We have several cloud agents that are in IP ranges that are being scanned by our scanner appliance. Rather than individually excluding each IP with a cloud agent is there an easier way to exclude all cloud agents from being scanned by a scanner appliance?
there are two ways; if your doing your scans by TAGS you can exclude those with TAGS.
Additionally though when you kick off a scan you have an option to TARGET hosts to add them to the scan so they should be excluded by default but you might need to check this setting in your schedules as well.
Update 01-12-2018:
_______________________________
There's more than one way...here are some ideas to consider:
1. Make sure NOT to check the “Scan agent hosts in my target”:
2. IP Include and Exclude:
3. Asset Group (include), IP (exclude):
4. Asset Tag (include) and Asset Tag (exclude): >>> My Preference <<<
Good luck! Let us know which one worked best for you.
Thanks! On a similar note. How can I confirm this? For example: I have an agent on my laptop, the scan that covers the same IP range as my laptop is set to not scan agents. In the Scan Results my IP not does appear under the "Hosts not scanned" field, but rather under the "Hosts not alive" field. Which makes me think it still tried to scan my laptop, but it was off network so gave the "no host alive" alert.
I would try a scan of your machine only when you are online and you should be able to verify. Also you could turn the logging on your local firewall and then verify in the logs after the scan that no packets tried to come from Qualys.
Probably the way to be the most sure.
Let me know if you want Windows or Linux and I will try to come up with something.
Good suggestion. I did just that and despite the "Scan agent hosts in my target" box NOT being checked it still scanned my machine.
Open a support ticket as this is going to affect a lot of people. My understanding it should not scan the host but they may also depend on the tracking mechanism chosen. But better to let support deal with it so we can all benefit from the answer.
I have not been able to get a good answer yet. All they have said is "If you have the asset in your chosen targets of your VM scan, it will still be scanned. If you want to exclude it, you could add the IP to "Exclude IPs/Ranges"
Which does not make sense, since there is the box "Scan agent hosts in my target" You would think you are given the option to exclude an agent from a scan, but apparently not?
I will run a test on my end for this. But you can do this with TAGS as well. I should be done by tomorrow.
OK I took an IP address that belongs to a host with the Qualys Agent installed and talking in the last 40 minutes.
I then created two scans for the same IP, one with the option to scan Agent Hosts and one not.
Both scans got data from the target suggesting this did not work as expected. We should open a ticket to get clarification. I know what Debra is doing below will work but not everyone is using tags and I should not be required to setup a TAG just to scan the network range.
So this does not seem right but it could be my misunderstanding of the Agent Host; is that a Cloud Agent Host or something else?
David
Yeah, we do not run scans per TAGS so while that solution works, its not helpful in our environment. Yes, the host I am targeting has a cloud agent. When our TAM gave us a preview of the cloud agent we specifically asked if scanning a cloud agent with a scanner would in theory "scan it twice" and we were told that it would not.
now we did at that IP to the VM Module. If you want I will submit a ticket to Qualys; I know they love seeing all of mine.
Haha I hear you there! Ya go ahead if you would like, I'm sure more tickets on the same issue will help.
Just for the record, Case #335820 has been created I will update when we get a resolution to the benefit of I hope someone.
This is the best way to accomplish your goal: Asset Tag (include) and Asset Tag (exclude):
Will this scan also pick any new devices (devices that have not been scanned before but are connected when the scan is executing)?
Brgds
Alvaro
My personal advice would be to create a network Range TAG if applicable then do a LIGHT Asset Scan of the range.
Turn around and do a second full scan of all assets with the Network Range tag but not as a Network Range and exclude hosts with the Cloud Agent TAG. If any show the scanner would scan those targets.
FYI, If you create a TAG with a range of 10.1.0.0/16 and you launch a scan of that TAG with the network range selected your scanning a /16. If you kick off the scan of the same tag but do not select Network Range you are saying I want to scan everything with this TAG. So if you have just defined it and never scanned anything then this TAG would have no assets.
David
Is it just me or has the option “Scan agent hosts in my target” been removed?
Thank you!
jmalon@bokf.com Not removed, renamed/relabeled in Cloud Suite 8.19 , Page 4:
Renamed Scan Agent Hosts Option (VM, PC)
In the Target Hosts section of Launch/Schedule Scan pages, we have changed the label "Scan agent hosts in my target" to "Temporarily add agent addresses not currently in my subscription". This option temporarily adds the IP addresses of any agents in your target to your subscription for this scan only. The option is visible only if Qualys Cloud Agent is enabled for your subscription.
John,
Just remember that the Cloud Agent does not detect all vulnerabilities. You may want to create a scan specifically targeting the Assets with the Cloud Agents but with a set of vulnerabilities only detected by the scan. This would not be all vulnerabilities just the ones not detected by the Cloud Agent. Some vulnerabilities can only be detected by sending packets to the port/service to test.
You would need to create a Search List that gives you all vulnerabilities detected by the Cloud Agent. Then in the scan profile you can exclude all the QIDs identified in the list. This will reduce the over all number of vulnerabilities that are tested for.
example Search below. Let me know if you have questions, David
Update 01-12-2018:
_______________________________
There's more than one way...here are some ideas to consider:
1. Make sure NOT to check the “Scan agent hosts in my target”:
2. IP Include and Exclude:
3. Asset Group (include), IP (exclude):
4. Asset Tag (include) and Asset Tag (exclude): >>> My Preference <<<
Good luck! Let us know which one worked best for you.