Page Comparison

This document will cover the various scan types that can be initiated in V4 and provide some helpful insight into troubleshooting common issues for failed scans.

V4 Scan Types - Table of Contents

...

V4 Scan Types

...

Full Scan (Probe Scan)

The Full Scan initiates Asset Discovery, Vulnerability, SNMP, Firewall, and Active Directory Scans using configured parameters under Discovery Settings and Credentials.

...

The following methods are used to communicate with assets:

Windows

It attempts to use the Admin SMB (Admin$) share to send a small executable called the Dissolvable Agent that it then runs on the remote machine to fetch the details. It probes the shares using standard SMB tools and does an NFS discovery to check any NFS shares.

Active Directory

It uses LDAP to query the users and groups from the Credentials provided during the AD setup in the AD/Master credentials. It runs PowerShell commands to figure out GPOs, Security Groups, and Memberships of the Groups.

Linux

It uses SSH credentials to log into the asset and determine what processes run using Linux commands.

Network Devices

It uses SNMP to discover the SysObjectID, look up the device's version, and query vulnerabilities for that version. It also connects to OEM APIs to get vulnerability details.

Asset Discovery Scan

To use this scan with your Probe agents, configure the IP Range settings (CIDR, Static, Range) under the Discovery Settings and Credentials section. Once configured, you can initiate the Full Scan or Asset Discovery Scan to scan the configured subnet(s) for assets. You can also set up Exclude IP settings for these scans if needed.

Active Directory Scan

To use this scan with your Probe agents, you need to configure Active Directory Credentials, which are associated with your Probe. We are using a dissolvable agent if SMB is available, creating PowerShell in memory to execute. If SMB is unavailable, we use LDAP directly without the PowerShell scripts.

Active Directory Scan Method

1. A vulnerability scan is performed on the computers detected during the Active Directory scan.

2. If any of the Active Directory computers have a Lightweight Agent installed, the asset will be skipped as it is being scanned by the Lightweight agent locally.

3. The scan utilizes NMAP device discovery on the remaining computers.

Active Directory Prerequisite

Enable Audit Events - To perform an Active Directory Audit on a Domain Controller, it is essential first to enable Audit Events. Once enabled, the ConnectSecure Scan Agent will read the Audit Events every 15 minutes and push those updates to your ConnectSecure portal.

...

AUDITPOL /SET /SUBCATEGORY:"Kerberos Authentication Service" /SUCCESS:ENABLE /FAILURE:ENABLE

Compliance Scan

NEED INFO

SNMP Scan

SNMP-enabled devices will be detected and scanned by the ConnectSecure Scan Agent. It will read the SNMP description using the defined SNMP Credentials (from the Probe). For supported network devices, it will initiate a vulnerability scan automatically.

Vulnerability Scan

This scan helps you identify vulnerabilities based on the installed application and/or security updates. It uses the SMB protocol for scanning purposes. Sometimes, you may need to provide the credentials and/or user privileges to scan an asset.

...

Supported Operating Systems for Vulnerability Scanning in V4

...

How To Initiate Scans in V4

Lightweight Agent Scans

The Lightweight Agent scan in V4 automatically runs every 15, 30, 60, 90, or 120 minutes, based on your LW Agent Scan Interval in the Global > Overview > Settings menu.

...

3. Assets > Asset > Asset Details Screen = Tap on the IP address of any Asset to see the Asset Details view; use the Scan Now button on the action toolbar to scan that single asset.

...

Troubleshooting Failed Scans

Work in progress

...