Copyright: Copyright © 1999-2001 by VIGILANTe


Overview

The VIGILANTe SecureScan NX family of products is a complete solution for ensuring the security and availability of the services on your network.

It provides the most comprehensive view of compliance with security policies for all your host systems, and the associated information security risks across the network. Tests can be run to report on hosts throughout your network, regardless of operating system. Intrusion vulnerabilities are reported immediately, with step-by-step solutions for fixing the problem.

The VIGILANTe SecureScan NX Console is your interface with the test environment. It controls the tests that you run and the hosts that you test. The Console's Main Screen allows you to set up security policies for testing your network and your firewalls, routers and hosts to test, and to examine the results of your tests.

The Network component tests hosts on the same network as the Console, either the Local Area Network or a Wide Area Network.

VIGILANTe SecureScan NX Remote agent let you test enterprise-wide networks faster by running test cases remotely and centralizing the results to a single Console.

VIGILANTe SecureScan NX Firewall component analyzes the filtering rules currently defined on the firewall or other filtering equipment that protects your network. It can also be used to check whether the Network test cases can be run through the firewall.

To do so, you install VIGILANTe SecureScan NX Firewall Console on the 'external' side of the firewall or filtering equipment - the side from which attacks are most likely to take place. The VIGILANTe SecureScan NX Remote Agent is installed behind each firewall that you want to test ; it identifies the hosts that are connected to the network, and tests those hosts as instructed by the Console. By communicating with the Console through the firewall, it can precisely determine vulnerabilities caused by missing filter rules.


Main Screen

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run, monitor tests and to analyze the results of these tests.

The main screen contains the following elements :

Main menu

Tool bar

Shortcut bars

Policy pane

Test pane

Output pane


Test Case Properties Screen

The Test Case Properties screen displays information about the current test case.

It has two tabs :

General

Parameters


Host Properties Screen

This screen displays the properties of the selected host. It contains three tabs :

General

Properties

Services

For remote agent, it also contains

Action


Menu Principal
Main Menu

Click on an item menu


Tool bar

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

By default, the VIGILANTe SecureScan NX main window contains three tool bars :

File tool bar

Action tool bar

View tool bar

You can customize the tool bar by selecting View>Tool bar option in the menu


Shortcut bar

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Shortcut bar has two tabs : Jobs tab and Reports tab.

•	The Jobs tab allows you to start a new job, to load a job that you have previously run, or to delete a job. When you start a job, you run the selected test cases against the hosts defined in the perimeter. It is the equivalent of the Scan>Test Perimeter menu option.

•	The Reports tab allows you to generate reports from the test results obtained for the current session.


Policy pane

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Policy pane shows the test cases that are available under the current security policy, sorted according to various categories. The tree structure allows you to select which test cases to run against the hosts that are selected.

The pane provides the following ways of sorting test cases :

By Platform

By Impact

By Risk

By Service (for those test cases that are associated with a service)

By Level

By CVE Code

By Key

Note that each test case appears in several places in the tree. For example, 11100 (traceroute is possible) appears in By Impact>Gather Info, By Risk>Low, By Level>IP, By Key and By Platform>All.

If a checkbox next to a category is checked, then all items in the folder are selected. If a checkbox is checked but the background is gray, only some of the items in the folder are selected. Because a test case appears in several places, selecting a test case in one folder (or selecting a complete folder) will cause other folders to display the grayed checkmark.

To see more information about a test case, right-click it and select Properties from the pop-up menu. VIGILANTe SecureScan NX displays the Test Case Properties screen.


Test pane

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Test pane contains tabs that enable you to define the test environment, and to display the results of running the test cases you selected against the hosts you selected. It contains the following tabs :

Perimeter tab

Probe tab

Scan Results tab

Test Case Results tab

Host Results tab

Filter Rules tab


Test pane - Perimeter tab

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Test pane contains tabs that enable you to define the test environment, and to display the results of running the test cases you selected against the hosts you selected. It contains the following tabs :

Perimeter tab

Probe tab

Scan Results tab

Test Case Results tab

Host Results tab

Filter Rules tab

The Perimeter tab is only available in VIGILANTe SecureScan NX Network sessions. It allows you to specify the host machines that you want to test.

A perimeter is a set of hosts enclosed within a range of IP addresses that form a logical boundary to the set. You can specify one or more ranges from the pop-up menus in the Perimeters tab.

You can then populate the perimeter; this means that VIGILANTe SecureScan NX checks the network for hosts with the required IP address. When the hosts have been located, you can either include them in the test or exclude them.

Each type of element on the Perimeters tab has a different icon


Test pane - Probe tab

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Test pane contains tabs that enable you to define the test environment, and to display the results of running the test cases you selected against the hosts you selected. It contains the following tabs :

Perimeter tab

Probe tab

Scan Results tab

Test Case Results tab

Host Results tab

Filter Rules tab

The Probe tab is only available in Firewall sessions; it allows you to see the Remote Agents that are connected to the Console, and to specify the host machines that you want to test. Note that the number of Remote Agents you can manage at a time depends on the license you have purchased.

When one or more Remote Agents are connected, you can you can add the names of hosts on the same network as the Remote Agent to the Probe tab. Right-click on the Remote Agent name and select Perform a network scan from the pop-up menu; the Remote Agent scans its subnet, and sends back the machine names it finds to the Console.

Each type of element on the Probe tab has a different icon.

Each host name has a checkbox next to it. You can use these checkboxes to either include the host in the test or exclude it.


Test pane - Scan Results tab

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Test pane contains tabs that enable you to define the test environment, and to display the results of running the test cases you selected against the hosts you selected. It contains the following tabs :

Perimeter tab

Probe tab

Scan Results tab

Test Case Results tab

Host Results tab

Filter Rules tab

The Scan Results tab of the Test pane is updated in real time as the test is running. It contains the following elements :

•	The Port Scanning Status chart; this displays the results of scanning all ports on each host included in the test. It shows how many ports VIGILANTe SecureScan NX has scanned so far, and how many active UDP and TCP ports it has found.

•	Running totals of the number of ports scanned and found.

•	A progress bar showing how much of the scanning process has been completed.

•	The lower part of the tab contains a list of the scan results broken down by host. For each host, it shows the name and IP address, the number of ports scanned, and the number of UDP and TCP ports found.


Test pane - Test Case Results tab

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Test pane contains tabs that enable you to define the test environment, and to display the results of running the test cases you selected against the hosts you selected. It contains the following tabs :

Perimeter tab

Probe tab

Scan Results tab

Test Case Results tab

Host Results tab

Filter Rules tab

The Test Case Result tab in the Test pane is updated in real time as the test is running. It contains the following elements :

•	The Test Case Results chart shows the number of test cases that have failed and succeeded, and how many encountered a system or network error or have an undetermined status. The test case failures and successes are color-coded according to the level of risk.

•	Running totals of the number of test cases played and the number of vulnerabilities that have been found.

•	A summary of the results for each host tested. For each host, it shows the name and IP address; the current status of the host; the machine(s) on which test cases are currently running; how many test cases have been played and how many vulnerabilities have been found; and the level of risk represented by the vulnerabilities that have been found.


Test pane - Host Results Tab

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Test pane contains tabs that enable you to define the test environment, and to display the results of running the test cases you selected against the hosts you selected. It contains the following tabs :

Perimeter tab

Probe tab

Scan Results tab

Test Case Results tab

Host Results tab

Filter Rules tab

The Host Results tab displays a list of the hosts on which the test cases were run, and the results obtained. It contains three panes :

The Host List is the only pane displayed when you first select the Host Results tab. For each host, VIGILANTe SecureScan NX displays :

the name and IP address of the host

the status of the host

OK (fully accessible via the network)

Down (not accessible via the network)

Damaged (at least one service on the host is damaged)

Unreachable (cannot be reached via TCP/IP)

the number of test cases played against the host

the number of test cases that succeeded, i.e. that located a vulnerability on the host

the number of successful test cases that revealed high, medium and low vulnerability

When you click on a host in the list, VIGILANTe SecureScan NX displays the Test Case List. This contains the following information :

the ID of a test case

the test result for the test case (found, error or undefined)

the risk and impact associated with the test case

whether there is any extended information as a result of running the test case: if a [image] icon appears in the ExtInfo column, you can double-click on the test case to display the Extended Information dialog box

the port on which access was obtained

Clicking on a test case displays the Test Case Properties. This pane displays information about the test case, taken from the Vulnerabilities database.


Test pane - Filter Rules tab

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Test pane contains tabs that enable you to define the test environment, and to display the results of running the test cases you selected against the hosts you selected. It contains the following tabs :

Perimeter tab

Probe tab

Scan Results tab

Test Case Results tab

Host Results tab

Filter Rules tab

The Filter Rules tab is designed specifically to show the results of tests on firewalls and routers; it displays the filter rules that have been checked for each Remote Agent. Each "Success" means that the packet in question was able to cross the firewall or the filtering equipment. This may indicate a security failure, and you can now check if the results are consistent with the policy you wanted to implement.

This tab displays a list of the hosts on which the Filter Rule test cases were run, and the results obtained. It contains three panes:
The Host List is the only pane displayed when you first select the Host Results tab. For each host, VIGILANTe SecureScan NX displays :

the name and IP address of the host

the number of test cases played against the host

the number of test cases that succeeded, i.e. that located a vulnerability on the host

the risk represented by the test cases that succeeded

When you click on a host in the list, VIGILANTe SecureScan NX displays the Test Case List. This contains the following information :

the ID of a test case

the test result for the test case (found, error or undefined)

the risk and impact associated with the test case

whether there is any extended information as a result of running the test case: if a [image] icon appears in the ExtInfo column, you can double-click on the test case to display the Extended Information dialog box

the port on which access was obtained

Clicking on a test case displays the Test Case Properties. This pane displays information about the test case, taken from the Vulnerabilities database.


Output pane

The main screen is your interface with VIGILANTe SecureScan NX. It enables you to set up, run and monitor tests, and to analyze the results of these tests. It contains the following elements :

Main menu

Tool bar

Shortcut bar

Policy pane

Test pane

Output pane

The Output pane consists of three tabs :

The Control tab displays messages logging the progress of VIGILANTe SecureScan NX when it is starting up and analyzing your network. Right-clicking in the Control tab displays a pop-up menu; in addition to the standard options, you can select the following :

Filter Log Output displays the Log Filters dialog box, which allows you to specify what types of message should be displayed.

Save As enables you to save the contents of the Control tab to a text file.

The External tab displays messages about VIGILANTe SecureScan NX report generation.

The Status tab display the state (sleeping, waiting, ...) of the different thread of SecureScan NX and what they are doing (scanning, playing a TC, ...)


Open Session Dialog Box

This dialog box allows you to open an existing session. Select one of the sessions in the list and click OK. VIGILANTe SecureScan NX will load the policies and results that were obtained the last time this session was used.

The Predefined tab contains two sessions that do not allow results to be stored; one of them is used for testing networks, and the other for testing firewalls. You can also open New Session, to invoke the New Session Wizard.


New Session Wizard - Session Description

Enter a descriptive name for the new session. This description will be used to identify the session when you open it, and also in reports that are generated when you run the session.

Next page


New Session Wizard - Policy

The policy defines the test cases that will be available when you run this session.

Select an existing policy from the list, or create a new one by clicking on the New Policy button. This displays the Policy Editor.

The buttons above the list of policies allow you to display just the policy names, or the policy names and descriptions.

Previous Page Next page


New Session Wizard - Summary

This screen shows a summary of the parameters you have specified for your new session.

You can go back to the previous wizard screens to make any necessary change.

When you are satisfied with the specifications, click on Finish.

Previous Page


New Host Dialog Box

This dialog box allows you to add a new host to the perimeter. Enter the name or the IP address of the machine to be added. SecureScan NX will add the machine and check if it is connected.


Policy Properties Screen

This screen displays the properties of the current policy. It contains two tabs :

Properties

Policy Filters


Find Test Case Dialog Box

This dialog box allows you to find a Test Case and select it in the Policy pane.

If you know the ID of the Test Case you want to view, type the ID and click the Find button or press Return.

Alternatively, you can type some text that you know appears in the test case ; if you want to find the text exactly as you typed it, check Match Case.

You can click on More to display further options that specify :

what elements of the test case to search for the text. There are checkboxes for Name or Key, Summary and Description.

whether to display the Test Case Properties screen when the test case is found.


Setup Dialog - General Options Tab
Option Dialog - General Options Tab


New Tool bar dialog box

In this dialog box, you can create a new tool bar and add items or parts of the menu to this new tool bar.

You can edit or modify the existing tool bar by removing or adding new items or parts of the menu.

You can also delete the existing tool bar.


Customize - Tool bars tab

This dialog allows you to specify which tool bar will be displayed by VIGILANTe SecureScan NX, and their appearance. It contains the following elements :

List of tool bars : check the tool bar you want to be displayed in the main window; uncheck those you want to remove.

Tool bar name field : can be used to rename user defined tool bar. You can define a tool bar by clicking on the New button to display the New Tool bar dialog box.

Show Tool tips : when checked, on-screen descriptions of tool bar buttons are displayed when the pointer pauses over the button.

Cool Look : when checked, the tool bar buttons appear 'flush' to the window.

Large Buttons : when checked, buttons are increased in size so they are easier to see.


Customize - Commands tab

This tab allows you to add buttons to the tool bars in the VIGILANTe SecureScan NX main window.

First select the category of buttons, and then select the button you want. Now drag it to the main window and drop it in the tool bar you want it to appear in.


Policy Editor

To create a new policy, assign a name and a description, then check the vulnerabilities that you want to test for. These are listed by impact, level and vulnerability.

The vulnerabilities you select in the Policy Editor will be selected when you open the session. You can make temporary changes to the policy during a session by switching test cases on and off. Any change you make will last until you close the session.


Host Results - Extended Info

This screen is displayed when you right-click on a test case result that has a [image] icon in the ExtInfo column, and select ExtInfo from the pop-up menu.

It shows information generated by the test in addition to the basic results - for example, the FTP banner.


Host Properties - General Tab

This tab displays the following general information about the selected host :


Host Properties - Services
Host Properties – Services Tab

This tab displays the services that are active on the current host, on the TCP, UDP and SUN RPC ports.


Test Case Properties - General Tab

This tab contains two panes.

The upper pane displays a list of the selected test case's properties, such as the name, its impact, the platform to which it applies, and where on the SecureScan NX.VIGILANTe.com Web site you can find further information.

The lower pane contains the description of the test case from the vulnerability database.


Test Case Properties - Parameters Tab

This tab displays every parameter that applies to the current test case.

To set a new value for a parameter, double-click it ; or select the parameter and then click Change value. This displays the Change Property Value screen


Setup - Database Connection Tab
Option Dialog - Database Connection Tab


Database Connection

Choose the data source that VIGILANTe SecureScan NX will use.

By default this is nstplus, using the username nst and the password nst. We recommend that you do not change these default values.


Change Property Value Dialog Box

This dialog box allows you to specify a new value for the current property, so that you can run sessions and test cases under varying conditions. It contains the following fields :

Default Value	The value of the property as defined in the Test Case. This field is for output only, and cannot be edited.
Current Value	The value to which the property is currently set. This field is for output only, and cannot be edited.
New Value	The value you want to use for the property.


Policy Properties - Properties

This tab displays the current value of each property of the policy, along with a brief description.

To set a new value for a property, select the property and then click Change value. This displays the Change Property Value screen.


Policy Properties - Policy Filters

This tab displays the name and description of the current policy, and a tree structure that allows you to select what types of test case should be available in the policy.

Put a check mark next to each category of test cases that you want to be available.


Generating reports

The Reports tab of the Shortcut bar contains options that enable you to generate reports about the latest network scan that you have carried out. The reports are displayed in the default Web browser.

The following options are available :

General	VIGILANTe SecureScan NX generates both the Manager and the Administrator report, and displays a Web page that links to these reports and the Vulnerabilities List. This is a list of the IDs and descriptions of each vulnerability in the VIGILANTe SecureScan NX database, and in turn links to a detailed description of each one.
Administrator	VIGILANTe SecureScan NX generates a detailed report showing the vulnerabilities that were found for each host tested. For each vulnerability, there is a link to a description of the vulnerability that has been located, and what actions should be taken to remove it.
Host Report	VIGILANTe SecureScan NX generates a summary of each host tested. Each overview contains information similar to those displayed on the Host Properties screen, plus the number of vulnerabilities that were found on the host, subdivided by follow-up urgency.
Delta	VIGILANTe SecureScan NX generates a report of vulnerabilities that have been detected on the network since the report was last generated. The report contains a list of new vulnerabilities for each host, with a link to a description of the vulnerability.
Filter Rules	This report is only available when you are running a VIGILANTe SecureScan NX Firewall session. VIGILANTe SecureScan NX generates a report containing a summary of the Filter Rule test cases that succeeded in sending a packet across the firewall or filtering equipment.
Manager	VIGILANTe SecureScan NX generates a report containing a summary of the vulnerabilities that exist on the network, sorted in descending order of seriousness. This report also contains charts that show : how many vulnerabilities of each urgency (high, medium and low) were found; the status of the hosts that were scanned; and a summary of the results of the test cases that were run.
Services Report	VIGILANTe SecureScan NX generates a report that lists the vulnerabilities found in any service on the hosts that were tested.
Historical	VIGILANTe SecureScan NX displays a dialog box that prompts you to select the range of jobs for which you want to produce a report. When you have selected the earliest and latest jobs to be compared, VIGILANTe SecureScan NX generates a report showing the host status and the number of vulnerabilities of each type, at the time of each job in the range. The host status shows the number of hosts that were active, that had damaged services, and that were down.


Planning your test

Tests range in complexity from testing a single host for one specific vulnerability, to testing every host on each accessible sub-network for every single vulnerability in the VIGILANTe SecureScan NX vulnerability database.

You should develop a testing policy that specifies, amongst other things :

which firewalls, routers and hosts are to be tested, under what conditions

whether the hosts should be tested in a single operation or in batches

whether the Console should use Remote Agents to distribute the testing of the hosts, or carry out the testing directly

whether to run test cases that could result in a system crash or a denial of service, and if so in what circumstances

how to implement any follow-up actions recommended by VIGILANTe SecureScan NX

how to carry out retesting to ensure that the problem has been resolved

VIGILANTe SecureScan NX enables you to carry out the following kinds of test :

Testing a network

Testing a firewall

Testing a remote network


Specifying the hosts to test

How you specify the hosts to test depends on whether you are running a Network session or a Firewall session


Specifying the test cases to run

The test cases that are available to run are specified by the policy. You specify which of these test cases you want to run in the Policy pane

The Policy pane lists test cases according to various categories : By Platform, By Impact, By Risk, By Service, By Level and By Key. You can display the properties of a test case by double-clicking on it.

You can use the checkboxes to select or deselect individual test cases or an entire category of test cases. If a checkbox next to a category is checked, then all items in the folder are selected. If a checkbox is checked but the background is gray, only some of the items in the folder are selected. Because a test case appears in several places, selecting a test case in one folder (or selecting a complete folder) will get other folders to display the grayed checkmark.

You can also click on [image] to display the Test Case Search dialog box. This enables you to search for test cases using the ID number or some text that appears in the test case.


Predefined policies
A policy determines the set of test cases that you can select from.

The VIGILANTe SecureScan NX vulnerability database includes vulnerabilities of all types. Some represent no risk to the target host, because they are designed simply to gather information and not to use that information. Others present a real threat because they can cause a system crash on the target system, or a denial of service (DoS). In a DoS attack, normal use of the system is inhibited as a result of, for example, network bandwidth being used up or CPU cycles being wasted.

VIGILANTe SecureScan NX has three policies built in, to determine which test cases can be run :

Safe Scan, which includes all test cases except those that can cause a crash or denial of service.

Quick and Safe Scan, which includes all test cases with High Risk, except those that can cause a crash or denial of service.

Full Scan, which executes all test cases, including those that can cause a crash or denial of service.


Test cases

The VIGILANTe SecureScan NX test cases have been designed to test for vulnerabilities - security weaknesses for all major operating systems across your enterprise, not just Windows NT or Windows 95/98. The VIGILANTe SecureScan NX test cases probes all network hosts, just as a hostile attacker would, and quickly report on which hosts are vulnerable and why.

Test cases act very much like any intruder would - attempting to obtain information about the system, and then trying any open backdoor through an unsecured service or inherent weakness in the version. By mimicking the way in which an intruder would gain access, VIGILANTe SecureScan NX can provide the most complete report on the potential weaknesses in any system.


Manage Session - Existing Tab

The Manage Session dialog box (Existing Tab) lists the name of each session defined within VIGILANTe SecureScan NX, the date the session was last accessed, and the date at which it was created. When the pointer hovers over a session name, a pop-up is displayed, containing the context, perimeter and policy that the session uses.


Log Filters Dialog Box

This dialog box allows you to specify the types of message that should be displayed on the Control tab of the Output panel.

The messages are divided into the categories Error, Warning and Info. You can suppress Warning and Info messages by unchecking the checkbox next to them.


Running the test

When you have specified the hosts that are to be tested and the test cases that are to be run, you start the test in one of the following ways :

Select Action>Run.

Click on the Start a New Job icon in the Jobs tab of the Shortcut bar.

Click on the [image] icon.

When the test first starts, VIGILANTe SecureScan NX opens the Scan Results tab of the Test pane. This tab displays a graph of how many ports VIGILANTe SecureScan NX has scanned so far, and how many active UDP and TCP ports it has found. It also shows running totals of the number of ports scanned and found. The lower part of the tab contains a list of the scan results broken down by the host. The graph and statistics are updated in real time, so you can get an overall impression of how the scan is progressing.

When the port scanning is complete, the TC Results tab is displayed. The Test Case Results chart shows a dynamic chart of the number of test cases that have failed and succeeded, and how many encountered a system or network error or have an undetermined status. The test case failures and successes are color coded according to the level of risk. This tab also contains running totals of the number of test cases played and the number that were successful, plus a summary of the results for each host tested. Like the Scan Results tab, the graph and statistics are updated in real time.


Running job

Select the job whose results you want to read into VIGILANTe SecureScan NX. The current job is shown by the [image] icon.


Deleting job

You can select a single job to delete, or use the Ctrl and Shift keys to select several jobs. The current job is shown by the [image] icon.


Compare job

Select all the jobs you want to see in the historical report. The current job is shown by the [image] icon.

When you click on OK, SecureScan NX will generate a report that contains the number of vulnerabilities ordered by risk (high, medium or low) for each job in the range you select.


Scheduler Parameters Dialog Box

The Scheduler Parameters dialog box allows you to schedule jobs to be carried out regularly within the context of the current session.

It contains two tabs: Manage and More Options.

It is also possible to schedule jobs using external scheduling software.


Scheduler Parameter - Manage Tab

This tab allows you to manage the jobs that are scheduled for the current session.

It displays the name of the batch file that contains the parameters for the job; the time at which the job will be executed; and the day(s) on which the job will be executed (e.g. every Monday and Thursday).

The Manage tab contains the following buttons:

New	Creates a new job and displays the Frequency dialog box
Edit	Displays the Edit Job Parameters dialog box, so you can edit the selected job
Remove	Deletes the selected job


Scheduler Parameters - More Options Tab

This tab allows you to specify the way the scheduled session waits for the remote agents to connect

o	It can wait indefinitely for all the remote agent to connect.

o	It can wait a certain time and exit if all the Remote Agents are not connected.

o	It can wait a certain time and continue even if all the Remote Agent are not connected.


Frequency Dialog Box

This dialog box allows you to specify when and how often you want the test job to be run.

The Time field at the top of the dialog box, is used to specify the time of day at which the job should be run. Select the hour, minute or second, and type the new value; or use the up and down arrows at the end of the field to change the values. This field is initially set at the current time when you opened the dialog box.

The radio buttons are used to specify the day(s) on which the job should be run. You can specify :

Today only	Primarily used to schedule the job for later on the day you create it.
Every day
Every	Selecting this radio button activates the check-boxes for the days of the week. Check one or more boxes to specify that the job should be run on the same day(s) every week.
On date	Selecting this radio button activates the date field. Specify the date on which the job should be run: either type the date, or click on the arrow at the right of the field to drop down a calendar from which you can select the date.


Edit Job Parameters Dialog Box

This dialog box allows you to edit the parameters that specify when and how often you want the test job to be run.

The Time field at the top of the dialog box is used to specify the time of day at which the job should be run. Select the hour, minute or second, and type the new value ; or use the up and down arrows at the end of the field to change the values. This field is initially set to the current time when you opened the dialog box.

The radio buttons are used to specify the day(s) on which the job should be run. You can specify :

Today only	Primarily used to schedule the job for later on the day you create it.
Every day
Every	Selecting this radio button activates the check-boxes for the days of the week. Check one or more boxes to specify that the job should be run on the same day(s) every week.
On date	Selecting this radio button activates the date field. Specify the date on which the job should be run: either type the date, or click on the arrow at the right of the field to drop down a calendar from which you can select the date. The date is initially set to the current date.


New Session Wizard - Perimeter

This screen is only displayed when you are creating a Network session.

Select a perimeter from the list, or click on the New Perimeter button to invoke the Perimeter Editor.

The buttons above the list of perimeters allow you to display just the perimeter names, or the perimeter names and descriptions.

Previous Page Next page


Perimeter Properties Screen

This dialog box is only available in VIGILANTe SecureScan NX Network sessions. It displays the properties of the perimeter currently in use :

Name	The name of the perimeter.
Description	The description associated with the perimeter.
Include Ranges	The lowest and highest values of IP addresses to be included in the perimeter.
Exclude Ranges	The lowest and highest values of IP addresses to be excluded from the perimeter.


Perimeter Range Dialog Box

This dialog box is only available in VIGILANTe SecureScan NX Network sessions. It allows you to define a new range of IP addresses for the current perimeter, using the following fields :

Low IP Address	The lowest IP address to include in the range.
High IP Address	The highest IP address to include in the range.


Perimeter Editor

The Perimeter Editor is only available in VIGILANTe SecureScan NX Network sessions. It allows you to create a new perimeter, using the following fields :

Name	The name of the perimeter.
Description	Your description of the new perimeter.
Include Ranges	Lowest and highest IP addresses to include in the perimeter. The numerical values are inclusive.
Exclude Ranges	Lowest and highest IP addresses to exclude from the perimeter. The numerical values are inclusive.

To create a new range of IP addresses, click on New.

To edit an existing range of IP addresses, click on Edit.

To delete the selected range, click on Delete.


Perimeter Screen

This dialog box is only available in VIGILANTe SecureScan NX Network sessions. It allows you to edit the name and description of the perimeter that is currently in use, provided that you created the perimeter.


Perimeter definition

A perimeter is a pair of IP addresses that 'enclose' the hosts that can be included in a test ; it is defined in the Perimeter tab of the VIGILANTe SecureScan NX main screen.


Host Properties - Properties Tab

This tab displays information about four properties of the selected host. You can change the value of a property by selecting it and clicking on Change value.

HasPortMapper	Specifies whether or not the remote host has an active portmapper RPC service. Can be set to Yes or No.
OS Type	Specifies the operating system running on the selected host. You can type any value into this field.
ICMPReplyOn	Specifies whether or not the remote host is configured to reply to ICMP requests. Can be set to Yes or No.
ICMPPortUnreachableReplyOn	Specifies whether or not the remote host is able to send ICMP Unreachable replies. Can be set to Yes or No.


Setup - Auto Upgrade Tab
Option Dialog - Auto Upgrade Tab


Specifying hosts to test - Network sessions

How you specify the hosts to test depends on whether you are running a Network session or a Firewall session.

In a Network session, the hosts that are available to be tested are specified by a perimeter.

The perimeter is determined by the session that is being used. If you are running the No Session Network session, the perimeter defaults to the local subnet - that is, all machines on the same subnet as the machine that the Console is running on.

Note that the machine that VIGILANTe SecureScan NX is running on is by default excluded from the test.

There are two ways to specify these hosts: you can populate the perimeter, which means that VIGILANTe SecureScan NX will scan the network and add each host that it finds to the perimeter; or you can add individual hosts.

To populate the perimeter, you would select the Scan>Populate Perimeter option. Each host that is added has a checkbox next to it; you could then exclude hosts from the test by unchecking these boxes.

To add an individual host, right-click on the Include IP range and select Add Host from the pop-up menu. VIGILANTe SecureScan NX displays a dialog box in which you can type either the name of the host or its IP address. When you click on OK, the host is added to the Include hosts.


Specifying hosts to test - Firewall sessions

How you specify the hosts to test depends on whether you are running a Network session or a Firewall session.

In a Firewall session, the hosts that are available to be tested are specified in the Probe tab.

There are two ways of specifying these hosts:

You can instruct the Remote Agent to scan the network and add each host that it finds to the Probe tab. To do this, right-click on a range of IP addresses, and select Perform a Network Scan from the pop-up menu. Each host that is added has a checkbox next to it ; you can exclude hosts from the test by unchecking these boxes.

You can add an individual host to the Probe tab. To do this, right-click in the Probe tab and select Add Host from the pop-up menu. VIGILANTe SecureScan NX displays a dialog box in which you can type either the name of the host or its IP address. When you click on OK, the host is added to the Probe tab.


Managing perimeters
New Range

Define a new range of IP addresses

Edit	Edit the range in the Perimeter Range dialog box
Delete	Delete the perimeter range
Add Host	Add a new host to be included or excluded
Populate	Populate the perimeter by finding all hosts in the selected range responding to ICMP protocol.


Engine Manager dialog box

This dialog box displays a list of the Remote Agents that are connected to the Console. When you select one, the Perimeter and Status buttons become available.

If you click on Perimeter, the Engine Binding dialog box is displayed

The Status button displays the Host Properties dialog box for the Remote Agents.


Test Case Index

This window contains two tabs : Test Cases and Helper Libs.


Session Properties screen

This screen displays a summary of the session that is running.

It displays the name of the session, the type of the session (network or firewall), the perimeter name and ranges and the policy.

Contract Branch	Closes all nodes of the tree
Check / Uncheck	Checks or unchecks the checkbox next to the perimeter name
Sort by IP Address	When this option is checked, hosts are sorted by IP address; when unchecked, they are sorted alphabetically
Properties	Displays the Perimeter Properties screen
Check / Uncheck	Checks or unchecks the checkbox next to the host name
Sort by IP Address	When this option is checked, hosts are sorted by IP address; when unchecked, they are sorted alphabetically
Add Host	Add a new host to the list
Properties	Displays the Host Properties screen
Contract Branch	Closes all nodes of the tree
Check / Uncheck	Checks or unchecks the checkbox next to the Testing Space
Sort by IP Address	When this option is checked, hosts are sorted by IP address; when unchecked, they are sorted alphabetically
Check / Uncheck	Checks or unchecks the checkbox next to Managed by Probes
Sort by IP Address	When this option is checked, hosts are sorted by IP address; when unchecked, they are sorted alphabetically
Contract Branch	Closes all nodes of the tree
Check / Uncheck	Checks or unchecks the checkbox next to Local Network
Sort by IP Address	When this option is checked, hosts are sorted by IP address; when unchecked, they are sorted alphabetically
Add Host	Add a new host to the list


Using external scheduling software

VIGILANTe SecureScan NX sessions are normally scheduled using the built-in Session Manager. However, it is possible to use external scheduling software to run nstcmd.exe, which starts batch mode audits.

See batch console help file


Host Properties - Action Tab

This tab is only available when you display the properties of a Remote Agent. It allows you to perform actions on the selected Remote Agent.


Setup Dialog - Probe Tab
Option Dialog - Probe Tab


User Information Dialog Box

The User Information dialog box allows you to specify the user name and password to use when checking the VIGILANTe SecureScan NX Web site for updates.

Alternatively, you can specify them 'manually' each time you access the Web site.


Test Case Index - Test Cases

This tab displays a list of all the test cases in the VIGILANTe SecureScan NX vulnerability database, sorted according to their identifier.

The icon next to the identifier shows the Impact of the test case:

Attack

Crash

Denial of Service

Filter Rule

Gather Information

Full Log

Gain Root

You can double-click on a test case to display the Test Case Properties screen.


Test Case Index - Helper Libs

This tab contains a list of all the DLLs that VIGILANTe SecureScan NX uses.

You can double-click on a helper library name to display the Helper Lib Parameters window.


Helper Library Parameters

This tab displays any parameter that applies to the current helper lib.

To set a new value for a parameter, double-click it; or select the parameter and then click Change value. This displays the Change Property Value screen.


Tip of the Day

VIGILANTe SecureScan NX contains a number of hints and tips that are designed to help you to use the product in a more efficient and effective way.

By default, they are displayed each time you start VIGILANTe SecureScan NX; you can switch them off by checking the checkbox.


Planning your test - Networks (2)
Planning your test - Networks

Tests range in complexity from testing a single host for one specific vulnerability, to testing every host on each accessible sub-network for every single vulnerability in the VIGILANTe SecureScan NX vulnerability database.

You should develop a testing policy that specifies, amongst other things :

which firewalls, routers and hosts are to be tested, under what conditions

whether the hosts should be tested in a single operation or in batches

whether the Console should use Remote Agents to distribute the testing of the hosts, or carry out the testing directly

whether to run test cases that could result in a system crash or a denial of service, and if so in what circumstances

how to implement any follow-up action recommended by VIGILANTe SecureScan NX

how to carry out retesting to ensure that the problem has been resolved

VIGILANTe SecureScan NX enables you to carry out the following kinds of test :

Testing a local network Testing a firewall Testing a remote network	Hosts that are on the same network as the Console are tested using a Network session. Your planning should decide : which hosts you are going to test what kinds of tests you are going to carry out on these hosts. The test cases are run by the Console itself.


Planning your test - Firewalls (4)
Planning your test - Firewalls

Tests range in complexity from testing a single host for one specific vulnerability, to testing every host on each accessible sub-network for every single vulnerability in the VIGILANTe SecureScan NX vulnerability database.

You should develop a testing policy that specifies, amongst other things :

which firewalls, routers and hosts are to be tested, under what conditions

whether the hosts should be tested in a single operation or in batches

whether the Console should use Remote Agents to distribute the testing of the hosts, or carry out the testing directly

whether to run test cases that could result in a system crash or a denial of service, and if so in what circumstances

how to implement any follow-up action recommended by VIGILANTe SecureScan NX

how to carry out retesting to ensure that the problem has been resolved

VIGILANTe SecureScan NX enables you to carry out the following kinds of test :

Testing a local network Testing a firewall Testing a remote network	You can test your firewall in a number of ways : Test filtering rules | Test the firewall host | Test the hosts behind the firewall


Planning your test - Networks (1)
Planning your test - Remote networks

Tests range in complexity from testing a single host for one specific vulnerability, to testing every host on each accessible sub-network for every single vulnerability in the VIGILANTe SecureScan NX vulnerabilities database.

You should develop a testing policy that specifies, amongst other things :

which firewalls, routers and hosts are to be tested, under what conditions

whether the hosts should be tested in a single operation or in batches

whether the Console should use Remote Agents to distribute the testing of the hosts, or carry out the testing directly

whether to run test cases that could result in a system crash or a denial of service, and if so in what circumstances

how to implement any follow-up action recommended by VIGILANTe SecureScan NX

how to carry out retesting to ensure that the problem has been resolved

VIGILANTe SecureScan NX enables you to carry out the following kinds of test :

Testing a local network Testing a firewall Testing a remote network	You can test hosts that are on a different network from the Console, usually behind a firewall. These hosts are tested using a Network session. Your planning should decide : which hosts, on which networks, you are going to test what kinds of tests are you going to carry out on these hosts. The hosts and test cases are specified using the Console, which then passes the test case information to the Remote Agent. The Remote Agent runs the test cases, and passes the real-time information and results back to the Console. Because of this additional data transfer, you may find that there is an increase in performance if you start more than one Remote Agent on the remote network.


Planning your test - Firewalls (3)
Planning your test - Firewalls

Tests range in complexity from testing a single host for one specific vulnerability, to testing every host on each accessible sub-network for every single vulnerability in the VIGILANTe SecureScan NX vulnerability database.

You should develop a testing policy that specifies, amongst other things :

which firewalls, routers and hosts are to be tested, under what conditions

whether the hosts should be tested in a single operation or in batches

whether the Console should use Remote Agents to distribute the testing of the hosts, or carry out the testing directly

whether to run test cases that could result in a system crash or a denial of service, and if so in what circumstances

how to implement any follow-up action recommended by VIGILANTe SecureScan NX

how to carry out retesting to ensure that the problem has been resolved

VIGILANTe SecureScan NX enables you to carry out the following kinds of test :

Testing a local network Testing a firewall Testing a remote network	You can test your firewall in a number of ways : Test filtering rules | Test the firewall host | Test the hosts behind the firewall The firewall's filtering rules are tested using a Firewall session. The test cases are run by the Console, which tries to send specific packets through the firewall. The Remote Agent watches to see if these packets arrive inside the firewall.


Planning your test - Firewalls (2)
Planning your test - Firewalls

Tests range in complexity from testing a single host for one specific vulnerability, to testing every host on each accessible sub-network for every single vulnerability in the VIGILANTe SecureScan NX vulnerability database.

You should develop a testing policy that specifies, amongst other things :

which firewalls, routers and hosts are to be tested, under what conditions

whether the hosts should be tested in a single operation or in batches

whether the Console should use Remote Agents to distribute the testing of the hosts, or carry out the testing directly

whether to run test cases that could result in a system crash or a denial of service, and if so in what circumstances

how to implement any follow-up action recommended by VIGILANTe SecureScan NX

how to carry out retesting to ensure that the problem has been resolved

VIGILANTe SecureScan NX enables you to carry out the following kinds of test :

Testing a local network Testing a firewall Testing a remote network	You can test your firewall in a number of ways : Test filtering rules | Test the firewall host | Test the hosts behind the firewall As well as testing the firewall's filtering rules, it is necessary to run the Network test cases on the firewall host's inbound and outbound IP addresses. Tests of this kind are run in a Network session. The inbound IP address is tested by the Console itself, and the outbound IP address is tested by the Remote Agent behind the firewall.


Planning your test - Firewalls (1)
Planning your test - Firewalls

Tests range in complexity from testing a single host for one specific vulnerability, to testing every host on each accessible sub-network for every single vulnerability in the VIGILANTe SecureScan NX vulnerability database.

You should develop a testing policy that specifies, amongst other things :

which firewalls, routers and hosts are to be tested, under what conditions

whether the hosts should be tested in a single operation or in batches

whether the Console should use Remote Agents to distribute the testing of the hosts, or carry out the testing directly

whether to run test cases that could result in a system crash or a denial of service, and if so in what circumstances

how to implement any follow-up actions recommended by VIGILANTe SecureScan NX

how to carry out retesting to ensure that the problem has been resolved

VIGILANTe SecureScan NX enables you to carry out the following kinds of test :

Testing a local network Testing a firewall Testing a remote network	You can test your firewall in a number of ways : Test filtering rules | Test the firewall host | Test the hosts behind the firewall In this type of test, the Console runs the Network test cases on hosts that are behind a firewall. The objective is to see whether it is possible to exploit these vulnerabilities through the firewall. The Remote Agent checks that the hosts are still up and running. Your planning should decide : which firewalls and which hosts you are going to test what kinds of tests you are going to carry out on these hosts.


Distributed test engine
Remote Agent definition

A Remote Agent is an instance of the SecureScan NX Console that runs test cases on a specific set of hosts.

Each of these Remote Agent connects to the main Console, which controls and coordinates the test. The Remote Agents pass the results of the tests that they run back to the main Console.


Icon list

	Perimeter		Local host
	Include range		Remote Agent
	Exclude range		Unreachable / Not Active
	Range		Down / Damaged
	Host		Unknown


Engine Binding dialog box

This dialog box displays all the ranges of IP address that are available to be managed by the current Remote Agent.

You can select a range and click on OK to assign a new range to the Remote Agents, or you can click on Reset to remove the current range from the Remote Agents.


Menu File


Menu File NewSession
Menu / File / New Session

Starts the New Session Wizard


Menu File OpenSession
Menu / File / Open Session

Opens an existing session using the Open Session dialog box


Menu File SaveSession
Menu / File / Save Session

Saves the settings and results of the current session for later use


Menu File ManageSession
Menu / File / Manage Session

Opens the Manage Session dialog box, which allows you to delete and schedule sessions


Menu File RecentSession
Menu / File / <Recent Session>

Shortcuts to the four most recently accessed sessions


Menu File Exit
Menu / File / Exit

Closes VIGILANTe SecureScan NX Console


Menu Action


Menu Action NetworkScan
Menu / Action / Network Scan

Starts scan of network ; in a Firewall session, the scan is carried out by the selected Remote Agent(s)


Menu Action AddHost
Menu / Action / Add Host

Displays New Host dialog box to add a host to the perimeter


Menu Action Run
Menu / Action / Run

Runs the Test Cases selected in the current Policy against the selected hosts


Menu Action AbortAction
Menu / Action / Abort Action

Terminates a test


Menu Action EnableServiceScan
Menu / Action / Enable Service Scan

When pressed, a service scan is performed before running test cases

When released, the service scan is not performed before running test cases


Menu Action ResetServiceList
Menu / Action / Reset Service Lists

When pressed, the service list of each host is reset before running test cases

When released, the service list of each host is not reset before running test cases


Menu Action EngineManager
Menu / Action / Engine Manager

Displays Engine Manager dialog box so testing can be distributed to Remote Agent


Menu View


Menu View Properties
Menu / View / Properties

Contains sub-entries to display properties of the Session, Perimeter or Policy


Menu View Current parameters
Menu / View / Current parameters

Show current parameters of the session


Menu View Toolbar
Menu / View / Tool bar

Displays the Tool bars tab of the Customize dialog box


Menu View Status bar
Menu / View / Status bar

When checked, the Status Bar is displayed


Menu View Shortcut bar
Menu / View / Shortcut bar

When pressed the Shortcut bar is displayed


Menu View Output panel
Menu / View / Output panel

When pressed, the Output panel is displayed


Menu View Log filter
Menu / View / Log filter

Displays the Log Filters dialog box


Menu View Refresh
Menu / View / Refresh

Updates the window


Menu View Full Screen
Menu / View / Full Screen

Expands the VIGILANTe SecureScan NX Console main window to fill the entire screen


Menu Tools


Menu Tools Options
Menu / Tools / Options

Show the different options of the program

General options

Database connection

Auto Upgrade

Probe

New TC


Menu Tools Main parameters
Menu / Tools / Main parameters

Show (and edit) the main parameters of the program


Menu Tools Find test cases
Menu / Tools / Find Test cases

Show Find Test cases dialog box


Menu Tools Miscellaneous lists
Menu / Tools / Miscellaneous lists

This window contains three tabs and three lists :

Test Cases Index

Helper Libs Index

Well Known Services


Test Case Index - Well Known Services

This tab displays a list of all the "'well known services", their port number and the protocol they use. By double clicking on a service, a new list shows all the TC that use this service.


Menu Help


Menu Help Help Topics
Menu / Help / Help Topics

Displays the VIGILANTe SecureScan NX help file


Menu Help NV SecureScan NX WEB
Menu / Help / SecureScan NX on the Web

Discloses the following menu options for connecting to the VIGILANTe SecureScan NX Web site :

Check Web site for a newer version

Product News

Frequently Asked Questions

Send feedback

Security Failure Page

VIGILANTe SecureScan NX Home Page


Menu Help Dump Status
Menu / Help / Dump Current Status

Dump information, internal variables, library versions and many other things about the program in the output panel


Menu Help Tip of Day
Menu / Help / Tip of the Day

Displays a dialog box that gives useful hints about the VIGILANTe SecureScan NX interface


Menu Help About
Menu / Help / About this application

Displays information about this version of VIGILANTe SecureScan NX


Menu View FQDN

When checked, the Fully Qualified Domain Name (FQDN) of the host is displayed


Menu View Address IP

When checked, the IP address of the host is displayed


Menu View Sort

When checked, the hosts are sorted according to their IP address


Setup Dialog - New TC Tab
Option Dialog - New TC Tab


Option Auto Upgrade Never
Never

Do not check for new upgrade package unless specifically instructed to do so


Option Auto Upgrade Prompt me
Prompt me

Ask for confirmation to check for new upgrade package each time that VIGILANTe SecureScan NX is started


Option Auto Upgrade Always
Always, don't prompt me

Check for new upgrade package each time that VIGILANTe SecureScan NX is started, without confirmation


Option Auto Upgrade Once
Once a week

Combine with Prompt me and Always, to check for new upgrade package once a week, with or without confirmation


Option Auto Upgrade Check
Check for update now

Connects to the Web site immediately


Option Auto Upgrade User
User information

User and password information needed to connect to the Web site of SecureScan NX


Option Auto Upgrade Proxy
Proxy settings

Proxy parameters to connect to the Web site of SecureScan NX


Option Auto Upgrade Package
Packages location

This screen allows you to configure where you can download the SecureScan NX Upgrade packages.

These locations can be :

o	on the Web. The fields Upgrade Server and Upgrade Directory must be valid.

on a network file system. The path of the directory must be valid.


Option New TC Uncheck
Uncheck all the new test cases

The new test cases coming from Upgrade Package are not integrated in the existing policies


Option New TC Check
Check all the new test cases

The new test cases coming from Upgrade Package are automatically integrated in the existing policies


Option New TC Check but
Check all the new test cases except the crash and Dos ones

The new test cases coming from Upgrade Package are automatically integrated in the existing policies except the Crash and DoS test cases for safety reasons


Option New TC Show
Show me the list of the new test cases at startup

When checked, show at session loading, the list of the new test cases since the last upgrade package


Option Probe Port
Port number

Specify the port on which the Remote Agent and the Console should communicate.

You may specify a number in the range 1 - 65535


Option Probe Default
Default value

Reset the port number to default value (9999)


Option Database DSN
Data source to use

Choose the data source that VIGILANTe SecureScan NX will use. By default this is nstplus


Option Database Username
Username

Username to use to connect to the database. By default, this is nst. We recommend that you do not change this default value


Option Database Password
Password

Password to use to connect to the database. By default, this is nst. We recommend that you do not change this default value


Option General Item
Check / uncheck options

This tab enables you to modify the configuration of SecureScan NX, by checking or unchecking many options. Options that have "(*)" in beginning of the name will not take effect until the next time that the SecureScan NX Console is restarted

These option are :

Use database cache

Attemp to resolv names from IP addresses

Disable test cases execution

Display a warning message before playing tests

Display host's IP address

Display parameter summary before starting a new job

Display shortened host name

Enable service scan

Erase log file of database at startup

Reset service list of hosts before playing tests

Show clock in status bar

Show tips at startup

Warn checked host when playing test cases


Shortcut bar - Load a job

Load one of the different jobs of the current session


Shortcut bar - Start a new job

Runs the Test Cases selected in the current Policy against the selected hosts


Shortcut bar - Delete a job

Delete one of the different jobs of the current session


Button Close
Close Button

To close this window


Button Help
Help Button

To get Help


Session List

The list of the sessions.

A right click on a session and select option 'properties' show you the session properties screen


Session Properties

This screen shows you a summary description of the session

This include :

The session identifier,

The perimeter used by this session

The policy used by this session


Button Delete
Delete Button

Deletes the selected session, subject to confirmation


Button Delete 2
Delete Button

Delete the selected perimeter or policy


Button Edit
Edit Button

Start the edit perimeter dialog box or the edit policy dialog box


Manage Session - Session Dependencies Tab

The Manage Session dialog box (Session Dependencies Tab) lists the name of all the policies and perimeters which are never used in any session.


Orphan perimeters

The list of orphan perimeters (perimeters never used in any session)


Orphan policies
Orphans policies

The list of orphan policies (policies never used in any session)


Main Parameters


Clear List
Clear list of services

If this option is set, the service list of each perimeter's hosts will be reset and a service scan (TCP, UDP, RPC and Guess OS) will be performed (according to the Enable service scan flag).


Clear Now

Clicking on this button will immediately reset the list of service for each host in the perimeter. This button allows to override the effect of 'Clear list of services' if unchecked


Scan Allow

If this option is disabled, no TCP, UDP, RPC and Guess OS service scan will be performed on the perimeter's hosts and only test cases will be run.


Low TCP
TCP ranges

This field contains the list of TCP port ranges to scan during port scanning.

Each range contains a low port and a optional high port separated by a minus sign.

The ranges are separated by a comma.


Low UDP
UDP ranges

This field contains the list of UDP port ranges to scan during port scanning.

Each range contains a low port and a optional high port separated by a minus sign.

The ranges are separated by a comma.


Heavy Scan

If set, Heavy Scan mode is activated. This means that all the test cases will be run even if the target host is not the correct Operating System according to the test case. This option can produce many false positives in the results. Some test cases have an internal flag that deactivates the Heavy Scan mode for this particular test case.


Save Results

If unset, only test cases with a "Found" or "unknown / undetermined" result will be saved in the database. If set, all the test case results (Found, Not Found, Error, Unknown/undetermined, Not played, No connect) will be saved in the database. Setting this flag consumes time and space but provides more accurate differential reports.


Resolve_Hosts_Name
Resolve Host Names

If this option is unset, no reverse DNS resolution will be performed. If set, reverse DNS resolution will be performed if a DNS server is available somewhere on the network and if the DNS protocol is well configured on the host where is running the console.


Not Documented
No help topic for this item

No help topic for this item


Use database cache

SecureScan NX uses an internal file "dbcache.bin" to access more quickly to the test cases description without using the database. If this file exists and if this option is checked, the product will use this cache file instead of the database.


Attempt to resolve names from IP addresses

If this option is unset, no reverse DNS resolution will be performed. If set, reverse DNS resolution will be performed if a DNS server is available somewhere on the network and if the DNS protocol is well configured on the host where is running the console. This flag is reflected by the flag "Resolve Host names from IP addresses" in the Main Parameters dialog box (main menu/Tools/Main Parameters).


Disable test cases execution

If set no test cases will be run. Only TCP, UDP, RPC service scan and Guess OS (fingerprinting) will be performed on the perimeter's hosts.


Display a warning message before playing tests

If set, this option display a warning before running a session. The warning shown is "VIGILANTe cannot take any responsibility for the use of these Test Cases. Note that a number of these Test Cases may crash, reboot or damage some computers". If unset, the warning is not displayed but VIGILANTe SecureScan NX will assume you agree to the previous warning".


Display host's IP address

If set, the host IP address is added after the host name (rounded in parenthesis) in the tree perimeter. If unset, the IP address is not shown. This flag has the same effect as the icon "@1.2.3" in the shortcuts bar.


Display parameter summary before starting a new job

If set, this option show a summary before running a session. This summary contains: the number of selected test cases, the number of selected hosts, if the heavy scan mode is enabled or disabled, the range of TCP and UDP port that will be scanned, the way to save the results.


Display shortened host name

If set, only the host name is shown in the tree perimeter. If unset, the domain name is appended to the host name. This flag has the same effect as the icon "@A.B." in the shortcuts bar.


Enable service scan

If this option is disabled, no TCP, UDP, RPC and Guess OS service scan will be performed on the perimeter's hosts and only test cases will be run.


Erase log file of database at startup

When Sybase SQL Anywhere Database is started, it had log information in the file "c:\program files\VIGILANTe\SecureScan NX\database\NSTPLUS.LOG". If this option is set, this log file is erased when the database starts.


Reset service list of hosts before playing tests

If this option is set, the service list of each perimeter's hosts will be reset and a service scan (TCP, UDP, RPC and Guess OS) will be performed (according to the Enable service scan flag).


Show clock in status bar

If set, a clock is shown in the product status bar. If unset, this clock is not shown.


Show tips at startup

If set, tips are shown at product startup. If unset, tips are not shown but stay available in the main menu "Help/Tip of the day".


Warn checked host when playing test cases

If this option is set, a popup message is displayed (if possible) using the Microsoft Messenger Service on every perimeter's host before running the test cases.


Port tested during TCP Network Scan

When performing network scan to discover the active hosts, SecureScan NX send first an "ICMP Echo requets" packet. If there is no response (no active host or ICMP disabled on the target host), SecureScan NX send then a TCP packet on a port (or list of ports). This field lets you specify the set of port to test during this TCP network scan.


Test Cases Execution

If set, no test cases will be run. Only TCP, UDP, RPC and Guess OS service scan will be performed on the perimeter's hosts.


Scheduling parameters

This button lets you configure the general parameters for your scheduled sessions.


Scheduling Parameters - General tab


Scheduling Parameters - Advanced tab


Scheduling Parameters - Details tab


Port for remote agent connection

to set the batch console "-port" parameter

See batch console help file


TCP port list for ping prohibition

to set the batch console "-tcpportlist" parameter

See batch console help file


Does not kill remote agent at exit

to set the batch console "-nokill" parameter.

See batch console help file


Does not perform a service scan

to set the batch console "-noss" parameter

See batch console help file


Does not perform a network scan

to set the batch console "-nons" parameter

See batch console help file


Does not reset host status and service list

to set the batch console "-noreset" parameter

See batch console help file


Does not perform any DNS resolution

to set the batch console "-noresolve" parameter

See batch console help file


Does not perform test cases execution

to set the batch console "-noplaytc" parameter

See batch console help file


Output directory

to set the batch console "-base" parameter

See batch console help file


Test cases folder

to set the batch console "-tc" parameter

See batch console help file


Helper lib folder

to set the batch console "-hl" parameter

See batch console help file


License file

to set the batch console "-dat" parameter

See batch console help file


Log files max number

to set the batch console "-maxlog" parameter

See batch console help file


File name reports

to set the batch console "-rpx" parameter

See batch console help file


Mail recipient(s)

to set the batch console "-mto" parameter

See batch console help file


Mail's subject field
Mail’s subject field

to set the batch console "-msu" parameter

See batch console help file


Mail's from field
Mail’s from field

to set the batch console "-mfrom" parameter

See batch console help file


Disable console upgrade

to set the batch console "-upg" parameter

See batch console help file


Disable remote agent upgrade

to set the batch console "-upgragent" parameter

See batch console help file


Remote agent connection timeout

to set the batch console "-prconn" parameter

See batch console help file


Network scan timeout

to set the batch console "-prnw" parameter

See batch console help file


Alias

to set the batch console "-dsn" parameter

See batch console help file


User name

to set the batch console "-dsnu" parameter

See batch console help file


Password

to set the batch console "-dsnp" parameter

See batch console help file


Customer name

to set the batch console "-kn" parameter

See batch console help file


Company name

to set the batch console "-kc" parameter

See batch console help file


File name

to set the batch console "@" parameter

See batch console help file


Fully Qualified Domain Name

Shows the Fully Qualified Domain Name and the IP address of the selected host


Kill button
Kill

Press on this button asks the Remote Agent to kill itself. It will automatically restarted or not depending on its "Automatic restart after session" flag.


Consoles

It is a list of IP addresses or Console names and their respective ports to be used by the Remote Agent. WARNING, if you make a mistake in the console name or port number, the remote agent  will not be able to connect to any console and you will have to go on the remote agent workstation to set a new correct value. The new value will be effective the next time the remote agent had to connect to a console.


Retry time-out

It is the time between each try to connect to a console. The new value will be effective the next time the remote agent had to connect to a console.


Number of attempts

It is the number of time that the remote agent will try to connect to a console. If this number is 0, there is no limit. The new value will be effective the next time the remote agent had to connect to a console.


Show/Hide remote agent window

If set, the remote agent show its window, if unset, it hide it. The new value will be effective immediately.


Verify license file

Normally, a remote agent does not need a license file. When checked, this force the remote agent to verify that a license file is present and valid. The new value will be effective the next time the remote agent is started. You have to kill manually the remote agent to modify it immediately.


Verbose mode

This force the remote agent to be more verbose in its log file. The new value will be effective immediately.


Automatic restart after session
Keep Alive Mode

If set, the Remote Agent exits when a session is ended by the Console and is automatically restarted by the supervisor. If unset, the Remote Agent exits normally at the end of the session and is not restarted by the supervisor. The new value will be effective the next time the remote agent is connected to a console.


Automatic restart at boot time

If set, the Remote Agent and its supervisor are started at boot time. If unset, nothing is started at boot time. The new value will be effective immediately.


Apply

Press on this button to update the remote agent configuration after modifying its parameters.


Log list

This list shows all the Remote Agent messages received by the console.


IP_Address
IP Address

The IP address of the host.


Netbios Name

If NetBios support is enabled on the selected host, this field shows the NetBios name.


Initial Reply Time

The reply delay (in millisecond) for the first ping performed on this host.


Last Reply Time

The reply delay (in millisecond) for the last ping performed on this host. Differences may occur if the host is damaged or suffering a DoS.


Current Status

The status of the selected host. This can be one of the following status:

o	OK (fully accessible via the network)

o	Down (not accessible via the network)

o	Damaged (at least one service on the host is damaged)

o	Unreachable (cannot be reached via TCP/IP)

o	Undefined (never tested)


Flag Remote Agent

This flag indicates if the selected host is a Remote agent or not..


Next Host

To see the host properties of the next host in the list.


Previous Host

To see the host properties of the previous host in the list.


Property HasPortMapper

Specifies whether or not the remote host has an active portmapper RPC service. Can be set to Yes or No.


Property OS Type

Specifies the operating system running on the selected host. You can type any value into this field.


Property ICMPReplyOn

Specifies whether or not the remote host is configured to reply to ICMP requests. Can be set to Yes or No.


Property ICMPPortUnreachableReplyOn

Specifies whether or not the remote host is able to send ICMP Unreachable replies. Can be set to Yes or No.


Property TCPRSTReplyOn

When performing network scan to discover the active hosts, SecureScan NX send first an "ICMP Echo requets" packet. If there is no response (no active host or ICMP disabled on the target host), SecureScan NX send then a TCP packet on a port.

This property specifies whether or not the remote host is able to Reset TCP packets when performing a network TCP Scan. Can be set to Yes or No.


Change Property Value

This button lets you change the value of the selected property.


Service Name

The name of the service.


Service Protocol

Whether it is a TCP or UDP or RPC service.


Port Number

The port on which the service is normally found, and the port on which VIGILANTe SecureScan NX actually found the service.


Service Status

The Status can be one of the following :

o	Undefined (i.e. not initialized)

o	OK

o	Host Unreachable

o	Port Unreachable (i.e. the service is down or dead)


RPC Service Name

The service name in the meaning of SUN Remote Procedure Call.