4.4 Hosts - VulnDetect Technical Guide

4.4 Hosts - VulnDetect Technical Guide

Hosts Overview

The Hosts page is to view the status of the Hosts.

The Hosts page is updated when the agent has run and checked-in within a given time frame.
  1. The Online field is a status indicator:
    1. Online(green)  - the host has checked-in within the last 15 minutes.
    2. Offline(yellow) - the host has not checked-in for up to 72 hours.
    3. Down(red)  - the host has not checked-in for more than 72 hours.
  2. Tags display the number of Tags a host is part of.
  3. Last Insepction display the number of Tags a host is part of.
  4. Next inspection displays the next time the agent will conduct an inspection.
  5. Installations displays the number of installed applications on the host.
  6. Ok displays the number of installed applications that are Patched.
  7. Insecure displays the number of installed applications that are Unpatched.


Filter by Host / Group / User / Tags

You can view specific hosts, groups or users by entering them into the appropriate text field.
Then to sort the list, click the arrows  next to Host, Group or User to sort the list alphabetically ascending or descending.
To filter by Tags:
  1. Use the filter button , pressing the button shows a List of Tags.
  2. It's possible to have multiple Tags on the filter.
  3. The arrow beside it , is to sort the list alphabetically ascending or descending.


Host Information

On the Hosts page, clicking on a host name opens the and gives additional information about the chosen host.
The information displayed gets Auto-refreshed every 5 seconds.

The host results page will be displayed, and it consists of the following tabs:
Applications tab, Windows Updates tab, Host information tab, Ignore rules, Patching activity tab and Windows Update Activity tab.

Applications tab, shows a list of installed applications on the Host

Along with Vendor, Version, Recommended Version, Highest CVSS Score and Status.
  1. Status:
    1.  OK  this version has no known.
    2.  Insecure  his version has known vulnerabilities.
    3.  Update  an update is available and recommended for this version of the application.
    4.  Patch  an update is available and recommended for this version The update can be applied automatically by SecTeer VulnDetect.
    5.  0-day  this update fixes a known 0-day vulnerability.


Windows Updates tab, Available Windows Updates, KB Articles, Severity, Highest CVSS Score and Details

On the Hosts page, it's possible to Apply a Selected update:
  1. Select 1 or more Updates by marking it by clicking.
  2. Click Apply Selected Updates, on the bottom left.
  3. The applied updates will be pushed out to the host upon Inspect & Update.
    1. It is also possible to cancel the updates applied.


Host Information tab, detailed information of the host, including manafacturer, model, architecture, startup, agent version and if user is online

  1. To Initiate a scan on the host, click Inspect & Update Host.
  2. To Request a Host Restart, click Request hosts restart, and a drop-down menu will show all restart Tags*
Notes
*For more information about restart Tag, please head to the Tags documentation


Tags tab, current Tags assigned to the host

On this page, you can create new Tag, Edit Selected Tag and Manage Tag for Hosts.
Notes
For more information about Tags, head to the Tags documentation.


Ignore Rules tab, list of applications exempted from the scan results

Notes
For more information, please head to the Ignore Rules documentation


Patching Activity tab, list of applications that has been patched for the host

Along with Update to version, Time of activity, Restart and State.
  1. States:
    1. Pending
    2. Applying 
    3. Updated
    4. Superseded
    5. Failed
    6. Disk Full
    7. App Restart Required
    8. Reboot Required
It's also possible to filter: Application name, Restart and State in the appropriate text field.
This list is sorted alphabetically and by clicking on the arrows to sort it Ascending or Descending.


Windows Update Activity tab, list of Windows Updates that has been approved and installed on this host


On this tab, it shows:
Name of the Windows Update, Time of activity, Restart and State.
  1. States:
    1. Pending
    2. Applying
    3. Updated
    4. Failed
    5. Reboot Required


Export to CSV

Click Export to CSV to download the table into CSV format. This function is available on the following pages.
  1. Hosts
  2. Hosts > Results > Applications
  3. Hosts > Results > Windows Updates
  4. Hosts > Results > Tags