This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
ogiwak
Level 2
‎Aug 25, 2020 07:47 AM

Downloading vulnerability information during scanning

Hello,

There is a process to download vulnerability difference data from NVD at the time of scanning. Is there a plan to download vulnerability difference data separately from scanning in the future?
Since it is not possible to predict which project's scan will execute this process and the process cannot be seen by the customer unless they see the log, I think it is desirable to have a mechanism that can be executed separately rather than a scan.

Thanks.

 

Labels (1)
Labels
0 Kudos
(1) Reply
alexrybak
Revenera
Revenera
‎Nov 04, 2020 02:25 PM

Thank you for this question as it is an important part of our data improvement strategy. This response is also related to your previous post (https://community.flexera.com/t5/FlexNet-Code-Insight-Customer/Reduced-time-for-Electronic-Updates/m-p/159809) regarding update processing time.

We currently have several manners by which data is updated in Code Insight:

  • The Compliance Library (CL) is delivered on disk to customers and provides patterns for exact and source matching for scan server deep scans.
  • NG-bridge is a new exact match overlay data delivery mechanism that will be released as a beta in 2020 R4. It will provide patterns for exact matching beyond those in the Compliance Library. The NG-bridge will update itself automatically and can support an air-gapped deployment environment where needed. This mechanism will replace future CL deliveries and will become the ongoing way by which exact match data updates are delivered to the product. We are also exploring the feasibility of this approach for source match data.
  • The electronic update service delivers data updates to Code Insight that includes components, versions, licenses, and vulnerabilities. This update can be automatically run by the product as well as manually invoked by an admin, including in an air-gapped deployment environment.
  • As part of a scan, the automated detection module has its own update service that handles NVD vulnerability data as well as automated detection rules which drive its functionality.

We are planning the following improvements for 2021:

  • Fold the automated detection module updates into the electronic update service. This will accomplish two things: (1) a synchronized update process with consistent notifications and alerts, and (2) de-couping of the update from the scan process which allows updates to occur without the need to scan.
  • Design work for an incremental update process to speed up the update processing time.
0 Kudos