Enabling Network Scanning with IP Scan Policy

The CyberCyte can scan the internal network and display the results on the portal. For IP scanning the portal requires a Linux machine, on the machine CyberCyte agent will scan the network and return results to portal.

Please follow these steps below:

• Navigate to "Rules & Policies" -> "Policy Management" and search for "Def. IP Scan & Network Testing Policy". Click on the policy name or three dots right side of the entry and click on the "Edit" button.

• The default collection interval is 30 minutes. Users should fill these fields below:

  • Scanner Host: The scanner host must be a Linux machine with CyberCyte agent.

  • IP Block: For example 192.168.1.0/24, the field can take multiple IP blocks, users need to type the IP block and press enter for apply.

• The other sections are designed for scenario and vulnerability tests, can be leaved without any additional configuration. The "Run Vulnerability Scan Every X" should be selected as users requirements.

Important Settings

Parameters	Description
Assigned Groups	The groups for policy assignments.
Collection Interval	The interval for executing the policy.
Scanner Host	The scanner host for scanning the IP block and execute scenario tests.
IP Blocks	The IP blocks for scanning.
Port Scan Settings	The option for enabling the port scan. The nmap scripts can be attached in this section for further analysis.
SNMP Community Strings	The community strings for SNMP, defaults are "public", "private" and "admin".
Credentials for Host Information Gathering	These credentials will be tried for every available port. Supported credentials types are: Windows, SSH, SNMPv2 and SNMPv3(MD5/SHA and AES/DES/NONE)
Agentless Collection Commands	This section provide users to gather artifacts without agents.
Agentless Windows Connection Priority (based on Order)	Users can pick the order of methods to use when attempting to connect to Windows. E.g: WMI, RPC, Powershell.
Vulnerability Scan Frequency	The interval for executing the vulnerability scan.
Vulnerability Scan Time Range	Vulnerability scan will be run only in this time range. Format: HH:MM-HH:MM
Vulnerability Scan Active Days	Leaving empty means vulnerability scan will be active every day.
OpenVAS Settings	Provide OpenVAS with SSH and SNMP credentials listed above if any of them match with any hosts.
OpenVAS Repository	Existing OpenVAS installation. OpenVAS will not be installed if this is selected.
Tenable Nessus Repository	The section for selecting of the Tenable Nessus repository.
Tenable Security Center Repository	The section for selecting of the Tenable Security Center repository.
Acunetix Repository	The section for selecting of the Acunetix repository.
ZAP Repository	The sction for providing ZAP target URLs.

• CyberCye platform can integrate with Tenable Nessus, OpenVAS, Acunetix and ZAP if the credentaisl provided on the policy settings, the agent will connect to tools and collect/execute vulnerability scans per host.

• After everything is configured, please click on the "Save" button. The result can be observed under the "Asset Management" and "Security Assurance" -> "Vulnerability Management" pages.