|Applies to Product:||USM Appliance™||AlienVault OSSIM®|
To modify a custom profile for vulnerability scans
- Navigate to Environment > Vulnerabilities > Overview, and click Profiles.
Click the pencil () icon of the profile you want to modify.
Note: Only admin and global admin accounts can modify a custom profile. Non-admin users can only edit the profiles they've created.
Deep, Default, and Ultimate profiles are default USM Appliance profiles that can't be modified.
The Edit Profile: <name of profile> popup displays.
Modify the settings as needed.
Options available in a custom profile
Displays a list of plugin categories or families. Allows users to modify the description, the owner and the auto-enable options.
Allows for detailed adjustment of the plugins that the AlienVault vulnerability scanner uses to scan your assets. USM Appliance displays the number of plugins available as well as the number of plugins enabled in the current profile.
Allows for personalized configuration for each profile.
These preferences are generated dynamically. They may change after an AlienVault Lab Intelligence Update.
Shows the final configuration.
USM Appliance displays the preferences selected in the previous option in plain text.
- Enable or disable the plugins as needed with the Enable All or Disable All options. Currently, the Enable New, Disable New, and Intelligent options have no designated functionality in USM Appliance.
USM Appliance displays "Update Status" at the top of the page.
After it completes, the vulnerabilities overview page displays.
To enable or disable specific plugins
Click Plugins when editing a profile.
USM Appliance displays two lists, Family and CVE ID, for you to filter the plugins.
Use one of the lists to make a selection, depending on what you are looking for.
USM Appliance displays the list of plugins based on your selection.
- Select the plugins you want to enable or disable, and then click Update.
Alternatively, use the Enable All/Disable All buttons to enable or disable all the plugins belonging to the same group.
Note: If you choose Enable Non DOS, USM Appliance only enables the less aggressive plugins, making sure the appliance remains in service, no data is destroyed and no testing services are interrupted.
To search the Threat Database for available plugins
Navigate to Environment > Vulnerabilities > Threat Database.
USM Appliance displays the threat families with the number of plugins in each severity.
Use one of the four methods, Date Range, Keywords, CVE ID, and Risk Factor, to search for the plugin you want.
This returns a list of the plugins related to the search. Hovering the mouse over an ID will display the plugin details.
Note: The CVE links take you to the corresponding Vulnerability Details page on http://www.cvedetails.com.