Cisco Cisco Identity Services Engine Software Manual Técnico

NAC.MACAddress","C0:4A:00:14:8D:4B","TC-NAC.IpAddress","10.62.148.63","TC-

NAC.AdapterInstanceUuid","796440b7-09b5-4f3b-b611-199fb81a4b99","TC-

NAC.VendorName","Qualys","TC-NAC.AdapterInstanceName","QUALYS_VA"]}]

AdapterMessageListener checks each 5 minutes the status of the scan, until it is finished.

2016-06-28 17:09:43,459 DEBUG  [SimpleAsyncTaskExecutor-2][]

cpm.va.service.processor.AdapterMessageListener -:::::- Message from adapter :

{"AdapterInstanceName":"QUALYS_VA","AdapterInstanceUid":"a70031d6-6e3b-484a-adb0-

627f30248ad0","VendorName":"Qualys","OperationMessageText":"Number of endpoints queued for

checking scan results: 1, Number of endpoints queued for scan: 0, Number of endpoints for which

the scan is in progress: 0"}

2016-06-28 17:14:43,760 DEBUG  [SimpleAsyncTaskExecutor-2][]

cpm.va.service.processor.AdapterMessageListener -:::::- Message from adapter :

{"AdapterInstanceName":"QUALYS_VA","AdapterInstanceUid":"a70031d6-6e3b-484a-adb0-

627f30248ad0","VendorName":"Qualys","OperationMessageText":"Number of endpoints queued for

checking scan results: 0, Number of endpoints queued for scan: 0, Number of endpoints for which

the scan is in progress: 1"}

2016-06-28 17:19:43,837 DEBUG  [SimpleAsyncTaskExecutor-2][]

cpm.va.service.processor.AdapterMessageListener -:::::- Message from adapter :

{"AdapterInstanceName":"QUALYS_VA","AdapterInstanceUid":"a70031d6-6e3b-484a-adb0-

627f30248ad0","VendorName":"Qualys","OperationMessageText":"Number of endpoints queued for

checking scan results: 0, Number of endpoints queued for scan: 0, Number of endpoints for which

the scan is in progress: 1"}

2016-06-28 17:24:43,867 DEBUG  [SimpleAsyncTaskExecutor-2][]

cpm.va.service.processor.AdapterMessageListener -:::::- Message from adapter :

{"AdapterInstanceName":"QUALYS_VA","AdapterInstanceUid":"a70031d6-6e3b-484a-adb0-

627f30248ad0","VendorName":"Qualys","OperationMessageText":"Number of endpoints queued for

checking scan results: 0, Number of endpoints queued for scan: 0, Number of endpoints for which

the scan is in progress: 1"}

Adapter is gets QID's, CVE's along with the CVSS Scores

2016-06-28 17:24:57,556 DEBUG  [SimpleAsyncTaskExecutor-2][]

cpm.va.service.processor.AdapterMessageListener -:::::- Message from adapter :

{"requestedMacAddress":"C0:4A:00:14:8D:4B","scanStatus":"ASSESSMENT_SUCCESS","lastScanTimeLong":

1467134394000,"ipAddress":"10.62.148.63","vulnerabilities":[{"vulnerabilityId":"QID-

38173","cveIds":"","cvssBaseScore":"9.4","cvssTemporalScore":"6.9","vulnerabilityTitle":"SSL

Certificate - Signature Verification Failed

Vulnerability","vulnerabilityVendor":"Qualys"},{"vulnerabilityId":"QID-

90043","cveIds":"","cvssBaseScore":"7.3","cvssTemporalScore":"6.3","vulnerabilityTitle":"SMB

Signing Disabled or SMB Signing Not

Required","vulnerabilityVendor":"Qualys"},{"vulnerabilityId":"QID-90783","cveIds":"CVE-2012-

0002,CVE-2012-

0152,","cvssBaseScore":"9.3","cvssTemporalScore":"7.7","vulnerabilityTitle":"Microsoft Windows

Remote Desktop Protocol Remote Code Execution Vulnerability (MS12-

020)","vulnerabilityVendor":"Qualys"},{"vulnerabilityId":"QID-38601","cveIds":"CVE-2013-

2566,CVE-2015-

2808,","cvssBaseScore":"4.3","cvssTemporalScore":"3.7","vulnerabilityTitle":"SSL/TLS use of weak

RC4 cipher","vulnerabilityVendor":"Qualys"},{"vulnerabilityId":"QID-

90882","cveIds":"","cvssBaseScore":"4.7","cvssTemporalScore":"4","vulnerabilityTitle":"Windows

Remote Desktop Protocol Weak Encryption Method Allowed","vulnerabilityVendor":"Qualys"}]}

2016-06-28 17:25:01,282 INFO   [SimpleAsyncTaskExecutor-2][]

cpm.va.service.processor.AdapterMessageListener -:::::- Endpoint Details sent to IRF is

{"C0:4A:00:14:8D:4B":[{"vulnerability":{"CVSS_Base_Score":9.4,"CVSS_Temporal_Score":7.7},"time-

stamp":1467134394000,"title":"Vulnerability","vendor":"Qualys"}]}

2016-06-28 17:25:01,853 DEBUG  [endpointPollerScheduler-2][] cpm.va.service.util.VaServiceUtil -

:::::- VA SendSyslog systemMsg :

[{"systemMsg":"91019","isAutoInsertSelfAcsInstance":true,"attributes":["TC-

NAC.ServiceName","Vulnerability Assessment Service","TC-NAC.Status","VA successfully

completed","TC-NAC.Details","VA completed; number of vulnerabilities found: 5","TC-

NAC.MACAddress","C0:4A:00:14:8D:4B","TC-NAC.IpAddress","10.62.148.63","TC-

NAC.AdapterInstanceUuid","796440b7-09b5-4f3b-b611-199fb81a4b99","TC-