Topics Discussed

Product Overview


The Vulnerability Scanning service provides for continuous vulnerability scanning. For Virtual Machines, the service is facilitated by a vulnerability scanning agent that is deployed with the Armor Agent (the “Scan Agent”). For container images, the service is facilitated by a container sensor deployed to a container host (the “Sensor”).

Both the Scan Agent and Sensor collect information about the instance and includes basic asset identification information, Windows registry information (for Windows systems only), and file version and package information. This information is securely communicated to a scanning platform that assesses the data, determines the vulnerabilities that exist, and reports this data to customers in the Armor Management Portal (AMP). The Scan Agent and Sensor collect the information periodically throughout each day and reports the results to the platform. Armor posts vulnerability information in AMP on both a daily and weekly basis to represent the state of the instance as of the last scan report.

AMP provides information related to vulnerability information and includes vulnerability reports on a weekly basis. Each report contains details on the vulnerabilities identified, including the name and description of each vulnerability, the assets that are affected by each vulnerability, the CVSS score for the vulnerability, and the criticality rating (i.e., Critical, High, Medium, Low, or Informational). Customer can review the results by each vulnerability on a virtual machine/container image basis and by the criticality rating of the identified vulnerabilities.



Armor’s vulnerability scanning service puts our customers in control of their network. Keeping them ahead of the next threat through increased visibility, preparedness, and protection. Armor’s service scans internal and external networks for technical vulnerabilities, patching, and compliance issues—providing clients with the ability to mitigate risk and ensure compliance.

To fully use this screen, you must add the following permissions to your account:

  • View Vulnerability Scans
  • Write New Vulnerability Report
  • View Vulnerability Exclusions
  • Write Vulnerability Exclusions

Once the Scan Agent or Sensor is installed, the initial scan starts immediately. Subsequent scans take place daily (every 4 hours for virtual machines, every 24 hours for container images) and the data displayed on the Vulnerabilities tab is refreshed every day at 22:00 GMT (6pm CST or 7pm CST) depending on day light savings.

Weekly reports are generated at 22:00 GMT every Sunday. Weekly reports are available for 13 months. When a report is complete, it will be available in the Reports screen. Weekly Reports reflect imported data and does not initiate scans. Based on your dat's location and your environment, your report's availability in AMP may vary.


Vulnerabilities


You can use the Vulnerabilities screen to view information for a specific vulnerability scanning report within an interactive table. 

Users can manually refresh the table data using the refresh data link at the top of the table, but the data displayed will only reflect the state of the environment at the time of the last interval scan. For example, if your next scheduled scan occurs at 4pm, refreshing the data will show the state of your environment at noon and not reflect any patching you did at 3:30pm. 

This screen also displays severity levels for each detected vulnerability, along with the quantity of vulnerabilities detected for each severity level. A severity is assigned to a vulnerability based on the Common Vulnerability Scoring System (CVSS). CVSS is the accepted system to rate the severity status of a vulnerability. Armor uses NVD CVSS v3.0 to score vulnerabilities. To learn more, please see the National Vulnerability Database website. 

You can use this information to prioritize how to troubleshoot these vulnerabilities, as well as understand how these vulnerabilities can affect your environment. 

A user concerned with patching vulnerabilities will be primarily focused on the information in the Vulnerabilities tab. 

Even though a vulnerability is patched, it should be expected that AMP will not immediately reflect any updates as scans occur at 4 hour intervals. Even when manually refreshing the data, expect patched vulnerabilities to remain visible. Patched vulnerabilities should disappear from the Vulnerabilities tab after the 22:00 GMT daily refresh. 


  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security
  2. Click Vulnerability Scanning
ColumnDescription
Vulnerability NameThis column displays the name of the vulnerability scan report.
Affected AssetsThis column displays the number of assets affected by the vulnerability, regardless of asset type (virtual machines and/or container images). 
Excluded AssetsThis column displays the number of assets excluded from the scan for the vulnerability. 
CVSS Score

This columns displays the Common Vulnerability Scoring System (CVSS) score assigned to the vulnerability. 

The breakdown of CVSS Scores aligns with the Severity types. 

Severity

This column displays the severity level of the vulnerability. 

There are four severity types, based on the vulnerability's CVSS:

  • Critical vulnerabilities receive a score of 10.
  • High vulnerabilities receive a score of 7-10.
  • Medium vulnerabilities receive a score of 4-7.
  • Low vulnerabilities receive a score of 0-4.

    There is an additional severity type called Info. Although Info is listed as a severity type, in reality, Info simply displays activity information for corresponding plugins from third-party vendors. 

Known Exploits

This column indicates if there are any known exploits for the vulnerability.

  • Yes indicates that a known exploit exists for the vulnerability.
  • No indicates that there are no known exploits.


Clicking a Vulnerability Name will take the user to the detail screen for that vulnerability. The vulnerability detail screen includes a synopsis of the vulnerability, a table of affected assets, and the remediation guidance for the vulnerability. 

The Affected Assets table includes:

  • Asset Name
  • If the asset has been excluded (see Vulnerability Exclusions)
  • Asset ID
  • Asset Type
  • Date stamps for first and last time the vulnerability has been detected on the asset


Exclusions


Vulnerability Exclusions give users the ability to manage their vulnerability programs. Users can exclude vulnerabilities on specific reports or silence them to be addressed later.

ColumnDescription
Vulnerability This column displays the name of the vulnerability excluded.
Excluded AssetsThis column displays the number of assets excluded from the vulnerability, regardless of asset type (virtual machines and/or container images). 
ReasonThis column displays the risk reason selected in the Exclude Assets form.
CVSS Score

This columns displays the Common Vulnerability Scoring System (CVSS) score assigned to the vulnerability. 

The breakdown of CVSS Scores aligns with the Severity types. 

Severity

This column displays the severity level of the vulnerability. 

There are four severity types, based on the vulnerability's CVSS:

  • Critical vulnerabilities receive a score of 10.
  • High vulnerabilities receive a score of 7-10.
  • Medium vulnerabilities receive a score of 4-7.
  • Low vulnerabilities receive a score of 0-4.

    There is an additional severity type called Info. Although Info is listed as a severity type, in reality, Info simply displays activity information for corresponding plugins from third-party vendors. 

Known Exploits

This column indicates if there are any known exploits for the vulnerability.

  • Yes indicates that a known exploit exists for the vulnerability.
  • No indicates that there are no known exploits.

Users can filter the table by any of the columns listed above. 

Clicking the Menu icon to the right of the Expires On column allows users to View a read-only copy of the Exclusion Details or Remove Exclusions from the associated assets. 


Reports


The Reports screen displays a table of completed reports. Reports are compiled and published on a weekly basis. 

Armor generates a vulnerability report once a week on Sundays at 10:00PM UTC. These reports are stored for 13 months. This weekly report is valuable for Compliance and can be provided to auditors to illustrate patching activity over time. For example, a series of reports for an environment might show a decrease in Critical vulnerabilities over a span of weeks, showing actions taken to resolve detected vulnerabilities. A user concerned with patching vulnerabilities day to day will primarily focus on the Vulnerabilities tab. 


ColumnDescription
Report NameReports are named by the date on which they are imported from the VS service.
Import TimeImport time is the time at which the report is imported into AMP. 
Import StatusImport status is the status of the report job. Reports listed will show a status of either Completed or InProgress.
Vulnerabilities

This column provides an at-a-glance view of the number of vulnerabilities included in a specific report, grouped by severity. 

Change in Quantity of Severity

On April 1, 2021 we switched from the vulnerability subagent platform severity scoring to the industry standard of NVD CVSS v3.0 (https://nvd.nist.gov/vuln-metrics/cvss). Some of what the vulnerability subagent deemed critical, may not have a 10.0 CVSS v3.0 score. As a result of this, you may find a significant increase in the number of critical severities. Please note that the vulnerabilities themselves were detected previously and only scored differently. 

Data from within a Report can be filtered either by Vulnerability or Virtual Machine using the tabs at the top of the report. 


Enable Vulnerability Scanning for Virtual Machines


Use the following commands to manage the Vulnerability Scanning service within the Scan Agent. 


Install Vulnerability Scanning:

Windows: C:\.armor\opt\armor.exe vuln install
Linux: /opt/armor/armor vuln install


Uninstall Vulnerability Scanning:

Windows: C:\.armor\opt\armor.exe vuln uninstall
Linux: /opt/armor/armor vuln uninstall 


Vulnerability Scanning Help

Windows: C:\.armor\opt\armor.exe vuln help
Linux: /opt/armor/armor vuln help 


Enable Vulnerability Scanning for Container Images


For instructions on how to get started with Container Images, please see the documentation provided here


View a Report


  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security
  2. Click Vulnerability Scanning
  3. Click the Reports tab.
  4. Locate and select the desired scan. 
  5. On the next screen, you can filter the table By Vulnerabilities or By VM (virtual machine / host). 

Troubleshooting

If you do not see any data in the Vulnerability Scanning screen, consider that:

  • The scanning is not complete. 
    • The scan takes place every Sunday at approximately 10:00 PM, local server time.
  • You do not have permission to view this screen. 
    • You must have the View Vulnerability Scans permission enabled. Contact your account administrator to enable this permission. To learn how to update your permissions, see Roles and Permissions.

If a virtual machine is incorrectly labeled as offline in a report, then contact Armor Support to run the Armor Toolbox. 


Filter By Vulnerabilities


When you filter the table By Vulnerabilities, you will see: 

COLUMN NAMEDESCRIPTION
Vulnerability Name

This column displays the name of the vulnerability.
You can click the Vulnerability Name to learn more about the vulnerability. You will be taken to a detailed page where you can review a description of the vulnerability, along with the solution. To learn how to troubleshoot, see Troubleshoot a vulnerability.

Affected Assests

This column displays the virtual machines (host) affected by the vulnerability.

If you are unfamiliar with the name of a virtual machine, you can use the Virtual Machines screen to search.

  1. Copy the desired virtual machine name (host name or CoreInstance ID).
  2. In the Armor Management Portal (AMP), in the left-side navigation, click Infrastructure.
  3. Click Virtual Machines.
  4. In the search field, paste the virtual machine name (host name or CoreInstance ID), and then click the magnifying glass icon.
CategoryThis column displays the category(s) associated with the vulnerability. For a complete list of vulnerability categories and QIDs, please see this documentation
Known Exploits

This column indicates if there are any known exploits for the vulnerability.

  • Yes indicates that a known exploit exists for the vulnerability.
  • No indicates that there are no known exploits.
Severity

This column displays the severity of the vulnerability.

There are four severity types, based on the vulnerability's CVSS:

  • Critical vulnerabilities receive a score of 10.
  • High vulnerabilities receive a score of 7-10.
  • Medium vulnerabilities receive a score of 4-7.
  • Low vulnerabilities receive a score of 0-4.
     

There is an additional severity type called Info. Although Info is listed as a severity type, in reality, Info simply displays activity information for corresponding plugins from third-party vendors. 


Filter By Virtual Machines


You will only see vulnerabilities for your active virtual machines.

When you filter the table By VM (virtual machines / host) you will see: 

COLUMNDESCRIPTION
VM Name

This column displays the virtual machines (host) affected by this vulnerability.

If you are unfamiliar with the name of a virtual machine, you can use the Virtual Machines screen to search.

  1. Copy the desired virtual machine name (host name or CoreInstance ID).
  2. In the Armor Management Portal (AMP), in the left-side navigation, click Infrastructure.
  3. Click Virtual Machines.
  4. In the search field, paste the virtual machine name (host name or CoreInstance ID), and then click the magnifying glass icon.
Last ScanThis column displays the date and time of the last scan.
CriticalThis column displays the number of vulnerabilities that contained a score of 10.
HighThis column displays a vulnerability that scored between 7 to 10 on the CVSS.
MediumThis column displays a vulnerability that scored between 4 to 7 on the CVSS.
LowThis column displays a vulnerability that scored between 0 to 4 on the CVSS.
InfoThis column displays activity information regarding corresponding plugins from a third-party vendor.


Request a New Vulnerability Scan Report


A weekly vulnerability scan report is available in AMP. If you want a new report outside of the weekly report, you can request an "ad-hoc" report as needed.*

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security
  2. Click Vulnerability Scanning
  3. Click the Reports tab.
  4. Click Get New Report

  5. In the New Report Request window, click Submit.

    • The latest scan report will be requested, and will display in the list of reports on the Vulnerability Scanning screen in a Pending status.
    • You may need to refresh the page to view the report status.

If you recently provisioned a new virtual machine, configured new container images, or recently patched a vulnerability, Armor recommends that you wait at least 6 hours to ensure the changes are reflected in the latest report.

*Assets still using Rapid7 are limited to one report every 24 hours.

When resolving vulnerabilities, an old package must be removed after installing a new one in order for the vulnerability to be considered resolved. As long as a vulnerable package is on the machine, the vulnerability will remain.

For more information, please refer to the documentation here and here


Export a Report of Vulnerabilities


From the By Vulnerability section, you can also download a CSV report.

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.
  2. Click Vulnerability Scanning.
  3. Click By Vulnerability.
  4. (Optional) Ue the filter function to customize the data displayed.
  5. Below the table, click CSV.
    • You have the option to export all the data (All) or only the data that appears on the current screen (Current Set). 


Export a Report of a Virtual Machines


From the By VM section, you can also download a CSV report.

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.
  2. Click Vulnerability Scanning.
  3. Click By VM.
  4. (Optional) Ue the filter function to customize the data displayed.
  5. Below the table, click CSV.
    • You have the option to export all the data (All) or only the data that appears on the current screen (Current Set). 


Log Search for Vulnerability Scanning


Users can search for Vulnerability events in Log Search. For instructions on how to access and use Log Search, please see our documentation here

An example of Vulnerability logs can be seen below: 


For a full list of Log Search fields and descriptions, please visit our glossary here


Troubleshooting 

Each listed vulnerability contains information on how to troubleshoot the vulnerability, typically by downloading a patch from an external source. 

  1. In the Armor Management Portal (AMP), on the left-side navigation, click Security.
  2. Click Vulnerability Scanning.
  3. Select a vulnerability scanning report. 
  4. In the next screen, select By Vulnerabilities.
  5. Select a vulnerability. You will be taken to a description page where you can review a description of the vulnerability, including the solution. 
  6. Under See Also, click the link to access external information and to download a patch. 

To return to the previous screen and view additional vulnerabilities for the current report, click the name of the current report in the top menu.

Troubleshooting

If you do not see any data in the Vulnerability Scanning screen, consider that:

  • The scanning is not complete. 
    • The scan takes place every Sunday at approximately 10:00 PM, local server time.

  • Your firewall rules have not been updated to support this feature. This applies onto for the Scan Agent and not Container Images

    INBOUND / OUTBOUNDSERVICE / PURPOSEPORTDESTINATION
    Outbound

    Vulnerability Scanning

    *443/tcp64.39.96.0/20

    * The agent will perform a lookup to the applicable DNS entry, which may resolve to one of multiple Amazon Web Services based subnets. As a result, if your firewall does not support outbound filtering by domain name, then you may need to open all outbound traffic to 443/tcp to accommodate this service.

  • You do not have permission to view this screen. 
    • You must have the View Vulnerability Scans permission enabled. Contact your account administrator to enable this permission. To learn how to update your permissions, see Roles and Permissions.

If a virtual machine is incorrectly labeled as offline in a report, then contact Armor Support to run the Armor Toolbox. 



Related Documentation




Was this helpful?
Your Rating: Results: 1 Star2 Star3 Star4 Star5 Star 24 rates