Nessus Patch Management Integration Now Supports IBM Tivoli Endpoint Manager
Nessus and SecurityCenter now support Tivoli Endpoint Manager (TEM) as a patch management platform in which patch-level information can be extracted for given scan targets.
Nessus Patch Management Support
We are pleased to announce new support for IBM Tivoli Endpoint Manager (TEM) for Patch Management (formerly known as BigFix). This new capability allows us to use the information gathered by TEM from systems where we may not have credentials or we’re unable to reach such systems over the network. The TEM integration is configured similarly to our integration with other patch management solutions where credentials and the server IP address/hostname are provided so Nessus can retrieve the patch information for the hosts targeted in the scan.
- Microsoft Windows Server Update Services (WSUS)
- Microsoft System Center Configuration Manager (SCCM) 2007
- Red Hat Network Satellite Server
- VMware Go (formerly known as Shavlik)
In order to make use of this feature, be certain you've configured TEM properly. Refer to this discussion post for more information and instructions.
Configuring Nessus Integration with Tivoli Endpoint Manager
To enable this feature, create a Nessus scan policy and enable the Nessus plugin named "Patch Management: Tivoli Endpoint Manager Report."
Click for larger image.
Also enable all plugins in the "Windows: Microsoft Bulletins" family.
Next, in the Preferences tab, select "Patch Management: IBM Tivoli Endpoint Manager" from the drop-down menu. Enter the IP address or hostname of your TEM system, the Web Report port, and valid credentials. If your server is configured to use SSL, be certain to check the "SSL" checkbox.
When performing the scan, if Nessus is able to log in to the target host, the corresponding Nessus local patch-checking plugins will be run. This ensures the greatest level of accuracy for the check being performed.
If Nessus is unable to log in to the target host, and fingerprints such host as a Windows system, it will query the TEM for the patch information. If Nessus sees that the host is not being managed by the TEM solution, then it will report it as an unmanaged host.
This information will allow administrators to determine which hosts may be outside of the enforcement of policies configured in their patch and configuration management solution. Nessus will also identify the information source for the specific local check in the Plugin Output section:
Click for larger image
Conclusion
Nessus’ ability to leverage the information from patch and configuration management solutions provides deeper insight into systems that may have been previously missed in scans. This added information also provides administrators a way to validate that all hosts are managed under their patch and configuration solutions, and that such solutions are providing the appropriate information.
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
CloudImposer: Executing Code on Millions of Google Servers with a Single Malicious Package
September 16, 2024Tenable Research discovered a remote code execution (RCE) vulnerability in Google Cloud Platform (GCP) that is now fixed and that we dubbed CloudImposer. The vulnerability could have allowed an attacker to hijack an internal software dependency that Google pre-installs on each Google Cloud Composer pipeline-orchestration tool. Tenable Research also found risky guidance in GCP documentation that customers should be aware of.
Cybersecurity Snapshot: Russia-backed Hackers Aim at Critical Infrastructure Orgs, as Crypto Fraud Balloons
September 13, 2024Critical infrastructure operators must beware of Russian military hacking groups. Plus, cyber scammers are having a field day with crypto fraud. Meanwhile, AI and cloud vendors face stricter reporting regulations in the U.S. And get the latest on AI-model risk management and on cybersecurity understaffing!
Microsoft’s September 2024 Patch Tuesday Addresses 79 CVEs (CVE-2024-43491)
September 10, 2024Microsoft addresses 79 CVEs with seven critical vulnerabilities and four zero-day vulnerabilities, including three that were exploited in the wild.
- Nessus
- Patch Auditing
- SecurityCenter