Skip to main content

Lacework Console - Host Vulnerability

View Vulnerabilities

The host vulnerability page contains current vulnerabilities and previous vulnerabilities that were fixed. Select Vulnerabilities > Hosts in the Lacework Console to view this page.

note

AWS Fargate containers do not show on the host vulnerability page.

console-host-vuln-oct2022.png

Groups

By default, the list displays vulnerabilities that are grouped by host and from the past day.

To change how the list groups vulnerabilities, select a different grouping from the drop-down:

  • Host
    • AMI ID
    • Account
    • Zone
  • CVE
    • Package Name
    • Package Namespace

Use the search function at the top of the page to find specific text in any of the details available on the page. You can also click the search field to select values and operators to filter your search (these vary depending on the Group by option).

console-host-vulnerability-advanced_search.png

Apply an operator that helps refine your search (these vary depending on the type of filter).

console-host-vulnerability-advanced_search-operator.png

For example, when Group by Host is active, search for all hosts affected by a CVE matching ALAS2-2022-1780:

console-vulnerability-advanced_search-ALAS2-2022-1780.png

When searching for package names on hosts, the results contain both vulnerable and non-vulnerable packages.

Filters

By default, the page is grouped by host and the following filters are active:

You can use the following methods to refine the list of vulnerabilities displayed:

  • Use filters to display a subset of specific vulnerabilities. Click the filter dropdowns along the top of the page, select your desired matches and then click Show results to make them active. To remove an active filter, deselect the checkbox in the corresponding filter dropdown and then click Show results. You can also click Reset in the filter dropdowns or in the row of filters to reset all filters. Or, click the filter icon and select the filters you want to display. EOL filters don't display at the top of the page by default.
  • Use the search function at the top of the page to find specific text.

Fixability

tip

When grouped by Host, this filter functions as an AND operator when paired with one or more Severity levels.

For example, Fixability = Yes and Severity = Critical lists hosts with at least one CVE that is critical and fixable.

Group by Host fixable filter definitions:

  • Yes - The hosts listed contain fixable packages for the vulnerabilities found.
  • No - The hosts listed contain unfixable packages for the vulnerabilities found.

Group by CVE fixable filter definitions:

  • Yes - The vulnerabilities listed are for fixable packages.
  • No - The vulnerabilities listed are for unfixable packages.

Severity

tip

When grouped by Host, this filter functions as an AND operator when paired with one or more Fixability levels.

For example, Severity = Critical and Fixability = Yes lists hosts with at least one CVE that is critical and fixable.

  • Group by Host: Display hosts that have vulnerabilities at the selected severity level (for example: Critical, High).
  • Group by CVE: Display vulnerabilities (found in your environment) with the selected severity level (for example: Critical).

Machine Status

Lacework bases the machine status on the last hour’s Agent heartbeat. This lets you filter out ephemeral machines that are currently offline and helps you to understand fleet risk.

  • Online - The Lacework Agent sent a heartbeat in the last hour.
  • Offline - The Lacework Agent did not send a heartbeat in the last hour.

Scan Status

Group by Host scan status filter definitions:

  • Successful Scan - Matches hosts that were successfully scanned.
  • Failed Scan - Matches hosts that couldn't be scanned due to an error.
  • Unsupported Scan - Matches hosts that couldn't be scanned due to running an unsupported operating system.

Scanner Type

Group by Host scanner type filter definitions:

  • Agent - The vulnerability assessment data has been collected by a Lacework Agent installed on the host.
  • Agentless - The vulnerability assessment data has been collected through an Agentless Workload Scanning integration.

EOL Date

Group by Host OS end of life (EOL) filter definitions:

  • Currently EOL – Matches all hosts where the EOL date is in the past.
  • EOL within 30 days – Matches all hosts where the EOL is within 30 days from now.
  • EOL within 90 days – Matches all hosts where the EOL is within 90 days from now.

Account

Filter for certain cloud accounts by using this Group by Host filter. Apply an operator (for example: matches) to help constrain your search.

CVE

Filter for certain vulnerability IDs (CVEs) by using this Group by Host filter. Apply an operator (for example: includes) to help constrain your search.

Hostname

Filter for certain hostnames by using this Group by Host filter. Apply an operator (for example: excludes) to help constrain your search.

Machine ID

Filter for certain machine IDs by using this Group by Host filter. Apply an operator (for example: does not match) to help constrain your search.

Machine Tags

Filter for certain machine tags by using this Group by Host filter. Search for specific tag values or check the tags you want to display.

Vulnerability Status

Group by CVE vulnerability status filter definitions:

  • New - Vulnerability was detected for the first time during the last assessment.
  • Unpatched - Vulnerability was detected and has been active longer than a day (since the last assessment).
  • Fixed - Vulnerability was not detected in consecutive assessments.
  • Reopened - Vulnerability was fixed, but has been detected again.

Kernel Status

Group by CVE kernel status filter definitions:

  • Active Kernel - Vulnerability has been found on a kernel package for an active kernel.
  • Inactive Kernel - Vulnerability has been found on a kernel package for an inactive kernel.
note

If the Kernel Status field value is empty, it indicates that Kernel Status field is not applicable because the vulnerability exists on a non-kernel package.

Package Name

Filter for package names by using this Group by CVE filter. Apply an operator (for example: starts with) to help constrain your search.

Package Namespace

Filter for package namespaces by using this Group by CVE filter. Apply an operator (for example: ends with) to help constrain your search.

Internet Exposure

The vulnerability's internet exposure value is derived from the Exposure Polygraph.

Group by Host internet exposure filter definitons:

  • Yes - Matches all hosts that have been determined as exposed to the internet during the latest Agentless scan.
  • No - Matches all hosts that have been determined as not exposed to the internet during the latest Agentless scan.
  • Unknown - Matches all hosts where the internet exposure status could not be determined.

Each host assessment contains tags for the internet exposure status and when the status was last updated. The internet exposure status depends on the last update in a given time range (including up to 24 hours prior to the start time).

note

Internet exposure deprecates the public facing filter.

Package Version

Filter for package versions by using this Group by CVE filter. Apply an operator (for example: matches) to help constrain your search.

Fixed Version

Filter for fixed versions (of packages) by using this Group by CVE filter. Apply an operator (for example: includes) to help constrain your search.

Time Range

To change the time period, select a different one from the drop-down or use the horizontal arrows to move to the next/previous period. Select from the following past periods: hour, day, three days, week, month, or a Custom range.

Only information found during assessment of the specified date range is reported.

Save View

When the page displays your required vulnerabilities, click the Save view icon in the top right corner to save the current view. You can access the saved view later through the Open view icon. When you open a saved view, its name displays in the page title as Host vulnerabilities/view name.

Click the icon adjacent to this name to access additional actions such as delete and duplicate. You can also copy the link to the current view by clicking the Copy link icon. You can then share the link with others so they can see the same view. You cannot save searches and sorting in views or copy them as links.

Statistics

The statistics depict data for the current view:

  • MTTR = Mean Time to Resolve (MTTR) in days.
  • Scanned hosts = Number of hosts that have been successfully scanned and evaluated.
  • 24-hour coverage (percentage) = (Number of hosts successfully scanned for vulnerabilities / Number of hosts discovered through Agents, Agentless and Cloud integrations) x 100. This figure is based on the last 24 hours.
  • Hosts with Critical and High Severities = Number of scanned hosts with critical and/or high severity vulnerabilities.

Charts

The page displays the following charts:

  • An open vulnerabilities trend-line chart.
    • Hover over the filter icon (active-filters-icon.png) to see the active filters that are influencing the chart.
  • A severity chart for each hostname row.
  • A severity detail chart under the CVE tab, which appears when you click a hostname.
  • A sunburst chart for each CVE row.
  • A CVE sunburst chart under the Hosts tab, which appears when you click a CVE.

Hover your mouse over the trend-line chart to see the critical, high, medium, and low vulnerabilities.

open_vuln.png

Vulnerabilities List

Below the overview is the vulnerabilities list. The information displayed depends on how the vulnerabilities are grouped.

The vulnerability list allows you to Refresh data, Download CSV, and sort.

Click a tag link to reload the vulnerability list with the tag as the filter.

Download CSV

info

The CSV reports are limited to the last month's worth of data and/or the first 5000 rows of data returned from the Lacework API (v2). This is based on the latest assessment.

When grouped by CVE, the Download CSV option provides the Simplified CSV.

When grouped by Host, select from three different options for your CSV report (see the following sections below for details).

note

Hosts with zero vulnerabilities are not listed in the CSV report.

Simplified CSV

Your active filters or tags control which Hosts or CVEs are listed in the CSV report.

  • Group by Host: The CSV is indexed by Hostname and provides details about the host and a summary on the number vulnerabilities found (categorized into severity and fixability).

  • Group by CVE: The CSV is indexed by Vulnerability (CVE) ID and provides details on the vulnerability and affected package.

Both types list when the last assessment was performed on the Host/CVE.

Detailed CSV

note

The report always contains at least 3 days of data prior to the end time (unless the start time/date is older than 3 days).

All Hosts are listed in this report regardless of active filters or tags. The report is limited to the first 5000 rows of data returned from the Lacework API (V2).

The Detailed CSV is indexed by Machine ID (MID) and lists details on all the CVEs applicable to the Host in each row.

Custom CSV

note

The report always contains at least 3 days of data prior to the end time (unless the start time/date is older than 3 days).

Define which type of CVEs are listed in the report by filtering for the severity, fixability, and/or CVE ID(s).

vulnerabilities-custom-csv-options.png

Click Download once you have specified your filters.

The Custom CSV is indexed by Machine ID (MID) and lists details on the CVEs applicable to the Host in each row (depending on which filters you have applied). The report is limited to the first 5000 rows of data returned from the Lacework API (V2).

Group by Host

When grouped by Host, AMI ID, Account, or Zone, the list displays the following information:

  • Hostname
  • Uptime
  • Host Risk
  • Number of vulnerabilities
    • Failure displays if the assessment failed. Potential reasons for failure include the following: host is unavailable, package data not found. For the reasons why package data may not be found, see Package Data Not Found.
    • Unsupported displays if the host is running an unsupported operating system.

Host Assessment Drawer

Click a hostname to display its risk assessment where you can see an expandable view of host details and any vulnerabilities in the CVE tab (viewed in the table).

Host Assessment - Details

The Details tab contains descriptive information about the host. Click on any of the tags to filter the vulnerabilities list with that tag.

Host Assessment - CVE (default)

The CVE tab displays a list of vulnerabilities for the host with additional information in columns. This table lets you refresh data, download a report in CSV or PDF format, select which columns to display, filter, and search.

Click the filter icon to view the active filters on the table.

vuln-cvetab-interactive-filter-15032022.png

You can search for, add, and remove filters to adjust the list of vulnerabilities displayed in the table.

The available columns in the CVE tab are listed below:

ColumnDescription
VulnerabilitiesDisplays the common vulnerabilities and exposures (CVE) code assigned to this vulnerability by the CVE Numbering Authority. Click the CVE number to open a web page that provides details about the CVE.
SeverityDisplays the CVE’s severity ranking, which is assigned by the vendor or computed from CVSS v3 or CVSS v2 scores (in that order of precedence).
CVSS ScoreDisplays the CVSS (Common Vulnerability Scoring System) severity rankings score for the vulnerability. Hover over the score for the CVSS version. For both CVSS v3 and CVSS v2, the severity ranking is a scale from 0 - 10, where 10 is the highest severity. Defaults to CVSS v3 scores or CVSS v2 if v3 scores are not available.
Vulnerability impactDisplays the Lacework risk score for the vulnerability.
Package NameDisplays the operating system package or language package that the vulnerability was found in. Click the package name to reload and filter the vulnerability list for this package.
Package NamespaceThe namespace of the vulnerable package.
Current VersionDisplays the current version of the package found on the host.
Fix VersionDisplays the version of the package where the issue is fixed.
Package StatusDisplays active if there was an active process linked to this package during the last scan on the host. Only Agent assessments can determine whether a package is active or not. Agentless assessments will mark all packages as inactive.
Kernel StatusDisplays Active if the vulnerability was found on a running kernel. See Kernel Status for other possible values.
File Path (hidden by default)If applicable, displays the filesystem path to the vulnerable package source.
First SeenWhen the vulnerability was first seen during a scan.
Last Status UpdateDisplays the last time the status of this package was updated in the Lacework Console.
Time to Resolve (hidden by default)Displays how long it took for the vulnerability to be fixed. This is the time between when the vulnerability was First Seen and the Last Status Update.
Vulnerability Status (hidden by default)Displays the status of the vulnerability. The status can be one of the following:
New - Vulnerability was detected for the first time during the last assessment.
Active - Vulnerability was detected in consecutive assessments.
Reopened - Vulnerability was fixed, but has been detected again.
Fixed - Vulnerability was not detected in consecutive assessments.
Exception - A vulnerability exception has been applied to this vulnerability, or the vulnerability was found on an inactive kernel.
Host Assessment - Packages

The Packages tab displays a list of vulnerable packages found on the host with additional information in columns. This table lets you refresh data, download CSV/PDF, add/remove columns, filter, and search.

Click the filter icon to view the active filters on the table. You can search for, add, and remove filters to adjust the list of packages displayed in the table.

note

Each row in the table displays one vulnerability, so a package may be listed more than once if multiple vulnerabilities are found.

The available columns in the Packages tab are listed below:

ColumnDescription
Package NameDisplays the vulnerable operating system package or language package that was found on the host.
Package NamespaceDisplays the vulnerable package namespace that was found on the host.
Package Risk ScoreDisplays the Lacework risk score for the vulnerable package.
Vulnerability StatusDisplays the status of the vulnerability. The status can be one of the following:
New - Vulnerability was detected for the first time during the last assessment.
Active - Vulnerability was detected in consecutive assessments.
Reopened - Vulnerability was fixed, but has been detected again.
Fixed - Vulnerability was not detected in consecutive assessments.
Exception - A vulnerability exception has been applied to this vulnerability.
Package StatusDisplays active if there was an active process linked to this package during the last scan on the host. Only Agent assessments can determine whether a package is active or not. Agentless assessments will mark all packages as inactive.
Fixable StatusDisplays whether the package is fixable or not (whether there is a new or patched version of the package available).
CVEDisplays the common vulnerabilities and exposures (CVE) code assigned to this vulnerability by the CVE Numbering Authority.
SeverityDisplays the CVE’s severity ranking, which is assigned by the vendor or computed from CVSS v3 or CVSS v2 scores (in that order of precedence).
CVSS ScoreDisplays the CVSS (Common Vulnerability Scoring System) severity rankings score for the vulnerability. Hover over the score for the CVSS version. For both CVSS v3 and CVSS v2, the severity ranking is a scale from 0 - 10, where 10 is the highest severity. Defaults to CVSS v3 scores or CVSS v2 if v3 scores are not available.
Current VersionDisplays the current version of the package found on the host.
Fix VersionDisplays the version of the package where the issue is fixed (when a patch is available).
File PathIf applicable, displays the filesystem path to the vulnerable package source.

Group by CVE

When grouped by CVE, Package Name, or Package Namespace, the list displays the following information:

CVE Assessment Drawer

Click a vulnerability ID to display its risk assessment where you can see an expandable view of vulnerability details and affected or unaffected hosts (click the < icon to expand this view to full screen).

CVE Assessment - Details

The Details tab contains descriptive information about the vulnerability.

CVE Assessment - Hosts

The Hosts tab displays a list of hosts where the vulnerability was found with additional information in columns. This table lets you refresh data, download as a CSV/PDF, select which columns to display, filter, and search.

The available columns in the Hosts tab are listed below:

ColumnDescription
MACHINE ID (hidden by default)Displays the Machine ID for the host.
HostDisplays the hostname for the machine.
UptimeDisplays the uptime for the machine.
Host StatusDisplays the most recent agent status, either Online or Offline, based on the last hour’s agent heartbeat. Online means the Lacework agent sent a heartbeat the last hour. Offline means the Lacework agent did not send a heartbeat the last hour.
Host RiskDisplays the Lacework risk score for the host. A higher score indicates more risk/impact from discovered vulnerabilities.
Vulnerability StatusDisplays the status of the vulnerability. The status can be one of the following:
New - Vulnerability was detected for the first time during the last assessment.
Active - Vulnerability was detected in consecutive assessments.
Reopened - Vulnerability was fixed, but has been detected again.
Fixed - Vulnerability was not detected in consecutive assessments.
Exception - A vulnerability exception has been applied to this vulnerability.
Collector (hidden by default)The Scanner Type used to perform the assessment.

Package Data Not Found

Package data not found occurs under two circumstances:

  • Package collection was intentionally disabled
  • Package collection did not occur due to timing

If package collection was not disabled, then timing prevented package collection.

Scans do not occur on the host. An enumeration of packages is sent as a manifest to Lacework and any scanning activity occurs in the Lacework backend based on that host's manifest.

Package collection on a host does not occur immediately after the agent is installed. Package collection is delayed to limit the impact on host resources (CPU, Memory) and occurs after the core HIDS functionality is started. If the host shuts down after it registers with Lacework but before it transports package data, the package data will not be found.

You can use the /scan endpoint to supply a manifest (os, os_ver, package name, package version) and get a response. You can do this 20 times an hour for up to 1k packages each time. This action does not directly result in an assessment in the Lacework Console, but it does help to get an assessment.