Written by Stefan Walter, Front-end Developer, IBM Security

Imagine you are a network administrator in a company. You know what software is used in your environment, including what specific versions are deployed. Maintaining an accurate asset inventory is a key step in incident response planning. Likewise, maintaining timely patching practices is important to protect against common attack vectors.

Gartner estimated that 90 percent of exploits leverage vulnerabilities for which a patch has been available but not yet applied. But how can you track relevant vulnerabilities for your enterprise IT assets?

A Tedious Task

Until now, tracking vulnerabilities was a tedious task. The volume of incoming vulnerabilities needs to be matched against your own enterprise asset inventory to track those interesting to you and your environment. This is a massive task: IBM X-Force logged nearly 9,000 new vulnerabilities in 2015.

The IBM X-Force Exchange collaborative threat intelligence platform offers a new way to track relevant vulnerabilities. Within the platform, you can research indicators of compromise, conduct security investigations and watch for vulnerabilities on target technologies in your infrastructure just by maintaining a list of keywords or products to monitor. If new vulnerabilities are disclosed that match keywords or products on your watchlist, you will be automatically notified.

Tailor Your Watchlist to Track Relevant Vulnerabilities

To use the watchlist feature, log into X-Force Exchange with your IBM ID. Then open up the user panel by clicking on the icon in the upper-right corner. Go to Settings at the bottom of this panel. On the settings page, select the Watchlist option on the left side.

In the input field, you can enter a product name that you want to watch or select existing or known products from the menu. The search feature will make suggestions as you start typing the product name. Items will get added to a list below. If you want to delete items from the list, you can do so by hovering over the item and clicking the delete icon on the right hand side.

The watchlist keywords enable you to track, for example, “Linux” as a general term, or terms as specific as “Linux Kernel” or “Linux Kernel 3.9, rc7.” This flexibility allows you to tailor your watchlist to vulnerabilities that can truly affect your enterprise security rather than a flood of new vulnerabilities that may not necessarily apply to your organization.

Once you finish creating your watchlist, you’ll be alerted of any new vulnerability that matches the items you selected in the notification center in the X-Force Exchange. Check the upper-right corner of the window when logged into the platform. You can also opt for email notifications to monitor these vulnerabilities.

Watch the on-demand webinar: Transform Threat Intelligence Into Prevention In Minutes

Take Action

To help take action on these vulnerabilities or scrutinize them in your network, you can add them to a Collection in the X-Force Exchange and import it into your security information and event management (SIEM), either via the X-Force Exchange API or using STIX/TAXII protocols. You can generate credentials for the X-Force Exchange API from within the same user settings area on the platform.

As part of our agile development cycle, new capabilities are added frequently, highlighted in the notifications areas on the platform. To learn more about other ways X-Force Exchange can help solve security problems and protect your network, watch our on-demand webinar, “Transform Threat Intelligence Into Prevention In Minutes.”

More from X-Force

Hive0147 serving juicy Picanha with a side of Mekotio

17 min read - IBM X-Force tracks multiple threat actors operating within the flourishing Latin American (LATAM) threat landscape. X-Force has observed Hive0147 to be one of the most active threat groups operating in the region, targeting employee inboxes at scale, with a primary focus on phishing and malware distribution. After a 3-month break, Hive0147 returned in July with even larger campaign volumes, and the debut of a new malicious downloader X-Force named "Picanha,” likely under continued development, deploying the Mekotio banking trojan. Hive0147…

FYSA – Critical RCE Flaw in GNU-Linux Systems

2 min read - Summary The first of a series of blog posts has been published detailing a vulnerability in the Common Unix Printing System (CUPS), which purportedly allows attackers to gain remote access to UNIX-based systems. The vulnerability, which affects various UNIX-based operating systems, can be exploited by sending a specially crafted HTTP request to the CUPS service. Threat Topography Threat Type: Remote code execution vulnerability in CUPS service Industries Impacted: UNIX-based systems across various industries, including but not limited to, finance, healthcare,…

Getting “in tune” with an enterprise: Detecting Intune lateral movement

13 min read - Organizations continue to implement cloud-based services, a shift that has led to the wider adoption of hybrid identity environments that connect on-premises Active Directory with Microsoft Entra ID (formerly Azure AD). To manage devices in these hybrid identity environments, Microsoft Intune (Intune) has emerged as one of the most popular device management solutions. Since this trusted enterprise platform can easily be integrated with on-premises Active Directory devices and services, it is a prime target for attackers to abuse for conducting…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today