Manage vulnerabilities in OneView

In OneView, the Vulnerabilities page offers an overview of vulnerabilities in installed software on managed endpoints. This is essential for system security, as it highlights potential weaknesses that could be exploited. Regular vulnerability assessments allow organizations to proactively address risks from outdated or insecure software.

To view and manage vulnerabilities in OneView, go to Monitor > Vulnerabilities. There are 3 tabs on this page:

• Active Vulnerabilities: Shows current vulnerabilities on endpoints.
• Ignored Vulnerabilities: Lists vulnerabilities dismissed from Active Vulnerabilities.
• Resolved Vulnerabilities: Lists vulnerabilities addressed in the past 365 days.

Manage vulnerabilities

Administrators can view and ignore current vulnerabilities on the Active Vulnerabilities tab. They can also resolve them by updating applications with Patch Management.

If an installed application is not needed, remove it from the endpoint using the Software Inventory page. For more information, see Uninstall software with Vulnerability & Patch Management in OneView.

Filter for important vulnerabilities

The quick filters at the top of the page help admins focus on specific sets of vulnerabilities. We suggest resolving vulnerabilities in this order: 

1. Ransomware Risk: Vulnerabilities linked to ransomware campaigns and require immediate attention.
2. CISA Recommended: Vulnerabilities listed in the Cybersecurity and Infrastructure Security Agency (CISA) managed catalog of Known Exploited Vulnerabilities.
3. Severity level: Vulnerabilities sorted by severity and impact.

Active Vulnerabilities table

The following information is displayed for each endpoint vulnerability.

Ignore vulnerabilities

Ignoring vulnerabilities increases breach risks. It's essential to resolve them to prevent threats and unauthorized access. However, some vulnerabilities may not apply if an application must stay on a specific version.

For instance, if an in-house app relies on a specific Adobe version, updating it could break the app. In this case, the vulnerability can be ignored from the Active Vulnerabilities tab. 

1. Check the boxes for specific CVE numbers.
2. Click Actions > Ignore.
3. Review the selected vulnerabilities in the pop-up window.
4. Select how long to ignore the vulnerability:
   • Permanent: Do not detect this vulnerability again until it is manually removed from the list. Use this option sparingly, as it requires extra effort to track unresolved vulnerabilities.
   • 30 or 60 days: Temporarily ignore the vulnerability and revisit in a short amount of time.
   • Custom date: Ignore the vulnerability until a certain date.
5. Provide a reason for ignoring the vulnerability. This helps other admins understand the decision.
6. Click Ignore.

The vulnerability is moved to the Ignored Vulnerabilities tab. This tab adds the following columns to the table:

Restore ignored vulnerabilities

Ignored vulnerabilities reappear in the Active Vulnerabilities tab once their duration ends and can be re-ignored as needed.

For permanently ignored vulnerabilities, an admin must restore them manually from the Ignored Vulnerabilities tab, which can also be used to restore a vulnerability before its duration expires. To do this:

1. Click on the Ignored Vulnerabilities tab.
2. Check the box next to an ignored vulnerability.
3. Click Actions > Restore.
4. Click Confirm.

Edit ignored vulnerabilities

To update the duration or reason for an ignored vulnerability:

1. Click on the Ignored Vulnerabilities tab.
2. Check the box next to an ignored vulnerability.
3. Click Actions > Edit.
4. Update the duration or reason.
5. Click Save.

Resolve vulnerabilities

Vulnerabilities can be patched from the Active Vulnerabilities page by updating software. 

1. Check the boxes for specific CVE numbers.
2. Click Actions > Update Software.
3. In the confirmation window, click Update software.
   • If the Update software button is grayed out, the application isn't supported for updating via Patch Management. Manually update the software by visiting the vendor's website. Filter the Update available column to Yes to check which applications can be patched with Patch Management.

After the software is patched, run an Inventory & Vulnerability scan. This updates the Active Vulnerabilities list and moves the vulnerability to the Resolved Vulnerabilities tab. The Resolved Vulnerabilities tab adds the following column to the table:

Return to Vulnerability and Patch Management.