Written by Stefan Walter, Front-end Developer, IBM Security

Imagine you are a network administrator in a company. You know what software is used in your environment, including what specific versions are deployed. Maintaining an accurate asset inventory is a key step in incident response planning. Likewise, maintaining timely patching practices is important to protect against common attack vectors.

Gartner estimated that 90 percent of exploits leverage vulnerabilities for which a patch has been available but not yet applied. But how can you track relevant vulnerabilities for your enterprise IT assets?

A Tedious Task

Until now, tracking vulnerabilities was a tedious task. The volume of incoming vulnerabilities needs to be matched against your own enterprise asset inventory to track those interesting to you and your environment. This is a massive task: IBM X-Force logged nearly 9,000 new vulnerabilities in 2015.

The IBM X-Force Exchange collaborative threat intelligence platform offers a new way to track relevant vulnerabilities. Within the platform, you can research indicators of compromise, conduct security investigations and watch for vulnerabilities on target technologies in your infrastructure just by maintaining a list of keywords or products to monitor. If new vulnerabilities are disclosed that match keywords or products on your watchlist, you will be automatically notified.

Tailor Your Watchlist to Track Relevant Vulnerabilities

To use the watchlist feature, log into X-Force Exchange with your IBM ID. Then open up the user panel by clicking on the icon in the upper-right corner. Go to Settings at the bottom of this panel. On the settings page, select the Watchlist option on the left side.

In the input field, you can enter a product name that you want to watch or select existing or known products from the menu. The search feature will make suggestions as you start typing the product name. Items will get added to a list below. If you want to delete items from the list, you can do so by hovering over the item and clicking the delete icon on the right hand side.

The watchlist keywords enable you to track, for example, “Linux” as a general term, or terms as specific as “Linux Kernel” or “Linux Kernel 3.9, rc7.” This flexibility allows you to tailor your watchlist to vulnerabilities that can truly affect your enterprise security rather than a flood of new vulnerabilities that may not necessarily apply to your organization.

Once you finish creating your watchlist, you’ll be alerted of any new vulnerability that matches the items you selected in the notification center in the X-Force Exchange. Check the upper-right corner of the window when logged into the platform. You can also opt for email notifications to monitor these vulnerabilities.

Watch the on-demand webinar: Transform Threat Intelligence Into Prevention In Minutes

Take Action

To help take action on these vulnerabilities or scrutinize them in your network, you can add them to a Collection in the X-Force Exchange and import it into your security information and event management (SIEM), either via the X-Force Exchange API or using STIX/TAXII protocols. You can generate credentials for the X-Force Exchange API from within the same user settings area on the platform.

As part of our agile development cycle, new capabilities are added frequently, highlighted in the notifications areas on the platform. To learn more about other ways X-Force Exchange can help solve security problems and protect your network, watch our on-demand webinar, “Transform Threat Intelligence Into Prevention In Minutes.”

More from X-Force

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

Being a good CLR host – Modernizing offensive .NET tradecraft

14 min read - The modern red team is defined by its ability to compromise endpoints and take actions to complete objectives. To achieve the former, many teams implement their own custom command-and-control (C2) or use an open-source option. For the latter, there is a constant stream of post-exploitation tooling being released that takes advantage of various features in Windows, Active Directory and third-party applications. The execution mechanism for this tooling has, for the last several years, relied heavily on executing .NET assemblies in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today