- play_arrow Vulnerability Assessment Scanner Overview
- play_arrow Troubleshooting Scanners
- play_arrow AXIS Scanner
- play_arrow Beyond Security Automatic Vulnerability Detection System Scanner Overview
- play_arrow Digital Defense Inc AVS Scanner Overview
- play_arrow eEye Scanner Overview
- play_arrow IBM AppScan Enterprise Scanner Overview
- IBM AppScan Enterprise Scanner Overview
- Creating a Customer User Type for IBM AppScan Enterprise
- Enabling Integration with IBM AppScan Enterprise
- Creating an Application Deployment Map in IBM AppScan Enterprise
- Publishing Completed Reports in IBM AppScan Enterprise
- Adding an IBM AppScan Enterprise Vulnerability Scanner
- play_arrow IBM Guardium Scanner Overview
- play_arrow IBM SiteProtector Scanner Overview
- play_arrow Juniper Profiler NSM Scanner Overview
- play_arrow McAfee Vulnerability Manager Scanner Overview
- play_arrow Microsoft SCCM Scanner Overview
- play_arrow nCircle IP360 Scanner Overview
- play_arrow Nessus Scanner Overview
- play_arrow netVigilance SecureScout Scanner Overview
- play_arrow NMap Scanner Overview
- play_arrow Outpost24 Vulnerability Scanner Overview
- play_arrow Qualys Scanner Overview
- play_arrow SAINT Security Suite Overview
- play_arrow Tenable.io Scanner Overview
- play_arrow Tenable SecurityCenter Scanner Overview
- play_arrow Scheduling a Vulnerability Scan
- play_arrow Viewing the Status Of a Vulnerability Scan
- play_arrow Supported Vulnerability Scanners
Adding a Rapid7 NeXpose Scanner Local File Import
Before you add this scanner, a server certificate is required to support HTTPS connections. JSA supports certificates with the following file extensions: .crt, .cert, or .der. To copy a certificate to the /opt/qradar/conf/trusted_certificates directory, choose one of the following options:
Manually copy the certificate to the /opt/qradar/conf/trusted_certificates directory by using SCP or SFTP.
SSH into the Console or managed host and retrieve the certificate by using the following command: /opt/qradar/bin/getcert.sh <IP or Hostname> <optional port - 443 default>. A certificate is then downloaded from the specified host name or IP and placed into /opt/qradar/conf/trusted_certificates directory in the appropriate format.
JSA uses local files to import site vulnerability data from your Rapid7 Nexpose scanner.
Local file imports collect vulnerabilities for a site from a local file that is downloaded. The Rapid7 NeXpose XML file that contains the site and vulnerability information must be copied from your Rapid7 NeXpose appliance to the Console or managed host you specify when the scanner is added to JSA. The destination directory on the managed host must exist before the Rapid7 NeXpose appliance can copy site reports to the managed host. The site files can be copied to the managed host using Secure Copy (SCP) or Secure File Transfer Protocol (SFTP).
The import directory created on the managed host or JSA console must have the appropriate owner and permission set on it for the vis user within JSA. For example, chown -R vis:qradar <import_directory_path> and chmod 755 <import_directory_path> set the owner of the import directory path to vis user with adequate read-write-execute permissions.
Site files that are imported are not deleted from the import folder, but renamed to .processed0. Administrators can create a cron job to delete previously processed site files.
You must use the XML Export or XML Export 2.0 report format for the XML export to JSA.
XML Export is also known as raw XML. The XML export contains an extensive set of scan data with the smallest amount of structure. The XML export scan data must be parsed so that other systems can use the information.
XML Export 2.0 is similar to XML Export, but has more attributes:
Asset Risk
Exploit Title
Site Name
Exploit IDs
Malware Kit Name(s)
Site Importance
Exploit Skill Needed
PCI Compliance Status
Vulnerability Risk
Exploit Source Link
Scan ID
Vulnerability Since
Exploit Type
Scan Template.
You are now ready to create a scan schedule. See Scheduling a Vulnerability Scan.
