CVE Dashboard available

[leewei]

@BF_dev, technically it is absolutely possible to run this under Web Reports which some tweaks. I think I did it for someone but never publish it. If I can find it and something easy I will post here.

[BF_dev]

@leewei, Thanks a lot

[android]

Good day!
Could you explain, how bigfix_cve_util choice a cve what it remove or add ?
Example, I interested CVE-2017-1376 but it was remove.
How i can understand why it was remove? What have rules for choice?

[leewei]

CVEs downloaded from NVD are removed if there are no corresponding Fixlets.
For example:

• A CVE for the Cisco router will be removed because BigFix does not have content (Fixlets) for them.
• On the other hand, if you do not subscribe to a certain sites, say Patches for AIX, then CVEs relating to AIX will be excluded as well.

The idea is that I will only show you CVEs where there are Fixlets.

[randydavis]

Sorry for stupid question, but how do I load this in console in a custom site?

[leewei]

Here is the install guide that describes how to add the files for the dashboard into any sites you choose.
Actually, you can only add to a custom site anyway because we cannot modify “external” sites from IBM.
CVEDashboard.pdf (1.3 MB)

[asouza]

Hi All, Just recently purchased product and installed 9.5.9. CVE dashboard stopped getting updated content in June 2018. Anyone else facing this issue?

Regards,
A

[jkj1962]

I realize this is an old topic, but I’m just trying this out. I, too, need for non-master operators to be able to see this dashboard. I’ve imported the files into a Custom Site, and given the desired operator “Writer” permissions to the site. They can see the site, and the files, but not the Dashboard. I read above about permissions to the “dashboard variables”, but that’s a new one on me. (7 years with Bigfix).

Also, “Show Computers” does not work. (Bigfix 9.5.7)

Any ideas?

[asouza]

Hi lkj962,

Are you getting updated information from your CVE dashboard, after June 2018?

[jkj1962]

The last “Critical” ones are from June, but I’m seeing “High” and “Medium” from July 18, 2018.

[swap041]

@leewei : When i run the relevance it shows the values of Computer, Risk Score in XML format.
But still the Dashboard shows empty . I dont know why its showing like that.

Any Suggestions

[mako3]

Hi,

Where will this dashboard access?
I confirm that the dashboard access following site only.
http://static.nvd.nist.gov/

If there are other sites, let me know.

[leewei]

@mako3, technically, the dashboard does not have any external access except for the BigFix repository. The loading command line script is the one that connects to and download the CVE database from the URL you indicated.

[Masatsugu]

Hi,

When we click “Show Computers” on the dashboard, following script error occurs.
It seems, it occurs for groups with many computers and it doesn’t occur for groups with 1000 computers or so.
Does anyone have any idea to solve this situation?

Regards,

[Masatsugu]

WeiLee-san,

Do you have any idea to solve this script error?

Regards,

[sydabr]

When we click “Show Computers” on the dashboard, facing same script issue , any help please

[MRitchotte]

Has anyone here run into an issue when attempting to run the importer? I will get the error that parameter username is required even though i’m using the switch to specify the username (See attachment)

[leewei]

@MRitchotte Hello Matthew, I cannot duplicate what you are seeing. Is it possible that your command line, especially where you have the -server param is breaking up with a space or some characters?