AlienVault® USM Appliance™

Vulnerability Assessment

AlienVaultUSM Appliance delivers vulnerability assessment as part of a complete package of security monitoring and management capabilities for efficient threat detection. Because to improve security in your network, you first need to know what is vulnerable.

What Is Vulnerability Assessment?

Vulnerability assessment is a functionality used for defining, identifying, classifying and prioritizing the vulnerabilities in your system.

USM Vulnerabilites architecture.

USM Appliance architecture.

The USM Appliance Server controls vulnerability scanning on USM Appliance Sensors. It scans assets in specific networks.

You can select which sensor should scan which network. Alternatively, you can also specify that the first available sensor in your USM Appliance deployment performs the scanning.

Vulnerability Assessment in USM Appliance

The USM Appliance Sensor has a built-in vulnerability scanner that you can use to detect vulnerabilities in critical assets. You then use these discovered vulnerabilities in cross-correlation rules, and when creating compliance and auditing reports.

The USM Appliance Server controls the following scanning functions by the USM Appliance Sensor:

  • Running and scheduling vulnerability scans
  • Generating and examining reports
  • Updating vulnerability signatures

Vulnerability Risk Factors

Discovering a vulnerability by itself is important, but can be of little use without the ability to estimate the associated risk to an asset. For this reason, USM Appliance assigns a risk factor to each vulnerability found in the system. The risk factors correspond with the Common Vulnerability Scoring System (CVSS) v2.0 severity ratings provided by the National Vulnerability Database (NVD).

Vulnerability risk factor and its assigned value
Risk Factor Assigned Value
Critical 1
High 2
Medium 3
Low 6
Info 7

USM Appliance assess the risk factor for each vulnerability, which cannot be modified. But, you can configure a ticket to be generated when the risk factor reaches a certain value. This value is called Vulnerability Ticket Threshold in USM Appliance. See Changing the Vulnerability Ticket Threshold for more details.