1 Reply Latest reply on Jan 26, 2017 7:08 AM by worto03

    Solarwinds NCM and Cisco Vulnerability management - 3 questions.




      We're about to start using solarwinds NCM 7.5.1 for vulnerability management but I have a few questions I'm hoping someone who already uses this can help out with.


      1) Is there still an issue with false positives because NCM doesn't detect minor IOS versions, this issue may make it a bit of a non starter, I really don't want loads of false positives to have to validate because solarwinds can't detect minor versions?


      2) We score the CVSS using the following

      Critical : 9.0 - 10

      High : 7.0 - 8.9

      Medium : 4.0 - 6.9

      Low : 3.9 or below


      but NCM doesn't seem to have a critical section, it just considers everything above 7 as high, is there somewhere I can configure this as we have 7 days to fix a critical vulnerability but 30 days to fix a high one so I need to be able to separate them in reports and the resource?


      3) In the press release it says NCM can identify device vulnerabilities and provide automated remediation actions, I can't find any video's or guides that go beyond setting up the Firmware Vulnerabilities Resource or the vulnerabilities reports, so I've got as far as detection, where do I look for recommended remediation actions per node?


      Thanks for any help or pointers to guides that I've missed,