Configure vulnerability assessments

Configure CVE matching

Product Guardian
Syntax conf.user configure va cve enable [true|false|if_not_sync]
Description CVE matching depends on both the configuration value and whether the sensor is connected to an upstream system (CMC or Vantage). The behavior is as follows:
  • true CVE matching is always performed locally on the sensor, regardless of upstream connectivity
  • false CVE matching is completely disabled on the sensor
  • if_not_sync CVE matching follows the intended default behavior:
    • Enabled locally only when the sensor is not connected upstream
    • Delegated upstream when the sensor is connected
Important:
New sensors are explicitly configured with if_not_sync
Important:
When if_not_sync or false are not explicitly configured, CVE matching runs locally on the sensor. This can lead to increased CPU and memory usage on the sensor. Therefore, it is strongly recommended to explicitly configure if_not_sync when CVE processing can be delegated upstream.
Where CLI
To apply In a shell console execute: service n2osva stop

Configure CVE matching options

Product Guardian
Syntax conf.user configure va cve options <json_value>
Description This command allows the configuration of diverse CVE matching options. The JSON object can have the following attributes: skip_windows_if_hotfixes_missing. This boolean controls whether CVE calculation should be skipped for Windows CPEs if hotfix information is not available (default: true).
Where CLI
To apply In a shell console execute: service n2osva stop

Enables the management of Microsoft Hotfixes

Product Guardian
Syntax conf.user configure va hotfixes_enabled <flag>
Description Please consider that when this is set to true hotfixes are loaded and used to set CVEs status whereas when this flag is set to false, hotfixes are not loaded nor used by CVE calculation.
Parameters flag: The management of Microsoft Hotfixes is enabled by default
Where CLI
To apply It is applied automatically

Disable the Microsoft Hotfixes resolution capabilities

Product Guardian
Syntax conf.user configure va use_hotfix_resolution <flag>
Description Please consider that disabling the Microsoft Hotfixes resolution feature means that CVEs for Microsoft Windows machines will not be automatically closed through Smart Polling, and as a consequence those nodes might be assigned by Guardian a large number of obsolete CVEs.
Parameters flag: Microsoft Hotfixes resolution is enabled by default
Where CLI
To apply It is applied automatically

Disable the CPE computation for a specific node

Product Guardian
Syntax conf.user configure va cpe disable <node_id> [true|false]
Description Please consider that, when this command is used, the vulnerabilities assessment engine is completely disabled for that specific node and no CVEs will be assigned to the node itself.
Parameters node_id: Node ID of the node targeting the rule
Where CLI
To apply It is applied automatically

Disable End Of Life CPEs calculation

Product Guardian
Syntax conf.user configure va use_eol_cpe_calculation false
Description By default, when CVE associated to CPES calculation is perfomed, CPE that are referring to products that reached End Of Life are not taken into account. To disable this behaviour use this configuration.
Where CLI
To apply In a shell console execute: service n2osva stop