Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Adding an eEye REM SNMP Scan

To use CVE identifiers and descriptions, you must copy the audits.xml file from your eEye REM scanner to the managed host responsible for listening for SNMP data. If your managed host is in a distributed deployment, you must copy the audits.xml to the Console first and SSH the file to /opt/qradar/conf/audits.xml on the managed host. The default location of audits.xml on the eEye scanner is %ProgramFiles(x86)%\eEye Digital Security\Retina CS\Applications\RetinaManager\Database\audits.xml.

To receive the most up-to-date CVE information, periodically update JSA with the latest audits.xml file.

You can add a scanner to collect vulnerability data over SNMP from eEye REM or CS Retina scanners.

  1. Click the Admin tab.
  2. Click the VA Scanners icon.
  3. Click Add.
  4. In the Scanner Name field, type a name to identify your SecureScout server.
  5. From the Managed Host list, select an option that is based on one of the following platforms:

    • On the JSA Console, select the managed host that is responsible for communicating with the scanner device.

  6. From the Type list, select eEye REM Scanner.
  7. From the Import Type list, select SNMP.
  8. In the Base Directory field, type a location to store the temporary files that contain the eEye REM scan data.

    The default directory is /store/tmp/vis/eEye/.

  9. In the Cache Size field, type the number of transactions you want to store in the cache before the SNMP data is written to the temporary file. The default is 40.

    The default value is 40 transactions.

  10. In the Retention Period field, type the time period, in days, that the system stores scan information.

    If a scan schedule did not import data before the retention period expires, the scan information from the cache is deleted.

  11. Select the Use Vulnerability Data check box to correlate eEye vulnerabilities to Common Vulnerabilities and Exposures (CVE) identifiers and description information.
  12. In the Vulnerability Data File field, type the directory path to the eEye audits.xml file.
  13. In the Listen Port field, type the port number that is used to monitor for incoming SNMP vulnerability information from your eEye REM scanner.

    The default port is 1162.

  14. In the Source Host field, type the IP address of the eEye scanner.
  15. From the SNMP Version list, select the SNMP protocol version.

    The default protocol is SNMPv2.

  16. In the Community String field, type the SNMP community string for the SNMPv2 protocol, for example, Public.
  17. From the Authentication Protocol list, select the algorithm to authenticate SNMPv3 traps.
  18. In the Authentication Password field, type the password that you want to use to authenticate SNMPv3 communication.

    The password must include a minimum of 8 characters.

  19. From the Encryption Protocol list, select the SNMPv3 decryption algorithm.
  20. In the Encryption Password field, type the password to decrypt SNMPv3 traps.
  21. To configure a CIDR range for your scanner:

    1. Type the CIDR range for the scan or click Browse to select a CIDR range from the network list.

    2. Click Add.

  22. Click Save.
  23. On the Admin tab, click Deploy Changes.

Select one of the following options:

Related Documentation