Hi all,
The standard dashboard that comes with Solarwinds for looking at CVE's is limited and it is difficult to decipher what is really going on.
To make this easier, I have written a second dashboard with a number of widgets that focus on different aspects of CVEs.
Note: Our environment has a defined naming convention for anything in the DC's so the dashboard is written to show how the DC and non-DC environments are affected by CVEs - but you can easily modify the swql queries to modify or remove the WHERE statements that filter on the naming standard.
For DC's only:
WHERE (n.Caption LIKE 'ASH-%'
OR n.Caption LIKE 'FR2-%'
OR n.Caption LIKE 'FR7-%'
OR n.Caption LIKE 'HKG-%'
OR n.Caption LIKE 'IAD-%'
OR n.Caption LIKE 'LEB-%'
OR n.Caption LIKE 'WOK-%')
For Offices only:
WHERE (n.Caption NOT LIKE 'ASH-%'
AND n.Caption NOT LIKE 'FR2-%'
AND n.Caption NOT LIKE 'FR7-%'
AND n.Caption NOT LIKE 'HKG-%'
AND n.Caption NOT LIKE 'IAD-%'
AND n.Caption NOT LIKE 'LEB-%'
AND n.Caption NOT LIKE 'WOK-%')
I should also point out that the dashboard is only showing information about Critical (Sev4) and High(Sev3) CVEs.
An explanation of the dashboard widgets:
The top widget just gives some summary figures detailing how many Critical/High CVEs there are that affect the network and how many nodes are affected.
The second widget above shows the Analysis status totals for Critical/High CVE's.
The third widget above provides a searchable node list of all CVE's that are "potential" or "confirmed" vulnerabilities.
The fourth widget above provides a searchable list of all CVEs that are applicable to the network along with a node count for each CVE and the assessment status totals for that CVE.
The fifth widget above provides a searchable node list detailing the total applicable CVE count per node as well as a breakdown of the CVE status totals for each node.
The final widget provides a searchable node list detailing every CVE applicable to that node along with the CVE assessment status for that node/CVE.
Using this dashboard, in conjunction with the built-in vulnerability & Risk dashboard, it is relatively easy to assess the CVEs against your network estate and assign a relevant status in bulk.
I hope this is useful to fellow Thwackers!
Daran.