Nessus Patch Management Integration Now Supports IBM Tivoli Endpoint Manager
Nessus and SecurityCenter now support Tivoli Endpoint Manager (TEM) as a patch management platform in which patch-level information can be extracted for given scan targets.
Nessus Patch Management Support
We are pleased to announce new support for IBM Tivoli Endpoint Manager (TEM) for Patch Management (formerly known as BigFix). This new capability allows us to use the information gathered by TEM from systems where we may not have credentials or we’re unable to reach such systems over the network. The TEM integration is configured similarly to our integration with other patch management solutions where credentials and the server IP address/hostname are provided so Nessus can retrieve the patch information for the hosts targeted in the scan.
- Microsoft Windows Server Update Services (WSUS)
- Microsoft System Center Configuration Manager (SCCM) 2007
- Red Hat Network Satellite Server
- VMware Go (formerly known as Shavlik)
In order to make use of this feature, be certain you've configured TEM properly. Refer to this discussion post for more information and instructions.
Configuring Nessus Integration with Tivoli Endpoint Manager
To enable this feature, create a Nessus scan policy and enable the Nessus plugin named "Patch Management: Tivoli Endpoint Manager Report."
Click for larger image.
Also enable all plugins in the "Windows: Microsoft Bulletins" family.
Next, in the Preferences tab, select "Patch Management: IBM Tivoli Endpoint Manager" from the drop-down menu. Enter the IP address or hostname of your TEM system, the Web Report port, and valid credentials. If your server is configured to use SSL, be certain to check the "SSL" checkbox.
When performing the scan, if Nessus is able to log in to the target host, the corresponding Nessus local patch-checking plugins will be run. This ensures the greatest level of accuracy for the check being performed.
If Nessus is unable to log in to the target host, and fingerprints such host as a Windows system, it will query the TEM for the patch information. If Nessus sees that the host is not being managed by the TEM solution, then it will report it as an unmanaged host.
This information will allow administrators to determine which hosts may be outside of the enforcement of policies configured in their patch and configuration management solution. Nessus will also identify the information source for the specific local check in the Plugin Output section:
Click for larger image
Conclusion
Nessus’ ability to leverage the information from patch and configuration management solutions provides deeper insight into systems that may have been previously missed in scans. This added information also provides administrators a way to validate that all hosts are managed under their patch and configuration solutions, and that such solutions are providing the appropriate information.
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
- Nessus
- Patch Auditing
- SecurityCenter