System and method for grouping computer vulnerabilities
View Patent ↗A system and method in one embodiment includes modules for creating an asset tag including one or more conditions of an asset on a network, adding the asset tag to an asset report template, and generating an asset report from the asset report template. More specific embodiments include creating the asset tag by generating a query for the one or more conditions. The asset tag may include a second asset tag configured to be updated automatically, and a third asset tag configured to be updated manually, and the second asset tag may be updated automatically when the asset tag is updated. Other embodiments include creating a vulnerability set including a selection of vulnerabilities from a plurality of vulnerabilities, adding the vulnerability set to the asset report template, and scanning a plurality of assets on the network.
1. A method comprising:
providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes a processor;
creating, by an asset tag module, a dynamic asset tag based on a query comprising a plurality of conditions associated with at least one asset on a network;
providing, by the asset tag module, a representation of the query comprising the plurality of conditions to be displayed by the GUI;
scanning, by a scan module, one or more assets of the network for vulnerable content, wherein the scanning includes searching each of the one or more assets for two or more vulnerabilities included in a first vulnerability set selected from a plurality of vulnerability sets, wherein the two or more vulnerabilities represent a proper subset of a plurality of vulnerabilities, each one of the plurality of vulnerabilities included in at least one of the plurality of vulnerability sets;
generating scan results based on the scanning;
adding the dynamic asset tag to an asset report template;
generating, by a report module, an asset report from the asset report template, wherein the asset report is based, at least in part, on the dynamic asset tag and the scan results;
editing the dynamic asset tag by modifying the plurality of conditions in the query and by adding a second vulnerability set to the dynamic asset tag; and
generating, by the report module, an updated asset report from the asset report template after the plurality of conditions in the query is modified, wherein the updated asset report is based on the modified plurality of conditions, the second vulnerability set, and the scan results.
2. The method of claim 1 , wherein at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, Common Vulnerabilities and Exposures (CVE) number, false positives, host domain name system (DNS) name, host netBIOS name, Information Assurance Vulnerability Alert (IAVA) Number, Internet Protocol (IP) Address, Microsoft Knowledge Base (KB) Number, open ports, operating system, protocol name, scan name, vulnerability name, vulnerability severity, and vulnerability set.
3. The method of claim 1 , wherein the updated asset report comprises a list of assets on the network meeting the modified plurality of conditions in the query.
4. The method of claim 1 , wherein the editing the dynamic asset tag includes adding a new condition to the query.
5. The method of claim 1 , wherein the dynamic asset tag comprises:
a second asset tag configured to be updated automatically; and
a third asset tag configured to be updated manually.
6. The method of claim 5 , further comprising updating the second asset tag automatically when the dynamic asset tag is updated.
7. The method of claim 1 , wherein the asset report corresponds to, at least, a pre-configured vulnerability set and the vulnerable content.
8. An apparatus comprising:
a memory including data stored therein;
a hardware processor operable to execute instructions associated with the data;
an asset tag module configured to run on the hardware processor for:
providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes a processor;
creating a dynamic asset tag based on a query comprising a plurality of conditions associated with at least one asset on a network; and
providing a representation of the query comprising the plurality of conditions to be displayed;
a scan module configured to run on the hardware processor for:
scanning one or more assets of the network for vulnerable content, the scanning to include searching each of the one or more assets for two or more vulnerabilities included in a first vulnerability set selected from a plurality of vulnerability sets, wherein the two or more vulnerabilities represent a proper subset of a plurality of vulnerabilities, each one of the plurality of vulnerabilities included in at least one of the plurality of vulnerability sets; and
generating scan results based on the scanning; and
a report module configured to run on the hardware processor for:
adding the dynamic asset tag to an asset report template;
generating an asset report from the asset report template, wherein the asset report is based, at least in part, on the dynamic asset tag and the scan results; and
generating an updated asset report from the asset report template after the dynamic asset tag is edited by modifying the plurality of conditions in the query and by adding a second vulnerability set to the dynamic asset tag, wherein the updated asset report is based on the modified plurality of conditions, the second vulnerability set, and the scan results.
9. The apparatus of claim 8 , wherein at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, Common Vulnerabilities and Exposures (CVE) number, false positives, host domain name system (DNS) name, host netBIOS name, Information Assurance Vulnerability Alert (IAVA) Number, Internet Protocol (IP) Address, Microsoft Knowledge Base (KB) Number, open ports, operating system, protocol name, scan name, vulnerability name, vulnerability severity, and vulnerability set.
10. The apparatus of claim 8 , wherein the dynamic asset tag is to be edited by adding a new condition to the query.
11. Non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:
providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes a processor;
creating a dynamic asset tag based on a query comprising a plurality of conditions associated with at least one asset on a network;
providing a representation of the query comprising the plurality of conditions to be displayed;
scanning one or more assets of the network for vulnerable content, the scanning to include searching each of the one or more assets for two or more vulnerabilities included in a first vulnerability set selected from a plurality of vulnerability sets, wherein the two or more vulnerabilities represent a proper subset of a plurality of vulnerabilities, each one of the plurality of vulnerabilities included in at least one of the plurality of vulnerability sets;
generating scan results based on the scanning;
adding the dynamic asset tag to an asset report template;
generating an asset report from the asset report template, wherein the asset report is based, at least in part, on the dynamic asset tag and the scan results;
editing the dynamic asset tag by modifying the plurality of conditions in the query and by adding a second vulnerability set to the dynamic asset tag; and
generating an updated asset report from the asset report template after the plurality of conditions in the query is modified, wherein the updated asset report is based on the modified plurality of conditions, the second vulnerability set, and the scan results.
12. The media of claim 11 , wherein at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, Common Vulnerabilities and Exposures (CVE) number, false positives, host domain name system (DNS) name, host netBIOS name, Information Assurance Vulnerability Alert (IAVA) Number, Internet Protocol (IP) Address, Microsoft Knowledge Base (KB) Number, open ports, operating system, protocol name, scan name, vulnerability name, vulnerability severity, and vulnerability set.
13. The media of claim 11 , wherein the asset report corresponds to, at least, a pre-configured vulnerability set and the vulnerable content.
14. The media of claim 11 , wherein the dynamic asset tag is to be edited by adding a new condition to the query.
15. The media of claim 11 , wherein the updated asset report comprises a list of assets on the network meeting the modified plurality of conditions in the query.
16. The media of claim 11 , wherein the dynamic asset tag comprises:
a second asset tag configured to be updated automatically; and
a third asset tag configured to be updated manually.
17. The media of claim 16 , further comprising updating the second asset tag automatically when the dynamic asset tag is updated.
18. The media of claim 11 , wherein the dynamic asset tag is to be edited by deleting a condition of the plurality of conditions of the query.
19. The media of claim 11 , further comprising:
when the edited dynamic asset tag is used in the asset report template, applying an asset tag name associated with the edited dynamic asset tag to any asset in the network that meets the modified plurality of conditions in the query.
20. The media of claim 11 , wherein the generating the updated asset report comprises:
selecting, from the scan results, information associated with one or more assets that meet the modified plurality of conditions in the query, wherein the information is to be included in the updated asset report.