Written by Stefan Walter, Front-end Developer, IBM Security

Imagine you are a network administrator in a company. You know what software is used in your environment, including what specific versions are deployed. Maintaining an accurate asset inventory is a key step in incident response planning. Likewise, maintaining timely patching practices is important to protect against common attack vectors.

Gartner estimated that 90 percent of exploits leverage vulnerabilities for which a patch has been available but not yet applied. But how can you track relevant vulnerabilities for your enterprise IT assets?

A Tedious Task

Until now, tracking vulnerabilities was a tedious task. The volume of incoming vulnerabilities needs to be matched against your own enterprise asset inventory to track those interesting to you and your environment. This is a massive task: IBM X-Force logged nearly 9,000 new vulnerabilities in 2015.

The IBM X-Force Exchange collaborative threat intelligence platform offers a new way to track relevant vulnerabilities. Within the platform, you can research indicators of compromise, conduct security investigations and watch for vulnerabilities on target technologies in your infrastructure just by maintaining a list of keywords or products to monitor. If new vulnerabilities are disclosed that match keywords or products on your watchlist, you will be automatically notified.

Tailor Your Watchlist to Track Relevant Vulnerabilities

To use the watchlist feature, log into X-Force Exchange with your IBM ID. Then open up the user panel by clicking on the icon in the upper-right corner. Go to Settings at the bottom of this panel. On the settings page, select the Watchlist option on the left side.

In the input field, you can enter a product name that you want to watch or select existing or known products from the menu. The search feature will make suggestions as you start typing the product name. Items will get added to a list below. If you want to delete items from the list, you can do so by hovering over the item and clicking the delete icon on the right hand side.

The watchlist keywords enable you to track, for example, “Linux” as a general term, or terms as specific as “Linux Kernel” or “Linux Kernel 3.9, rc7.” This flexibility allows you to tailor your watchlist to vulnerabilities that can truly affect your enterprise security rather than a flood of new vulnerabilities that may not necessarily apply to your organization.

Once you finish creating your watchlist, you’ll be alerted of any new vulnerability that matches the items you selected in the notification center in the X-Force Exchange. Check the upper-right corner of the window when logged into the platform. You can also opt for email notifications to monitor these vulnerabilities.

Watch the on-demand webinar: Transform Threat Intelligence Into Prevention In Minutes

Take Action

To help take action on these vulnerabilities or scrutinize them in your network, you can add them to a Collection in the X-Force Exchange and import it into your security information and event management (SIEM), either via the X-Force Exchange API or using STIX/TAXII protocols. You can generate credentials for the X-Force Exchange API from within the same user settings area on the platform.

As part of our agile development cycle, new capabilities are added frequently, highlighted in the notifications areas on the platform. To learn more about other ways X-Force Exchange can help solve security problems and protect your network, watch our on-demand webinar, “Transform Threat Intelligence Into Prevention In Minutes.”

More from Threat Intelligence

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

An IBM Hacker Breaks Down High-Profile Attacks

On September 19, 2022, an 18-year-old cyberattacker known as "teapotuberhacker" (aka TeaPot) allegedly breached the Slack messages of game developer Rockstar Games. Using this access, they pilfered over 90 videos of the upcoming Grand Theft Auto VI game. They then posted those videos on the fan website GTAForums.com. Gamers got an unsanctioned sneak peek of game footage, characters, plot points and other critical details. It was a game developer's worst nightmare. In addition, the malicious actor claimed responsibility for a…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…

Charles Henderson’s Cybersecurity Awareness Month Content Roundup

In some parts of the world during October, we have Halloween, which conjures the specter of imagined monsters lurking in the dark. Simultaneously, October is Cybersecurity Awareness Month, which evokes the specter of threats lurking behind our screens. Bombarded with horror stories about data breaches, ransomware, and malware, everyone’s suddenly in the latest cybersecurity trends and data, and the intricacies of their organization’s incident response plan. What does all this fear and uncertainty stem from? It’s the unknowns. Who might…