnerabilities.
3. Optional: Click the Risk Score column to sort your vulnerabilities by risk.
4. To investigate the risk score, hover you mouse on a vulnerability risk score.

Risk score details

In IBM Security QRadar Vulnerability Manager, vulnerability risk scores provide an
indication of the risk that a vulnerability poses to your organization.
Using IBM Security QRadar Risk Manager, you can configure policies that adjust
vulnerability risk scores and draw attention to important remediation tasks.

Risk Score
The Risk Score provides specific network context by using the Common
Vulnerability Scoring System (CVSS) base, temporal, and environmental metrics.
When QRadar Risk Manager is not licensed the Risk Score column shows the
CVSS environmental metric score with a maximum value of 10.

Copyright IBM Corp. 2012, 2014

57

Exploitability subscore
Exploitability is calculated as a subset of the CVSS base score by using the
following elements:
v Access Vector provides an indication of risk that is based on the remoteness for
example, local, adjacent network, or network, of an attacker.
v Access Complexity provides an indication of risk that is based on attack
complexity. The lower the complexity the higher the risk.
v Authentication provides an indication of risk that is based on authentication
attempts. The fewer the attempts the higher the risk.

Risk adjustments
If IBM Security QRadar Risk Manager is installed and you configured vulnerability
risk policies, then the risk adjustments are listed. The adjustments either increase
or decrease the overall risk that is associated with a vulnerability.
Related concepts:
IBM Security QRadar Risk Manager and IBM Security QRadar Vulnerability
Manager integration on page 19
IBM Security QRadar Vulnerability Manager integrates with QRadar Risk Manager
to help you prioritize the risks and vulnerabilities in your network.
Related tasks:
Prioritizing high risk vulnerabilities by applying risk policies on page 65
In IBM Security QRadar Vulnerability Manager, you can alert administrators to
higher risk vulnerabilities by applying risk policies to your vulnerabilities.

Searching vulnerability data

In IBM Security QRadar Vulnerability Manager, you can identify important
vulnerabilities by searching your vulnerability data.
QRadar Vulnerability Manager provides various methods to search your data. You
can search by network, by asset, by open service, or by vulnerability.
Default saved searches provide a fast method of identifying the risk to your
organization. Saved searches are displayed in the Available Saved Searches field
on the Vulnerability Manager Search page.

Before you begin

You must create a scan profile and scan your network assets.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Manage Vulnerabilities.
3. On the toolbar, select Search > New Search.
4. If you want to load a saved search, do the following steps:
a. Optional: Select a group from the Group list.
b. Optional: In the Type Saved Search field, type the saved search that you
want to load.
c. From the Available Saved Searches list, select a saved search, and then
click Load.

58

QRadar Vulnerability Manager

d. Click Search.
5. If you want to create a new search, do the following steps in the Search
Parameters pane:
a. In the first list, select the parameter that you want to use.
b. In the second list, select a search modifier. The modifiers that are available
depend on the search parameter that you select.
c. In the third list, type or select the specific information that is related to
your search parameter.
d. Click Add Filter.
For example, to email the vulnerabilities that are assigned to a technical user,
select Technical Owner Contact and provide an email address that is
configured on the Vulnerability Assignment page.
6. Click Search.
7. Optional: On the toolbar, click Save Search Criteria.
Important: Vulnerability reports use saved search information. If you want to
create a report that emails a technical user, you must save your search criteria.
Related concepts:
Vulnerability search parameters
In IBM Security QRadar Vulnerability Manager, you can search your vulnerability
data and save the searches for later use.

Vulnerability search parameters

In IBM Security QRadar Vulnerability Manager, you can search your vulnerability
data and save the searches for later use.
The following table is not a complete list of vulnerability search parameters, but a
subset of the available options.
Select any of the parameters to search and display vulnerability data.
Table 5. Vulnerability search parameters
Option

Description

Access Complexity

The complexity of the attack that is required

to exploit a vulnerability.

Access Vector

The network location from where a

vulnerability can be exploited.

Asset saved search

The host, IP address, or range of IP

addresses associated with a saved asset
search.
For more information about saving asset
searches, see the Users Guide for your
product.

Assets with open service

Assets that have specific open services. For

example, http, FTP, and smtp.

Authentication

The number of times an attacker must

authenticate against a target to exploit a
vulnerability.

Availability Impact

The level that resource availability can be

compromised if a vulnerability is exploited.

Chapter 7. Management of your vulnerabilities

59

Table 5. Vulnerability search parameters (continued)

Option

Description

Confidentiality Impact

The level of confidential information that

can be obtained if a vulnerability is
exploited.

Days since asset found

The elapsed number of days since the asset

with the vulnerability was discovered on
your network. Assets can be discovered
either by an active scan or passively by
using log or flow analysis.

Days since associated vulnerability service

traffic

Displays vulnerabilities on assets with

associated layer 7 traffic to or from an asset,
based on the elapsed number of days since
the traffic was detected.

Days since vulnerabilities discovered

The elapsed number of days since the

vulnerabilities were first discovered on your
network assets.

External Reference of type

Vulnerabilities that have an associated

Endpoint Manager fixlet. By using this
parameter you can show only those
vulnerabilities without an available patch.

Impact

The potential impact to your organization.

For example, access control loss, downtime,
and reputation loss.

Include early warnings

Newly published vulnerabilities that are

detected on your network without
performing additional scanning.

Include vulnerability exceptions

Those vulnerabilities with an exception rule

applied.

Integrity Impact

The level to which system integrity might be

compromised if a vulnerability is exploited.

Only include assets with risk

Vulnerabilities that pass or fail specific risk

policies that are defined and monitored in
IBM Security QRadar Risk Manager.

Vulnerability external reference

Vulnerabilities that are based on an

imported list of vulnerability IDs, for
example CVE ID.
For more information about Reference Sets,
see the Administration Guide for your
product.

60

Vulnerability has a virtual patch from

vendor

Vulnerabilities that can be patched by an

intrusion prevention system.

Vulnerability reference

Vulnerabilities that are based on external

vulnerability reference information.

Vulnerability state

The status of the vulnerability since the last

scan of your network or specific network
assets. For example, when you scan assets,
the vulnerabilities that are discovered are
either New, Pre-existing, Fixed, or Existing.

QRadar Vulnerability Manager

Table 5. Vulnerability search parameters (continued)

Option

Description

Quick Search

You can search for a vulnerabilities title,

description, solution, and external reference
ID. In the Quick Search field, you can use
and, or, and not operators, and brackets.

Saving your vulnerability search criteria

In IBM Security QRadar Vulnerability Manager, you can save your vulnerability
search criteria for future use.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Manage Vulnerabilities.
3. On the toolbar, select Search > New Search and complete the search of your
data.
4. On the toolbar, click Save Search Criteria.
5. In the Save Search Criteria window, type a recognizable name for your saved
search.
6. Optional: To include your saved search in the Quick Searches list on the
toolbar, then click Include in my Quick Searches.
7. Optional: To share your saved search criteria with all QRadar users, then click
Share with Everyone.
8. Optional: To place your saved search is a group, then click a group or click
Manage Groups to create a new group.
For more information about managing search groups, see the Administration
Guide for your product.
9. Optional: If you want to show the results of your saved search when you click
any of the Manage Vulnerabilities pages in the navigation pane, then click Set
As Default.
10. Click OK.

Deleting saved vulnerability search criteria

In IBM Security QRadar Vulnerability Manager, you can delete your saved
vulnerability search criteria.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Manage Vulnerabilities > By Network
3. On the toolbar, select Search > New Search.
4. On the Vulnerability Manager Search page, in the Available Saved Searches
list, select the saved search that you want to delete.
5. Click Delete.
6. Click OK.

Chapter 7. Management of your vulnerabilities

61

Vulnerability instances
In IBM Security QRadar Vulnerability Manager, you can display the vulnerabilities
on each of the scanned assets in your network. Each vulnerability might be listed
multiple times because the vulnerability exists on several of your assets.
If you configure third-party vulnerability assessment (VA) scanners, by using the
QRadar Admin tab, then the vulnerabilities that are detected are automatically
displayed in the By Vulnerability Instances page.
For more information about VA scanners, see the Administration Guide for your
product.
The By Vulnerability Instances page provides the following information:
v A view of every vulnerability that was detected by scanning your network
assets.
v The risk that each vulnerability poses to the Payment Card Industry (PCI).
v The risk that a vulnerability poses to your organization. Click the Risk Score
column to identify the highest risk vulnerabilities.
v The name or email address of the user that is assigned to remediate the
vulnerability.
v The numbers of days in which a vulnerability must be remediated.
Related concepts:
Risk score details on page 57
In IBM Security QRadar Vulnerability Manager, vulnerability risk scores provide an
indication of the risk that a vulnerability poses to your organization.

Network vulnerabilities
In IBM Security QRadar Vulnerability Manager, you can review vulnerability data
that is grouped by network.
The By Network page provides the following information:
v An accumulated risk score that is based on the vulnerabilities that are detected
on each of your networks.
v The number of the assets, vulnerabilities, and open services for each network.
v The number of vulnerabilities that are assigned to a technical user and are
overdue for remediation.

Asset vulnerabilities
In IBM Security QRadar Vulnerability Manager, you can display summary
vulnerability data that is grouped by each scanned asset.
You can use the By Asset page to prioritize the remediation tasks for assets in your
organization that pose the greatest risk.
The By Asset page provides the following information:
v An accumulated risk score that is based on the vulnerabilities that are detected
on each of your assets.
Click the Risk Score column to sort your assets by their risk.

62

QRadar Vulnerability Manager

v The number of asset vulnerabilities that are assigned to a technical user and are
overdue for remediation.

Open service vulnerabilities

In IBM Security QRadar Vulnerability Manager, you can display vulnerability data
that is grouped by open service.
The By Open Service page shows an accumulated risk score and vulnerability
count for each service in your entire network.

Investigating the history of a vulnerability

In IBM Security QRadar Vulnerability Manager, you can display useful information
about the history of a vulnerability.
For example, you can investigate information about how the risk score of a
vulnerability was calculated. You can also review information about when a
vulnerability was first discovered and the scan that was used to discover the
vulnerability.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Manage Vulnerabilities.
3. Optional: Search your vulnerability data.
4. Click the vulnerability that you want to investigate.
5. On the toolbar, select Actions > History.
Related tasks:
Searching vulnerability data on page 58
In IBM Security QRadar Vulnerability Manager, you can identify important
vulnerabilities by searching your vulnerability data.

Reducing the number of false positive vulnerabilities

In IBM Security QRadar Vulnerability Manager, you can automatically create
exception rules for vulnerabilities that are associated with a specific type of server.
When you configure server types, QRadar Vulnerability Manager creates exception
rules and automatically reduces the vulnerabilities that are returned by searching
your data.

Procedure
1. Click the Assets tab.
2. In the navigation pane, select Server Discovery.
3. To automatically create false positive exception rules for vulnerabilities on
specific server types, from the Server Type list, select one of the following
options:
v
v
v
v

FTP Servers
DNS Servers
Mail Servers
Web Servers

It might take a few minutes for the Ports field to refresh.

Chapter 7. Management of your vulnerabilities

63

4. Optional: From the Network list, select the network for your servers.
5. Click Discover Servers.
6. In the Matching Servers pane, select the servers where the vulnerability
exception rules are created.
7. Click Approve Selected Servers.

Results
Depending on your server type selection the following vulnerabilities are
automatically set as false positive exception rules:
Table 6. Server type vulnerabilities
Server Type

Vulnerability

FTP Servers

FTP Server Present

DNS Servers

DNS Server is Running

Mail Servers

SMTP Server Detected

Web Servers

Web Service is Running

Investigating high risk assets and vulnerabilities

In IBM Security QRadar Vulnerability Manager, you can investigate high risk
vulnerabilities that might be susceptible to exploitation.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Manage Vulnerabilities.
3. On the By Vulnerability Instances page, click the Risk Score column heading to
sort the vulnerabilities by risk score.
4. To investigate the CVSS metrics that are used to derive the risk score, hover
your mouse on the Risk Score field.
5. Identify the vulnerability that has the highest score and click the Vulnerability
link.
6. In the Vulnerability Details window, investigate the vulnerability:
a. To view the IBM Security Systems website, click the X-Force link.
b. To view the National Vulnerability Database website, click the CVE link.
The IBM Security Systems website and National Vulnerability Database
provide remediation information and details on how a vulnerability might
affect your organization.
c. To open the Patching window for the vulnerability, click the Plugin Details
link. Use the tabs to discover Oval Definition, Windows Knowledge Base, or
UNIX advisory information about the vulnerability. This feature provides
information on how QRadar Vulnerability Manager checks for vulnerability
details during a patch scan. You can use it to identify why a vulnerability
was raised on an asset or why it was not.
d. The Solution text box contains detailed information about how to remediate
a vulnerability.
Related concepts:
Risk score details on page 57
In IBM Security QRadar Vulnerability Manager, vulnerability risk scores provide an
indication of the risk that a vulnerability poses to your organization.

64

QRadar Vulnerability Manager

Prioritizing high risk vulnerabilities by applying risk policies

In IBM Security QRadar Vulnerability Manager, you can alert administrators to
higher risk vulnerabilities by applying risk policies to your vulnerabilities.
When you apply a risk policy, the risk score of a vulnerability is adjusted, allowing
administrators to prioritize more accurately the vulnerabilities that require
immediate attention.
In this example, the vulnerability risk score is automatically increased by a
percentage factor for any vulnerability that remains active on your network after
40 days.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Manage Vulnerabilities.
3. On the toolbar click Search > New Search.
4. In the Search Parameters pane, configure the following filters:
a. Risk Equals High
b. Days since vulnerabilities discovered Greater than or equal to 40
5. Click Search and then on the toolbar click Save Search Criteria.
Type a saved search name that is identifiable in QRadar Risk Manager.
6. Click the Risks tab.
7. In the navigation pane, click Policy Monitor.
8. On the toolbar click Actions > New.
9. In the What do you want to name this question field, type a name.
10. In the Which tests do you want to include in your question field, click are
susceptible to vulnerabilities contained in vulnerability saved searches.
11. In the Find Assets that field, click the underlined parameter on the are
susceptible to vulnerabilities contained in vulnerability saved searches.
12. Identify your QRadar Vulnerability Manager high risk vulnerability saved
search, click Add, then click OK.
13. Click Save Question.
14. In the Questions pane, select your question from the list and on the toolbar
click Monitor.
Restriction: The Event Description field is mandatory.
15. Click Dispatch question passed events.
16. In the Vulnerability Score Adjustments field, type a risk adjustment
percentage value in the Percentage vulnerability score adjustment on
question fail field.
17. Click Apply adjustment to all vulnerabilities on an asset then click Save
Monitor.

What to do next
On the Vulnerabilities tab, you can search your high risk vulnerabilities and
prioritize your vulnerabilities
Related concepts:

Chapter 7. Management of your vulnerabilities

65

IBM Security QRadar Risk Manager and IBM Security QRadar Vulnerability
Manager integration on page 19
IBM Security QRadar Vulnerability Manager integrates with QRadar Risk Manager
to help you prioritize the risks and vulnerabilities in your network.
Related tasks:
Saving your vulnerability search criteria on page 61
In IBM Security QRadar Vulnerability Manager, you can save your vulnerability
search criteria for future use.

Configuring custom display colors for risk scores

Configure custom color coding for IBM Security QRadar Vulnerability Manager
risk scores to view color-coded risk scores in QRadar Vulnerability Manager
interfaces.

Procedure
1. In IBM Security QRadar, select Vulnerabilities > Vulnerability Assignment >
Risk Preferences.
2. In the Greater than or equal to column, enter the minimum risk score value for
High, Medium, Low, and Warning.
3. In the Color column, select or define a color to represent High, Medium, Low,
and Warning risk scores.

Identifying vulnerabilities with an IBM Endpoint Manager patch

In IBM Security QRadar Vulnerability Manager, you can identify the vulnerabilities
that have an available fix.
After you identify your vulnerabilities that have an available fix, you can
investigate detailed fix information in the Vulnerability Details window.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Manage Vulnerabilities.
3. On the toolbar, select Search > New Search
4. In the Search Parameters pane configure the following options:
a. In the first list select External Reference of type.
b. In the second list select Equals.
c. In the third list select IBM Endpoint Manager Patch.
d. Click Add Filter.
e. Click Search.
The By Vulnerability Instances page shows the vulnerabilities that have an
available fix.
5. Optional: Order your vulnerabilities according to their importance by clicking
the Risk Score column heading.
6. Optional: To investigate patch information for a vulnerability, click a
vulnerability link in the Vulnerability column.
7. Optional: In the Vulnerability Details window, scroll to the bottom of the
window to view the vulnerability patch information.
The Site ID and Fixlet ID are unique identifiers that you use to apply
vulnerability patches by using IBM Endpoint Manager.

66

QRadar Vulnerability Manager

The Base column indicates a unique reference that you can use to access more
information on a knowledge base.

Identifying the patch status of your vulnerabilities

In IBM Security QRadar Vulnerability Manager, you can identify the patch status
of your vulnerabilities.
By filtering patched vulnerabilities, you can prioritize your remediation efforts on
the most critical vulnerabilities in your organization.

Procedure
1.
2.
3.
4.

Click the Vulnerabilities tab.

In the navigation pane, click Manage Vulnerabilities.
On the toolbar, select Search > New Search.
In the first list in the Search Parameters pane, select Patch Status.

5. In the second list, select a search modifier.

6. To filter your vulnerabilities according to their patch status, select one of the
following options from the third list:
Option

Description

Pending Downloads

Select this option to show vulnerabilities

that are scheduled to be patched

Pending Restart

Select this option to shows vulnerabilities

that are patched after the scanned asset is
restarted

Fixed

Select this option to show vulnerabilities

that are patched by IBM Endpoint Manager

7. Click Add Filter.

8. Click Search.
Related concepts:
IBM Endpoint Manager integration on page 19
IBM Security QRadar Vulnerability Manager integrates with IBM Endpoint
Manager to help you filter and prioritize the vulnerabilities that can be fixed.

Chapter 7. Management of your vulnerabilities

67

68

QRadar Vulnerability Manager

Chapter 8. Vulnerability exception rules

In IBM Security QRadar Vulnerability Manager, you can configure exception rules
to minimize the number of false positive vulnerabilities.
When you apply exception rules to vulnerabilities, you reduce the number of
vulnerabilities that are displayed in search results.
If you create a vulnerability exception, the vulnerability is not removed from
QRadar Vulnerability Manager.

Viewing exception rules

To display vulnerability exceptions, you can search your vulnerability data by
using search filters.
To view exception rules, click the Vulnerabilities tab, then click Vulnerability
Exception in the navigation pane.
Related tasks:
Reducing the number of false positive vulnerabilities on page 63
In IBM Security QRadar Vulnerability Manager, you can automatically create
exception rules for vulnerabilities that are associated with a specific type of server.

Applying a vulnerability exception rule

In IBM Security QRadar Vulnerability Manager, you can manually apply a
vulnerability exception rule to a vulnerability that you decide does not pose a
significant threat.
If you apply an exception rule, the vulnerability is no longer displayed in QRadar
Vulnerability Manager search results. However, the vulnerability is not removed
from QRadar Vulnerability Manager.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Manage Vulnerabilities > By Network.
3. Optional: Search your vulnerability data. On the toolbar, click Search > New
Search.
4. Click the Vulnerability Instances column link.
5. Select the vulnerability that you want to create an exception rule for.
6. On the toolbar, select Actions > Exception.
To apply a vulnerability exception rule, the only mandatory field is the
Comment text box. All other parameters are optional.
7. Optional: In the Maintain Exception Rule window, choose one of the following
options:
v Type a date when your vulnerability exception must expire.
v If the vulnerability exception must never expire, click Never Expires.

Copyright IBM Corp. 2012, 2014

69

8. In the Notes section of the Maintain Exception Rule window, type text in the
Comments text box.
9. Click Save.
Related tasks:
Searching vulnerability data on page 58
In IBM Security QRadar Vulnerability Manager, you can identify important
vulnerabilities by searching your vulnerability data.

Managing a vulnerability exception rule

If you receive new information about a vulnerability, you can update or remove an
existing vulnerability exception rule.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Vulnerability Exception.
3. Click the vulnerability that you want to manage.
4. On the toolbar, select an option from the Actions menu.
Important: If you delete a vulnerability exception rule, no warning is
displayed. The vulnerability is immediately deleted.
5. Click Save.

Searching vulnerability exceptions

In IBM Security QRadar Vulnerability Manager, you can search your vulnerability
data and filter the search results to display vulnerability exceptions.

Procedure
1.
2.
3.
4.

Click the Vulnerabilities tab.

In the navigation pane, select Manage Vulnerabilities > By Asset.
On the toolbar, select Search > New Search.
To filter your vulnerability data to include vulnerability exceptions, from the
Search Parameters pane, select one of the following options:
v Include vulnerability exceptions
Displays all vulnerabilities, including vulnerabilities with an exception rule
applied to them.
v Only include vulnerability exceptions

Displays vulnerabilities only with an exception rule applied to them.

5. Click Add Filter.
6. Click Search.

70

QRadar Vulnerability Manager

Chapter 9. Vulnerability remediation

In QRadar Vulnerability Manager, you can assign vulnerabilities to a technical user
for remediation.
You can assign vulnerabilities to your technical user by using two methods.
v Assign individual vulnerabilities to a technical user for remediation.
v Assign a technical user as the owner of asset groups
Related tasks:
Configuring remediation times for the vulnerabilities on assigned assets on page
73
In IBM Security QRadar Vulnerability Manager you can configure the remediation
times for different types of vulnerabilities.

Assigning individual vulnerabilities to a technical user for remediation

In IBM Security QRadar Vulnerability Manager, you can assign individual
vulnerabilities to a QRadar user for remediation.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Manage Vulnerabilities.
3. Optional: Search your vulnerability data.
4. Select the vulnerability that you want to assign for remediation.
5. On the toolbar, click Actions > Assign/Edit.
None of the fields on the Assign/Edit Vulnerability window are mandatory.
6. Optional: Select an alternative user from the Assigned User list.
7. Optional: In the Due Date list, select a future date when the vulnerability must
be remediated.
If you do not select a date, the Due Data is set as the current date.
8. Optional: In the Notes pane, type useful information about the reason for the
vulnerability assignment.
9. Click Save.

Assigning a technical user as the owner of asset groups

In IBM Security QRadar Vulnerability Manager you can configure groups of assets
and automatically assign their vulnerabilities to technical users.
After you assign a technical user and scan the assets, all vulnerabilities on the
assets are assigned to the technical user for remediation.
The remediation times for vulnerabilities can be configured, depending on their
risk or severity.
If a new asset is added to your network, and it is contained in a technical user's
asset group, then vulnerabilities on the asset are automatically assigned to the
technical user.

Copyright IBM Corp. 2012, 2014

71

You can automatically email reports to your technical users with the details of
vulnerabilities that they are responsible for fixing.

Before you begin

If you want to configure a group of assets that are identified by a saved asset
search, you must search your assets and save the results.
For more information about searching assets and saving the results, see the User
Guide for your product.

Procedure
Click the Vulnerabilities tab.
In the navigation pane, click Vulnerability Assignment.
On the toolbar, click Add.
Type a name, email address, and CIDR range.
To automatically assign a technical user in the New Asset Owner window, the
only mandatory fields are Name, Email, and CIDR.
5. To filter the list of assets in your CIDR range by asset name, type a text string
in the Asset Name Filter field.
6. To filter the list of assets in your CIDR range by operating system, type a text
string in the OS Filter field.
7. Optional: Click Asset Search to assign the technical user to the assets
associated with a saved asset search.
1.
2.
3.
4.

8. Click Save.
9. Optional: On the toolbar, click Remediation Times.
You can configure the remediation time for each type of vulnerability,
depending on their risk and severity.
For example, you might need high risk vulnerabilities to be fixed within 5
days.
10. Optional: On the toolbar, click Schedule.
By default, the technical user contact for your assets is updated every 24
hours.
New assets added to your deployment and falling within the CIDR range that
you specified are automatically updated with the technical contact that you
specified.
Important: The schedule applies to the associations you made between
technical users and groups of assets.
11. Optional: Click Update Now, to immediately set the owner of your assets.
Attention: Depending on the size of your deployment, it might take an
extended time to update your assets.
12. Click Save.
Any vulnerabilities that are already assigned to a technical user for
remediation are updated with the new technical user.
13. If vulnerabilities were not previously assigned to a technical user, you must
scan the assets that you assigned to the technical user.
Important: Scanning the assets ensures that any vulnerabilities assigned to a
technical user exist on the asset.

72

QRadar Vulnerability Manager

Configuring remediation times for the vulnerabilities on assigned

assets
In IBM Security QRadar Vulnerability Manager you can configure the remediation
times for different types of vulnerabilities.

Procedure
1.
2.
3.
4.

Click the Vulnerabilities tab.

In the navigation pane, click Vulnerability Assignment.
Select an assignment from the Asset Owners list.
On the toolbar, click Remediation Times.

5. Update the remediation times for vulnerabilities that are based on their risk
and severity.
6. Click Save.

Chapter 9. Vulnerability remediation

73

74

QRadar Vulnerability Manager

Chapter 10. Vulnerability reports

In IBM Security QRadar Vulnerability Manager, you can generate or edit an
existing report, or use the report wizard to create, schedule, and distribute a new
report.
QRadar Vulnerability Manager contains several default reports.
The report wizard provides a step-by-step guide on how to design, schedule, and
generate reports.
For more information, see the IBM Security QRadar SIEM Users Guide.

Emailing technical users with their assigned vulnerabilities that

require remediation
When you assign vulnerabilities to a technical user for remediation, you can
generate a report that emails the technical user.
The email contains information about the vulnerabilities that the technical user
must remediate.

Generating PCI compliance reports

You can generate a compliance report for your PCI (payment card industry) assets.
The compliance report demonstrates that you took all the security precautions
necessary to protect your critical assets.

Running a default QRadar Vulnerability Manager report

In IBM Security QRadar Vulnerability Manager, you can run a default vulnerability
management report.

Procedure
1. Click the Reports tab.
2. From the list of reports, click the report that you want to run.
For example, you might want to show a report of your vulnerability overview
for the last seven days.
3. On the toolbar, select Actions > Run Report, then click OK.
4. To view the completed report in a PDF format, click the icon in the Formats
column.

Emailing assigned vulnerability reports to technical users

In IBM Security QRadar Vulnerability Manager, you can send an assigned
vulnerabilities report to the technical contact for each asset.
An emailed report reminds your administrators that vulnerabilities are assigned to
them and require remediation. Reports can be scheduled monthly, weekly, daily, or
hourly.
Copyright IBM Corp. 2012, 2014

75

Before you begin

You must complete the following tasks:
1. Assign a technical user as the owner of asset groups. For more information, see
Assigning a technical user as the owner of asset groups on page 71
2. Scan the assets that you assigned the technical owner to.
3. Create and save a vulnerability search that uses the Technical Owner Contact
parameter as an input. For more information, see Searching vulnerability
data on page 58

Procedure
Click the Reports tab.
On the toolbar, select Actions > Create.
Click Weekly and then click Next.
Click the undivided report layout that is displayed on the upper left section of
the report wizard and click Next.
5. Type a Report Title.
6. In the Chart Type list, select Asset Vulnerabilities and type a Chart Title.
1.
2.
3.
4.

7. Optional: If a technical contact owner is responsible for more than five assets
and you want to email all asset information, increase the value in the Limit
Assets To Top list.
Remember: By using the Assets tab, you must ensure that the same technical
contact owner is assigned to each asset that they are responsible for.
8. In the Graph Type field, select AggregateTable.
If you select any value other than AggregateTable, the report does not
generate a vulnerability sub-report.
9. In the Graph Content pane, click Search to Use and select your saved
technical contact vulnerability search then click Save Container Details.
10. Click Next and select your report output type.
11. In the report distribution section of the report wizard, click Multiple Reports.
12. Click All Asset Owners.
13. Optional: Click Load asset owners to display all list of the technical users
contact details.
You can remove any technical users that you do not want to email with a list
of assigned vulnerabilities.
14. On the Reports list, select the report that you created and on the toolbar, select
Actions > Run Report.
Related tasks:
Assigning a technical user as the owner of asset groups on page 71
In IBM Security QRadar Vulnerability Manager you can configure groups of assets
and automatically assign their vulnerabilities to technical users.
Searching vulnerability data on page 58
In IBM Security QRadar Vulnerability Manager, you can identify important
vulnerabilities by searching your vulnerability data.

76

QRadar Vulnerability Manager

Generating PCI compliance reports

In IBM Security QRadar Vulnerability Manager, you can generate a compliance
report for your PCI (payment card industry) assets. For example, generate a report
for assets that store credit card or other sensitive financial information.
The compliance report demonstrates that you took all the security precautions
necessary to protect your assets.

Procedure
1. Run a PCI scan for the assets in your network that store or process PCI
information.
For more information, see Creating a scan profile on page 23.
2. Update your asset compliance plans and software declarations.
Your compliance plan and software declarations are displayed in the special
notes section of the executive summary.
For more information, see the PCI security standards for approved software
vendors.
3. Create and run a PCI compliance report for the assets that you scanned.
Related tasks:
Creating a scan profile on page 23
In IBM Security QRadar Vulnerability Manager, you configure scan profiles to
specify how and when your network assets are scanned for vulnerabilities.

Updating your asset compliance plans and software

declarations
In IBM Security QRadar Vulnerability Manager, if you want to generate a PCI
compliance report for your assets, you must complete your attestations for each
asset.
Your attestation of compliance is displayed on your PCI compliance report.

Procedure
1.
2.
3.
4.

Click the Assets tab.

In the navigation pane, click Asset Profiles.
On the Assets page, select the asset that you want to provide an attestation for.
On the toolbar, click Edit Asset.

5. In the Edit Asset Profile window, click the CVSS, Weight & Compliance pane.
6. Complete the following fields. Use the hover help if you need assistance:
v
v
v
v
v

Compliance
Compliance
Compliance
Compliance
Compliance

Plan
Notes
Notes Declaration
Notes Description
Out Of Scope Reason

7. Click Save.

Creating a PCI compliance report

In IBM Security QRadar Vulnerability Manager, you can create and run a PCI
compliance report.
Chapter 10. Vulnerability reports

77

The PCI compliance report demonstrates that your assets involved in PCI activities
comply with security precautions that prevent outside attack.

Before you begin

Ensure that you ran a PCI compliance scan.

Procedure
1.
2.
3.
4.
5.
6.
7.

8.

Click the Reports tab.

On the toolbar, select Actions > Create.
Click Weekly and then click Next.
Click the undivided report layout that is displayed on the upper left section of
the report wizard and click Next.
Type a Report Title.
In the Chart Type list, select Vulnerability Compliance and type a Chart
Title.
In the Scan Profile list, select the scan profile for the assets that you scanned.
Attention: If no scan profile is displayed, you must create and run a PCI
scan of the assets in your network that store or process PCI information.
In the Scan Result list, select the version of the scan profile that you want to
use.

Remember: To provide evidence of your compliance, you must select the

Latest option in the Scan Result list. You can also generate a compliance
report by using a scan profile that was run at an earlier date.
9. In the Report Type list, select a report type.
If you select Executive Summary, Vulnerability Details, or a combination of
both, the attestation is automatically attached to your PCI compliance report.
10. Complete the information in the Scan Customer Information and Approved
Scanning Vendor Information panes.
Important: You must add a name in the Company field for both panes, as
this information is displayed in the attestation section of the report.
11. Click Save Container Details and then click Next.
12. Use the Report Wizard to complete your PCI compliance report.

Results
The report is displayed in the reports list and is automatically generated.

Including column headings in asset searches

Limit asset searches with filters that include custom asset profiles, name,
vulnerability count, and risk score.

Procedure
1. Click the Assets tab.
2. In the navigation pane, click Asset Profiles, then on the toolbar click Search >
New Search.
3. In the field containing column names, in the field on the left, click the column
headings you want to include in your search, and click the arrow button to
move the selected headings to field on the right.

78

QRadar Vulnerability Manager

4. Click the up and down buttons to change the priority of the selected column
headings.
5. When the field on the right contains all the column heading that you want to
search on, click Search.

Chapter 10. Vulnerability reports

79

80

QRadar Vulnerability Manager

Chapter 11. Vulnerability research, news, and advisories

You can use IBM Security QRadar Vulnerability Manager to remain aware of the
vulnerability threat level and manage security in your organization.
A vulnerability library contains common vulnerabilities that are gathered from a
list of external sources. The most significant external resource is the National
Vulnerability Database (NVD). You can research specific vulnerabilities by using a
number of criteria for example, vendor, product, and date range. You might be
interested in specific vulnerabilities that exist in products or services that you use
in your enterprise.
QRadar Vulnerability Manager also provides a list of security-related news articles
and advisories, gathered from an external list of resources and vendors. Articles
and advisories are a useful source of security information from around the world.
Articles also help you to keep up-to-date with current security risks.

Viewing detailed information about published vulnerabilities

In IBM Security QRadar Vulnerability Manager, you can display detailed
vulnerability information.
Using the Research Vulnerabilities page, you can investigate CVSS metrics and
access information from IBM X-Force research and development.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, select Research > Vulnerabilities.
3. Optional: If no vulnerabilities are displayed, select an alternative time range
from the Viewing vulnerabilities from list.
4. Optional: To search the vulnerabilities, on the toolbar, select Search > New
Search.
5. Identify the vulnerability that you want to investigate.
6. Click the vulnerability link in the Vulnerability Name column.

Remaining aware of global security developments

In IBM Security QRadar Vulnerability Manager, you can view security news from
across the world to help keep you updated about current security developments.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Research > News.
3. If no news articles are displayed, select an alternative time range from the
Viewing news from list.
4. To search the news articles, on the toolbar, select Search > New Search.
5. Identify the news article that you want to find out more about.
6. Click the news article link in the Article Title column.

Copyright IBM Corp. 2012, 2014

81

Viewing security advisories from vulnerability vendors

In IBM Security QRadar Vulnerability Manager, you can view the vulnerability
advisories that are issued by software vendors. Use advisory information to help
you identify the risks in your technology, and understand the implications of the
risk.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click Research > Advisories.
3. If no advisories are displayed, select an alternative time range from the
Viewing advisories from list.
4. If you want to search the security advisories, on the toolbar, select Search >
New Search.
5. Click the advisory link in the Advisory column.
Each security advisory might include vulnerability references, solutions, and
workarounds.

Searching vulnerabilities, news, and advisories

In IBM Security QRadar Vulnerability Manager, you can search the vulnerability
news and advisories that are issued by software vendors.

Procedure
1. Click the Vulnerabilities tab.
2. In the navigation pane, click one of the following options:
v Research > Vulnerabilities.
v Research > News.
v Research > Advisories.
3. On the toolbar, select Search > New Search.
4. Type a search phrase in the Phrase field.
5. If you are searching news items, select a news source from the Source list.
6. In the By Date Range area, specify the date period for the news or advisory
that you are interested in.
7. If you are searching a published vulnerability, specify a vendor, product, and
product version in the By Product area.
8. If you are searching a published vulnerability, specify a CVE, Vulnerability, or
OSVDB ID in the By ID area.

82

QRadar Vulnerability Manager

Notices
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this document in
other countries. Consult your local IBM representative for information on the
products and services currently available in your area. Any reference to an IBM
product, program, or service is not intended to state or imply that only that IBM
product, program, or service may be used. Any functionally equivalent product,
program, or service that does not infringe any IBM intellectual property right may
be used instead. However, it is the user's responsibility to evaluate and verify the
operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter
described in this document. The furnishing of this document does not grant you
any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785 U.S.A.
For license inquiries regarding double-byte character set (DBCS) information,
contact the IBM Intellectual Property Department in your country or send
inquiries, in writing, to:
Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan Ltd.
19-21, Nihonbashi-Hakozakicho, Chuo-ku
Tokyo 103-8510, Japan
The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law:
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS
PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS
FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions, therefore, this statement may not apply
to you.
This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.
Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this IBM
product and use of those Web sites is at your own risk.
Copyright IBM Corp. 2012, 2014

83

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.
Licensees of this program who wish to have information about it for the purpose
of enabling: (i) the exchange of information between independently created
programs and other programs (including this one) and (ii) the mutual use of the
information which has been exchanged, should contact:
IBM Corporation
170 Tracer Lane,
Waltham MA 02451, USA
Such information may be available, subject to appropriate terms and conditions,
including in some cases, payment of a fee.
The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer Agreement,
IBM International Program License Agreement or any equivalent agreement
between us.
Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments may
vary significantly. Some measurements may have been made on development-level
systems and there is no guarantee that these measurements will be the same on
generally available systems. Furthermore, some measurements may have been
estimated through extrapolation. Actual results may vary. Users of this document
should verify the applicable data for their specific environment.
Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available sources.
IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.
All statements regarding IBM's future direction or intent are subject to change or
withdrawal without notice, and represent goals and objectives only.
All IBM prices shown are IBM's suggested retail prices, are current and are subject
to change without notice. Dealer prices may vary.
This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include the
names of individuals, companies, brands, and products. All of these names are
fictitious and any similarity to the names and addresses used by an actual business
enterprise is entirely coincidental.
If you are viewing this information softcopy, the photographs and color
illustrations may not appear.

Trademarks
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of
International Business Machines Corporation in the United States, other countries,
or both. If these and other IBM trademarked terms are marked on their first
occurrence in this information with a trademark symbol ( or ), these symbols

84

QRadar Vulnerability Manager

indicate U.S. registered or common law trademarks owned by IBM at the time this
information was published. Such trademarks may also be registered or common
law trademarks in other countries. A current list of IBM trademarks is available on
the Web at Copyright and trademark information (www.ibm.com/legal/
copytrade.shtml).
Java and all Java-based trademarks and logos are trademarks or registered
trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.
Linux is a trademark of Linus Torvalds in the United States, other countries, or
both.
Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.
UNIX is a registered trademark of The Open Group in the United States and other
countries.
Other company, product, and service names may be trademarks or service marks
of others.

Privacy policy considerations

IBM Software products, including software as a service solutions, (Software
Offerings) may use cookies or other technologies to collect product usage
information, to help improve the end user experience, to tailor interactions with
the end user or for other purposes. In many cases no personally identifiable
information is collected by the Software Offerings. Some of our Software Offerings
can help enable you to collect personally identifiable information. If this Software
Offering uses cookies to collect personally identifiable information, specific
information about this offerings use of cookies is set forth below.
Depending upon the configurations deployed, this Software Offering may use
session cookies that collect each users session id for purposes of session
management and authentication. These cookies can be disabled, but disabling them
will also eliminate the functionality they enable.
If the configurations deployed for this Software Offering provide you as customer
the ability to collect personally identifiable information from end users via cookies
and other technologies, you should seek your own legal advice about any laws
applicable to such data collection, including any requirements for notice and
consent.
For more information about the use of various technologies, including cookies, for
these purposes, See IBMs Privacy Policy at http://www.ibm.com/privacy and
IBMs Online Privacy Statement at http://www.ibm.com/privacy/details the
section entitled Cookies, Web Beacons and Other Technologies and the IBM
Software Products and Software-as-a-Service Privacy Statement at
http://www.ibm.com/software/info/product-privacy.

Notices

85

86

QRadar Vulnerability Manager

Glossary
This glossary provides terms and definitions for
the IBM Security QRadar Vulnerability Manager
software and products.
The following cross-references are used in this
glossary:
v See refers you from a non-preferred term to the
preferred term or from an abbreviation to the
spelled-out form.
v See also refers you to a related or contrasting
term.
For other terms and definitions, see the IBM
Terminology website (opens in new window).
A C D E F H I on page 88 N on
page 88 O on page 88 P on page 88 R on
page 88 S on page 88 T on page 88 U on
page 88 V on page 89

A manageable object that is either

deployed or intended to be deployed in
an operational environment.

C
CDP

A web-based interface from which an

operator can control and observe the
system operation.
CVSS See common vulnerability scoring system.

D
DNS

See Domain Name System.

DNS zone transfer

A transaction that replicates a Domain
Name System (DNS) database.
Domain Name System (DNS)
The distributed database system that
maps domain names to IP addresses.

encryption
In computer security, the process of
transforming data into an unintelligible
form in such a way that the original data
either cannot be obtained or can be
obtained only by using a decryption
process.

F
See collateral damage potential.

CIDR See Classless Inter-Domain Routing.

Classless Inter-Domain Routing (CIDR)
A method for adding class C Internet
Protocol (IP) addresses. The addresses are
given to Internet Service Providers (ISPs)
for use by their customers. CIDR
addresses reduce the size of routing tables
and make more IP addresses available
within organizations.
client

console

advisory
A document that contains information
and analysis about a threat or
vulnerability.
asset

common vulnerability scoring system (CVSS)

A scoring system by which the severity of
a vulnerability is measured.

A software program or computer that

requests services from a server.

collateral damage potential (CDP)

A measurement of the potential impact of
an exploited vulnerability on a physical
asset or on an organization.
Copyright IBM Corp. 2012, 2014

false positive exception rule

A rule specific to low-risk vulnerabilities
that minimizes the volume of
vulnerabilities that are managed.

H
HA

See high availability.

high availability (HA)

Pertaining to a clustered system that is
reconfigured when node or daemon
failures occur so that workloads can be
redistributed to the remaining nodes in
the cluster.

87

I
Internet Protocol (IP)
A protocol that routes data through a
network or interconnected networks. This
protocol acts as an intermediary between
the higher protocol layers and the
physical network. See also Transmission
Control Protocol.
See Internet Protocol.

IP

N
national vulnerability database (NVD)
A United States repository of
standards-based vulnerability
management data.
NVD

See national vulnerability database.

O
offense
A message sent or an event generated in
response to a monitored condition. For
example, an offense will provide
information on whether a policy has been
breached or the network is under attack.
on-demand scan
A scan that runs only when initiated by
the user. The types of scans include full
scans, discovery scans, patch scans, PCI
scans, database scans and web scans.
operational window
A configured time period within which a
scan is permitted to run.

PCI DSS
See Payment Card Industry Data Security
Standard.
PCI severity level
The level of risk that a vulnerability poses
to the payment card industry.

R
remediation process
A process of assigning, tracking, and
fixing vulnerabilities that have been
identified on an asset.

S
scan exclusion list
A list of assets, network groups, and
CIDR ranges that are ignored by scans.
scan profile
The configuration information that
specifies how and when the assets on a
network are scanned for vulnerabilities.
Simple Network Management Protocol (SNMP)
A set of protocols for monitoring systems
and devices in complex networks.
Information about managed devices is
defined and stored in a Management
Information Base (MIB).
SNMP
See Simple Network Management
Protocol.

T
TCP

P
Payment Card Industry Data Security Standard
(PCI DSS)
A worldwide information security
standard assembled by the Payment Card
Industry Security Standards Council (PCI
SSC). The standard was created to help
organizations that process card payments
to prevent credit card fraud through
increased controls around data and its
exposure to compromise. The standard
applies to all organizations which hold,
process, or pass cardholder information
from any card branded with the logo of
one of the card brands.

88

QRadar Vulnerability Manager

See Transmission Control Protocol.

Transmission Control Protocol (TCP)

A communication protocol used in the
Internet and in any network that follows
the Internet Engineering Task Force (IETF)
standards for internetwork protocol. TCP
provides a reliable host-to-host protocol in
packet-switched communication networks
and in interconnected systems of such
networks. See also Internet Protocol.

U
UDP

See User Datagram Protocol.

User Datagram Protocol (UDP)

An Internet protocol that provides
unreliable, connectionless datagram

service. It enables an application program

on one machine or process to send a
datagram to an application program on
another machine or process.

V
vulnerability
A security exposure in an operating
system, system software, or application
software component.

Glossary

89

90

QRadar Vulnerability Manager

Index
A

deployment editor
verifying the vulnerability
processor 7
DMZ
scanning 10
DMZ scanning
configuring QRadar Vulnerability
Manager 11
DMZ scans
asset configuration 10
network configuration 10
document mode
Internet Explorer web browser 12
domain scanning
scheduling 28
domain scans
configuring 28

activation keys
QRadar Vulnerability Manager 4
QRadar Vulnerability Manager
appliances 4
administrative shares 44
asset configuration
DMZ scanning 10
asset search filters
custom asset properties 52, 78
asset vulnerabilities
analyzing 62
authenticated scanning 38
Linux,UNIX 37

B
backup and recovery
vulnerability data 4
benchmark scan profiles
configuring 25
creating 25
browser mode
Internet Explorer web browser

E
exception rules
manage 69
managing 70
excluded scan targets
managing 31
executing
scans 25, 26

12

C
CIDR ranges 48
scanning 30
customized vulnerability dashboards
creating 16

F
false positive vulnerabilities
reducing 63

D
dashboards
creating for vulnerability
management 16, 17
displaying for vulnerability
management 16
information about vulnerability
management 16
DCOM 43
default vulnerability management
dashboard
displaying 16
default vulnerability reports
running 75
deployment
DMZ scanner 10, 11
managed host processor 6
managed host scanner 9
QRadar Vulnerability Manager
processor 6
removing a vulnerability processor
verifying the vulnerability
processor 7
Vulnerability scanners 8

Copyright IBM Corp. 2012, 2014

G
glossary

87

H
high risk assets and vulnerabilities
identifying 64
high risk vulnerabilities
prioritizing 65
high risk vulnerability reports
emailing 76

IBM Endpoint Manager

integrating with QRadar Vulnerability
Manager 20, 21
integration 20
vulnerabilities with patch
available 66
IBM Security SiteProtector
connecting to QRadar Vulnerability
Manager 22
integrating 22
integration 22

install and deploy

QRadar Vulnerability Manager
introduction vii
IP addresses
scanning 30
IP ranges
scanning 30

L
Linux 38
patch scanning

34

M
managed host
deploying a processor 6
deploying a scanner 9
installation and processor
deployment 6

N
network administrator vii
network configuration
DMZ scanning 10
network vulnerabilities
reviewing 62
new asset scans
scheduling 28, 29
new features
version 7.2.4 user guide overview
news articles
researching 81

O
open port
scans 33
open port scans
configuring 33
open service vulnerabilities
analyzing 63
operational window
removing from scan profile
scans 45
operational windows
creating 45
editing 46

46

P
patch compliance dashboards
creating 17
patch scanning 40, 41, 42, 43, 44
Linux 34
UNIX 34
Windows 34, 39
pending patch downloads 54

91

permitted scan intervals

configuring 45
managing 46
port range scans
configuring 32
port ranges
scanning 32

Q
QRadar managed host
deploying a scanner 9
scanner deployment 9
QRadar Risk Manager
integration 19
QRadar Vulnerability Manager
activation keys 4
connecting IBM Security
SiteProtector 22
DMZ scanner deployment 11
DMZ scanning 10
installation and deployment 3
integrating IBM Endpoint
Manager 20, 21
overview 15
QRadar Vulnerability Manager appliance
activation keys 4
QRadar Vulnerability Manager processor
deployment 6
removal 7
QRadar Vulnerability Manager scanner
deployment 9
QRadar Vulnerability Manager scanners
additional deployments 8

R
remote registry 41
risk score
color coding 66
risk scores
investigating 57

S
saved vulnerability searches
deleting 61
scan exclusions
creating 31
managing 31
scan profile
configuration options 26
scan profile details
configuring 26
scan profiles
configuring 23, 24
creating 23, 24
excluding assets from scans 31
port range scanning 32
removing operational windows 46
running manually 25, 26
scheduling scans 28
specifying scan targets 30
windows patch scanning 39
scan results
management of 52

92

QRadar Vulnerability Manager

scan results (continued)

overview 51
searching 51
scanner deployment
verification 11
scanners
deployment options 8
scanning
DMZ 10
UNIX 34
Scanning 48
scans
executing 25, 26
running 25, 26
scheduling 28
scheduled scans
new unscanned assets 28, 29
security integrations
IBM Endpoint Manager 20
IBM Security SiteProtector 22
QRadar Risk Manager 19
security software
integrations 19
SNMP community names
scanning 34

T
technical owner asset details
configuring 77

U
UNIX 38
patch scanning 34
UNIX authenticated scans

38

V
vulnerabilities
assigning for remediation
automatically 72, 73
manually 71
backup and recovery 4
managing 57
researching 81
researching advisories 82
risk score 57
scanning 15, 23
scheduling scans 28
viewing history 63
vulnerability advisories
reviewing 82
vulnerability data
reviewing 53
vulnerability exception rules
applying automatically 63
creating 69
vulnerability exceptions
automatic configuration 63
searching 58
vulnerability history
viewing 63
vulnerability instances
analyzing 62

vulnerability management
creating a customized dashboard 16
creating a patch compliance
dashboard 17
displaying the default dashboard 16
overview 15
vulnerability patch status
identifying 67
vulnerability processor
adding to deployment 6
deploying on a managed host 5
deploying to a QRadar console 6
deploying to a QRadar Vulnerability
Manager managed host 6
moving to a managed host 5
removal 7
verifying deployment 7
vulnerability remediation
management 71
vulnerability reports
creating and scheduling 78
emailing 76
pci compliance 77
Vulnerability reports
overview 75
vulnerability research
overview 81
vulnerability risk
scoring vulnerabilities 57
vulnerability risk and pci severity
reviewing 54
vulnerability risk levels
reviewing 53
vulnerability scanning
scan profiles 23
specifying scan targets 30
vulnerability scans 38, 40, 41, 42
during permitted times 45
email when scans start and stop 55
excluding assets from scans 31
open port scanning 33
permitted scan intervals 45
port ranges 32
public key authentication 36
scheduling 28
UNIX authenticated scans 37
Windows patch scans 39
vulnerability search
parameters 59
vulnerability searches
saving criteria 61

W
web browser
supported versions 11, 12
what's new
version 7.2.4 user guide overview 1
Windows 40, 41, 42
patch scanning 34
Windows patch scanning 40, 41, 42, 43,
44
configuring 39
Windows remote registry access
configuring 41
Windows scanning
enabling remote registry access 41

WMI

40, 42, 43

Index

93