Technical Manual

ManualsBrandsCisco Manualssecurity management softwareCisco Identity Services Engine Software

199fb81a4b99","psnHostName":"ISE21-3ek","heartBeatTime":0,"lastScanTime":0}

Once the result is received it stores all Vulnerability data in the Context Directory.

2016-06-28 19:25:02,020 DEBUG [pool-311-thread-8][]

va.runtime.admin.vaservice.VaServiceMessageListener -:::::- Got message from VaService:

[{"macAddress":"C0:4A:00:14:8D:4B","ipAddress":"10.62.148.63","lastScanTime":1467134394000,"vuln

erabilities":["{\"vulnerabilityId\":\"QID-90783\",\"cveIds\":\"CVE-2012-0002,CVE-2012-

0152,\",\"cvssBaseScore\":\"9.3\",\"cvssTemporalScore\":\"7.7\",\"vulnerabilityTitle\":\"Microso

ft Windows Remote Desktop Protocol Remote Code Execution Vulnerability (MS12-

020)\",\"vulnerabilityVendor\":\"Qualys\"}","{\"vulnerabilityId\":\"QID-

38173\",\"cveIds\":\"\",\"cvssBaseScore\":\"9.4\",\"cvssTemporalScore\":\"6.9\",\"vulnerabilityT

itle\":\"SSL Certificate - Signature Verification Failed

Vulnerability\",\"vulnerabilityVendor\":\"Qualys\"}","{\"vulnerabilityId\":\"QID-

90882\",\"cveIds\":\"\",\"cvssBaseScore\":\"4.7\",\"cvssTemporalScore\":\"4\",\"vulnerabilityTit

le\":\"Windows Remote Desktop Protocol Weak Encryption Method

Allowed\",\"vulnerabilityVendor\":\"Qualys\"}","{\"vulnerabilityId\":\"QID-

90043\",\"cveIds\":\"\",\"cvssBaseScore\":\"7.3\",\"cvssTemporalScore\":\"6.3\",\"vulnerabilityT

itle\":\"SMB Signing Disabled or SMB Signing Not

Required\",\"vulnerabilityVendor\":\"Qualys\"}","{\"vulnerabilityId\":\"QID-

38601\",\"cveIds\":\"CVE-2013-2566,CVE-2015-

2808,\",\"cvssBaseScore\":\"4.3\",\"cvssTemporalScore\":\"3.7\",\"vulnerabilityTitle\":\"SSL/TLS

use of weak RC4 cipher\",\"vulnerabilityVendor\":\"Qualys\"}"]}]

2016-06-28 19:25:02,127 DEBUG [pool-311-thread-8][]

va.runtime.admin.vaservice.VaServiceMessageListener -:::::- VA: Save to context db,

lastscantime: 1467134394000, mac: C0:4A:00:14:8D:4B

2016-06-28 19:25:02,268 DEBUG [pool-311-thread-8][]

va.runtime.admin.vaservice.VaAdminServiceContext -:::::- VA: sending elastic search json to pri-

lan

2016-06-28 19:25:02,272 DEBUG [pool-311-thread-8][]

va.runtime.admin.vaservice.VaPanRemotingHandler -:::::- VA: Saved to elastic search:

{C0:4A:00:14:8D:4B=[{"vulnerabilityId":"QID-90783","cveIds":"CVE-2012-0002,CVE-2012-

0152,","cvssBaseScore":"9.3","cvssTemporalScore":"7.7","vulnerabilityTitle":"Microsoft Windows

Remote Desktop Protocol Remote Code Execution Vulnerability (MS12-

020)","vulnerabilityVendor":"Qualys"}, {"vulnerabilityId":"QID-

38173","cveIds":"","cvssBaseScore":"9.4","cvssTemporalScore":"6.9","vulnerabilityTitle":"SSL

Certificate - Signature Verification Failed Vulnerability","vulnerabilityVendor":"Qualys"},

{"vulnerabilityId":"QID-

90882","cveIds":"","cvssBaseScore":"4.7","cvssTemporalScore":"4","vulnerabilityTitle":"Windows

Remote Desktop Protocol Weak Encryption Method Allowed","vulnerabilityVendor":"Qualys"},

{"vulnerabilityId":"QID-

90043","cveIds":"","cvssBaseScore":"7.3","cvssTemporalScore":"6.3","vulnerabilityTitle":"SMB

Signing Disabled or SMB Signing Not Required","vulnerabilityVendor":"Qualys"},

{"vulnerabilityId":"QID-38601","cveIds":"CVE-2013-2566,CVE-2015-

2808,","cvssBaseScore":"4.3","cvssTemporalScore":"3.7","vulnerabilityTitle":"SSL/TLS use of weak

RC4 cipher","vulnerabilityVendor":"Qualys"}]}

Logs to be checked - vaservice.log. You can tail it directly from ISE CLI:

ISE21-3ek/admin# show logging application vaservice.log tail

Vulnerability Assessment Request Submitted to Adapter

2016-06-28 17:07:13,200 DEBUG [endpointPollerScheduler-3][] cpm.va.service.util.VaServiceUtil -

:::::- VA SendSyslog systemMsg :

[{"systemMsg":"91019","isAutoInsertSelfAcsInstance":true,"attributes":["TC-

NAC.ServiceName","Vulnerability Assessment Service","TC-NAC.Status","VA request submitted to

adapter","TC-NAC.Details","VA request submitted to adapter for processing","TC-