User Guide Lumension Endpoint Management and Security Suite Patch and Remediation 8.0
Lumension Endpoint Management and Security Suite: Patch and Remediation - 2 -
Notices Version Information Lumension Endpoint Management and Security Suite: Patch and Remediation User Guide - Lumension Endpoint Management and Security Suite: Patch and Remediation Version 8.0 - Published: April 2014 Document Number: 02_215_8.0_141201433 Copyright Information Lumension Security, Inc. 8660 East Hartford Drive, Suite 300 Scottsdale, AZ 85255 Phone: +1 888.725.7828 Fax: +1 480.970.6323 E-mail: info@lumension.com Copyright 1999-2014; Lumension Security, Inc.; all rights reserved. Covered by one or more of U.S. Patent Nos. 6,990,660, 7,278,158, 7,487,495, 7,823,147, 7,870,606, and/or 7,894,514; other patents pending. This manual, as well as the software described in it, is furnished under license. No part of this manual may be reproduced, stored in a retrieval system, or transmitted in any form electronic, mechanical, recording, or otherwise except as permitted by such license. LIMITATION OF LIABILITY/DISCLAIMER OF WARRANTY: LUMENSION SECURITY, INC. (LUMENSION) MAKES NO REPRESENTATIONS OR WARRANTIES WITH REGARD TO THE ACCURACY OR COMPLETENESS OF THE INFORMATION PROVIDED IN THIS MANUAL. LUMENSION RESERVES THE RIGHT TO MAKE CHANGES TO THE INFORMATION DESCRIBED IN THIS MANUAL AT ANY TIME WITHOUT NOTICE AND WITHOUT OBLIGATION TO NOTIFY ANY PERSON OF SUCH CHANGES. THE INFORMATION PROVIDED IN THIS MANUAL IS PROVIDED AS IS AND WITHOUT WARRANTY OF ANY KIND, INCLUDING WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE INFORMATION PROVIDED IN THIS MANUAL IS NOT GUARANTEED OR WARRANTED TO PRODUCE ANY PARTICULAR RESULT, AND THE ADVICE AND STRATEGIES CONTAINED MAY NOT BE SUITABLE FOR EVERY ORGANIZATION. NO WARRANTY MAY BE CREATED OR EXTENDED WITH RESPECT TO THIS MANUAL BY SALES REPRESENTATIVES OR WRITTEN SALES MATERIALS. LUMENSION SHALL NOT BE LIABLE TO ANY PERSON WHATSOEVER FOR ANY LOSS OF PROFIT OR DATA OR ANY OTHER DAMAGES ARISING FROM THE USE OF THIS MANUAL, INCLUDING BUT NOT LIMITED TO DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGES. - 3 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Trademark Information Lumension, Lumension Endpoint Management and Security Suite, Lumension Endpoint Management Platform, Lumension Patch and Remediation, Lumension Enterprise Reporting, Lumension Security Configuration Management, Lumension Content Wizard, Lumension Risk Manager, Lumension AntiVirus, Lumension Wake on LAN, Lumension Power Management, Lumension Remote Management, Lumension Scan, Lumension Security Configuration Management, Lumension Application Control, Lumension Device Control, Lumension Endpoint Security, Lumension Intelligent Whitelisting, PatchLink, PatchLink Update, their associated logos, and all other Lumension trademarks and trade names used here are the property of Lumension Security, Inc. or its affiliates in the U.S. and other countries. RSA Secured is a registered trademark of RSA Security Inc. Apache is a trademark of the Apache Software Foundation. In addition, any other companies' names, trade names, trademarks, and products mentioned in this document may be either registered trademarks or trademarks of their respective owners. Feedback Your feedback lets us know if we are meeting your documentation needs. E-mail the Lumension Technical Publications department at techpubs@lumension.com to tell us what you like best, what you like least, and to report any inaccuracies. - 4 -
Table of Contents Table of Contents Preface: About This Document... 13 Typographical Conventions...13 Contacting Lumension...14 Chapter 1: Lumension Patch and Remediation Overview...15 Patch and Remediation at a Glance...16 Chapter 2: Getting Started with Patch and Remediation...17 The Lumension Patch and Remediation Workflow...17 Logging In to Lumension Endpoint Management and Security Suite...18 Installing the Patch and Remediation Module Server Component... 19 Installing the Patch and Remediation Module for Endpoints... 20 Creating New Groups... 21 Apply Agent Policy Sets... 22 Viewing and Remediating Vulnerabilities... 23 Adding Content to a Mandatory Baseline...24 Defining Default Deployment Options...25 Editing Email Notifications... 25 Editing Custom Roles... 26 Chapter 3: Using the Web Console... 29 Common Functions... 29 Common Conventions...30 The Navigation Menu... 31 The Page Banner...34 List Pages... 34 Toolbars... 35 The Options Menu... 35 Filters... 36 Group By...40 Expanding and Collapsing Structures...41 Advancing Through Pages...41 Help... 42 Exporting Data... 42 The Home Page...43 The Dashboard... 43 Dashboard Setting and Behavior Icons... 50 Previewing and Printing the Dashboard...51 Editing the Dashboard... 51 The System Alert Pane... 53 License Expiration...54 Chapter 4: Configuring Options... 55 The Options Page... 55 The Options Page Buttons...56 Viewing the Options Page... 56-5 -
Lumension Endpoint Management and Security Suite: Patch and Remediation The Agents Tab...56 The Deployments Tab...59 Working with Options... 61 Configuring the Agents Tab... 61 Configuring the Deployments Tab... 62 Defining Access Rights...64 Chapter 5: Configuring Notifications...67 The Email Notifications Page...67 The Email Notifications Table...68 Working with Email Notifications... 68 Creating Email Notifications... 68 Testing Email Notifications... 69 GSS Notifications...69 Chapter 6: Licensing, Subscriptions, and Support...71 The Product Licensing Page... 71 Viewing the Product Licensing Page... 71 The Product Licensing Page Buttons... 72 The Product Licensing Page List... 72 Initiating Subscription License Replication...73 Exporting Product Information...73 The Subscription Updates Page... 74 Viewing the Subscription Updates Page... 74 Subscription Updates Page Toolbar...75 Subscription Service History... 75 The Subscription Service Configuration Dialog... 76 Working with Subscription Updates... 79 Manually Replicating with the GSS...79 Resetting the Replication Status...79 Configuring the Service Tab...80 Restarting the Replication Service... 81 Configuring the Languages Tab... 81 Exporting Enhanced Content Data... 82 Exporting Subscription Update Data...82 Chapter 7: Using Endpoints... 83 The Endpoints Page... 83 The Patch and Remediation Tab...84 Viewing the Endpoints Page...90 Working with the Endpoints Page... 90 Deploying Content to Endpoints (Patch and Remediation Tab)... 91 Enabling Modules on an Endpoint...91 Enabling an Endpoint...92 Disabling Modules on an Endpoint...92 Disabling an Endpoint... 93 The Add/Remove Modules Dialog...93 Managing Module Endpoint Components...94 Using Scan Now to Scan Inventory (Patch and Remediation Tab)... 95 Rebooting Endpoints...95-6 -
Table of Contents Exporting Endpoint Information...96 The Endpoint Details Page... 96 Viewing the Endpoint Details Page...97 The Information Tab... 97 The Vulnerabilities Tab...100 The Inventory Tab...104 The Deployments and Tasks Tab... 105 Working with the Endpoint Details Page... 107 Enabling Content...108 Disabling Content...108 Updating the Cache...109 Deploying Content (Endpoint Details Page)... 109 Enabling Deployments... 110 Disabling Deployments...111 Aborting Deployments... 111 Deleting Deployments...112 Managing Endpoint Modules...112 Using Scan Now to Scan Inventory (Endpoint Details Page)... 113 Rebooting the Endpoint... 114 Chapter 8: Using Inventory...115 About Inventory...115 Viewing Inventory...115 The Inventory Page... 116 The Inventory Page Toolbar... 116 The Inventory Page List (Filtered for Operating Systems)...117 The Inventory Page List (Filtered for Software)...118 The Inventory Page List (Filtered for Hardware)... 119 The Inventory Page List (Filtered for Services)... 120 About Scan Now (Scanning Inventory)... 120 Using Custom Inventory... 121 Guidelines for Linux/Unix/Mac-based Operating Systems...121 Guidelines for Microsoft Windows-based Operating Systems... 122 Chapter 9: Managing Deployments and Tasks...127 About Deployments...127 Explaining Deployment Distribution Order... 128 Deployment Types...128 Standard and Chained Deployments...129 The Deployments and Tasks Page...130 Viewing Deployments and Tasks... 131 Deployment Type... 133 The Deployments and Tasks Page Toolbar... 134 The Deployments and Tasks Page List... 135 Working With Deployments and Tasks... 136 Aborting Deployments and Tasks...136 Disabling Deployments...137 Enabling Deployments... 137 Editing Package Deployment Options...138 Deleting Deployments...141 Deploying Content (Deployments and Tasks Page)...141-7 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Explaining Deployment Deadlines... 142 Using the Deployment Wizard...142 Introduction Page... 142 Available Endpoints/Groups Page... 143 Available Packages Page...145 Licenses Page... 146 Deployment Information Page...148 Package Deployment Order and Behavior Page... 158 Notification Options Page...164 Deployment Confirmation Page... 167 Deployment Summary Page... 168 The Deployment Details Page... 169 Viewing the Deployment Details...170 The Deployment Details Page Toolbar... 170 The Deployment Details Page List...171 Chapter 10: Using Groups...173 The Groups Page...174 Viewing Groups... 174 The Information View...175 Group Information... 176 Mandatory Baseline Items... 176 The Group Membership View... 177 The Group Membership View Toolbar... 177 The Group Membership View List...178 Deploying Content to Groups (Group Membership View)...178 Using Scan Now to Scan Group Inventory...179 Rebooting Groups... 179 The Endpoint Membership View...180 The Patch and Remediation Tab (Groups Page)...180 Assigning Endpoints to a Group... 185 Removing Endpoint from a Group...187 Deploying Content to Endpoints (Endpoint Membership View)... 188 Enabling or Disabling Endpoints within a Group...188 Enabling or Disabling Endpoints Modules within a Group...189 Managing Endpoint Modules (Groups Page)...190 Using Scan Now to Scan Group Endpoint Inventory...191 Rebooting Group Endpoints... 192 The Mandatory Baseline View... 192 About Mandatory Baselines...193 About Mandatory Baseline Import/Export... 193 The Mandatory Baseline Process... 194 Viewing a Group Mandatory Baseline... 194 The Mandatory Baseline View Toolbar...195 The Mandatory Baseline View List...196 Adding Content to Mandatory Baselines... 198 Removing Content from Mandatory Baselines... 201 Setting Mandatory Baseline Deployment Options... 202 Removing Deployments Created by Mandatory Baselines...205 Updating the Mandatory Baseline Cache...206 Importing Mandatory Baseline Templates...207-8 -
Table of Contents Exporting Mandatory Baselines Templates... 211 Exporting Mandatory Baseline View Data...211 The Vulnerabilities View...212 The Vulnerabilities View Toolbar...212 The Vulnerabilities View List...213 Disabling Content within a Group... 215 Enabling Content within a Group... 215 Updating the Groups Cache...215 Deploying Selected Content (Vulnerabilities View)... 216 Exporting Vulnerability View Data... 216 The Inventory View...217 The Inventory View Toolbar...217 Exporting Inventory View Data...217 The Deployments and Tasks View... 217 The Deployments and Tasks View Toolbar... 218 The Deployments and Tasks View List...218 Enabling Group Deployments...219 Disabling Group Deployments... 220 Aborting Group Deployments...220 Deleting Group Deployments... 220 Deploying Content (Deployments and Tasks View)... 221 Exporting Deployments View Data...221 The Agent Policy Sets View...221 The Agent Policy Sets View Toolbar...222 The Agent Policy Sets View List...222 Assigning an Agent Policy Set to a Group...223 Unassigning an Agent Policy Set from a Group...223 Creating an Agent Policy Set (Groups Page)...224 Exporting Agent Policy Set View Data... 228 The Roles View...228 The Dashboard View...229 The Settings View... 229 Editing Group Settings...229 Chapter 11: Managing Agent Policy Sets... 231 The Agent Policy Sets Page... 231 About Agent Policies and Agent Policy Sets...231 Viewing the Agent Policy Sets Page...232 Defining Agent Policy Inheritance Rules...232 Defining Agent Policy Conflict Resolution... 232 The Agent Policy Sets Page Toolbar... 237 The Agent Policy Sets Page List...237 Working with Agent Policy Sets... 241 Creating an Agent Policy Set... 241 Editing an Agent Policy Set... 244 Defining Inventory Collection Options... 248 Defining Agent Hours of Operation...250 The Edit FastPath Servers Dialog... 252 Assigning an Agent Policy Set to a Group...255 Unassigning an Agent Policy Set from a Group...256-9 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Chapter 12: Using Content...259 About Content... 259 Defining Content Structure...260 Vulnerabilities...261 Software Content...262 Other Content... 262 The Content Pages... 263 To Access the Content Pages... 264 The Content Type Filter...264 The Content Pages Toolbar... 266 The Content Pages List...267 Working With Content... 271 Deploying Selected Content (Content Pages)... 271 Disabling And Enabling Content...271 Using Scan Now to Scan Inventory (Content Pages)... 272 Updating the Cache...273 Exporting Content Data... 273 The Patch Status Page...273 Viewing Content Patch Statuses...274 The Patch Status Page Toolbar...274 The Patch Status Page List...275 The Information Tab... 277 Working with Content Items...279 View Packages...279 Deploying Content... 279 Exporting Content Item Data...279 Chapter 13: Managing Packages... 281 About Packages... 281 The Packages Page...281 Viewing Packages... 281 The Packages Page Toolbar...282 The Packages Page List...282 Content Package Icons and Descriptions... 285 Working with Packages...285 Deploying Selected Packages... 286 Deleting a Package...286 Updating the Package Cache... 286 Creating a Package...287 Editing a Package...287 The Package Details Page...287 Viewing the Package Details Page...288 The Deployments Tab (Package Details Page)... 288 The Information Tab (Package Details Page)... 291 Using the Package Editor...294 Including Deployment Options in a Package...296 Package Flag Descriptions...296 Adding Files and Directories to a Package...297 Adding a Directory to a Package... 297 Creating a Drive for a Package...298-10 -
Table of Contents Adding a New Macro to a Package... 298 Creating a Folder for a Package...299 Adding a File to a Package... 299 Deleting a File from a Package...299 Renaming a File within a Package...299 Folder Properties for a Package... 300 Creating Scripts for a Package... 300 Chapter 14: Patch and Remediation Reporting...303 About Patch and Remediation Reports...303 The Patch and Remediation Report Pages... 304 Viewing the Patch and Remediation Report Pages...305 Generating a Report...305 Chapter 15: Using the Patch Module for Endpoints... 325 About the Patch Module for Pre-Windows Vista...325 Viewing the Patch Module for XP and Server 2003... 325 The Patch Module Dialog (Pre-Windows Vista)...326 About Patch Module for Windows Vista and Later...330 Viewing the Patch Module for Vista and Later... 331 The Patch Module Management Console (Windows Vista and Later)...331 About Notification Manager... 338 Completing a Deployment from an Endpoint... 339 Completing a Restart from an Endpoint... 339 Chapter 16: Using the Patch Agent for Mac Endpoints... 341 About the Agent for Mac... 341 Viewing the Patch Agent...341 Patch Agent Preferences... 342 Completing a Deployment from a Mac Endpoint...344 Completing a Restart from a Mac Endpoint... 345 Chapter 17: Supporting Linux and UNIX Endpoints... 347 Configuring Patch and Remediation to Download Linux and UNIX Content...347 Configuring Red Hat Network Credentials... 348 Configuring My Oracle Credentials... 350 Configuring Oracle Unbreakable Linux Network Credentials...350 Configuring SUSE Network Credentials...351 Configuring HP IT Resource Center Credentials...352 Specifying Content Mirrors for CentOS... 353 Patch Agent Command Line Usage... 354 Appendix A: Glossary... 357 Glossary... 357-11 -
Lumension Endpoint Management and Security Suite: Patch and Remediation - 12 -
Preface About This Document This User Guide is a resource written for all users of Lumension Endpoint Management and Security Suite: Patch and Remediation 8.0. This document defines the concepts and procedures for installing, configuring, implementing, and using Lumension Endpoint Management and Security Suite: Patch and Remediation 8.0. Tip: Lumension documentation is updated on a regular basis. To acquire the latest version of this or any other published document, please refer to the Lumension Customer Portal (http://portal.lumension.com/). Typographical Conventions The following conventions are used throughout this documentation to help you identify various information types. Table 1: Typographical Conventions Convention bold bold italics italics MONOSPACE UPPERCASE BOLD UPPERCASE monospace Usage Buttons, menu items, window and screen objects. Wizard names, window names, and page names. New terms, options, and variables. Keyboard keys. SQL Commands. File names, path names, programs, executables, command syntax, and property names. - 13 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Contacting Lumension Arizona 8660 East Hartford Drive Suite 300 Scottsdale, AZ 85255 United States of America Phone: +1 888 725 7828 Phone: +1 480 970 1025 Fax: +1 480 970 6323 Lumension Support Ireland Lumension Security Ireland Ltd. Lyrr Building, Second Floor Mervue Business & Technology Park Mervue, Galway Ireland Phone: +353 91 44 8980 Fax: +353 91 76 6722 Luxembourg Lumension Security SA Atrium Business Park Z.A Bourmicht 23, rue du Puits Romain L-8070 Bertrange Luxembourg Phone: +352 265 364 11 Fax: +352 265 364 12 phone: +1 480 970 1025 (USA) +1 877 713 8600 (USA - legacy Sanctuary products) +353 9142 2999 (EMEA) +44 800 012 1869 (UK) +61 (02) 8223 9810 (Australia) +852 3071 4690 (Hong Kong) +65 6622 1078 (Singapore) submit a ticket: Registered users can open a support ticket via the customer portal (http://support.lumension.com/). Lumension customers without a support account should contact our support team (support@lumension.com) to have an account created. Note: For additional contact information, please visit the Contact Lumension page at http:// www.lumension.com/contact-us.aspx. - 14 -
Chapter 1 Lumension Patch and Remediation Overview In this chapter: Patch and Remediation at a Glance Lumension Patch and Remediation (Patch and Remediation) is a Lumension Endpoint Management and Security Suite module that audits and remediates software and system configuration vulnerabilities within your network. It can also be used for networkwide installation of content non-related to vulnerabilities, such as software or service packs. To accomplish this task, Patch and Remediation uses two main components: The Endpoint Management and Security Suite Server and the Endpoint Management and Security Suite Agent. Patch and Remediation uses the Lumension EMSS Server to download content and then deploys it throughout your network. Content includes data that identifies vulnerabilities, patches that remediate them, and various other types of software and service packs. Content is deployed with assistance from the Lumension EMSS agent. The agent scans its host endpoint via a Discover Applicable Updates task, which takes a system inventory of endpoint software, hardware, and system configuration settings. The Discover Applicable Updates results are sent back to the server, which compares these results with a list of known vulnerabilities. Based on these results and administrator input, the server deploys content as needed. - 15 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Patch and Remediation at a Glance Patch and Remediation is a module you can use to install patches and other software on your network endpoints. Benefits Identifies endpoint vulnerabilities and remediates them by installing content (such as software and patches). Scans agent-managed endpoints for an inventory of their hardware and software. Lets you deploy patches, software, and other types on content to endpoints. Lets you establish Mandatory Baselines, which are content standards applied to endpoint groups that monitor endpoints to ensure defined content is always installed. Adds new Patch and Remediation-related reports, agent policies, default options, widgets, access rights, and email notifications. - 16 -
Chapter 2 Getting Started with Patch and Remediation In this chapter: The Lumension Patch and Remediation Workflow Patch and Remediation is a Lumension Endpoint Management and Security Suite module that remotely installs patches and other software on your managed network endpoints. To get started with Patch and Remediation, you should install the module and then perform several other tasks essential to its operation. After performing these tasks, you will be able to deploy patches and other content to endpoints in your network, thus remediating potential exploits. Following completion of these initial tasks, take some time to grow accustomed to the Patch and Remediation. You will continue to perform these tasks, plus many other. Lumension EMSS contains many features and functions, and by learning the environment, you can secure your network quickly and efficiently. The Lumension Patch and Remediation Workflow To use Lumension Patch and Remediation (Patch and Remediation), all Lumension Endpoint Management and Security Suite components must be installed, along with the Patch and Remediation module. After installing all necessary components, review this chart to understand the Patch and Remediation work flow. Refer to the following flow chart to determine tasks when using the Patch and Remediation module within Lumension EMSS. Install the Patch and Remediation module server component. This component is installed after initial Lumension EMSS installation. For additional information, refer to Installing the Patch and Remediation Module Server Component on page 19. Note: If you purchased a Patch and Remediation license during your initial Lumension EMSS purchase, Patch and Remediation is installed during the initial Lumension EMSS installation by default. - 17 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Install the Patch and Remediation module endpoint component on agents you want to support Patch and Remediation functions. Each agent you install the endpoint component on consumes a Patch and Remediation license. For additional information, refer to Installing the Patch and Remediation Module for Endpoints on page 20. Create groups containing Patch and Remediation endpoints in preparation for deployment. A group associates similar endpoints for the purpose of deploying content to multiple endpoints. For additional information, refer to Creating New Groups on page 21. Create new agent policy sets (or edit existing policy set for Patch and Remediation functions) and apply them to Patch and Remediation groups. Agent policy sets are a compilation of values that govern agent behavior. New settings for agent policy sets are added after installing Patch and Remediation. For additional information, refer to Apply Agent Policy Sets on page 22. View network vulnerabilities and then deploy content, which are patches and other software, to managed endpoints. First, view network vulnerabilities. Agents detect vulnerabilities by scanning endpoints for signatures that indicate a vulnerabilities are present. The, remediate vulnerabilities using a deployment, which triggers the agent to download selected content from the Lumension EMSS Server. For additional information, refer to Viewing and Remediating Vulnerabilities on page 23. After initial vulnerabilities are remediated, you can define a Mandatory Baseline. This baseline is a selection of user-defined content that must always be installed on all group endpoints. If an endpoint falls out of compliance, the Mandatory Baseline ensures the endpoint is patched back into compliance via automatic deployment. For additional information, refer to Installing the Patch and Remediation Module for Endpoints on page 20. Define default Patch and Remediation settings. New default settings are added to Lumension Endpoint Management and Security Suite after Patch and Remediation is installed. New settings include new access roles, email notifications, and deployment options. For additional information, refer to the following topics: Defining Default Deployment Options on page 25 Editing Email Notifications on page 25 Editing Custom Roles on page 26 Logging In to Lumension Endpoint Management and Security Suite Get started with Lumension Endpoint Management and Security Suite by logging in to the Web console. You can access this console from any endpoint in your network. 1. Open your Web browser. - 18 -
Getting Started with Patch and Remediation 2. In your browser s address bar, type the Lumension EMSS URL (http[s]://serverurl) and press ENTER. Tip: You can also use the server IP address. Step Result: A dialog prompting you for credentials opens. 3. Type your user name in the User name field. When logging in for the first time, type the user name of the Windows user account used to install Lumension EMSS. You can use additional user names after adding new user profiles to Lumension EMSS. If logging in using a domain account, type the name in the following format: DOMAIN\Username. 4. Type your password in the Password field. 5. Click OK. After Completing This Task: Continue to Installing the Patch and Remediation Module Server Component on page 19. Installing the Patch and Remediation Module Server Component After logging in to Lumension Endpoint Management and Security Suite, the first step in implementing Patch and Remediation features and functions is to install the server module Figure 1: Install Server Module Install the server module using Installation Manager. 1. Select Tools > Launch Installation Manager. Step Result: Installation Manager opens to the New/Update Components tab. 2. Select the Patch and Remediation check box for your version number of Lumension Endpoint Management and Security Suite. 3. Click Install. Step Result: The Install/Update Components dialog opens. 4. Click Next to dismiss the Database backup recommended notification. Lumension recommends backing up your database before installing a module. 5. Click Install. Step Result: A dialog opens, notifying you that installing the module may cause logged in user to lost their work. - 19 -
Lumension Endpoint Management and Security Suite: Patch and Remediation 6. Click OK. Step Result: The installation begins. 7. Click Finish. Tip: Select the Launch Lumension EMSS check box to relaunch Lumension Endpoint Management and Security Suite after clicking Finish. Result: The Patch and Remediation server module is installed. After Completing This Task: Continue to Installing the Patch and Remediation Module for Endpoints on page 20. Installing the Patch and Remediation Module for Endpoints After installing the Patch and Remediation server module, you must install the Patch and Remediation module for your network endpoints. Prerequisites: Complete Installing the Patch and Remediation Module Server Component on page 19. Figure 2: Install Endpoint Module Install the endpoint component from the Endpoints page. 1. Select Manage > Endpoints. Step Result: The Endpoints page opens to the All tab. 2. From the list, select the endpoints that you want to install the Patch and Remediation endpoint module on. 3. Click Manage Modules Step Result: The Add/Remove Modules dialog opens. 4. Select the Patch check box for all endpoints you want to install the component on. 5. Click OK. Result: The Patch and Remediation endpoint module is installed on selected endpoints. After Completing This Task: Continue to Creating New Groups on page 21. - 20 -
Getting Started with Patch and Remediation Creating New Groups After installing the Patch and Remediation components, create a new group for your Patch and Remediation endpoints. By placing your Patch and Remediation endpoints in a group (or multiple groups), you can manage them collectively. For example, you deploy content to all Patch and Remediation with one deployment by using groups. Prerequisites: Complete Installing the Patch and Remediation Module for Endpoints on page 20. Figure 3: Group Diagram Create and configure groups from the Groups page. 1. From the navigation menu, select Manage > Groups. 2. From the Group Browser directory tree, select Custom Groups. Groups are arranged within a directory tree structure. You can place your new group anywhere within the custom group hierarchy. Note: The group you create is added as a child group to the group selected within the directory tree. 3. Create a group. a) From the View list, select Group Membership. b) Click Create. c) In the Name field that displays, type a group name. d) In the Description field that displays, type a description. e) Click the Save icon. 4. Add endpoints to the group. a) From the View list, select Endpoint Membership. b) Click Manage. c) Assign endpoints to the group. For more detailed information, refer to Assigning Endpoints to a Group on page 185. d) Click OK. 5. Define the group's settings. Group settings contain additional group controls. a) From the View list, select Settings. b) Define the settings. For more detailed information, refer to Editing Group Settings on page 229. - 21 -
Lumension Endpoint Management and Security Suite: Patch and Remediation c) Click Save. Result: The group is created. After Completing This Task: Continue to Apply Agent Policy Sets on page 22. Apply Agent Policy Sets After you create a group, create and assign an agent policy set to govern the group endpoint behavior. Agent policy sets can control endpoint communications, hours or operations, and so on. Prerequisites: Complete Creating New Groups on page 21. Figure 4: Install Server Module Create agent policy sets using the Agent Policy Sets page, and then assign them to a group using the Groups page. 1. Select Manage > Agent Policy Sets. Step Result: The Agent Policy Sets page opens. 2. Click Create to create an agent policy set. For additional information, refer to Creating an Agent Policy Set on page 241. 3. Select Manage > Groups. Step Result: The Groups page opens. 4. From the View list, select Agent Policy Sets. Step Result: The Agent Policy Sets view opens. 5. From the Group Browser directory tree, select the group you created. 6. Click Assign to assign the agent policy set to your created group. For additional information, refer to Assigning an Agent Policy Set to a Group on page 223. Result: The agent policy set is created and assigned. After Completing This Task: Continue to Viewing and Remediating Vulnerabilities on page 23. - 22 -
Getting Started with Patch and Remediation Viewing and Remediating Vulnerabilities After installing the Patch and Remediation module server and endpoint components, your network endpoints complete their first Discover Applicable Updates task, which detect vulnerabilities. Following this task, you can then view vulnerabilities in your network and then deploy patches and other content to resolve them. Prerequisites: Complete Apply Agent Policy Sets on page 22. Figure 5: Viewing and Remediating Vulnerabilities 1. View dashboard widgets, vulnerabilities, and reports to identify vulnerabilities in your network. Dashboard widgets and reports provide detailed graphs and statistics about the state of your network. Reviewing this information provides insight about the actions required to secure your network. For additional information, refer to the following documentation: To see an overview of how many vulnerabilities are in your network, view The Dashboard. View the dashboard by click Home from the navigation menu. To view the vulnerabilities on a specific endpoint, view The Endpoint Details Page. View the Endpoint Details page by selecting Manage > Endpoints and clicking an endpoint link. To view the specific vulnerabilities in your network, view The Content Pages List. To view this page, select Manage > Vulnerabilities. To view a report of vulnerabilities in your network, view Generating a Report. To generate reports, select Reports > All Reports, select a report, and click Generate Report. 2. Select Review > Vulnerabilities > All. Step Result: The Content page opens to show vulnerabilities. 3. From the list, select the vulnerabilities you want to deploy. Tip: Use the page filters to find vulnerabilities applicable to your endpoints. 4. Click Deploy to remediate vulnerabilities. Remediate network vulnerabilities by deploying content that fix identified vulnerabilities. For additional information, refer to. Result: The deployment is scheduled and will begin at the scheduled time. Completion time of the deployment varies dependent on size. After Completing This Task: Continue to Adding Content to a Mandatory Baseline on page 24. - 23 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Adding Content to a Mandatory Baseline Each group in Lumension Endpoint Management and Security Suite has a Mandatory Baseline, which is a list of content that must be installed on the group's endpoints at all time. By default, this baseline is empty. However, you can add patches, software, and other content to this baseline. After adding content to the baseline, Lumension Endpoint Management and Security Suite continually checks groups endpoints for the content's presence. If a group endpoint is found to not have content included in the Mandatory Baseline, Lumension Endpoint Management and Security Suitet automatically deploys that content to the endpoint. Prerequisites: Complete Editing Email Notifications on page 25. Figure 6: Adding Content to Mandatory Baselines Add content to a Mandatory Baseline from the Groups page. 1. Select Manage > Groups. 2. From the View list, select Mandatory Baseline. 3. From the Group Browser directory, select the group you created earlier. 4. Click Manage to add content. For additional information, refer to Adding Content to Mandatory Baselines on page 198. 5. Click OK. Result: Content is added to the group Mandatory Baseline. After Completing This Task: Continue to Defining Default Deployment Options on page 25. - 24 -
Getting Started with Patch and Remediation Defining Default Deployment Options After you install Patch and Remediation, a Deployments tab is added to the Options page. Configure this tab to define the default values for the Deployments Wizard. Prerequisites: Complete Adding Content to a Mandatory Baseline on page 24. Figure 7: Define Default Deployment Options Define default deployment options from the Options page. 1. Select Tools > Options. 2. Select the Deployments tab. 3. Define the default deployment options. For additional information, refer to Configuring the Deployments Tab on page 62. 4. Click Save. Result: The default deployment options are defined. After Completing This Task: Continue to Editing Email Notifications on page 25. Editing Email Notifications After installing Patch and Remediation, two new email notification types are added: New Vulnerabilities and Deployment Failure. To use these new notifications, edit your defined email addresses or create new ones. Prerequisites: Complete Defining Default Deployment Options on page 25. Figure 8: Edit Email Notifications Edit email notifications from the Email Notifications page. - 25 -
Lumension Endpoint Management and Security Suite: Patch and Remediation 1. Select Tools > Email Notification. Step Result: The Email Notifications page opens. 2. For each defined email address, select one or both of the following new notification types available after installation of Patch and Remediation. Tip: For more information on how to define a new address and email notifications, refer to Creating Email Notifications on page 68. Notification Type New Vulnerabilities Deployment Failure Description Sends the defined address a notification email when new vulnerabilities are available. Sends the defined address a notification email when a scheduled deployment fails. Tip: Additional options are available for the Lumension EMSS core features and other modules. 3. Click Save. 4. Click OK. Result: The email addresses you edited are configured to receive the new email notifications. After Completing This Task: Continue to Editing Custom Roles on page 26. Editing Custom Roles After installing Patch and Remediation, new access rights are added for new features. To update custom roles for these features, edit your roles. Prerequisites: Complete Editing Email Notifications on page 25. Edit custom roles from the Users and Roles page. 1. Select Tools > Users and Roles. 2. Select the Roles tab. 3. From the page list, click the edit icon for the custom role to which you want to add access rights. Step Result: The Edit Role dialog opens. 4. Select the Access Rights tab. - 26 -
Getting Started with Patch and Remediation 5. Define the new Patch and Remediation access rights. Dashboard Access Rights View LPR Widgets Content and Vulnerabilities Access Rights View LPR Widgets View Content Manage Content Export Content View Content Details Endpoint Access Rights View LPR Tab Manage LPR Tab Export LPR Tab Scan Now Discover Applicable Updates Reboot Endpoints Inventory Access Rights View Inventory Export Inventory Deployments and Tasks Access Rights Create Deployments View My Deployments and Tasks View All Deployments Description Access to select and view the Patch and Remediation Dashboard widgets. Description Access to select and view the Patch and Remediation Dashboard widgets. Access the vulnerability and other content data. Enable and disable vulnerabilities and other content. Export vulnerability and other content data list. Access the detailed information for vulnerabilities and other content. Description Access the Patch and Remediation tab. Install, uninstall, enable, and disable the Patch and Remediation module. Export the Patch and Remediation tab endpoint list. Scan endpoints using the DAU Scan Now Dropdown button. Reboot endpoints using the Reboot Now button. Description View the endpoint inventory. Export the endpoint inventory list. Description Ability to create new deployments. Access the deployments and tasks that this user has created. Access the deployments that all users have created. - 27 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Deployments and Tasks Access Rights Manage Deployments and Tasks Export Deployments and Tasks Packages Access Rights View Packages Manage Packages Export Packages Cache Packages Email Notifications Access Rights Manage LPR Email Notifications Description Deploy, enable, disable, abort, and delete deployments and tasks that the user has access to. Export the deployments and tasks in the list that this user has access to. Description Access the package data. Create, edit, and delete packages. Export the package data list. Ability to download packages from the Global Subscription Service onto the Lumension Endpoint Management and Security Suite server. Description Create and edit Patch and Remediation notifications. 6. Click OK. - 28 -
Chapter 3 Using the Web Console In this chapter: Common Functions The Home Page Within the Lumension Endpoint Management and Security Suite Web console, you can use a number of common functions to navigate and operate the system. After you log in, Lumension Endpoint Management and Security Suite opens to the Home page. Lumension Endpoint Management and Security Suite performs the following functions: Endpoint Detection Agent Installation Endpoint Management Endpoint Grouping Agent Policy Set Creation User and Role Creation and Management Server Module Management Report Generation Lumension Endpoint Management and Security Suite consists of a browser-based management console, which provides access to system management, configuration, reporting, and deployment options. Common Functions Lumension Endpoint Management and Security Suite uses standard Web browser conventions and unique conventions. Familiarize yourself with these conventions to facilitate efficient product use. From the Navigation Menu and system pages, you can access all features and functions you are authorized for. - 29 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Common Conventions The Web console supports user interface conventions common to most Web applications. Table 2: Common User Interface Conventions Screen Feature Entry Fields Function Depending on text, type data into these fields to either: Retrieve matching criteria Enter new information Drop-Down Menus Command Buttons Check Boxes Display a list of selectable values when clicked. Perform specific actions when clicked. A check box is selected or cleared to: Enable or disable a feature Initiate functions for list items Some lists include a Select All check box for selecting all items, including overflow items. Radio Buttons Sort Select the button to select an item. Data presented in tables can be sorted by clicking column headers. Columns can be sort in the following orders: Ascending (default) Descending Mouseovers Auto Refresh Scrollbars Tabs Bread Crumb Move your mouse over an item to display a text description. Some pages feature an Auto Refresh check box. Select the check box to automatically refresh the page every 15 seconds. Drag scrollbars to see additional data. Select different tabs to display hidden information. Displays the path to the page you are viewing. The breadcrumb lists: The page you are viewing Its parent page (if applicable) The Navigation Menu item used to open the page If the breadcrumb contains a link, you can click it to retrace your steps. Tip: Most pages support right-click. - 30 -
Using the Web Console The Navigation Menu This menu appears on all Lumension Endpoint Management and Security Suite pages. Use this menu to navigate through the console. This menu organizes product features based on functionality. When you select a menu item, a new page, dialog, wizard, or window opens. You can access all system features from this menu (that your access rights authorize). Note: The menu items available change based on modules you install. Figure 9: Navigation Menu Table 3: Navigation Menus Menu Home Discover Review Manage Reports Tools Help Description Opens the Home page. This link contains no menu items. Contains menu items related to running discovery scan jobs. Contains menu items related to reviewing security content and discovery scan jobs. Contains menu items related to managing system features. Contains menu items related to creating reports. Contains menu items related to system administration. Contains menu items related to help systems. The following table lists each menu item in the Review menu and the actions that occur when they are selected. Table 4: Review Menu Items Menu Item My Default View Description The All Content page with your saved filters. - 31 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Menu Item Vulnerabilities Description Opens a sub-menu. The sub-menu contains the following items: All Critical Vulnerabilities New Vulnerabilities Top Vulnerabilities The Vulnerabilities page, filtered to show only critical vulnerabilities. The Vulnerabilities page, filtered to show only critical vulnerabilities that are not superseded. The Vulnerabilities page, filtered to show only critical but not superseded vulnerabilities released in the last 30 days. The Vulnerabilities page, filtered to show only critical but not superseded vulnerabilities sorted by the greatest number of applicable endpoints that are not patched. Software Opens a sub-menu. The sub-menu contains the following items: All Service Packs Software Installers Updates The Software page, filtered to show all software. The Software page, filtered to show only service packs. The Software page, filtered to show only software installers. The Software page, filtered to show only software updates. - 32 -
Using the Web Console Menu Item Other Description Opens a sub-menu. The sub-menu contains the following items: All Detection Only Informational Packages Policies Recommended System Management Tasks Virus Removal The Other page, filtered to show all noncritical content. The Other page, filtered to display Detection Only content. The Other page, filtered to display only Information content. The Other page, filtered to display only Packages content. The Other page, filtered to display only Policies content. The Other page, filtered to display only Recommended content. The Other page, filtered to display only System Management content. The Other page, filtered to display only Task content. The Other page, filtered to display only Virus Removal content. The following table lists each menu item in the Manage menu and the actions that occur when they are selected. Table 5: Manage Menu Items Menu Item Inventory Deployments and Tasks Description Opens the Inventory page. Opens the Deployments and Tasks page. The following table lists each menu item in the Reports menu and the actions that occur when they are selected. Table 6: Reports Menu Items Menu Item Deployments Management/Status Description Opens the All Reports page with deployments reports expanded. Opens the All Reports page with management/status reports expanded. - 33 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Menu Item Risks Vulnerabilities Enhanced Reports Description Opens the All Reports page with risks reports expanded. Opens the All Reports page with vulnerabilities reports expanded. Opens a custom, user-defined URL. This URL is usually used to open a third-party reporting Web page. Note: Any unavailable or absent menus, menu items, or sub-menu items are due to restricted access rights or unavailable modules. Contact your network administrator if you require access to unavailable features. The Page Banner A page banner displays when the page is added for a new module. Use this banner to identify the module that the page belongs to. Figure 10: Page Banner For example, pages for Lumension Patch and Remediation display a Patch and Remediation page banner. Page banners are color-coded by module. List Pages Most pages feature lists of selectable items. These items represent different product features that can be edited using menus and buttons. Figure 11: List Page To select a single list item: Select a check box. Click a list row. - 34 -
Using the Web Console To select multiple list items: Select the Select All check box. Select multiple, non-concurrent items by using CTRL+Click over list rows. Select multiple, concurrent items by using SHIFT+Click and mousing over list rows. Toolbars Toolbars appear on most Web console pages. They contain menus and buttons you can use to initiate page features. Figure 12: Toolbar The menus and buttons displayed vary according to page. Click the available menus and buttons to use them. User roles determine which buttons are available. The Options Menu Toolbars feature an Options menu. You can use these options to change how the page displays information. Table 7: Options Menu Items Option Show results on page load Save as default view Clear default view Show Filter Row 1 Show Group By Row 2 Enable Copy to Clipboard 3 Description Toggles automatic page results on and off. When enabled, the page list automatically populates with results. When disabled, you must define page filters and click Update View before results populate. For more information, see Filters on page 36. Saves the current page settings as the default view. Resets the saved view to the system default. Toggles the Filter Row on and off. For additional information, refer to Using Filter Rows on page 38 Toggles the Show Group By Row on and off. For additional information, refer to Group By on page 40. Toggles the ability to select text for clipboard copy. 1. This option title changes to Hide Filter Row when toggled. 2. This option title changes to Hide Group By Row when toggled. 3. Selecting this option disables other features, such as right-click context menus and list item dragging. - 35 -
Lumension Endpoint Management and Security Suite: Patch and Remediation Filters Filters appear on most list pages. You can use them to search pages for specific data. Depending on which page you are viewing, you can filter pages using one of the following features. Only one feature appears per page. Filters Filter Row Filters Filters appear above page lists. They feature different fields, lists, and check boxes used for filtering. Filters vary according to page. Figure 13: Filters You can save frequently used filter settings as your default view. To save your settings, select Options > Save as default view from the toolbar. The toolbar Options menu contains the following options for filtering. Table 8: Filter Options Option Show results on page load Save as default view Function Automatically retrieves and displays results when selected. Saves the active filter and sort criteria as the default view for the page. The default view displays each time the page is accessed, including the following events: Browsing to a different page. Logging out of the Web console. The default view is saved until you save a new one or you clear it. Clear default view Resets a saved default view to the system default view. Filter Rows - 36 -
Using the Web Console Filter rows appear in the lists themselves. Rows feature a field for each column. Figure 14: Filter Row Filters are not case sensitive. Columns can be filtered using a variety of data types. For example, you can use a Contains filter or a StartsWith filter. Date columns filter at the lowest level of granularity. Higher levels of granularity return no filter results. Supported Wildcards When searching for or filtering vulnerabilities, you can use wildcards to make search results more specific and efficient. Wildcards can be used anywhere within the search string. The following table lists the supported operators and wildcards in Lumension Endpoint Management and Security Suite. Type any wildcards that you intend to use in the Name of CVE-ID field. Table 9: Supported Wildcards Wildcard Description Example % Any string. The string can be empty or contain any number of characters. Typing Microsoft%Server in the Name or CVE- ID field returns any vulnerability with the words Microsoft and Server in any part of the name, such as: _ (underscore) Wildcard placeholder for any single character. MS12-043 Security Update for Microsoft Office SharePoint Server 2007 32-Bit Edition (KB2687497) The 2007 Microsoft Office Servers Service Pack 3 (SP3), 32-bit Edition (KB2526299) Typing _itrix or Citri_ in the Name or CVE- ID field returns any vulnerabilities with Citrix in the name. [ ] Any single character within a range ([a-f]) or set ([abcdef]). Typing [m]ic in the Name or CVE-ID field returns vulnerabilities with the string mic within the name (Microsoft and Dynamic). Typing 200[78] in the Name or CVE-ID field returns vulnerabilities with 2007 or 2008 within the name. [^] Any single character not within a range ([^a-f]) or set ([^abcdef]). Typing M[^i]cro in the Name or CVE-ID field returns any vulnerability that does not have Micro in its name. - 37 -