Written by Stefan Walter, Front-end Developer, IBM Security

Imagine you are a network administrator in a company. You know what software is used in your environment, including what specific versions are deployed. Maintaining an accurate asset inventory is a key step in incident response planning. Likewise, maintaining timely patching practices is important to protect against common attack vectors.

Gartner estimated that 90 percent of exploits leverage vulnerabilities for which a patch has been available but not yet applied. But how can you track relevant vulnerabilities for your enterprise IT assets?

A Tedious Task

Until now, tracking vulnerabilities was a tedious task. The volume of incoming vulnerabilities needs to be matched against your own enterprise asset inventory to track those interesting to you and your environment. This is a massive task: IBM X-Force logged nearly 9,000 new vulnerabilities in 2015.

The IBM X-Force Exchange collaborative threat intelligence platform offers a new way to track relevant vulnerabilities. Within the platform, you can research indicators of compromise, conduct security investigations and watch for vulnerabilities on target technologies in your infrastructure just by maintaining a list of keywords or products to monitor. If new vulnerabilities are disclosed that match keywords or products on your watchlist, you will be automatically notified.

Tailor Your Watchlist to Track Relevant Vulnerabilities

To use the watchlist feature, log into X-Force Exchange with your IBM ID. Then open up the user panel by clicking on the icon in the upper-right corner. Go to Settings at the bottom of this panel. On the settings page, select the Watchlist option on the left side.

In the input field, you can enter a product name that you want to watch or select existing or known products from the menu. The search feature will make suggestions as you start typing the product name. Items will get added to a list below. If you want to delete items from the list, you can do so by hovering over the item and clicking the delete icon on the right hand side.

The watchlist keywords enable you to track, for example, “Linux” as a general term, or terms as specific as “Linux Kernel” or “Linux Kernel 3.9, rc7.” This flexibility allows you to tailor your watchlist to vulnerabilities that can truly affect your enterprise security rather than a flood of new vulnerabilities that may not necessarily apply to your organization.

Once you finish creating your watchlist, you’ll be alerted of any new vulnerability that matches the items you selected in the notification center in the X-Force Exchange. Check the upper-right corner of the window when logged into the platform. You can also opt for email notifications to monitor these vulnerabilities.

Watch the on-demand webinar: Transform Threat Intelligence Into Prevention In Minutes

Take Action

To help take action on these vulnerabilities or scrutinize them in your network, you can add them to a Collection in the X-Force Exchange and import it into your security information and event management (SIEM), either via the X-Force Exchange API or using STIX/TAXII protocols. You can generate credentials for the X-Force Exchange API from within the same user settings area on the platform.

As part of our agile development cycle, new capabilities are added frequently, highlighted in the notifications areas on the platform. To learn more about other ways X-Force Exchange can help solve security problems and protect your network, watch our on-demand webinar, “Transform Threat Intelligence Into Prevention In Minutes.”

More from X-Force

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed ITG05…

Why federal agencies need a mission-centered cyber response

4 min read - Cybersecurity continues to be a top focus for government agencies with new cybersecurity requirements. Threats in recent years have crossed from the digital world to the physical and even involved critical infrastructure, such as the cyberattack on SolarWinds and the Colonial Pipeline ransomware attack. According to the IBM Cost of a Data Breach 2023 Report, a breach in the public sector, which includes government agencies, is up to $2.6 million from $2.07 million in 2022. Government agencies need to move…

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today