Finding gaps in vulnerability scanning

View as Markdown

Your vulnerability scanning is only as good as the coverage. As devices join and leave the network, monitor for gaps in scanning.

Who is this playbook for and why?

This playbook is for security teams who want to close gaps in their vulnerability management program so that remediation is effective and efficient.

How will runZero help?

runZero discovers assets on your network without an agent and imports asset information from your vulnerability management platform. With both in one inventory, you can identify the assets your vulnerability management platform is not scanning.

What will I need to do?

Start by scanning your entire network with runZero. Then configure a runZero integration with your vulnerability management platform to merge its vulnerability data with the runZero data. Finally, query the asset data for assets your vulnerability management platform is not scanning.

Prerequisites

Implementation steps

  1. Configure your vulnerability management integration:
  2. Use the sample queries to search your inventory for assets not seen in your vulnerability scanning data.
  3. Set up alerts that notify you of gaps automatically or start a workflow.

Sample queries

Terms and operators combine in endless ways. Use these examples as they are or adjust them to your needs.

Qualys

These queries monitor the state of your Qualys deployment from inside runZero.

Identify assets that have not been scanned by Qualys

source:runZero AND not source:qualys

Identify assets that have not been scanned in the last 14 days

source:qualys AND (@qualys.dev.host.lastScannedDateTimeTS:>14days OR @qualys.dev.host.lastVMScannedDateTS:>14days)

Rapid7 InsightVM or Nexpose

These queries monitor the state of your Rapid7 deployment from inside runZero.

Identify assets that have not been scanned by Rapid7

source:runZero AND not source:rapid7

Tenable.io or Tenable Nessus

These queries monitor the state of your Tenable.io or Tenable Nessus deployment from inside runZero.

Identify assets that have not been scanned by Tenable

source:runZero AND not source:tenable

Identify assets that have not been scanned in the last 14 days

source:tenable AND @tenable.dev.lastScanTimeTS:>14days

Outcome demo

This short video shows what the outcome of finding gaps in your vulnerability scanning policies may look like.

Getting help

For help building out this process, book a session with a runZero Customer Success Engineer.

Updated