Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT... User manual

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-025614-01, Revision 1

Security Threat Response Manager

Managing Vulnerability Assessment

Release 2008.2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

Managing Vulnerability Assessment

Release 2008.2

Revision History

June 2008—Revision 1

The information in this document is current as of the date listed in the revision history.

CONTENTS

ABOUT THIS GUIDE

Conventions 3

Technical Documentation 3

Documentation Feedback 3

Requesting Support 4

1OVERVIEW

Configuring Vulnerability Assessment 5

Viewing Scanners 6

2MANAGING IP360 SCANNERS

Adding an ip360 Scanner 9

Editing an ip360 Scanner 11

Deleting an ip360 Scanner 11

Exporting Reports 12

3MANAGING NESSUS SCANNERS

Adding a Nessus Scanner 13

Editing an Nessus Scanner 16

Deleting a Nessus Scanner 16

4MANAGING NESSUS SCAN RESULT IMPORTERS

Adding a Nessus Scan Result Importer 17

Editing a Nessus Scan Result Importer 19

Deleting a Nessus Scan Result Importer 20

5MANAGING NMAP SCANNERS

Adding a Nmap Scanner 21

Editing an Nmap Scanner 23

Deleting an Nmap Scanner 24

6MANAGING QUALYS SCANNERS

Adding a Qualys Scanner 25

Editing a Qualys Scanner 27

Deleting a Qualys Scanner 27

7MANAGING FOUNDSCAN SCANNERS

Adding a FoundScan Scanner 29

Editing a FoundScan Scanner 32

Deleting a FoundScan Scanner 32

Importing Custom Certificates 32

Example Of TrustedCA.pem File 34

Example of Portal.pem File 34

8MANAGING JUNIPER NSM PROFILER SCANNERS

Adding a Juniper NSM Profiler Scanner 39

Editing a Profiler Scanner 41

Deleting a Profiler Scanner 41

9MANAGING RAPID7 NEXPOSE SCANNERS

Adding a Rapid7 NeXpose Scanner 43

Editing a Rapid7 NeXpose Scanner 45

Deleting a Rapid7 NeXpose Scanner 45

10 MANAGING SCAN SCHEDULES

Scheduling a Scan 47

Editing a Scan Schedule 49

Deleting a Scheduled Scan 50

11 VIEWING ASSET PROFILE INFORMATION

INDEX

Managing Vulnerability Assessment

ABOUT THIS GUIDE

The Managing Vulnerability Assessment Guide provides you with information for

managing vulnerability scanners and scan schedules using STRM.

Conventions Table 1 lists conventions that are used throughout this guide.

Technical

Documentation You can access technical documentation, technical notes, and release notes

directly from the Juniper networks Support Web site at

http://www.juniper.net/support/.

Documentation

Feedback We encourage you to provide feedback, comments, and suggestions so that we

can improve the documentation. Send your comments to

techpubs-comments@juniper.net, or fill out the documentation feedback form at

http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail, be

sure to include the following information with your comments:

•Document name

•Document part number

•Page number

•Software release version

Table 1 Icons

Icon Type Description

Information note Information that describes important features or

instructions.

Caution Information that alerts you to potential loss of

data or potential damage to an application,

system, device, or network.

Warning Information that alerts you to potential personal

injury.

Managing Vulnerability Assessment

4ABOUT THIS GUIDE

Requesting

Support • Open a support case using the Case Management link at

http://www.juniper.net/support/ or call 1-888-314-JTAC (from the United States,

Canada, or Mexico) or 1-408-745-9500 (from elsewhere).

Managing Vulnerability Assessment

1OVERVIEW

Vulnerability assessment integration enables vulnerability assessment data to

build profiles of attackers and targets. Vulnerability assessment data uses

correlated event data, network activity, and behavioral changes to remove false

positives to determine the threat level for each critical business asset.

STRM's integration with vulnerability assessment tools allows you to schedule

scans to keep your vulnerability assessment data up-to-date.

Note: You must have permissions to all CIDRs you wish to scan. Also, do not

include CIDRs in your vulnerability assessment that are configured in your global

exclusions list. For more information on global exclusions, see the Offense

Resolutions Users Guide.

This chapter provides an overview of configuring vulnerability assessment,

including:

•Configuring Vulnerability Assessment

•Viewing Scanners

Configuring

Vulnerability

Assessment

To configure vulnerability assessment, you must:

Step 1 Configure your scanner using one of the following supported scanners:

•Chapter 2 Managing ip360 Scanners

•Chapter 3 Managing Nessus Scanners

•Chapter 4 Managing Nessus Scan Result Importers

•Chapter 5 Managing Nmap Scanners

•Chapter 6 Managing Qualys Scanners

•Chapter 7 Managing FoundScan Scanners

•Chapter 8 Managing Juniper NSM Profiler Scanners

•Chapter 9 Managing Rapid7 NeXpose Scanners

Managing Vulnerability Assessment

6OVERVIEW

The scanner determines the tests performed during the scanning of a host. The

selected scanner populates your asset profile data including the host information,

ports, and potential vulnerabilities.

You must configure scanners using the Administration Console. For information on

accessing the Administration Console, see the STRM Administration Guide.

Step 2 Schedule vulnerability assessment. See Chapter 10 Managing Scan Schedules.

Step 3 View the results of the asset profile. See Chapter 11 Viewing Asset Profile

Information.

Note: If you add, edit, or delete a scanner or if you add, edit, or delete a scheduled

vulnerability assessment scan, you must select Configurations > Deploy

Configuration Changes from the Administration Console menu for the changes to

take effect.

The results of the scan provides the operating system and version on each CIDR,

server, and version of each port. Also, the scan provides the known vulnerabilities

on discovered ports and services.

Viewing Scanners To view currently configured scanners:

Step 1 In the Administration Console, click the SIM Configuration tab.

The SIM Configuration panel appears.

Step 2 Click the VA Scanners icon.

The VA Scanners window appears.

The VA Scanners window provides the following details for each scanner:

Table 1-1 Scanner Parameters

Parameter Description

Name Specifies the name of the scanner.

Type Specifies the type of scanner, for example, Nessus Scan Results

Importer.

Host Specifies the IP address or host name of the host on which the

scanner operates.

Approved CIDR

Ranges Specifies the CIDR range(s) you wish this scanner to consider.

Multiple CIDR ranges are displayed using a comma separated

list.

Description Specifies a description for this scanner.

Managing Vulnerability Assessment

Viewing Scanners 7

Status Specifies the status of the scanner schedule.

Table 1-1 Scanner Parameters (continued)

Parameter Description

This manual suits for next models

Table of contents

Other Juniper Software manuals

Juniper

Juniper IGP - CONFIGURATION GUIDE V11.1.X User manual

Juniper

Juniper MEDIA FLOW MANAGER 2.0.2 - ADMINISTRATOR S GUIDE AND... Service manual

Juniper

Juniper PHYSICAL LAYER - CONFIGURATION GUIDE V11.1.X User manual

Juniper

Juniper JUNOSE 10.3.1 - S 3-19-2010 Instruction Manual

Juniper

Juniper JUNOSE SOFTWARE 11.0.X - LINK LAYER CONFIGURATION GUIDE... User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER - LOG MANAGEMENT INSTALLATION REV... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - M-SERIES AND MX-SERIES DEVICES GUIDE REV... User manual

Juniper

Juniper JUNOS SPACE SDK Installation guide

Juniper

Juniper VXA2000 START REV1 User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... User manual

Juniper

Juniper JUNOS OS 10.4 - S REV 5 Instruction Manual

Juniper

Juniper JUNOS OS 10.4 - XML API OPERATIONAL Manual

Juniper

Juniper JUNOS PULSE 2.0 RELEASE NOTES Instruction Manual

Juniper

Juniper MEDIA FLOW CONTROLLER 2.0.5 - S REV... Instruction Manual

Juniper

Juniper JUNOS OS 10.4 - S REV 5 Instruction Manual

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - REV1 User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - ADAPTIVE LOG EXPORTER... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER - S REV 1 Instruction Manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - EVENT CATEGORY CORRELATION REV... User manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - S... Instruction Manual

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING INTRUSION DETECTION PREVENTION DEVICES GUIDE REV... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER - NSM CONFIGURATION GUIDE FOR EX SERIES DEVICES REV... User manual

Juniper

Juniper JUNOSE SOFTWARE 11.0.X - LINK LAYER CONFIGURATION GUIDE... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS - ... User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual