V4 Scan Types

This document will cover the various scan types that can be initiated in V4 and provide some helpful insight into troubleshooting common issues for failed scans.

V4 Scan Types - Table of Contents

V4 Scan Types

Full Scan (Probe Scan)

The Full Scan initiates Asset Discovery, Vulnerability, SNMP, Firewall, and Active Directory Scans using configured parameters under Discovery Settings and Credentials.

Full Scan is achieved using the Probe Agent, not the Lightweight Agent.

The following methods are used to communicate with assets:

Windows

It attempts to use the Admin SMB (Admin$) share to send a small executable called the Dissolvable Agent that it then runs on the remote machine to fetch the details. It probes the shares using standard SMB tools and does an NFS discovery to check any NFS shares.

Active Directory

It uses LDAP to query the users and groups from the Credentials provided during the AD setup in the AD/Master credentials. It runs PowerShell commands to figure out GPOs, Security Groups, and Memberships of the Groups.

Linux

It uses SSH credentials to log into the asset and determine what processes run using Linux commands.

Network Devices

It uses SNMP to discover the SysObjectID, look up the device's version, and query vulnerabilities for that version. It also connects to OEM APIs to get vulnerability details.

Asset Discovery Scan

To use this scan with your Probe agents, configure the IP Range settings (CIDR, Static, Range) under the Discovery Settings and Credentials section. Once configured, you can initiate the Full Scan or Asset Discovery Scan to scan the configured subnet(s) for assets. You can also set up Exclude IP settings for these scans if needed.

Active Directory Scan

To use this scan with your Probe agents, you need to configure Active Directory Credentials, which are associated with your Probe. We are using a dissolvable agent if SMB is available, creating PowerShell in memory to execute. If SMB is unavailable, we use LDAP directly without the PowerShell scripts.

Active Directory Scan Method

1. A vulnerability scan is performed on the computers detected during the Active Directory scan.

2. If any of the Active Directory computers have a Lightweight Agent installed, the asset will be skipped as it is being scanned by the Lightweight agent locally.

3. The scan utilizes NMAP device discovery on the remaining computers.

Active Directory Prerequisite

Enable Audit Events - To perform an Active Directory Audit on a Domain Controller, it is essential first to enable Audit Events. Once enabled, the ConnectSecure Scan Agent will read the Audit Events every 15 minutes and push those updates to your ConnectSecure portal.

Verify Enabled Audit Events - To verify which Audit Events are currently enabled, you can run the following command:

>> auditpol /get /category:*

^ This command will list all Audit Categories and their current status.

To Enable the audit events, use the command given below:

(Ex: AUDITPOL /SET /SUBCATEGORY:"Security State Change" /SUCCESS:ENABLE )

@echo OFF

Rem Enable Security System Extension

echo Enabling "Security System Extension"

AUDITPOL /SET /SUBCATEGORY:"Security System Extension" /SUCCESS:ENABLE 

echo Enabling "Security State Change"

AUDITPOL /SET /SUBCATEGORY:"Security State Change" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Logon" /SUCCESS:ENABLE /FAILURE:ENABLE

AUDITPOL /SET /SUBCATEGORY:"Logoff" /SUCCESS:ENABLE

AUDITPOL /SET /SUBCATEGORY:"Logoff" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Other Logon/Logoff Events" /SUCCESS:ENABLE

AUDITPOL /SET /SUBCATEGORY:"Network Policy Server" /SUCCESS:ENABLE /FAILURE:ENABLE

AUDITPOL /SET /SUBCATEGORY:"Application Generated" /SUCCESS:ENABLE /FAILURE:ENABLE

AUDITPOL /SET /SUBCATEGORY:"Other Object Access Events" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Process Creation" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Process Termination" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Authentication Policy Change" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Authorization Policy Change" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"User Account Management" /SUCCESS:ENABLE /FAILURE:ENABLE

AUDITPOL /SET /SUBCATEGORY:"Computer Account Management" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Security Group Management" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Distribution Group Management" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Directory Service Changes" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Directory Service Access" /SUCCESS:ENABLE 

AUDITPOL /SET /SUBCATEGORY:"Other Account Logon Events" /SUCCESS:ENABLE /FAILURE:ENABLE

AUDITPOL /SET /SUBCATEGORY:"Kerberos Authentication Service" /SUCCESS:ENABLE /FAILURE:ENABLE

Compliance Scan

Compliance Scan could be initiated for Compliance types (such as CIS, HIPAA, PCI-DSS, NIST-800-53, NISt-800-171, CyberEssentials, Essential 8, GDPR) set under settings at company level or global level. Compliance scans assess adherence to a specific compliance framework. compliance scans are built to locate and assess flaws in system hardening configurations for a specific framework.

SNMP Scan

SNMP-enabled devices will be detected and scanned by the ConnectSecure Scan Agent. It will read the SNMP description using the defined SNMP Credentials (from the Probe). For supported network devices, it will initiate a vulnerability scan automatically.

Vulnerability Scan

This scan helps you identify vulnerabilities based on the installed application and/or security updates. It uses the SMB protocol for scanning purposes. Sometimes, you may need to provide the credentials and/or user privileges to scan an asset.

Supported Operating Systems for Vulnerability Scanning in V4

How To Initiate Scans in V4

Lightweight Agent Scans

The Lightweight Agent scan in V4 automatically runs every 15, 30, 60, 90, or 120 minutes, based on your LW Agent Scan Interval in the Global > Overview > Settings menu.

Scheduler

You can use the Scheduler to configure automatic scan jobs to run. This is found under the Global > Assets > Scheduler menu.

Tap on the ‘Add Scheduler' on your action toolbar.

Manual

1. Overview > Agents = Tap on the Agents menu listed under Overview, use the checkbox to select single or multiple agents, then tap the Global Actions > Scan option.

You can tap the three-dot action menu on any single Agent and tap the Scan option.

2. Assets > Assets = Tap on the Assets menu under the Assets section. You can select a single or multiple agents, then use the Scan Now icon on the action toolbar.

3. Assets > Asset > Asset Details Screen = Tap on the IP address of any Asset to see the Asset Details view; use the Scan Now button on the action toolbar to scan that single asset.

Troubleshooting Failed Scans

Work in progress