How to Configure Vulnerability Scanner Integrations in Patch Manager Plus

Key Points
Introduction: Explains why integrating vulnerability scanners with Patch Manager Plus is required to remediate detected risks through patch deployment.
What is a Vulnerability Scanner: Defines what a vulnerability scanner is, how it identifies security risks and missing patches, and why remediation requires integration with a patch management solution.
Vulnerability Scanner Integrations: Defines how Patch Manager Plus connects with third party vulnerability scanners to map vulnerabilities to missing patches.
Quick Setup: Walks through configuring supported vulnerability scanner integrations using Threat scanner settings in Patch Manager Plus.

Introduction

Patch Manager Plus can integrate with external vulnerability scanner tools to help administrators remediate detected vulnerabilities using patches from the same console. These integrations eliminate manual correlation between scanner results and missing patches, enabling faster and more accurate remediation.

What is a Vulnerability Scanner?

A vulnerability scanner is a security tool that detects known vulnerabilities, misconfigurations, and missing patches across operating systems, applications, and endpoints. It analyzes systems against a vulnerability database to identify potential security risks and assess their severity.

Vulnerability Scanner Integrations in Patch Manager Plus

Vulnerability scanner integrations in Patch Manager Plus allow the product to connect with supported third party scanners and import vulnerability and asset data. Patch Manager Plus analyzes the imported data from the vulnerability scanner and identifies corresponding missing patches for supported operating systems and applications, allowing vulnerabilities to be resolved through standard patch deployment workflows.

Patch Manager Plus supports integrations with Qualys, Tenable, Rapid7 InsightVM, and CrowdStrike Falcon Spotlight for vulnerability driven patch remediation.

Quick Setup

Use the steps below to configure vulnerability scanner integrations in Patch Manager Plus. The process involves generating API credentials in the scanner and configuring Threat scanner settings in the Patch Manager Plus console.

Access Threat scanner settings in Patch Manager Plus

1. Log in to the Patch Manager Plus console using an account with Administrator privileges.
2. Navigate to Admin → Integrations → Threat scanner settings.
3. Select the vulnerability scanner you want to integrate.

Configure Tenable Vulnerability Management or Tenable Security Center

Tenable is a widely used vulnerability scanner that helps identify missing patches and exploitable weaknesses across enterprise endpoints.

1. In the selected Tenable product, generate the required Access Key and Secret Key using an account with administrative permissions.
2. In Patch Manager Plus, under Threat scanner settings, choose Tenable VM or Tenable SC.
3. Enter the Access Key and Secret Key in the corresponding fields.
4. For Tenable SC, also provide the Base URL of the Tenable Security Center server.
5. Configure the data sync frequency based on how often vulnerability data should be imported.
6. Save the configuration to enable the integration.

Configure Rapid7 InsightVM Integration

Rapid7 InsightVM functions as a continuous vulnerability scanner for both cloud and on premises environments.

InsightVM Cloud

1. Generate an API key in Rapid7 InsightVM Cloud.
2. In Patch Manager Plus, select InsightVM Cloud under Threat scanner settings.
3. Enter the API key and base URL.
4. Set the data sync frequency and save the configuration.

InsightVM On Premises

1. Ensure the InsightVM user account has permissions to view site asset data, create reports, and view vulnerability investigations.
2. In Patch Manager Plus, select InsightVM On Premises under Threat scanner settings.
3. Enter the Base URL, username, and password of the InsightVM server.
4. If two factor authentication is enabled, provide the authentication token.
5. Configure proxy related options if required and set the data sync frequency.
6. Save the configuration to enable the integration.

Configure CrowdStrike Falcon Spotlight

CrowdStrike Falcon Spotlight is a cloud based vulnerability scanner that continuously assesses endpoint exposure by identifying vulnerabilities in operating systems and applications.

1. In CrowdStrike Falcon Spotlight, create an API client using an account with Falcon Administrator privileges.
2. Assign read permissions for detections, hosts, and vulnerabilities to the API client.
3. Note the generated Client ID and Client Secret.
4. In Patch Manager Plus, select Spotlight under Threat scanner settings.
5. Enter the Client ID, Client Secret, and Spotlight base URL.
6. Set the data sync frequency and save the configuration.

Configure Qualys Vulnerability Management

Qualys Vulnerability Management is a cloud based vulnerability scanner commonly used for compliance and risk assessment.

1. In Qualys Vulnerability Management, generate the required API credentials for integration.
2. In Patch Manager Plus, go to Admin → Integrations → Threat scanner settings and select Qualys.
3. Enter the Qualys username, password, and base URL.
4. Configure the data sync frequency to control how often vulnerability data is imported.
5. Save the configuration to complete the vulnerability scanner integration.

Additional details are available in the integration documentation.

Start your 30-day free trial and remediate vulnerabilities detected by your vulnerability scanner!