Skip navigation
Discussions Blogs Social Media Events Training Help Center
Up to Discussions in QualysGuard Suite
2634 Views 6 Replies Latest reply: Nov 5, 2012 11:46 AM by apedret RSS
apedret Level 1
apedret
25 posts since
Dec 9, 2010
Currently Being Moderated

May 4, 2012 1:47 PM

Maintaining vulnerability ignore status

We  have a challenge maintaining the Ignore status of vulnerabilities against assets that have been waived from Active reporting.

By default a new  vulnerability's status is Active and reported as such.

 

What options are available to Ignore an asset's vulnerabilities on a recurring basis or otherwise as new vulnerabilities are detected?

 

Any constructive feedback in appreciated.

 

Tony Pedretti

Tags: reporting, vulnerability, vulnerabilities, ignored, detected, status, ignore, active
  • pklahn Level 2
    pklahn
    148 posts since
    Jul 26, 2010
    Currently Being Moderated
    May 9, 2012 10:26 AM (in response to apedret)
    Maintaining vulnerability ignore status

    Tony -- two ways to ignore a vulnerability for a given host or hosts --

     

    1. within the html scan report we can choose the interactive "ignore vulnerability" selection for a vulnerability on a chosen host. This will place it in an ignored state for that host going forward.

     

    2.. within the remediation module, you can create a rule to ignore vulnerabilities (defined by a search list) for specific hosts (defined by asset groups / IP's). This method would put the vulnerabilities for those hosts in an ignored state after the next scan (assuming that rule in the remediation policy is acted on before another rule)

     

    Let me know if you want to Webex it or we can go over it in person.

     

    -Paul

    • apedret Level 1
      apedret
      25 posts since
      Dec 9, 2010
      Currently Being Moderated
      May 9, 2012 11:31 AM (in response to pklahn)
      Maintaining vulnerability ignore status

      Thanks Paul.

      We recently discussed the neglect of our remediation policies.  I'll schedule some time to review the options within and report back here.

       

      Or how about you get on a plane and join us for a Lou Mitchell's breakfast?

       

      Tony

    • apedret Level 1
      apedret
      25 posts since
      Dec 9, 2010
      Currently Being Moderated
      May 11, 2012 11:54 AM (in response to pklahn)
      Maintaining vulnerability ignore status

      I've created a new remediation policy based on the conditions we report Active vulnerabilities and reordered as apporiate in the list.

       

      I have yet to test but the action "Ignore: Do not create a ticket for these conditions" does that mean as stated it simply will not ticket new vulnerabilities as detected or as you implied setting "the vulnerabilities for those hosts in an ignored state after the next scan"?

       

      Thanks,

       

      Tony

      • pklahn Level 2
        pklahn
        148 posts since
        Jul 26, 2010
        Currently Being Moderated
        May 11, 2012 2:56 PM (in response to apedret)
        Re: Maintaining vulnerability ignore status

        It will put the vulnerability in an ignored state for those hosts.

        • apedret Level 1
          apedret
          25 posts since
          Dec 9, 2010
          Currently Being Moderated
          Aug 2, 2012 9:18 AM (in response to pklahn)
          Maintaining vulnerability ignore status

          After talking with support on this one, the action "Ignore: Do not create a ticket for these conditions" means as stated it simply will not ticket new vulnerabilities during detection.

          It will not set the status of newly detected vulnerabilities to Ignored.

           

          We're looking to configure our report templates with the policy in the Exclude QIDs section of their filter and possibly an enhancement request to develop logic to set them Ignored and allow us to target and keep up with them in our Ignored reports.

        • apedret Level 1
          apedret
          25 posts since
          Dec 9, 2010
          Currently Being Moderated
          Nov 5, 2012 11:46 AM (in response to pklahn)
          Maintaining vulnerability ignore status

          I haven't tested the QG 7.5 option yet but I have updated our applicable remediation policies with the Create tickets - set to Closed/Ignored setting.  Curious if this applies to Vulnerabilities as it does Tickets.

           

          QualysRemediationRuleEditActionCreateTicketsSetToIgnored.jpg

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 6 points