How to work with scans and scan results

You can access detailed information about network and host vulnerabilities discovered during internal and external scans from the Scans tab on the Scans page in the Alert Logic console. From the Scans tab, you can create new scans, edit existing scan definitions, and view scan results.

Access Alert Logic scans

You can access most scan-related features from the Scans page in the Alert Logic console. These features include creating and scheduling scans, managing scan results, and processing steps for PCI compliance.

To access scans and scan results:

1. In the Alert Logic console, click OVERVIEW, and then click Scans.
2. On the Scans page, use the tabs to access scan features, as follows:
   • Statistics: Access summarized vulnerability information for your environment from overall scan results. See View vulnerability statistics.
   • Scans: Create and update scan definitions and access scan results.
   • PCI Compliance: View historical PCI scan results. See Manage PCI scans.
   • Search: Search scan results for criteria such as vulnerability name and risk levels. See Search scan results.

View scans

From the Scans tab on the Scans page, you can view scheduled vulnerability scans, scan status and results, and links to disable, enable, and delete the scans.

To view vulnerability scans:

1. In the Alert Logic console, click OVERVIEW, and then click Scans.
2. On the Scans page, click the Scans tab.
3. If you manage more than one customer, in the Customer drop-down list, select the customer, and then click Go.
   Scheduled scans, scan status and results, and links to disable, enable, and delete the scans are displayed.
4. (Optional) To change the definition of a scan, see Modify scan definition.
5. (Optional) To change the status of a scan, see Modify scan status.

Define a scan

You can define and schedule scans to run on a regular basis to help you identify vulnerabilities across your organization. From the Scans tab, you can define and schedule internal and external scans.

Create a new scan

1. In the Alert Logic console, click OVERVIEW, and then click Scans.
2. On the Scans page, click the Scans tab.
3. If you have access to more than one entity, use the drop down menu to select the entity you want to scan.
4. Click Schedule New Scan.
5. Fill in the information according to the instructions below.
6. Click Submit scan job.

Scan Details

1. In Scan Title, type a descriptive name for the scan.
2. In the Type of Scan drop-down list, select one of the following options:
   • Internal Scan: This scan originates inside your network, behind your firewall, and shows an insider threat perspective.
   • External Scan: This scan originates from Alert Logic, outside your network, and shows an outside threat perspective.
3. If you chose Internal Scan, choose Appliances for your scan. The Unavailable Appliances box lists all appliances that are offline or deactivated. If you chose External Scan, the Appliances option is not available.
4. Under How to Scan, choose one of the following options:
   • Full Scan is a complete scan on all in-scope devices.
   • Uphost only scan is a scan that detects only the alive/offline status of each host.

What to Scan

Choose whether to scan by Zones, Host Groups, or Individual IPs, and then choose the appropriate item(s) from the list that appears.

• Zones are created around Alert Logic appliances. Set up zones on the Management page.
  • Choose one or more zones from the list. Press and hold the Ctrl key to select multiple items. To select adjacent items, click the first item, press and hold the Shift key, and then click the last item.
• Host Groups are sets of one or more hosts. Multiple host groups may reside within a single zone. Set up host groups on the Management page.
  • Choose one or more host groups from the list. Press and hold the Ctrl key to select multiple items. To select adjacent items, click the first item, press and hold the Shift key, and then click the last item.
• Individual IPs allow you to select the specific IPs to scan.
  • You may enter addresses, subnets, or address ranges. When you are done typing the information, click Add the above hosts to the scan to add them to the list. You may add more hosts or remove them from the list.

Scan Credentials

Enter user credential information to ensure the scanner has access to all necessary parts of your network. Alert Logic recommends adding user credentials for the most accurate scan. The prompt accepts information for Windows Credentials, SSH Credentials, and SNMP Community Names. For more information on authenticated scanning, click here.

Schedule Options

Set the timing of the scan. You may choose to scan once or set a recurring scan that runs quarterly, weekly, or on specific days of the month.

To set scan schedule:

1. Set the scan frequency. Choose from the following options:

   • Quarterly: Set the timing of the scans within the quarter:
     • Choose the first, second, or third month of the quarter in the Run scan in: drop down menu.
     • Set the day of the month in the on this day: text box.
   • Every Week:Set the day of the week for the scan to run.

   • Specific Days of the Month: Type in the date(s) you want the scan to run each month.

     If you want your scan to run later in the month, you should set it for the 28th at the latest. If you set it for the 31st, you will miss February and the months that have only 30 days.

   • Specific Weekday of the Month

     Use the drop down menus to choose the day you want the scan to run each month. For example, you may set it to the second Wednesday every month.

   • One Time

     Enter a date to run a single scan.

   • As soon as possible

     This option puts the scan in the queue so that it runs as soon as possible.

2. In the Run scan from: box, set a time for the scan to begin. This option is not available if you chose to run the scan as soon as possible.
3. In the Time Zone drop down menu, select a time zone. This option is not available if you chose to run the scan as soon as possible.

Advanced Settings

Click Advanced Settings for more options, if necessary:

• For Scan end time (optional):, set a time for the scan to end. Alert Logic recommends leaving this option empty because it may abort your scan before it is finished.

• Check the box to Enable roll-over scanning.

  Alert Logic discourages using roll-over scanning, as the feature is deprecated.

• If necessary, enter specific IPs in IP Addresses to Exclude.
  • You may enter addresses, subnets, or address ranges. When you are done typing the information, click Add the above hosts to scan to add them to the list. You may add more hosts or remove them from the list.

  • Alert Logic discourages excluding items from your scans.

Scan Report

Check the box to have Alert Logic send an email containing the scan results after the scan completes. Choose email contacts from the list, and add as many as you want.

Modify scan definition

After you have created a scan, you can modify its definition. For example, you can change what IP addresses are scanned, when the scan is scheduled to run, or the credentials used to log in to host computers.

To modify a scan definition:

1. In the Alert Logic console, click OVERVIEW, and then click Scans.
2. On the Scans page, click the Scans tab.
3. If you manage more than one customer, in the Customer drop-down list, select the customer, and then click Go.
4. In the displayed list of scans, click the Scan Title of the scan to modify.
5. On the Edit Scan page, modify the scan definition, and then click Save.

Modify scan status

Each defined scan has a status, which is displayed in the list of scans. Scheduled scans that are enabled show a status value of a date (for example, Sep 8 2016 10:00pm), which is when the scan is scheduled to run next. Additional status values include scanning, suspended, and disabled.

You can modify the state of a scheduled scan if needed. For example, to minimize potential risk when you make changes to your network, such as the roll-out of a new version of software on your mission critical servers or devices, you may want to deactivate a scan. The scan remains disabled until you enable it again.

You can also suspend or resume a scan that is in progress, or delete a scan entirely.

To modify scan status:

1. In the Alert Logic console, click OVERVIEW, and then click Scans.
2. On the Scans page, click the Scans tab.
3. If you manage more than one customer, in the Customer drop-down list, select the customer, and then click Go.
4. Perform one of the following actions in the row of the scan to modify:
   • To disable a scheduled scan, click Disable.
   • To suspend a scan in progress, click Suspend.
   • To resume a suspended scan, click Resume.
   • To cancel a suspended scan, click Cancel.
   • To delete a scheduled scan, click Delete.

Manage scan results

Through the Scans feature, you can access valuable vulnerability information about your network through your scan results. You can view high-level trend information as well as granular details. Reviewing the details of scan results helps to identify issues you can address to improve your security posture.

View vulnerability statistics

Several types of trend views are provided to help you better understand your recent activity at a high level.

To view vulnerability statistics:

1. In the Alert Logic console, click OVERVIEW, and then click Scans.
2. On the Scans page, click the Statistics tab.
3. Select one of the following views to display:
   • Most Vulnerable Hosts
   • Most Vulnerable Host Groups
   • Most Vulnerable Zones
   • Vulnerability History
   • Vulnerabilities by Risk Level

View results by scan

You can easily view the results for each scan execution. From the results, you can view details about any vulnerabilities that are found. You can also export scan results in PDF or .csv format for download.

To view results by scan:

1. In the Alert Logic console, click OVERVIEW, and then click Scans.
2. On the Scans page, click the Scans tab.
3. If you manage more than one customer, in the Customer drop-down list, select the customer, and then click Go.
4. A list of scans appears, in alphabetical order by title. For each scan, you can perform the following actions:
   • Enable: Set the scan to run on a set schedule.
   • Delete: Delete the scan results from the system.
5. Click the link in the Results column to expand the results for the scan. For each Scanned Date row, you can perform the following actions:
• In the Results column, click the linked number of hosts to open a list of hosts and the vulnerabilities for each. Click PCI Scan Results to see the PCI scan page.

• Click the icons in the Export column to download reports in various formats.

  • Click the green CSV icon () to download a .csv file with vulnerability and exposure details.
  • Click the blue CSV icon () to download a .csv file with host details.
    

  The industry-standard CSV downloads include detailed host and vulnerability information. The format allows you to analyze, sort, and filter the information externally in the software of your choice. Alert Logic recommends the use of the CSV downloads for all scan analysis.

• Click Delete to delete the scan results. This deletes results from the selected date only.

Search scan results

You can search all saved scan results for specific vulnerabilities by name or ID, risk level, zone, and host group. You can also filter your search results by all, active, or inactive vulnerabilities. This feature is useful if you discover a vulnerability and want confirmation, or if you discover a security breach and want to discover the vulnerabilities of a host.

To search scan results:

1. In the Alert Logic console, click OVERVIEW, and then click Scans.
2. On the Scans page, click the Search tab.
3. If you manage more than one customer, in the Customer drop-down list, select the customer, and then click Go.
4. Enter and select the appropriate options, and then click Search.

Ignore a vulnerability

If you cannot resolve a vulnerability immediately, you can temporarily deactivate the vulnerability. Deactivating a vulnerability makes working within the management interface more convenient, and does not remove the vulnerability from reports. You can deactivate vulnerabilities for a specific host or for all hosts.

To ignore a vulnerability:

1. At the top of the Alert Logic console, in the drop-down menu, click Scans.
2. On the Scans page, click the Scans tab.
3. If you manage more than one customer, in the Customer drop-down list, select the customer, and then click Go.
4. Next to the scan that identifies the vulnerability to deactivate, click and expand Results.
5. Next to the date the scan was run, under the Results column, click the hosts link.
6. In the Hosts window, under the appropriate host, click the name of the vulnerability to deactivate.
7. Click Change Status.
8. For Change the status of this vulnerability for, select one of the following options:
   • This Host—Deactivates this vulnerability on this host only.
   • All Hosts—Deactivates this vulnerability on all hosts. With this option, you must provide a global descriptive note.
9. Select Inactive.
10. Click Save.

Report a false positive

Sometimes vulnerability scans identify a vulnerability in your environment that may be a false positive. To investigate an identified vulnerability that may be a false positive, contact Alert Logic. The security analysts in the Alert Logic Security Operations Center (SOC) carefully review the vulnerability and assess the accuracy of the result.

To report a false positive (for non-PCI scans):

1. From the heading of the report that contains the vulnerability in question, find the date the report ran and the Report ID.
2. Contact Alert Logic using one of the following options:
   • Contact Alert Logic Support at (US) (877) 484-8383 or (EU) +44 (0) 203 011 5533.
   • Send an email to support@alertlogic.com.

If the security analyst determines the vulnerability is a false positive, the security analyst updates the vulnerability in the system database.

Clean up scan results

As part of your maintenance activities, you can "clean up" scan results. When you clean up scan results, certain results are hidden in the Alert Logic console, providing you with a cleaner view. You can clean up results predating a specific date, or you can clean up results for individual scans. The hidden results remain in the system and are included in your reports.

Clean up scan results by date

You can hide older scan results from the Alert Logic console by specifying a date and time; results with a Scanned Date that is older than the specified date are hidden.

To clean up scan results by date:

1. At the top of the Alert Logic console, in the drop-down menu, click Scans.
2. On the Scans page, click the Scans tab.
3. If you manage more than one customer, select the customer in the Customer list, and then click Go.
4. Click Clean up Scan Results.
5. In the Clean up Scan Results dialog box, enter the date and time before which to hide scan results, specify whether to also hide inactive scans, and then click Clean up.

Clean up scan results by individual scans

You can hide individual scan results from the scan list.

To clean up scan results by individual scans:

1. At the top of the Alert Logic console, in the drop-down menu, click Scans.
2. On the Scans page, select the Scans tab.
3. If you manage more than one customer, in the Customer drop-down list, select the customer, and then click Go.
4. In the row of the scan for which to hide results, click Results.
   A list of scan executions appears, ordered by scan date.
5. For each Scanned Date row, click Delete to hide the results of that particular scan.

Related topics