4.5 Groups - VulnDetect Technical Guide

4.5 Groups - VulnDetect Technical Guide

Groups overview

The Groups page allows you to view and manage the list of host groups. 
The list of groups shows:
  1. Groups, name of the groups.
  2. Approvals, number of how many Applications have an approval available for the group.
  3. Hosts, how many hosts are assigned to the group.
  4. Installations, how many applications have been installed.
  5. Ok, number of Installations with no known vulnerabilities
  6. Insecure, number of Installations with known vulnerabilities.
Info
A group can consist of any amount of hosts.
A host can only be assigned to one group at a time.
Groups are used to:
  1. Organize hosts
  2. Apply approval policies
  3. Configure inspection schedules
  4. Execute actions (Inspect & Update, Restart) at scale


Default Group Behavior

When VulnDetect is first deployed, only one group is present by default: The Default Group

The Default Group setting, controls automatic group assignment.
When a new host is added to the solution, it is automatically assigned to the group designated as default, unless overridden by wrapped arguments when deploying the agent.

By default:
  1. The system-created Default Group has this setting applied.
  2. Newly registered hosts are therefore placed in the Default Group.
If administrators create additional groups and assign the Default Group setting to another group, new hosts will be assigned to that group instead.
This ensures that newly onboarded hosts are always placed into a defined group, even if no custom grouping structure has been configured.


Filter by Group

On the Group page, you can filter the list using the available filter fields.
  1. Entering them in the appropriate text field.
  2. Sort the list, click the arrows  next to Groups, Approvals, Hosts, Installations, Ok And Insecure to sort the list alphabetically ascending.

Groups Applications List

Click a group name to view all applications within that specific group.
You can observe the following indicators for each application:

  1. Versions and installations found amongst the hosts
  2. Status of said installations:
    1. Ok
    2. End of Life
    3. 0-day
    4. Insecure
  3. Highest CVSS Score for insecure apps assigned with CVSS
  4. Updates in Progress
  5. Updates that require approvals
  6. Manual updates


Approvals

On the Groups page, it is possible to see the list of approvals of applications for a chosen Group.

To view the approvals
  1. Click on the text in the Approvals column, that will bring you to the Groups Approvals page
  1. Some groups might display an icon that shows the number of Out-of-Date approvals.