Creating vulnerability assessments

You can create a new assessment on the Assessments page or create one using an existing standard on the Standards page. You must have the Comply Report Administrator role to create assessments that used client-based scanning. You must have the Comply RAS Assessment Create role to create assessments that use remote authenticated scanning. For more information about Comply roles, see User role requirements.

Configure a client-based scan assessment

1. Select Assessments from the Comply menu.
2. Select Vulnerability from the Create Assessment drop-down button.
3. On the Create Vulnerability Assessment page, in the Summary section, enter a Name for the assessment. You can also provide Labels.
4. Select a Scan Method:
• Client-Based: Client-based scanning uses Tanium Clients installed on endpoints. This is the recommended method of scanning. (The following instructions are for this scan method.)
• Remote Authenticated: Remote authenticated scanning uses Tanium Clients as satellites to scan endpoints that do not have the Tanium Client installed. This scan type is useful for obtaining information from endpoints that do not support having the Tanium Client installed. See Configure a remote authenticated scan assessment for details.
• Network unauthenticated: Find vulnerabilities on unmanaged endpoints in your environment using Tanium Clients as satellites to scan endpoints that do not have the Tanium Client installed and cannot be authenticated to. You can also do distributed scans using the Discover module. See Configure a network unauthenticated scan assessment for details.
• SBOM (Software Bill of Materials): (requires an Tanium SBOM license) An SBOM vulnerability scan has visibility into libraries and all files that are known to Software Manager. The results of an SBOM assessment analysis are mapped to CVEs on the endpoint. See Create an SBOM scan assessment for details.

5.  In the Targeting section:

   • Select Computer Groups. Use the pulldown list to select a group. Add additional groups by using the Add button to build upon or narrow your selection. When finished, click the check mark for each selection.

   Be sure to select the appropriate platform and Computer Groups containing endpoints that align with the Platform.

6. Select a Platform.
7. Select the Engine. The Engine field displays only when more than one engine is installed.
8. Select either Low or Normal from the Comply Process Priority drop-down list.

   If you select Low, the Comply scan process yields processor utilization to other processes running on the machine. If you select Normal, the scan process runs with the same priority as other processes on the machine.

   Selecting Low might increase the duration of the scan processes on endpoints with high processor utilization.

9. Optionally, when the Tanium Scan Engine is selected, you can enable the Include network drives in scan check box. Network drives are not included in scans by default. Scanning them can be time-consuming and resource intensive.
10. Select the Source from the drop-down list in the Vulnerability Content section.
11. Select an Operating System.
12. Specify the Range of CVEs. The Preview section on the right will show the number of CVEs and Definitions that will be included in the report.

    You can specify now in the Range of CVEs field as the end of a range. For example, entering 2016-now will run the report against all Common Vulnerabilities and Exposures (CVEs) from 2016 to the current date. By using this format, you can easily define a range that always is current.
    As a best practice, scan more frequently for recently released high and critical vulnerabilities (for example, 2018-now high and critical on a weekly basis), and conduct scans against all vulnerabilities less frequently (for example, monthly or quarterly).

13. Check the scores you want to see in CVSS Score.
14. List specific CVEs in the List of Individual CVEs field.

    If you specify a List of Individual CVEs, they will always be included in the report regardless of the values specified for Range of CVEs or CVSS Score. To search by year and score, you must provide values for both fields for the search to be valid. If you specify Range of CVEs, you must select at least one score in CVSS Score. If you select a score in CVSS Score, you must specify Range of CVEs. If you list specific CVEs, you can choose to leave the Range of CVEs field blank and select no CVSS Score.
    
    If you have previously saved a report with values for List of Individual CVEs, Range of CVEs, or CVSS Score, these values will remain the same for the next vulnerability report you create. You can edit these values as needed.

15. Specify the Batch Size.

    Batch Size defines the number of checks that will run at a time. In order to run a manageable number of checks on your endpoints, the default value for this field is 500 for CIS-CAT and SCC, and the default is 2000 for Tanium Scan Engine (powered by JovalCM). This setting does not typically need to be adjusted from the default value. However, in some cases, increasing the batch size can speed up scans and may avert scan timeouts. This increase may also require increasing the endpoint maximum heap size to avoid out-of-memory errors.

16. Select Start on and End on and complete the date and time values to limit the report to run only during a specific time period.

    The date and time displayed by default is the local browser time.

17. Select the Distribute Over option and enter values to run the report over minutes, hours, or days. See Tanium Console User Guide: Deploying actions for information on how the Distribute over option works.
18. Select Interval, Using report age, or Never for the Repeat field.
• If you choose Interval, the Reissue every field displays, and you can specify how often the report is run.
• If you choose Using assessment age, then the Run when results are older than field displays, and you can specify how old you want the results to be before the assessment is run. If a targeted endpoint comes online that has never run the assessment, the assessment will be run as soon as the next age-check occurs. The age of results is checked every hour.

  Use the Using assessment age option and set it to 7 days.

19. Click Create & Deploy and enter your credentials. Results will display on the Findings page.

Configure a remote authenticated scan assessment

Remote authenticated scanning is useful for obtaining information from endpoints and subnets that do not support having the Tanium Client installed. For all other endpoints, you should use client-based scanning for performance reasons and to take advantage of the linear chain architecture.

To configure a remote authenticated scan assessment, do the following:

1. Select Assessments from the Comply menu.
2. Select Vulnerability from the Create Assessment drop-down button.
3. On the Create Vulnerability Assessment page, in the Summary section, enter a Name for the assessment. You can also provide Labels.
4. Select a Scan Method:
• Client-Based: Client-based scanning uses Tanium Clients installed on endpoints. This is the recommended method of scanning.
• Remote Authenticated: Remote authenticated scanning uses Tanium Clients as satellites to scan endpoints that do not have the Tanium Client installed. This scan type is useful for obtaining information from endpoints that do not support having the Tanium Client installed. Note that remote authenticated scanning only supports using the Tanium Scan Engine. (The following instructions are for this scan method.)
• Network unauthenticated: Find vulnerabilities on unmanaged endpoints in your environment using Tanium Clients as satellites to scan endpoints that do not have the Tanium Client installed and cannot be authenticated to. You can also do distributed scans using the Discover module. See Configure a network unauthenticated scan assessment for details.



5. In the Satellite section, select a satellite to perform the scan.
6. In the Targeting section, select a Targeting Type.

   If you use IP addresses (the default), the addresses you enter do not have to be on the same subnet as the satellite to be scanned. If you use discovered endpoints, because Tanium Discover cannot get the MAC address from endpoints that are not in the same subnet as the satellite, only endpoints in the same subnet as the satellite will be scanned.

   • IP Addresses:
     • In the Included Networks field, enter a comma separated list of IP addresses, IP address ranges, or CIDR addresses. You can also click the Copy button to upload a text file containing IP addresses, IP ranges, or CIDRs separated either by commas or carriage returns.
     • In the Excluded Networks field, enter IP addresses, IP address ranges, or CIDR addresses to be excluded from the scan. You can enter them manually or upload a file of addresses.

     Be sure to enter IP addresses that the selected satellite can reach.

     4,096 is the maximum number of addresses that can be included in a scan. When you click the Create button, a calculation takes place to determine the number of included addresses less the number of excluded addresses to determine the final amount.

   • Discovered Endpoints: Click the +ROW or +Grouping button to view the Select Attribute field. Select from the following Attribute combinations to filter the list of discovered endpoints:

   Attribute	Available Operators	Value
   IP Address	is equal to, is not equal to, contains, does not contain	Enter a single IP address or multiple addresses, each separated by a comma. For example, 192.168.1.1, 192.168.1.3
   Discover Labels	include one of, include all of	Select one or more labels configured in Tanium Discover. See Tanium Discover User Guide: Labels for more information.
   IP Range	equals	Enter an IP address range. For example, 192.168.1.1 - 192.168.1.150
   CIDR	equals	Enter an IP address range in CIDR format. For example, 192.168.1.0/24
   OS Platform	contains, does not contain	Enter text for targeting a specific OS.

   To select multiple items in the Value field, click within the field after adding an item, and you can select additional items.

   Use the And/Or buttons to build upon or narrow your selection. Use the Row button to add a new target to the group. Use the Grouping button to build another And/Or combination for targeting. Click the check mark to save each selection.

   • In the Preview section for Discovered Endpoints, click the Show Preview button to view the list of unmanaged endpoints you selected for targeting. You can use the information in the preview grid to expand or narrow your targeting. For example, you can target a satellite initially and then add an IP range to further filter your targets based on what you observed in the preview.

7. Select the Credential List for this assessment. You can only use one list per assessment. In order for satellites to perform secure scans of non-Tanium endpoints, the login credentials for those endpoints are required. See Configure credentials lists for remote-authenticated scans.

Make sure the credential list you select matches the targeting in the assessment. If too many incorrect credentials are attempted and fail, this could trigger security alerts and cause account lockouts.

8. Optionally but not recommended, in the Subsequent Scan Configuration section, enable the Include new endpoints found on recurring scans check box. By default, if scans are recurring, Comply only scans endpoints that were reachable during the initial scan. If new endpoints come online, they are not scanned unless you change the assessment's targeting or select this check box.

If you enable the Include new endpoints found on recurring scans check box and your network is compromised at any point after the initial scan, a honeypot could be installed in your environment that matches the scan configuration requirements. If that occurs, an unmanaged endpoint could capture the credentials being passed to it and use them with malicious intent.

9. Enabled by default and recommended when you use SSH key and SSH password credentials, use Trust on First Use for fingerprint comparison. With this feature enabled, Comply will collect the SSH fingerprint the first time an endpoint connects. For every future connection, Comply will check to make sure the endpoint presents the same SSH fingerprint. If it does not, Comply will log a Fingerprint Mismatch Error. An endpoint that fails the fingerprint check will not be logged into or scanned.




If you receive a fingerprint mismatch error, you can click on the assessment error message and then click through to the endpoint to accept the new key to resolve the error.






10. Select the Source from the drop-down list in the Vulnerability Content section.
11. Select an Operating System.
12. Specify the Range of CVEs. The Preview section on the right will show the number of CVEs and Definitions that will be included in the report.

    You can specify now in the Range of CVEs field as the end of a range. For example, entering 2016-now will run the report against all Common Vulnerabilities and Exposures (CVEs) from 2016 to the current date. By using this format, you can easily define a range that always is current.
    As a best practice, scan more frequently for recently released high and critical vulnerabilities (for example, 2019-now high and critical on a weekly basis), and conduct scans against all vulnerabilities less frequently (for example, monthly or quarterly).

13. Check the scores you want to see in CVSS Score.
14. List specific CVEs in the List of Individual CVEs field.

    If you specify a List of Individual CVEs, they will always be included in the report regardless of the values specified for Range of CVEs or CVSS Score. To search by year and score, you must provide values for both fields for the search to be valid. If you specify Range of CVEs, you must select at least one score in CVSS Score. If you select a score in CVSS Score, you must specify Range of CVEs. If you list specific CVEs, you can choose to leave the Range of CVEs field blank and select no CVSS Score.
    
    If you have previously saved a report with values for List of Individual CVEs, Range of CVEs, or CVSS Score, these values will remain the same for the next vulnerability report you create. You can edit these values as needed.

15. Specify the Batch Size.

    Batch Size defines the number of checks that will run at a time. In order to run a manageable number of checks on your endpoints, the default value for this field is 500 for CIS-CAT and SCC, and the default is 2000 for Tanium Scan Engine (powered by JovalCM). This setting does not typically need to be adjusted from the default value. However, in some cases, increasing the batch size can speed up scans and may avert scan timeouts. This increase may also require increasing the endpoint maximum heap size to avoid out-of-memory errors.

16. Select Start on and End on and complete the date and time values to limit the report to run only during a specific time period.

    The date and time displayed by default is the local browser time.

17. Select the Distribute Over option and enter values to run the report over minutes, hours, or days. See Tanium Console User Guide: Deploying actions for information on how the Distribute over option works.
18. Select Interval, Using report age, or Never for the Repeat field.
• If you choose Interval, the Reissue every field displays, and you can specify how often the report is run.
• If you choose Using assessment age, then the Run when results are older than field displays, and you can specify how old you want the results to be before the assessment is run. If a targeted endpoint comes online that has never run the assessment, the assessment will be run as soon as the next age-check occurs. The age of results is checked every hour.

  Use the Using assessment age option and set it to 7 days.

19. Click Create & Deploy and enter your credentials. Results will display on the Findings page.

Remote authenticated scan workflow

When a remote authenticated scan begins, it asks the Comply service for its targets and credentials. The service uses the scan’s criteria for IP inclusion to query for currently reachable targets for that satellite and sends that list to the client to execute the scan. Scheduled periodic RAS scans do not automatically include new targets as they are identified by the associated Tanium Discover scan. Reoccurring assessments will only include the unmanaged assets that were reachable at the time of the initial scan, unless you select the Include newly discovered endpoints on reoccurring scans check box, which is not recommended.

Create a vulnerability report from the Standards page

Select Standards from the main menu, select the Vulnerability tab, and click Create next to the vulnerability standard for which you want to create an assessment.

Configure a network unauthenticated scan assessment

You can find vulnerabilities on managed and unmanaged endpoints in your environment by creating a network unauthenticated vulnerability assessment. Unlike remote authenticated scanning, which requires credentials for all endpoints, network unauthenticated scanning allows you to use satellite targeting to scan unmanaged devices without having to authenticate to them. You can also configure distributed targeting in Comply using the Discover module.

Before you begin

• If you are using satellite targeting, you must create satellites in Tanium Direct Connect. See Tanium Direct Connect User Guide: Managing satellites. Tanium Discover is not required for satellite scans.

• If you're using distributed targeting, you must have the Discover module installed and configured. You must also have the following privileges: Discover Profile Read to view a network unauthenticated vulnerability assessment and Discover Profile Write. There is background information and detailed instructions for this section in the Tanium Discover User Guide.

  • You must use Discover 4.0 or later.
  • Discover currently scans only for IPv4 addresses.

  • Network unauthenticated scans are currently not supported on Windows 11 ARM clients.

To configure a network unauthenticated scan assessment, do the following:

1. From the Comply menu, select Assessments.
2. Click the Create Assessment button and select Vulnerability.
3. In the Summary section, enter a Name for the assessment.
4. Select a Scan Method:

• For this assessment type, select Network Unauthenticated.

  With this scan type, you can do a distributed scan or you can use satellite targeting to scan unmanaged devices without having to authenticate to them.
5. You can provide Labels to further identify the assessment.
6. In the Targeting section, select a Targeting Type.
   • Satellite - With a satellite scan, you manually enter IP addresses (ranges, CIDR, etc.) to be scanned by the selected satellite. The addresses you enter do not have to be on the same subnet as the satellite. They only have to be reachable by the satellite. You can view these results using remote reports. See Create a network unauthenticated report.

     • In the Included Networks field, enter a comma separated list of IP addresses, IP address ranges, or CIDR addresses. You can also click the Copy button to upload a text file containing IP addresses, IP ranges, or CIDRs separated either by commas or carriage returns.

     • In the Excluded Networks field, enter IP addresses, IP address ranges, or CIDR addresses to be excluded from the scan. You can enter them manually or upload a file of addresses.

     4,096 is the maximum number of addresses, or a /20, that can be included in a scan. When you click the Create button, a calculation takes place to determine the number of included addresses less the number of excluded addresses to determine the final amount.

   • Distributed - Scan endpoints in the same subnets as existing Tanium Clients. This uses the Discover module to run Nmap scans. Results from distributed scans are not viewable in Comply Findings. You can view these results using remote reports. See Create a network unauthenticated report.
     • Under Scan Inclusions, specify Tanium Client networks to scan as part of this assessment.

       • All Networks: It is recommended you include all networks in the scan.

       • Specific Networks: Enter the IP addresses for specific networks to include in the scan. Tanium clients within those networks will perform the scan.

       • Computer groups: Select specific computer groups to include in the scan.

         These are the computers from which the results will be pulled.
     • Under Scan Exclusions, specify networks to exclude from the assessment. You can select multiple options.

       • Isolated Subnets/Systems: Select this check box to prevent devices that have no peers from performing scans.

       • Specific Networks: Enter IP addresses to be excluded from scans. These can be single addresses, address ranges, or comma-separated CIDRs.

       • VPN Networks: Enter VPN networks to be excluded from scans. This prevents computers that are not on the network from being scanned. These can be single addresses, address ranges, or comma-separated CIDRs.

       • Zone Servers: Enter zone servers to be excluded from scans. This prevents computers that are not on the network from being scanned by using IP addresses or host names of DMZ facing servers. These can be IP addresses or host names separated by commas.

7.  In the Port Specification section, select one of the following:

   By default, the Network Mapper utility (Nmap) scans the top 1000 most commonly used TCP ports. If needed, you can customize the ports that are scanned during the discovery process and the source ports from which clients run scans.

   • Target Ports: Specify the TCP ports that you want to scan: Top 1000 Ports, Top 1000 Ports plus specified ports, or Only Specified Ports.

   • Excluded Ports: Specify a list of TCP ports to exclude from the ports scanned. These ports are excluded from all types of scans.

   • Source Port: Specify a source port from which Nmap on clients attempts to run scans.

8.  In the Scan Frequency section, specify how often you want the scan to run.
9. Click Create or Create & Deploy and enter your credentials.

View findings

To view findings for satellite and distributed scans:

• Create a report. See Create a network unauthenticated report.
• Export the results using Tanium Connect. See Exporting vulnerability assessments.
• Use the Comply NMAP Scan results sensor ("Get Comply - NMap Scan Results from all machines").

Create an SBOM scan assessment

SBOM scanning is useful for determining vulnerabilities on endpoints based on the results of a Software Bill of Materials assessment. An SBOM scan uses data obtained by the Tanium Client Index Extension, which indexes local file systems on Tanium Client endpoints and makes that list available to Software Manager. The results of the SBOM scan analysis are mapped to CVEs on the endpoint.

Unlike other scan types, SBOM scans are continuous, always running in the background. An SBOM scan is considered complete when one loop of the system is finished.

Before you begin

• A valid Tanium SBOM license is required.

  Note that when the SBOM license expires, SBOM assessments and findings are deleted.
• A Custom Setting with at least one ecosystem selected is required. SBOM scans use custom settings to configure index settings such as ecosystems to be scanned and file/directory exclusions. You must configure Custom Settings and select at least one ecosystem for an SBOM assessment to begin scanning. From the Comply menu, navigate to Setup > Configuration and select the Custom Settings tab. For more information, see Custom settings.

• You typically only need one Comply SBOM scan assessment for an environment. SBOM scans are continuous scans and use the Tanium Client Index Extension to index file systems.

• If both a client-based OVAL scan and an SBOM scan find a particular CVE, the OVAL finding takes precedence and is reported.

• An SBOM scan does not make an association between a library file and the application it belongs to.

• An SBOM scan does not include a defined set of CVEs to be evaluated. All CVEs are included and the list is updated periodically.

To configure an SBOM scan assessment, do the following:

1. Select Assessments from the Comply menu.
2. Select Vulnerability from the Create Assessment drop-down button.
3. On the Create Vulnerability Assessment page, in the Summary section, enter a Name for the assessment. You can also provide Labels.
4. Select a Scan Method:
• SBOM (Software Bill of Materials): (requires a Tanium SBOM license) An SBOM vulnerability scan has visibility into libraries and all files that are known to Software Manager. The results of an SBOM assessment analysis are mapped to CVEs on the endpoint.



5.  In the Targeting section:

   • Select Computer Groups. Use the pulldown list to select a group. Add additional groups by using the Add button to build upon or narrow your selection. When finished, click the check mark for each selection.

   Be sure to select the appropriate platform and Computer Groups containing endpoints that align with the Platform.

6. In the Schedule section, there are no configuration options. An SBOM scan runs continuously.

To stop an SBOM scan, delete the SBOM scan assessment. You can also remove SBOM Custom Settings and the SBOM scan assessment will stop running.

7. Click Create & Deploy and enter your credentials. Results will display on the Findings page.

A Custom Setting with at least one ecosystem selected is required for the SBOM scan assessment to run.

Because an SBOM scan runs continuously, results should be interpreted a bit differently for Comply - CVE Findings - Last Scan. In this case, the returned time indicates when the scan most recently resumed. Typically, this occurs on a client reset.

You cannot export SBOM assessments using Tanium Connect. Only SBOM findings can be exported using Tanium Connect.

Status definitions

View the status of a scan in the Status column on the assessment list page. Hover over the icon to see one of the following statuses:

Loading

No statistics have been received from the Comply service for the assessment.

Pending

At least one endpoint in the assessment has not yet run the scan, but there are no scan errors.

Success

The assessment has at least one successful run with no errors and no scans not run.

Error

The assessment has at least one endpoint that produced an error during the scan.

Warning

Any issue that does not fall into the other status categories.

You must reload the page to update the status column.

Run an assessment again

On the Assessments page, select an assessment and click Deploy to run it again.

Export an assessment

The following instructions are for exporting one assessment at a time. To export findings using Tanium Connect, see Exporting findings and assessments for instructions.

1. On the Assessments page, select an assessment and click the Export icon . You can only export one assessment at a time. If you have more than one assessment selected, the Export icon is not displayed.
2. In the Export Assessment window, provide the following:
   • Vulnerability
     1. Enter an Assessment Name.
     2. Optionally, enter a Description.
     3. Enter a File Name.
     4. Select a Format: HTML or CSV. If you select CSV, no further information is required.
     5. Select one or more Results Display types for the export: Details, Endpoint List, Open Ports (if applicable), and Vulnerability Test Criteria.
     6. Click Export.

Go to the Reports > Exports page to view the progress of any report export jobs currently running. The last column in the results table on indicates the status of the report export job.

3. When the export report is complete, select the export and click the Download icon to download the report in the format you selected.

Update vulnerability assessments

When vulnerability sources are updated and contain new definitions that match an assessment's vulnerability content, the assessment will get the updated feed the next time it is deployed. That process occurs automatically if it is deployed by a set schedule. If the vulnerability assessment does not have a recurring schedule, you must manually deploy it to receive the new vulnerability feed.

This does not apply to configuration compliance assessments, which require a new assessment to use updated configuration compliance standards.

Edit an assessment

1. On the Assessments page, select the assessment you want edit and click the Edit icon .
2. Edit the Name if needed.
3. Add labels in the Labels field. Click the X next to a label to remove it.
4. Change the Comply Process Priority if needed.
5. Select Start at and End at and complete the date and time values to limit the assessment to run only during a specific time period. The date and time displayed by default is the local browser time.
6. Select the Distribute over and enter values to run the assessment over minutes or hours.
7. Select None, Interval, or Use assessment age for the Repeat field.
• If you choose None, the report will run once if the Start At field is specified for a date and time in the future. Otherwise, the report will not run again.
• If you choose Interval, the Reissue every field will appear, and you can specify how often the assessment is run. The default value for this field is 1 Days and, if you do not specify a value for Start at, the assessment will run immediately. If you choose Interval and do not enter a value for End At, the assessment will run at the specified interval forever.
• If you choose Use assessment age, then the Run when results are older than field will appear, and you can specify how old you want the results to be before the assessment is run. The default value for this field is 1 Days and, if you do not specify a value for Start at, the assessment will run immediately. If a targeted endpoint comes online that has never run the assessment, the assessment will be run as soon as the next age-check occurs. The age of results is checked either every hour or every 3 hours. If you specify an age less than 3 hours, the age of results will be checked every hour. If do not enter a value for End At, the assessment will continue to run forever.
8. Click Save.

Clone an assessment

You can quickly create a new assessment based on an existing assessment by using the clone feature.

1. On the Assessments page, select the assessment you want clone and click the Clone icon .

   You can also clone an assessment from the assessment's side panel.
2. A new assessment page opens with all fields prepopulated with settings from the original assessment. In the name field, the name of the original assessment is prepended with the text Clone -.
3. Make necessary edits and click Create and Deploy.

Delete an assessment

Vulnerability assessments are updated automatically.

You cannot delete a standard, custom check, or custom ID mapping if they are associated with an assessment.