Page Comparison

This document will cover the various scan types that can be initiated in V4 and provide some helpful insight into troubleshooting common issues for failed scans.

...

V4 Scan Types - Table of Contents

...

V4 Scan Types

Scan Data

SCAN DATA	Vulnerability	Asset Discovery	SNMP	Active Directory	Compliance	PII

Scan Type

SCAN TYPE
Full

Scan

	Yes	Yes	Yes	Yes	Yes	No
Network

Scan

	Yes	Yes	Yes	No	No	No
Active Directory

Scan

	Yes	Yes	No	Yes	No	No
Firewall	Yes	No	No

SNMP Scan

Yes

No	No	No
PII	No

Yes

No

No

No

No

Yes

Firewall Scan

External

Yes

No

No

No

No

No

PII Scan

Compliance	No	No	No	No	Yes	No
Attack Surface Mapper	Yes	No	No	No	No	No

...

Full Scan (Probe Scan)

The Full Scan initiates Asset Discovery, Vulnerability, SNMP, Firewall, and Active Directory Scans using configured parameters under Discovery Settings and Credentials.

...

The following methods are used to communicate with assets:

Windows

It attempts to use the Admin SMB (Admin$) share to send a small executable called the Dissolvable Agent that it , which then runs on the remote machine to fetch the details. It probes the shares using standard SMB tools and does an NFS discovery to check any NFS shares.

Active Directory

It uses LDAP to query the users and groups from the Credentials provided during the AD setup in the AD/Master credentials. It runs PowerShell commands to figure out GPOs, Security Groups, and Memberships of the Groups.

Linux

It uses SSH credentials to log into the asset and determine what processes run using Linux commands.

Network Devices

It uses SNMP to discover the SysObjectID, look up the device's version, and query vulnerabilities for that version. It also connects to OEM APIs to get vulnerability details.

Asset Discovery Scan

To use this scan with your Probe agents, configure the IP Range settings (CIDR, Static, Range) under the Discovery Settings and Credentials section. Once configured, you can initiate the Full Scan or Asset Discovery Scan to scan the configured subnet(s) for assets. You can also set up Exclude IP settings for these scans if needed.

Active Directory Scan

To use this scan with your Probe agents, you need to configure the Active Directory Credentials , which are associated with your Probe. We are using If SMB is available, we use a dissolvable agent if SMB is available, creating PowerShell in memory to execute. If SMB is unavailable, we use LDAP directly without the PowerShell scripts.

Active Directory Scan Method

1. A vulnerability scan is performed on the computers detected during the Active Directory scan.

2. If any of the Active Directory computers have a Lightweight Agent installed, the asset will be skipped as it is being scanned by the Lightweight agent locally.

3. The scan utilizes NMAP device discovery on the remaining computers.

Active Directory Prerequisite

Enable Audit Events - To perform an Active Directory Audit on a Domain Controller, it is essential first to enable Audit Events. Once enabled, the ConnectSecure Scan Agent will read the Audit Events every 15 minutes and push those updates to your ConnectSecure portal.

...

To Enable the audit events, use the command given below:

...

AUDITPOL /SET /SUBCATEGORY:"Logoff" /SUCCESS:ENABLEAUDITPOL /SET /SUBCATEGORY:"Logoff" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Other Logon/Logoff Events" /SUCCESS:ENABLE

...

AUDITPOL /SET /SUBCATEGORY:"Kerberos Authentication Service" /SUCCESS:ENABLE /FAILURE:ENABLE

Compliance Scan

NEED INFOA compliance scan can be initiated for Compliance types (such as CIS, HIPAA, PCI-DSS, NIST-800-53, NISt-800-171, CyberEssentials, Essential 8, GDPR) set under settings at the company level or global level. Compliance scans assess adherence to a specific compliance framework. Compliance scans are built to locate and assess flaws in system hardening configurations for a specific framework.

SNMP Scan

The ConnectSecure Scan Agent detects and scans SNMP-enabled devices will be detected and scanned by the ConnectSecure Scan Agent. It will read reads the SNMP description using the defined SNMP Credentials (from the Probe) . For supported network devices, it will initiate and initiates a vulnerability scan automatically for supported network devices.

Vulnerability Scan

This scan helps you identify vulnerabilities based on the installed application and/or security updates. It uses the SMB protocol for scanning purposes. In some casesSometimes, you may need to provide the necessary credentials and/or user privileges to scan an asset.

...

Supported Operating Systems for Vulnerability Scanning in V4

...

How To Initiate Scans in V4

...

content

Lightweight Agent Scans

The Lightweight Agent scan in V4 automatically runs every 15, 30, 60, 90, or 120 minutes, based on your LW Agent Scan Interval in the Global > Overview > Settings menu.

...

Scheduler

You can use the Scheduler to configure automatic scan jobs to run. This is found under the Global > Assets > Scheduler menu.

...

Tap on the ‘Add Scheduler' on your action toolbar.

...

Manual

1. Overview > Agents = Tap on the Agents menu listed under Overview, use the checkbox to select single or multiple agents, then tap the Global Actions > Scan option.

...

You can tap the three-dot action menu on any single Agent and tap the Scan option.

...

2. Assets > Assets = Tap on the Assets menu under the Assets section. You can select a single or multiple agents, then use the Scan Now icon on the action toolbar.

...

3. Assets > Asset > Asset Details Screen = Tap on the IP address of any Asset to see the Asset Details view; use the Scan Now button on the action toolbar to scan that single asset.

...