User Guide. Lumension Endpoint Management and Security Suite Patch and Remediation 8.0

Transcription

1 User Guide Lumension Endpoint Management and Security Suite Patch and Remediation 8.0

2 Lumension Endpoint Management and Security Suite: Patch and Remediation - 2 -

3 Notices Version Information Lumension Endpoint Management and Security Suite: Patch and Remediation User Guide - Lumension Endpoint Management and Security Suite: Patch and Remediation Version Published: April 2014 Document Number: 02_215_8.0_ Copyright Information Lumension Security, Inc East Hartford Drive, Suite 300 Scottsdale, AZ Phone: Fax: info@lumension.com Copyright ; Lumension Security, Inc.; all rights reserved. Covered by one or more of U.S. Patent Nos. 6,990,660, 7,278,158, 7,487,495, 7,823,147, 7,870,606, and/or 7,894,514; other patents pending. This manual, as well as the software described in it, is furnished under license. No part of this manual may be reproduced, stored in a retrieval system, or transmitted in any form electronic, mechanical, recording, or otherwise except as permitted by such license. LIMITATION OF LIABILITY/DISCLAIMER OF WARRANTY: LUMENSION SECURITY, INC. (LUMENSION) MAKES NO REPRESENTATIONS OR WARRANTIES WITH REGARD TO THE ACCURACY OR COMPLETENESS OF THE INFORMATION PROVIDED IN THIS MANUAL. LUMENSION RESERVES THE RIGHT TO MAKE CHANGES TO THE INFORMATION DESCRIBED IN THIS MANUAL AT ANY TIME WITHOUT NOTICE AND WITHOUT OBLIGATION TO NOTIFY ANY PERSON OF SUCH CHANGES. THE INFORMATION PROVIDED IN THIS MANUAL IS PROVIDED AS IS AND WITHOUT WARRANTY OF ANY KIND, INCLUDING WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE INFORMATION PROVIDED IN THIS MANUAL IS NOT GUARANTEED OR WARRANTED TO PRODUCE ANY PARTICULAR RESULT, AND THE ADVICE AND STRATEGIES CONTAINED MAY NOT BE SUITABLE FOR EVERY ORGANIZATION. NO WARRANTY MAY BE CREATED OR EXTENDED WITH RESPECT TO THIS MANUAL BY SALES REPRESENTATIVES OR WRITTEN SALES MATERIALS. LUMENSION SHALL NOT BE LIABLE TO ANY PERSON WHATSOEVER FOR ANY LOSS OF PROFIT OR DATA OR ANY OTHER DAMAGES ARISING FROM THE USE OF THIS MANUAL, INCLUDING BUT NOT LIMITED TO DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGES

4 Lumension Endpoint Management and Security Suite: Patch and Remediation Trademark Information Lumension, Lumension Endpoint Management and Security Suite, Lumension Endpoint Management Platform, Lumension Patch and Remediation, Lumension Enterprise Reporting, Lumension Security Configuration Management, Lumension Content Wizard, Lumension Risk Manager, Lumension AntiVirus, Lumension Wake on LAN, Lumension Power Management, Lumension Remote Management, Lumension Scan, Lumension Security Configuration Management, Lumension Application Control, Lumension Device Control, Lumension Endpoint Security, Lumension Intelligent Whitelisting, PatchLink, PatchLink Update, their associated logos, and all other Lumension trademarks and trade names used here are the property of Lumension Security, Inc. or its affiliates in the U.S. and other countries. RSA Secured is a registered trademark of RSA Security Inc. Apache is a trademark of the Apache Software Foundation. In addition, any other companies' names, trade names, trademarks, and products mentioned in this document may be either registered trademarks or trademarks of their respective owners. Feedback Your feedback lets us know if we are meeting your documentation needs. the Lumension Technical Publications department at techpubs@lumension.com to tell us what you like best, what you like least, and to report any inaccuracies

5 Table of Contents Table of Contents Preface: About This Document Typographical Conventions...13 Contacting Lumension...14 Chapter 1: Lumension Patch and Remediation Overview...15 Patch and Remediation at a Glance...16 Chapter 2: Getting Started with Patch and Remediation...17 The Lumension Patch and Remediation Workflow...17 Logging In to Lumension Endpoint Management and Security Suite...18 Installing the Patch and Remediation Module Server Component Installing the Patch and Remediation Module for Endpoints Creating New Groups Apply Agent Policy Sets Viewing and Remediating Vulnerabilities Adding Content to a Mandatory Baseline...24 Defining Default Deployment Options...25 Editing Notifications Editing Custom Roles Chapter 3: Using the Web Console Common Functions Common Conventions...30 The Navigation Menu The Page Banner...34 List Pages Toolbars The Options Menu Filters Group By...40 Expanding and Collapsing Structures...41 Advancing Through Pages...41 Help Exporting Data The Home Page...43 The Dashboard Dashboard Setting and Behavior Icons Previewing and Printing the Dashboard...51 Editing the Dashboard The System Alert Pane License Expiration...54 Chapter 4: Configuring Options The Options Page The Options Page Buttons...56 Viewing the Options Page

6 Lumension Endpoint Management and Security Suite: Patch and Remediation The Agents Tab...56 The Deployments Tab...59 Working with Options Configuring the Agents Tab Configuring the Deployments Tab Defining Access Rights...64 Chapter 5: Configuring Notifications...67 The Notifications Page...67 The Notifications Table...68 Working with Notifications Creating Notifications Testing Notifications GSS Notifications...69 Chapter 6: Licensing, Subscriptions, and Support...71 The Product Licensing Page Viewing the Product Licensing Page The Product Licensing Page Buttons The Product Licensing Page List Initiating Subscription License Replication...73 Exporting Product Information...73 The Subscription Updates Page Viewing the Subscription Updates Page Subscription Updates Page Toolbar...75 Subscription Service History The Subscription Service Configuration Dialog Working with Subscription Updates Manually Replicating with the GSS...79 Resetting the Replication Status...79 Configuring the Service Tab...80 Restarting the Replication Service Configuring the Languages Tab Exporting Enhanced Content Data Exporting Subscription Update Data...82 Chapter 7: Using Endpoints The Endpoints Page The Patch and Remediation Tab...84 Viewing the Endpoints Page...90 Working with the Endpoints Page Deploying Content to Endpoints (Patch and Remediation Tab) Enabling Modules on an Endpoint...91 Enabling an Endpoint...92 Disabling Modules on an Endpoint...92 Disabling an Endpoint The Add/Remove Modules Dialog...93 Managing Module Endpoint Components...94 Using Scan Now to Scan Inventory (Patch and Remediation Tab) Rebooting Endpoints

7 Table of Contents Exporting Endpoint Information...96 The Endpoint Details Page Viewing the Endpoint Details Page...97 The Information Tab The Vulnerabilities Tab The Inventory Tab The Deployments and Tasks Tab Working with the Endpoint Details Page Enabling Content Disabling Content Updating the Cache Deploying Content (Endpoint Details Page) Enabling Deployments Disabling Deployments Aborting Deployments Deleting Deployments Managing Endpoint Modules Using Scan Now to Scan Inventory (Endpoint Details Page) Rebooting the Endpoint Chapter 8: Using Inventory About Inventory Viewing Inventory The Inventory Page The Inventory Page Toolbar The Inventory Page List (Filtered for Operating Systems) The Inventory Page List (Filtered for Software) The Inventory Page List (Filtered for Hardware) The Inventory Page List (Filtered for Services) About Scan Now (Scanning Inventory) Using Custom Inventory Guidelines for Linux/Unix/Mac-based Operating Systems Guidelines for Microsoft Windows-based Operating Systems Chapter 9: Managing Deployments and Tasks About Deployments Explaining Deployment Distribution Order Deployment Types Standard and Chained Deployments The Deployments and Tasks Page Viewing Deployments and Tasks Deployment Type The Deployments and Tasks Page Toolbar The Deployments and Tasks Page List Working With Deployments and Tasks Aborting Deployments and Tasks Disabling Deployments Enabling Deployments Editing Package Deployment Options Deleting Deployments Deploying Content (Deployments and Tasks Page)

8 Lumension Endpoint Management and Security Suite: Patch and Remediation Explaining Deployment Deadlines Using the Deployment Wizard Introduction Page Available Endpoints/Groups Page Available Packages Page Licenses Page Deployment Information Page Package Deployment Order and Behavior Page Notification Options Page Deployment Confirmation Page Deployment Summary Page The Deployment Details Page Viewing the Deployment Details The Deployment Details Page Toolbar The Deployment Details Page List Chapter 10: Using Groups The Groups Page Viewing Groups The Information View Group Information Mandatory Baseline Items The Group Membership View The Group Membership View Toolbar The Group Membership View List Deploying Content to Groups (Group Membership View) Using Scan Now to Scan Group Inventory Rebooting Groups The Endpoint Membership View The Patch and Remediation Tab (Groups Page) Assigning Endpoints to a Group Removing Endpoint from a Group Deploying Content to Endpoints (Endpoint Membership View) Enabling or Disabling Endpoints within a Group Enabling or Disabling Endpoints Modules within a Group Managing Endpoint Modules (Groups Page) Using Scan Now to Scan Group Endpoint Inventory Rebooting Group Endpoints The Mandatory Baseline View About Mandatory Baselines About Mandatory Baseline Import/Export The Mandatory Baseline Process Viewing a Group Mandatory Baseline The Mandatory Baseline View Toolbar The Mandatory Baseline View List Adding Content to Mandatory Baselines Removing Content from Mandatory Baselines Setting Mandatory Baseline Deployment Options Removing Deployments Created by Mandatory Baselines Updating the Mandatory Baseline Cache Importing Mandatory Baseline Templates

9 Table of Contents Exporting Mandatory Baselines Templates Exporting Mandatory Baseline View Data The Vulnerabilities View The Vulnerabilities View Toolbar The Vulnerabilities View List Disabling Content within a Group Enabling Content within a Group Updating the Groups Cache Deploying Selected Content (Vulnerabilities View) Exporting Vulnerability View Data The Inventory View The Inventory View Toolbar Exporting Inventory View Data The Deployments and Tasks View The Deployments and Tasks View Toolbar The Deployments and Tasks View List Enabling Group Deployments Disabling Group Deployments Aborting Group Deployments Deleting Group Deployments Deploying Content (Deployments and Tasks View) Exporting Deployments View Data The Agent Policy Sets View The Agent Policy Sets View Toolbar The Agent Policy Sets View List Assigning an Agent Policy Set to a Group Unassigning an Agent Policy Set from a Group Creating an Agent Policy Set (Groups Page) Exporting Agent Policy Set View Data The Roles View The Dashboard View The Settings View Editing Group Settings Chapter 11: Managing Agent Policy Sets The Agent Policy Sets Page About Agent Policies and Agent Policy Sets Viewing the Agent Policy Sets Page Defining Agent Policy Inheritance Rules Defining Agent Policy Conflict Resolution The Agent Policy Sets Page Toolbar The Agent Policy Sets Page List Working with Agent Policy Sets Creating an Agent Policy Set Editing an Agent Policy Set Defining Inventory Collection Options Defining Agent Hours of Operation The Edit FastPath Servers Dialog Assigning an Agent Policy Set to a Group Unassigning an Agent Policy Set from a Group

10 Lumension Endpoint Management and Security Suite: Patch and Remediation Chapter 12: Using Content About Content Defining Content Structure Vulnerabilities Software Content Other Content The Content Pages To Access the Content Pages The Content Type Filter The Content Pages Toolbar The Content Pages List Working With Content Deploying Selected Content (Content Pages) Disabling And Enabling Content Using Scan Now to Scan Inventory (Content Pages) Updating the Cache Exporting Content Data The Patch Status Page Viewing Content Patch Statuses The Patch Status Page Toolbar The Patch Status Page List The Information Tab Working with Content Items View Packages Deploying Content Exporting Content Item Data Chapter 13: Managing Packages About Packages The Packages Page Viewing Packages The Packages Page Toolbar The Packages Page List Content Package Icons and Descriptions Working with Packages Deploying Selected Packages Deleting a Package Updating the Package Cache Creating a Package Editing a Package The Package Details Page Viewing the Package Details Page The Deployments Tab (Package Details Page) The Information Tab (Package Details Page) Using the Package Editor Including Deployment Options in a Package Package Flag Descriptions Adding Files and Directories to a Package Adding a Directory to a Package Creating a Drive for a Package

11 Table of Contents Adding a New Macro to a Package Creating a Folder for a Package Adding a File to a Package Deleting a File from a Package Renaming a File within a Package Folder Properties for a Package Creating Scripts for a Package Chapter 14: Patch and Remediation Reporting About Patch and Remediation Reports The Patch and Remediation Report Pages Viewing the Patch and Remediation Report Pages Generating a Report Chapter 15: Using the Patch Module for Endpoints About the Patch Module for Pre-Windows Vista Viewing the Patch Module for XP and Server The Patch Module Dialog (Pre-Windows Vista) About Patch Module for Windows Vista and Later Viewing the Patch Module for Vista and Later The Patch Module Management Console (Windows Vista and Later) About Notification Manager Completing a Deployment from an Endpoint Completing a Restart from an Endpoint Chapter 16: Using the Patch Agent for Mac Endpoints About the Agent for Mac Viewing the Patch Agent Patch Agent Preferences Completing a Deployment from a Mac Endpoint Completing a Restart from a Mac Endpoint Chapter 17: Supporting Linux and UNIX Endpoints Configuring Patch and Remediation to Download Linux and UNIX Content Configuring Red Hat Network Credentials Configuring My Oracle Credentials Configuring Oracle Unbreakable Linux Network Credentials Configuring SUSE Network Credentials Configuring HP IT Resource Center Credentials Specifying Content Mirrors for CentOS Patch Agent Command Line Usage Appendix A: Glossary Glossary

12 Lumension Endpoint Management and Security Suite: Patch and Remediation

13 Preface About This Document This User Guide is a resource written for all users of Lumension Endpoint Management and Security Suite: Patch and Remediation 8.0. This document defines the concepts and procedures for installing, configuring, implementing, and using Lumension Endpoint Management and Security Suite: Patch and Remediation 8.0. Tip: Lumension documentation is updated on a regular basis. To acquire the latest version of this or any other published document, please refer to the Lumension Customer Portal ( Typographical Conventions The following conventions are used throughout this documentation to help you identify various information types. Table 1: Typographical Conventions Convention bold bold italics italics MONOSPACE UPPERCASE BOLD UPPERCASE monospace Usage Buttons, menu items, window and screen objects. Wizard names, window names, and page names. New terms, options, and variables. Keyboard keys. SQL Commands. File names, path names, programs, executables, command syntax, and property names

14 Lumension Endpoint Management and Security Suite: Patch and Remediation Contacting Lumension Arizona 8660 East Hartford Drive Suite 300 Scottsdale, AZ United States of America Phone: Phone: Fax: Lumension Support Ireland Lumension Security Ireland Ltd. Lyrr Building, Second Floor Mervue Business & Technology Park Mervue, Galway Ireland Phone: Fax: Luxembourg Lumension Security SA Atrium Business Park Z.A Bourmicht 23, rue du Puits Romain L-8070 Bertrange Luxembourg Phone: Fax: phone: (USA) (USA - legacy Sanctuary products) (EMEA) (UK) +61 (02) (Australia) (Hong Kong) (Singapore) submit a ticket: Registered users can open a support ticket via the customer portal ( Lumension customers without a support account should contact our support team (support@lumension.com) to have an account created. Note: For additional contact information, please visit the Contact Lumension page at

15 Chapter 1 Lumension Patch and Remediation Overview In this chapter: Patch and Remediation at a Glance Lumension Patch and Remediation (Patch and Remediation) is a Lumension Endpoint Management and Security Suite module that audits and remediates software and system configuration vulnerabilities within your network. It can also be used for networkwide installation of content non-related to vulnerabilities, such as software or service packs. To accomplish this task, Patch and Remediation uses two main components: The Endpoint Management and Security Suite Server and the Endpoint Management and Security Suite Agent. Patch and Remediation uses the Lumension EMSS Server to download content and then deploys it throughout your network. Content includes data that identifies vulnerabilities, patches that remediate them, and various other types of software and service packs. Content is deployed with assistance from the Lumension EMSS agent. The agent scans its host endpoint via a Discover Applicable Updates task, which takes a system inventory of endpoint software, hardware, and system configuration settings. The Discover Applicable Updates results are sent back to the server, which compares these results with a list of known vulnerabilities. Based on these results and administrator input, the server deploys content as needed

16 Lumension Endpoint Management and Security Suite: Patch and Remediation Patch and Remediation at a Glance Patch and Remediation is a module you can use to install patches and other software on your network endpoints. Benefits Identifies endpoint vulnerabilities and remediates them by installing content (such as software and patches). Scans agent-managed endpoints for an inventory of their hardware and software. Lets you deploy patches, software, and other types on content to endpoints. Lets you establish Mandatory Baselines, which are content standards applied to endpoint groups that monitor endpoints to ensure defined content is always installed. Adds new Patch and Remediation-related reports, agent policies, default options, widgets, access rights, and notifications

17 Chapter 2 Getting Started with Patch and Remediation In this chapter: The Lumension Patch and Remediation Workflow Patch and Remediation is a Lumension Endpoint Management and Security Suite module that remotely installs patches and other software on your managed network endpoints. To get started with Patch and Remediation, you should install the module and then perform several other tasks essential to its operation. After performing these tasks, you will be able to deploy patches and other content to endpoints in your network, thus remediating potential exploits. Following completion of these initial tasks, take some time to grow accustomed to the Patch and Remediation. You will continue to perform these tasks, plus many other. Lumension EMSS contains many features and functions, and by learning the environment, you can secure your network quickly and efficiently. The Lumension Patch and Remediation Workflow To use Lumension Patch and Remediation (Patch and Remediation), all Lumension Endpoint Management and Security Suite components must be installed, along with the Patch and Remediation module. After installing all necessary components, review this chart to understand the Patch and Remediation work flow. Refer to the following flow chart to determine tasks when using the Patch and Remediation module within Lumension EMSS. Install the Patch and Remediation module server component. This component is installed after initial Lumension EMSS installation. For additional information, refer to Installing the Patch and Remediation Module Server Component on page 19. Note: If you purchased a Patch and Remediation license during your initial Lumension EMSS purchase, Patch and Remediation is installed during the initial Lumension EMSS installation by default

18 Lumension Endpoint Management and Security Suite: Patch and Remediation Install the Patch and Remediation module endpoint component on agents you want to support Patch and Remediation functions. Each agent you install the endpoint component on consumes a Patch and Remediation license. For additional information, refer to Installing the Patch and Remediation Module for Endpoints on page 20. Create groups containing Patch and Remediation endpoints in preparation for deployment. A group associates similar endpoints for the purpose of deploying content to multiple endpoints. For additional information, refer to Creating New Groups on page 21. Create new agent policy sets (or edit existing policy set for Patch and Remediation functions) and apply them to Patch and Remediation groups. Agent policy sets are a compilation of values that govern agent behavior. New settings for agent policy sets are added after installing Patch and Remediation. For additional information, refer to Apply Agent Policy Sets on page 22. View network vulnerabilities and then deploy content, which are patches and other software, to managed endpoints. First, view network vulnerabilities. Agents detect vulnerabilities by scanning endpoints for signatures that indicate a vulnerabilities are present. The, remediate vulnerabilities using a deployment, which triggers the agent to download selected content from the Lumension EMSS Server. For additional information, refer to Viewing and Remediating Vulnerabilities on page 23. After initial vulnerabilities are remediated, you can define a Mandatory Baseline. This baseline is a selection of user-defined content that must always be installed on all group endpoints. If an endpoint falls out of compliance, the Mandatory Baseline ensures the endpoint is patched back into compliance via automatic deployment. For additional information, refer to Installing the Patch and Remediation Module for Endpoints on page 20. Define default Patch and Remediation settings. New default settings are added to Lumension Endpoint Management and Security Suite after Patch and Remediation is installed. New settings include new access roles, notifications, and deployment options. For additional information, refer to the following topics: Defining Default Deployment Options on page 25 Editing Notifications on page 25 Editing Custom Roles on page 26 Logging In to Lumension Endpoint Management and Security Suite Get started with Lumension Endpoint Management and Security Suite by logging in to the Web console. You can access this console from any endpoint in your network. 1. Open your Web browser

19 Getting Started with Patch and Remediation 2. In your browser s address bar, type the Lumension EMSS URL (http[s]://serverurl) and press ENTER. Tip: You can also use the server IP address. Step Result: A dialog prompting you for credentials opens. 3. Type your user name in the User name field. When logging in for the first time, type the user name of the Windows user account used to install Lumension EMSS. You can use additional user names after adding new user profiles to Lumension EMSS. If logging in using a domain account, type the name in the following format: DOMAIN\Username. 4. Type your password in the Password field. 5. Click OK. After Completing This Task: Continue to Installing the Patch and Remediation Module Server Component on page 19. Installing the Patch and Remediation Module Server Component After logging in to Lumension Endpoint Management and Security Suite, the first step in implementing Patch and Remediation features and functions is to install the server module Figure 1: Install Server Module Install the server module using Installation Manager. 1. Select Tools > Launch Installation Manager. Step Result: Installation Manager opens to the New/Update Components tab. 2. Select the Patch and Remediation check box for your version number of Lumension Endpoint Management and Security Suite. 3. Click Install. Step Result: The Install/Update Components dialog opens. 4. Click Next to dismiss the Database backup recommended notification. Lumension recommends backing up your database before installing a module. 5. Click Install. Step Result: A dialog opens, notifying you that installing the module may cause logged in user to lost their work

20 Lumension Endpoint Management and Security Suite: Patch and Remediation 6. Click OK. Step Result: The installation begins. 7. Click Finish. Tip: Select the Launch Lumension EMSS check box to relaunch Lumension Endpoint Management and Security Suite after clicking Finish. Result: The Patch and Remediation server module is installed. After Completing This Task: Continue to Installing the Patch and Remediation Module for Endpoints on page 20. Installing the Patch and Remediation Module for Endpoints After installing the Patch and Remediation server module, you must install the Patch and Remediation module for your network endpoints. Prerequisites: Complete Installing the Patch and Remediation Module Server Component on page 19. Figure 2: Install Endpoint Module Install the endpoint component from the Endpoints page. 1. Select Manage > Endpoints. Step Result: The Endpoints page opens to the All tab. 2. From the list, select the endpoints that you want to install the Patch and Remediation endpoint module on. 3. Click Manage Modules Step Result: The Add/Remove Modules dialog opens. 4. Select the Patch check box for all endpoints you want to install the component on. 5. Click OK. Result: The Patch and Remediation endpoint module is installed on selected endpoints. After Completing This Task: Continue to Creating New Groups on page

21 Getting Started with Patch and Remediation Creating New Groups After installing the Patch and Remediation components, create a new group for your Patch and Remediation endpoints. By placing your Patch and Remediation endpoints in a group (or multiple groups), you can manage them collectively. For example, you deploy content to all Patch and Remediation with one deployment by using groups. Prerequisites: Complete Installing the Patch and Remediation Module for Endpoints on page 20. Figure 3: Group Diagram Create and configure groups from the Groups page. 1. From the navigation menu, select Manage > Groups. 2. From the Group Browser directory tree, select Custom Groups. Groups are arranged within a directory tree structure. You can place your new group anywhere within the custom group hierarchy. Note: The group you create is added as a child group to the group selected within the directory tree. 3. Create a group. a) From the View list, select Group Membership. b) Click Create. c) In the Name field that displays, type a group name. d) In the Description field that displays, type a description. e) Click the Save icon. 4. Add endpoints to the group. a) From the View list, select Endpoint Membership. b) Click Manage. c) Assign endpoints to the group. For more detailed information, refer to Assigning Endpoints to a Group on page 185. d) Click OK. 5. Define the group's settings. Group settings contain additional group controls. a) From the View list, select Settings. b) Define the settings. For more detailed information, refer to Editing Group Settings on page

22 Lumension Endpoint Management and Security Suite: Patch and Remediation c) Click Save. Result: The group is created. After Completing This Task: Continue to Apply Agent Policy Sets on page 22. Apply Agent Policy Sets After you create a group, create and assign an agent policy set to govern the group endpoint behavior. Agent policy sets can control endpoint communications, hours or operations, and so on. Prerequisites: Complete Creating New Groups on page 21. Figure 4: Install Server Module Create agent policy sets using the Agent Policy Sets page, and then assign them to a group using the Groups page. 1. Select Manage > Agent Policy Sets. Step Result: The Agent Policy Sets page opens. 2. Click Create to create an agent policy set. For additional information, refer to Creating an Agent Policy Set on page Select Manage > Groups. Step Result: The Groups page opens. 4. From the View list, select Agent Policy Sets. Step Result: The Agent Policy Sets view opens. 5. From the Group Browser directory tree, select the group you created. 6. Click Assign to assign the agent policy set to your created group. For additional information, refer to Assigning an Agent Policy Set to a Group on page 223. Result: The agent policy set is created and assigned. After Completing This Task: Continue to Viewing and Remediating Vulnerabilities on page

23 Getting Started with Patch and Remediation Viewing and Remediating Vulnerabilities After installing the Patch and Remediation module server and endpoint components, your network endpoints complete their first Discover Applicable Updates task, which detect vulnerabilities. Following this task, you can then view vulnerabilities in your network and then deploy patches and other content to resolve them. Prerequisites: Complete Apply Agent Policy Sets on page 22. Figure 5: Viewing and Remediating Vulnerabilities 1. View dashboard widgets, vulnerabilities, and reports to identify vulnerabilities in your network. Dashboard widgets and reports provide detailed graphs and statistics about the state of your network. Reviewing this information provides insight about the actions required to secure your network. For additional information, refer to the following documentation: To see an overview of how many vulnerabilities are in your network, view The Dashboard. View the dashboard by click Home from the navigation menu. To view the vulnerabilities on a specific endpoint, view The Endpoint Details Page. View the Endpoint Details page by selecting Manage > Endpoints and clicking an endpoint link. To view the specific vulnerabilities in your network, view The Content Pages List. To view this page, select Manage > Vulnerabilities. To view a report of vulnerabilities in your network, view Generating a Report. To generate reports, select Reports > All Reports, select a report, and click Generate Report. 2. Select Review > Vulnerabilities > All. Step Result: The Content page opens to show vulnerabilities. 3. From the list, select the vulnerabilities you want to deploy. Tip: Use the page filters to find vulnerabilities applicable to your endpoints. 4. Click Deploy to remediate vulnerabilities. Remediate network vulnerabilities by deploying content that fix identified vulnerabilities. For additional information, refer to. Result: The deployment is scheduled and will begin at the scheduled time. Completion time of the deployment varies dependent on size. After Completing This Task: Continue to Adding Content to a Mandatory Baseline on page

24 Lumension Endpoint Management and Security Suite: Patch and Remediation Adding Content to a Mandatory Baseline Each group in Lumension Endpoint Management and Security Suite has a Mandatory Baseline, which is a list of content that must be installed on the group's endpoints at all time. By default, this baseline is empty. However, you can add patches, software, and other content to this baseline. After adding content to the baseline, Lumension Endpoint Management and Security Suite continually checks groups endpoints for the content's presence. If a group endpoint is found to not have content included in the Mandatory Baseline, Lumension Endpoint Management and Security Suitet automatically deploys that content to the endpoint. Prerequisites: Complete Editing Notifications on page 25. Figure 6: Adding Content to Mandatory Baselines Add content to a Mandatory Baseline from the Groups page. 1. Select Manage > Groups. 2. From the View list, select Mandatory Baseline. 3. From the Group Browser directory, select the group you created earlier. 4. Click Manage to add content. For additional information, refer to Adding Content to Mandatory Baselines on page Click OK. Result: Content is added to the group Mandatory Baseline. After Completing This Task: Continue to Defining Default Deployment Options on page

25 Getting Started with Patch and Remediation Defining Default Deployment Options After you install Patch and Remediation, a Deployments tab is added to the Options page. Configure this tab to define the default values for the Deployments Wizard. Prerequisites: Complete Adding Content to a Mandatory Baseline on page 24. Figure 7: Define Default Deployment Options Define default deployment options from the Options page. 1. Select Tools > Options. 2. Select the Deployments tab. 3. Define the default deployment options. For additional information, refer to Configuring the Deployments Tab on page Click Save. Result: The default deployment options are defined. After Completing This Task: Continue to Editing Notifications on page 25. Editing Notifications After installing Patch and Remediation, two new notification types are added: New Vulnerabilities and Deployment Failure. To use these new notifications, edit your defined addresses or create new ones. Prerequisites: Complete Defining Default Deployment Options on page 25. Figure 8: Edit Notifications Edit notifications from the Notifications page

26 Lumension Endpoint Management and Security Suite: Patch and Remediation 1. Select Tools > Notification. Step Result: The Notifications page opens. 2. For each defined address, select one or both of the following new notification types available after installation of Patch and Remediation. Tip: For more information on how to define a new address and notifications, refer to Creating Notifications on page 68. Notification Type New Vulnerabilities Deployment Failure Description Sends the defined address a notification when new vulnerabilities are available. Sends the defined address a notification when a scheduled deployment fails. Tip: Additional options are available for the Lumension EMSS core features and other modules. 3. Click Save. 4. Click OK. Result: The addresses you edited are configured to receive the new notifications. After Completing This Task: Continue to Editing Custom Roles on page 26. Editing Custom Roles After installing Patch and Remediation, new access rights are added for new features. To update custom roles for these features, edit your roles. Prerequisites: Complete Editing Notifications on page 25. Edit custom roles from the Users and Roles page. 1. Select Tools > Users and Roles. 2. Select the Roles tab. 3. From the page list, click the edit icon for the custom role to which you want to add access rights. Step Result: The Edit Role dialog opens. 4. Select the Access Rights tab

27 Getting Started with Patch and Remediation 5. Define the new Patch and Remediation access rights. Dashboard Access Rights View LPR Widgets Content and Vulnerabilities Access Rights View LPR Widgets View Content Manage Content Export Content View Content Details Endpoint Access Rights View LPR Tab Manage LPR Tab Export LPR Tab Scan Now Discover Applicable Updates Reboot Endpoints Inventory Access Rights View Inventory Export Inventory Deployments and Tasks Access Rights Create Deployments View My Deployments and Tasks View All Deployments Description Access to select and view the Patch and Remediation Dashboard widgets. Description Access to select and view the Patch and Remediation Dashboard widgets. Access the vulnerability and other content data. Enable and disable vulnerabilities and other content. Export vulnerability and other content data list. Access the detailed information for vulnerabilities and other content. Description Access the Patch and Remediation tab. Install, uninstall, enable, and disable the Patch and Remediation module. Export the Patch and Remediation tab endpoint list. Scan endpoints using the DAU Scan Now Dropdown button. Reboot endpoints using the Reboot Now button. Description View the endpoint inventory. Export the endpoint inventory list. Description Ability to create new deployments. Access the deployments and tasks that this user has created. Access the deployments that all users have created

28 Lumension Endpoint Management and Security Suite: Patch and Remediation Deployments and Tasks Access Rights Manage Deployments and Tasks Export Deployments and Tasks Packages Access Rights View Packages Manage Packages Export Packages Cache Packages Notifications Access Rights Manage LPR Notifications Description Deploy, enable, disable, abort, and delete deployments and tasks that the user has access to. Export the deployments and tasks in the list that this user has access to. Description Access the package data. Create, edit, and delete packages. Export the package data list. Ability to download packages from the Global Subscription Service onto the Lumension Endpoint Management and Security Suite server. Description Create and edit Patch and Remediation notifications. 6. Click OK

29 Chapter 3 Using the Web Console In this chapter: Common Functions The Home Page Within the Lumension Endpoint Management and Security Suite Web console, you can use a number of common functions to navigate and operate the system. After you log in, Lumension Endpoint Management and Security Suite opens to the Home page. Lumension Endpoint Management and Security Suite performs the following functions: Endpoint Detection Agent Installation Endpoint Management Endpoint Grouping Agent Policy Set Creation User and Role Creation and Management Server Module Management Report Generation Lumension Endpoint Management and Security Suite consists of a browser-based management console, which provides access to system management, configuration, reporting, and deployment options. Common Functions Lumension Endpoint Management and Security Suite uses standard Web browser conventions and unique conventions. Familiarize yourself with these conventions to facilitate efficient product use. From the Navigation Menu and system pages, you can access all features and functions you are authorized for

30 Lumension Endpoint Management and Security Suite: Patch and Remediation Common Conventions The Web console supports user interface conventions common to most Web applications. Table 2: Common User Interface Conventions Screen Feature Entry Fields Function Depending on text, type data into these fields to either: Retrieve matching criteria Enter new information Drop-Down Menus Command Buttons Check Boxes Display a list of selectable values when clicked. Perform specific actions when clicked. A check box is selected or cleared to: Enable or disable a feature Initiate functions for list items Some lists include a Select All check box for selecting all items, including overflow items. Radio Buttons Sort Select the button to select an item. Data presented in tables can be sorted by clicking column headers. Columns can be sort in the following orders: Ascending (default) Descending Mouseovers Auto Refresh Scrollbars Tabs Bread Crumb Move your mouse over an item to display a text description. Some pages feature an Auto Refresh check box. Select the check box to automatically refresh the page every 15 seconds. Drag scrollbars to see additional data. Select different tabs to display hidden information. Displays the path to the page you are viewing. The breadcrumb lists: The page you are viewing Its parent page (if applicable) The Navigation Menu item used to open the page If the breadcrumb contains a link, you can click it to retrace your steps. Tip: Most pages support right-click

31 Using the Web Console The Navigation Menu This menu appears on all Lumension Endpoint Management and Security Suite pages. Use this menu to navigate through the console. This menu organizes product features based on functionality. When you select a menu item, a new page, dialog, wizard, or window opens. You can access all system features from this menu (that your access rights authorize). Note: The menu items available change based on modules you install. Figure 9: Navigation Menu Table 3: Navigation Menus Menu Home Discover Review Manage Reports Tools Help Description Opens the Home page. This link contains no menu items. Contains menu items related to running discovery scan jobs. Contains menu items related to reviewing security content and discovery scan jobs. Contains menu items related to managing system features. Contains menu items related to creating reports. Contains menu items related to system administration. Contains menu items related to help systems. The following table lists each menu item in the Review menu and the actions that occur when they are selected. Table 4: Review Menu Items Menu Item My Default View Description The All Content page with your saved filters

32 Lumension Endpoint Management and Security Suite: Patch and Remediation Menu Item Vulnerabilities Description Opens a sub-menu. The sub-menu contains the following items: All Critical Vulnerabilities New Vulnerabilities Top Vulnerabilities The Vulnerabilities page, filtered to show only critical vulnerabilities. The Vulnerabilities page, filtered to show only critical vulnerabilities that are not superseded. The Vulnerabilities page, filtered to show only critical but not superseded vulnerabilities released in the last 30 days. The Vulnerabilities page, filtered to show only critical but not superseded vulnerabilities sorted by the greatest number of applicable endpoints that are not patched. Software Opens a sub-menu. The sub-menu contains the following items: All Service Packs Software Installers Updates The Software page, filtered to show all software. The Software page, filtered to show only service packs. The Software page, filtered to show only software installers. The Software page, filtered to show only software updates

33 Using the Web Console Menu Item Other Description Opens a sub-menu. The sub-menu contains the following items: All Detection Only Informational Packages Policies Recommended System Management Tasks Virus Removal The Other page, filtered to show all noncritical content. The Other page, filtered to display Detection Only content. The Other page, filtered to display only Information content. The Other page, filtered to display only Packages content. The Other page, filtered to display only Policies content. The Other page, filtered to display only Recommended content. The Other page, filtered to display only System Management content. The Other page, filtered to display only Task content. The Other page, filtered to display only Virus Removal content. The following table lists each menu item in the Manage menu and the actions that occur when they are selected. Table 5: Manage Menu Items Menu Item Inventory Deployments and Tasks Description Opens the Inventory page. Opens the Deployments and Tasks page. The following table lists each menu item in the Reports menu and the actions that occur when they are selected. Table 6: Reports Menu Items Menu Item Deployments Management/Status Description Opens the All Reports page with deployments reports expanded. Opens the All Reports page with management/status reports expanded

34 Lumension Endpoint Management and Security Suite: Patch and Remediation Menu Item Risks Vulnerabilities Enhanced Reports Description Opens the All Reports page with risks reports expanded. Opens the All Reports page with vulnerabilities reports expanded. Opens a custom, user-defined URL. This URL is usually used to open a third-party reporting Web page. Note: Any unavailable or absent menus, menu items, or sub-menu items are due to restricted access rights or unavailable modules. Contact your network administrator if you require access to unavailable features. The Page Banner A page banner displays when the page is added for a new module. Use this banner to identify the module that the page belongs to. Figure 10: Page Banner For example, pages for Lumension Patch and Remediation display a Patch and Remediation page banner. Page banners are color-coded by module. List Pages Most pages feature lists of selectable items. These items represent different product features that can be edited using menus and buttons. Figure 11: List Page To select a single list item: Select a check box. Click a list row

35 Using the Web Console To select multiple list items: Select the Select All check box. Select multiple, non-concurrent items by using CTRL+Click over list rows. Select multiple, concurrent items by using SHIFT+Click and mousing over list rows. Toolbars Toolbars appear on most Web console pages. They contain menus and buttons you can use to initiate page features. Figure 12: Toolbar The menus and buttons displayed vary according to page. Click the available menus and buttons to use them. User roles determine which buttons are available. The Options Menu Toolbars feature an Options menu. You can use these options to change how the page displays information. Table 7: Options Menu Items Option Show results on page load Save as default view Clear default view Show Filter Row 1 Show Group By Row 2 Enable Copy to Clipboard 3 Description Toggles automatic page results on and off. When enabled, the page list automatically populates with results. When disabled, you must define page filters and click Update View before results populate. For more information, see Filters on page 36. Saves the current page settings as the default view. Resets the saved view to the system default. Toggles the Filter Row on and off. For additional information, refer to Using Filter Rows on page 38 Toggles the Show Group By Row on and off. For additional information, refer to Group By on page 40. Toggles the ability to select text for clipboard copy. 1. This option title changes to Hide Filter Row when toggled. 2. This option title changes to Hide Group By Row when toggled. 3. Selecting this option disables other features, such as right-click context menus and list item dragging

36 Lumension Endpoint Management and Security Suite: Patch and Remediation Filters Filters appear on most list pages. You can use them to search pages for specific data. Depending on which page you are viewing, you can filter pages using one of the following features. Only one feature appears per page. Filters Filter Row Filters Filters appear above page lists. They feature different fields, lists, and check boxes used for filtering. Filters vary according to page. Figure 13: Filters You can save frequently used filter settings as your default view. To save your settings, select Options > Save as default view from the toolbar. The toolbar Options menu contains the following options for filtering. Table 8: Filter Options Option Show results on page load Save as default view Function Automatically retrieves and displays results when selected. Saves the active filter and sort criteria as the default view for the page. The default view displays each time the page is accessed, including the following events: Browsing to a different page. Logging out of the Web console. The default view is saved until you save a new one or you clear it. Clear default view Resets a saved default view to the system default view. Filter Rows

37 Using the Web Console Filter rows appear in the lists themselves. Rows feature a field for each column. Figure 14: Filter Row Filters are not case sensitive. Columns can be filtered using a variety of data types. For example, you can use a Contains filter or a StartsWith filter. Date columns filter at the lowest level of granularity. Higher levels of granularity return no filter results. Supported Wildcards When searching for or filtering vulnerabilities, you can use wildcards to make search results more specific and efficient. Wildcards can be used anywhere within the search string. The following table lists the supported operators and wildcards in Lumension Endpoint Management and Security Suite. Type any wildcards that you intend to use in the Name of CVE-ID field. Table 9: Supported Wildcards Wildcard Description Example % Any string. The string can be empty or contain any number of characters. Typing Microsoft%Server in the Name or CVE- ID field returns any vulnerability with the words Microsoft and Server in any part of the name, such as: _ (underscore) Wildcard placeholder for any single character. MS Security Update for Microsoft Office SharePoint Server Bit Edition (KB ) The 2007 Microsoft Office Servers Service Pack 3 (SP3), 32-bit Edition (KB ) Typing _itrix or Citri_ in the Name or CVE- ID field returns any vulnerabilities with Citrix in the name. [ ] Any single character within a range ([a-f]) or set ([abcdef]). Typing [m]ic in the Name or CVE-ID field returns vulnerabilities with the string mic within the name (Microsoft and Dynamic). Typing 200[78] in the Name or CVE-ID field returns vulnerabilities with 2007 or 2008 within the name. [^] Any single character not within a range ([^a-f]) or set ([^abcdef]). Typing M[^i]cro in the Name or CVE-ID field returns any vulnerability that does not have Micro in its name