Written by Stefan Walter, Front-end Developer, IBM Security
Imagine you are a network administrator in a company. You know what software is used in your environment, including what specific versions are deployed. Maintaining an accurate asset inventory is a key step in incident response planning. Likewise, maintaining timely patching practices is important to protect against common attack vectors.
Gartner estimated that 90 percent of exploits leverage vulnerabilities for which a patch has been available but not yet applied. But how can you track relevant vulnerabilities for your enterprise IT assets?
A Tedious Task
Until now, tracking vulnerabilities was a tedious task. The volume of incoming vulnerabilities needs to be matched against your own enterprise asset inventory to track those interesting to you and your environment. This is a massive task: IBM X-Force logged nearly 9,000 new vulnerabilities in 2015.
The IBM X-Force Exchange collaborative threat intelligence platform offers a new way to track relevant vulnerabilities. Within the platform, you can research indicators of compromise, conduct security investigations and watch for vulnerabilities on target technologies in your infrastructure just by maintaining a list of keywords or products to monitor. If new vulnerabilities are disclosed that match keywords or products on your watchlist, you will be automatically notified.
Tailor Your Watchlist to Track Relevant Vulnerabilities
To use the watchlist feature, log into X-Force Exchange with your IBM ID. Then open up the user panel by clicking on the icon in the upper-right corner. Go to Settings at the bottom of this panel. On the settings page, select the Watchlist option on the left side.
In the input field, you can enter a product name that you want to watch or select existing or known products from the menu. The search feature will make suggestions as you start typing the product name. Items will get added to a list below. If you want to delete items from the list, you can do so by hovering over the item and clicking the delete icon on the right hand side.
The watchlist keywords enable you to track, for example, “Linux” as a general term, or terms as specific as “Linux Kernel” or “Linux Kernel 3.9, rc7.” This flexibility allows you to tailor your watchlist to vulnerabilities that can truly affect your enterprise security rather than a flood of new vulnerabilities that may not necessarily apply to your organization.
Once you finish creating your watchlist, you’ll be alerted of any new vulnerability that matches the items you selected in the notification center in the X-Force Exchange. Check the upper-right corner of the window when logged into the platform. You can also opt for email notifications to monitor these vulnerabilities.
Watch the on-demand webinar: Transform Threat Intelligence Into Prevention In Minutes
Take Action
To help take action on these vulnerabilities or scrutinize them in your network, you can add them to a Collection in the X-Force Exchange and import it into your security information and event management (SIEM), either via the X-Force Exchange API or using STIX/TAXII protocols. You can generate credentials for the X-Force Exchange API from within the same user settings area on the platform.
As part of our agile development cycle, new capabilities are added frequently, highlighted in the notifications areas on the platform. To learn more about other ways X-Force Exchange can help solve security problems and protect your network, watch our on-demand webinar, “Transform Threat Intelligence Into Prevention In Minutes.”
Security Intelligence Staff