Revision History
Formatting Conventions
This guide uses the following formatting conventions to denote specific information.Notes, Tips, and Cautions
This symbol indicates information that applies to the task at hand.
About this Document
This guide describes the basic features and uses of AppDetectivePRO. You can use this guide as a reference when using the product.AppDetectivePRO Basics
AppDetectivePRO is an in-depth database security assessment solution. It provides a comprehensive database security diagnostics approach that includes vulnerability assessment, configuration assessment, and identity access assessment. The solution offers easy-to-use features that allow you to get up and running quickly.View your version of AppDetectivePRO
To view the version, go to the System Settings by clicking on the gear icon located on the upper right of the application. You will see an About section that lists the component versions of AppDetectivePRO.Typical System Requirements
The following table lists AppDetectivePRO typical system requirements:Supported Database Platforms
For a list of all supported assets in AppDetectivePRO, visit https://www.levelblue.com/.Installation
This section describes the installation and configuration of the AppDetectivePRO. Complete installation of Nmap 7.94 and above is required prior to installing AppDetectivePRO v10.14.Nmap (Network Mapper) is an open-source, third party software used for mapping networks, auditing, and security scanning. You can download the Nmap executable file from their website https://nmap.org/.
Install AppDetectivePRO
Run the executable file as a local Windows Administrator. Double-clicking on the executable file opens the dialog box where you can choose to allow changes to be made to your computer system. You will see a message that you have successfully installed the application when the process has finished successfully.Notes:
- The backend database will be created when AppDetectivePRO is started for the first time. AppDetectivePRO must be started by a local Windows Administrator to create this database.
- Support for Web Application Scanning ended with v10.6. Upgrading to v10.8 will purge web application-related control and check results. This is an irreversible action upon upgrade.
Install Nmap for AppDetectivePRO
Here are the steps related to the Scan Engine installation during AppDetectivePRO setup:- In the Nmap Setup dialog, click I Agree.
- Select the components you want to install, and then click Next.
- Click Install. The required components are downloaded, and the Nmap installation begins.
- Click I Agree.
- Choose the installation option, and then click Install.
- Click Next. The Npcap installation completes, and the Nmap setup resumes.
- Click Finish.
Configure the AppDetectivePRO User
At installation time, you must be logged on as a Windows Administrator. The account used for installation is the only user that initially has access to the AppDetectivePRO software. To add any other Windows login, the Windows Administrator who installed the software can navigate to the System Settings and choose User Configuration.It is best practice to create a local Windows user and configure it in AppDetectivePRO. You can use this user to always get access to AppDetectivePRO.
Install the License
After you purchase licenses for AppDetectivePRO, you receive your licenses. Some licenses require a machine ID, and other types do not. If a machine ID is required for your license, you are required to provide it to the LevelBlue Account Executive or Delivery Ops Department to receive a new license file. To obtain the machine ID, go to the Licensing section in the System Settings. Copy and paste the number from the Machine ID field and send it to the LevelBlue contact. Once you have received a license file from LevelBlue, navigate to the Licensing section in the System Settings, choose Add a License and browse to the .lic file you received. Once the license is added, you will see the following information:- Customer Name
- License Type
- Product Expiration Date
- ASAP Expiration Date
- Purchased amount of UUTs for Policy Scans (Audit/Pen Test) and User Rights Review
- Purchased amount of UUTs for IBM DB2 z/OS
Notes:
- In this version, you do not need to be an Administrator to add a license.
- In this version, do not move the license files to the licensing folder within the AppDetectivePRO directory. You must use the Add a License function in the product.
- If you have added more than one license, the Product Expiration Date and ASAP Expiration Date will display the information from the license file that has the greatest expiry date
Additional Setup for Client Drivers
Additional client driver installations must be performed to run Audit policy scans and Rights Review scans. The following table includes details.Platform Client Drivers
Keeping your software up to date
Staying current with the latest software and knowledgebase updates is always encouraged. Best practice for keeping your system current is to run the ASAP Updater, available in the System Settings section of AppDetectivePRO. Updates are also available for download from the Support Portal, at: https://www.levelblue.com/company/support.Uninstall AppDetectivePRO
- Open the Start Menu.
- Click Control Panel.
- Under Programs, click Uninstall a program.
- Select AppDetective PRO and click Uninstall.
Product Support Lifecycle
LevelBlue’s Database Security Product Support Lifecycle is 18 months. Product versions older than 18 months are generally unsupported. For your convenience, a recent product support matrix is included below. Version upgrades are available to all customers who have a current and valid software subscription. Upgrading is only allowed from supported versions. Also, session import functionality is only allowed if exported from a supported version. Clients running unsupported software are strongly encouraged to plan for an upgrade or fresh installation of their licensed software. Newer releases of software offer better performance, new features and capabilities, and often resolve issues experienced in older releases of software.Customer Support
You are welcome to contact LevelBlue Technical Support for any questions or concerns. For various ways to contact us, please visit https://www.levelblue.com/company/support.Understanding the AppDetectivePRO User Interface
The user interface allows you to see different sections at a time. It has three main areas where you can perform different tasks: Sessions, Policies, and System Settings.- Sessions: manage assets and perform all your different scans, review results, and run scan reports
- Policies: view how the built-in policies are configured and create any custom policies
- System Settings: configure users of the product, run ASAP Updates, and change other settings
Working in Sessions
When you create a new session or open an existing session, you can view the data in a single session at a time. Multiple sessions cannot be opened at a time. Sessions can be exported from AppDetectivePRO and imported back into it. Exported sessions can be used to back up the data to be imported at a later date or be used to import to another installation of AppDetectivePRO.The session import functionality is only allowed if exported from a supported version (see Product Support Lifecycle, above).
The password is not part of the session data. Sessions that are exported are not locked.
Assets
Assets are any target database you input into a session. Assets can be discovered, added manually, or imported using a CSV file. Once assets are added to your session, you can perform different types of scans against them.Discover
To run a discovery, select the Discover button in the UI. This opens a wizard that prompts you to insert certain information, such as an IP address, ports, and detection options that will be used to run the discovery against. The discovery performs a combination of an IP/Port sweep and an intelligent database detection to accurately identify the assets to add to the Session.Versions of Oracle 10g or greater may not be discovered. If TCP/IP or Browser Services are not enabled on Microsoft SQL Server, then discovery may not identify the instances. If the DB2 Admin Server is not running, then the discovery of IBM DB2 LUW databases may not be discovered. Microsoft Azure SQL Database are not supported for discovery. To add these to the Asset list, use the New Asset option.
New Asset
To manually add an asset, select the New Asset button in the UI. This allows you to enter information about the target database you want to add as an asset. You can test the database connection to the target by supplying credentials. If the test connection is successful, you see a green “plug” icon under the Audit column in the grid. This test checks that you can connect to the asset. It does not verify the credentials needed to run an Audit policy.When creating a new Oracle asset, you have the option of setting up the connection with the SID or Service Name. When creating a new Microsoft SQL Server asset, you have the option of setting up the connection with Port/Instance or Named Pipe. Once a policy or user rights scan is completed against the asset, the license is tied to that asset. Changing between connection types (SID vs Service Name or Port/Instance vs Named Pipe) will be treated as a new asset.
Import
To import a list of assets, select the Import button in the UI. This allows you to select a CSV file with information to add assets to the session. You can select the View sample file link to see an example. Here are more details on formatting the CSV file: The file should include the following information:Notes:
- PipeName is only to be used for Microsoft SQL Server. If used, Port and InstanceName are not to be specified.
- OracleServiceName is only to be used for Oracle. If used, OracleSIDName is not to be specified.
You can always change the value of any of the imported assets using the Edit option after the import is complete.
Platform (OS) Value (not all options listed)
Database Value
Edit
At any time, you can edit an asset in the session. Mark the check box next to the asset and the Edit button is enabled. You can edit the platform type, version, or asset name of any discovered asset. You can edit the platform type, version, asset name, hostname, port, or instance name of any asset manually added or imported. You can also test the database credentials of any asset.OS detection is not always available with discovery based on the configuration of the target database. You can always edit the platform (OS) using the edit option. Some checks rely on understanding the platform (OS) to run properly. If you imported a list of assets and you see something listed as “Unknown”, you can use the Edit option to enter the correct value.
Filter
The filter allows you to sort out the assets in the Asset list. You can choose to filter by assert type or by keywords you can enter in the search box.Report
At any time, you can generate an Asset Inventory Report. Select the asset(s) from the grid to include in the report. You have the option of including banner information if it was collected during discovery in the report. The report is available in AppDetectivePRO report viewer format which can be exported to PDF or as a CSV file. The CSV file can also be used to import assets into another session.Delete
At any time, you can delete an asset in the session. Mark the check box next to the asset(s) and the Delete button is enabled.If you have any scan results data associated with the asset, this data will also be deleted. You will be prompted with a warning message to confirm that you want to proceed with the deletion.
Run Policy
After assets are added to the session, you can run policy scans against them. Mark the check box next to the asset(s) you want to run the policy scan against and click the Run Policy button. There are three types of policies that can be run: Audit, Pen Test, and Application Scan.Audit
After clicking Run Policy, you see a list of Audit policies. Select a policy and then enter the database credentials for the asset(s). Use the scroll bar and then also enter the OS credentials if your policy requires OS access. Some controls and checks require OS access to perform its configuration analysis. If you have a policy that requires this, make sure you also test the OS credentials prior to running the scan.Notes:
- In this version of AppDetectivePRO, you no longer select a specific DISA STIG or CIS framework (the selection is no longer available). When you select either the CIS NEW or the DISA-STIG NEW policy, the appropriate framework will be used on the asset(s) selected. Do not use the CIS Benchmark – Audit (Built-in) or DISA-STIG Database Security – Audit (Built-in) policies if you have been scanning using specific frameworks in previous versions.
- In this version of AppDetectivePRO, you have the option to collect database users’ information when selecting an Audit policy. Mark the checkbox prior to clicking Next for this option. This option requires database credentials with privileges to collect User Rights Review information. Results from this collection of database users’ information can be viewed in the User Rights Results section within the Users view. See User Account Privileges Needed for Audit and User Rights Review Scans for more information.
- Test Connection: This will test that AppDetectivePRO can connect both to the target DB and OS using the credentials supplied.
- Test DB only: This will test the connection using the DB credentials supplied.
- Test OS only: This will test the connection using the OS credentials supplied.
For guidance on the privileges required to run Audit policy scans, see User Account Privileges Needed for Audit and User Rights Review Scans.
Pen Test
You can also choose to run Pen Test policies. Within the Run Policy section, you see a Pen Test option next to Audit. Pen Test policies do not require database credentials to run. You can run a Pen Test against any discovered assets or assets that have been verified (meaning that you have already successfully tested the database credentials for the assets). If you manually entered or imported the assets and do not know the database credentials, you can verify the asset by running a discovery against it. As with the Audit policy, you will see a Test button. Click this button to run a discovery on the single selected asset, to attempt to verify it. Once an asset is verified, you can run the Pen Test policy scan.Notes:
- You can run up to 15 concurrent policy scans. The performance of the scans will depend on the amount of RAM allocated at the time of the scan.
- Encrypted connections are not supported for Pen Tests.
- You can cancel all concurrent policy scans by using the cancel option at the overall progress bar. You can cancel a scan for an asset by hovering over the Scan Status of the asset in the Assets grid and selecting the Cancel option.
Run User Rights
You can run User Rights scans against assets. To do so, mark the checkbox next to the asset(s) you want to run the scan against, and click the Run User Rights button. After clicking Run User Rights, you will be prompted to enter the database credentials for each of asset(s) you marked to scan. As with the Run Policy scan, you will test the connection to the database and verify the credentials have sufficient privileges to perform the scan.For guidance on the privileges required to run Rights Review scans, see User Account Privileges Needed for Audit and User Rights Review Scans.
Run Now and Run Later Option
There are two options when you want to run a policy or a user rights review scan:- Run Now: This option will immediately run your policy or user rights review scan.
- Run Later: This option will allow you to run your policy or user rights review scan(s) within a 24-hour period. You can select a time within the next 24-hour period when the scan should run, in half hour increments. You can have a total of 15 scans set using the Run Later option at any given time.
History
To see what actions you have performed in your session, click the History section. History captures some information about the actions you performed in your session.- If you added an asset, it is displayed in the History list.
- If you ran a discovery, you see an entry showing the details of the asset the discovery scan ran against. You can expand the entry to see all the components discovered beyond the asset (for example, Oracle Listener or Microsoft SQL Server Redirector).
- If you ran a policy scan, you see an entry as well. Expanding the details for a policy scan will display any failed or skipped result status and any associated error message.
Policy Results
To see the results for your Policy scans, go to the Policy Results section.Check Results
This section becomes enabled only after a successful policy scan is performed against an asset. When you click Policy Results the default view of Check Results (Informational view) is displayed, filtered to show all the findings from the scan. You can choose different options using the filter on the left to tailor your results. You have options to filter on showing results from a specific asset, a specific policy scan from an asset, by risk level of the check, and by the check result. If you want to see a graphical representation of the results, choose the Graphical view option on the upper right. If there are any policy scans that you want to delete from the session, mark the check box of the policy scan in the grid and click the Delete button on the side toolbar. This action is only available when the Filter and Report options are collapsed.Understanding the Check Results Filter
The filter allows you to sort out the data you want to view for any asset with policy results. You can select from the following attributes and click Filter to see your desired results. If you click Clear, the selection in the filter is removed and shows all possible policy results for all assets.- Search: filter by text anywhere in the entire grid of results. Enter text to search for.
- Assets and Policies: filter by asset or specific policy scan. If you select the asset, it will display all the policy results for the selected asset. If you select a specific policy scan, it will display the results only for the one selected.
- Risk Level: filter by Risk level of the check: High, Medium, Low, and Informational.
- Result Type: filter by the state of the check after the policy scan was executed.
- Failed: the check failed and was not fully executed. The most common error that results in a failed state is that the account used for the audit scan had insufficient privileges to the object needed for review.
- Skipped: the check was skipped because it does not apply to the particular version of the asset, so no review needs to be performed.
- Finding: the check returned a system result that captures a violation.
- Non-Finding: the check returned a system result that captures an absence of a violation.
- Fact: the check returned a system result that is informational without positive or negative orientation.
The other available view in Policy Results is the Control Review. Use the Control Review to review the controls from the Policy scan that was conducted. You can add notes and suppress at all levels of the control (control, check result, or check result occurrence).
If there are any policy scans that you want to delete from the session, mark the check box of the policy scan in the grid and click the Delete button from the side toolbar. This action is only available when the Filter and Report options are collapsed.
Using the Control Review Feature
By default, the Control Review section is grouped by Asset, then by Policy Ran. You can choose to drag any of the column headers to change the grouping. The Control Review presents the controls based on your framework and allows you to change the Response Type for any of the controls. If there is any check associated with the control, logic is applied to the initial Response Type you view.- If a check resulted in a Finding, then the Response type will be made a Finding.
- If a check resulted in a Non Finding, then the Response type will be made Non Finding.
- If a check result is Skipped or Failed, then the Response type will be made Not Reviewed (leaving it up to you to change the type as you see fit).
- If a control has more than one check associated with it and at least one of the checks resulted in a Finding, then the Response type will be made a Finding.
Understanding the Control Review Filter
Use this filter to sort out the data you want to view for any asset with policy results. You can select from the following attributes and click Filter to see your desired results. If you click Clear, the selection in the filter is removed and shows all possible policy results for all assets.- Search: filter by text anywhere in the entire grid of results. Enter text to search for.
- Assets and Policies: filter by asset or specific policy scan. If you select the asset, it will display all the policy results for the selected asset. If you select a specific policy scan, it will display the results only for the one selected.
- Risk Level: filter by risk level of the check: High, Medium, Low, and Informational.
The Risk Level filter does not apply to any DISA STIG framework.
- Response Type: This is the final response you have control over for the judgment of a control.
- Not Reviewed: review the control and create your final response.
- Non Finding: you have reviewed the control and do not think it has an issue.
- Finding: you have reviewed the control and have an issue that is a violation of the control.
- N/A: the control is not applicable, and you choose not to provide a definite response.
- Control Action: If the check box is marked for Suppressed, the filter will include controls that have been suppressed in addition to the ones unsuppressed.
User Rights Results
After a Rights Review scan is performed, the User Rights Results section is enabled. When you navigate to this section you can review all the details of any Rights Review scan performed in the Session. You can choose from different views (Objects, Roles, and Users) depending on the data to examine. The default view is by Objects. Use the Filter on the left to drill down to the data you want. Use the arrow to expand and review the details for each of the rows. If there are any User Rights Scans that you want to delete from the session, mark the check box of the policy scan in the grid and click the Delete button from the side toolbar. This action is only available when the Filter and Report options are collapsed.Object View
The Objects view allows you to view all the objects collected from User Rights Review scans. By default, the results are grouped by the snapshot collected from each scan. You can filter on the following:- Search: filter by text anywhere in the entire grid of results. Enter text to search for.
- Assets: filter by the asset and then provide you the results for all snapshots taken for that asset.
- Object Type: select the object type you want to filter the results on: Table, View, Function, Procedure, Synonym, Other
- Granted To: The user/role that has access to the object.
- Grantee Type: The type of the user/role who inherits this privilege.
- State: The privilege state; for example, GRANT.
- Privilege: The type of privilege; for example, SELECT, UPDATE, or EXECUTE.
Roles View
The Roles view allows you to view all the roles collected from User Rights Review scans. By default, the results are grouped by the snapshot collected from each scan. Using the filter, you can filter on the following:- Search: filter by text anywhere in the entire grid of results. Enter text to search for.
- Assets: filter by the asset and then provide you the results for all snapshots taken for that asset.
- Privilege Type: select the privilege type you want filter the results on: System or Object
- Users: displays all the users that are a member of the role. You will also see a column that specifies if the user was granted the role directly or indirectly.
- Effective Privileges: displays all the privileges effectively granted to the role. It also displays columns for Privilege Type, Grant Path (how the privilege was granted), and Grantee Type.
- Roles: displays all the roles that are granted to the role.
Users View
The Users view allows you to view all the users collected from User Rights Review scans. By default, the results are grouped by the snapshot collected from each scan. Using the filter, you can filter on the following:- Search: filter by text anywhere in the entire grid of results. Enter text to search for.
- Assets: filter by the asset and then provide you the results for all snapshots taken for that asset.
- Privilege Type: select the privilege type you want filter the results on: System or Object.
- Roles: displays all the roles that are granted to the user and where they are granted from.
- Effective Privileges: displays all the privileges effectively granted to the user. It also displays columns for Privilege Type, Grant Path (how the privilege was granted), and Grantee Type.
Reports
Generating reports works together with the filtered view of your scan results. You can generate reports based on whatever filter is currently applied to the data set. You can generate reports from the Check Results section, the Control Review section, and the User Rights Review section.Generate Check Results Reports
After reviewing your check results data and filtering to the data set, select the checks you want to include in your report. You can mark the check box at the Policy Scan level to include all the checks in the hierarchy or mark the checkboxes of the specific checks you want to include. After you have selected the data set, click the Report icon on the left tool bar. The following reports are available:- Vulnerability Summary: A summary report of all database finding results based on selected options in the filter. This will only report result type findings, even if your filter also contains other result types.
- Vulnerability Details: A detailed report of all database finding results based on the selected options in the filter. This will include all occurrence details of finding results. Like the summary report, this will only report on result type findings, even if your filter contains other result types.
You can choose to exclude exceptions information.
- Check Results: This report allows you to select fields from the Knowledgebase Article to include in an XML or CSV formatted report. There is also an option to include the occurrence details.
- Check Status: A summary report of all checks and their result types based on the selected options in the filter. This will only include the result types you have filtered.
- Differences Summary: A summary report of the differences between two scans of the same policy against the same asset.
To generate this report, mark the checkboxes of two policy scans (same policy used) from the same asset. When selecting this report, the grid in the UI will collapse and show you what assets have valid policy scans for this report to generate.
- Fix Scripts: A detailed report of possible SQL statements to fix findings uncovered for an Audit policy. Fix Scripts do not apply to findings from a Pen Test policy ran. Not all findings have a related fix script.
- DAS Vulnerability: An XML formatted report of all database findings mapped to elements of the DISA STIG Checklist. This specific report is used to import details to the TMA TAD system.
- DIACAP Vulnerability: An XML formatted report of all database findings mapped to elements of the DISA STIG Checklist.
Generate Control Review Reports
After reviewing your Control Review data and filtering the data set, select the controls you want generated in the report. You can mark the checkbox at the Policy Scan level to include all the controls in the hierarchy or mark the checkboxes of the specific controls you want to. After you have selected your desired results, click the Report icon on the left tool bar. There are three reports available for generation:- Control Review: A detailed report of all policy control responses and associated check result details.
- DAS Control Review: XML formatted report of all database control responses mapped to elements of the DISA STIG Checklist. This specific report is used to import details to the TMA TAD system.
- DISA-STIG Review: A detailed report of all policy control responses and associated check result details in complete DISA STIG context. You must run the DISA-STIG NEW policy or have results from DISA-STIG framework policies to generate this report.
Report Reviewer Options
The Vulnerability Summary, Vulnerability Details, Check Status, and Control Review reports all generate in a report viewer. The viewer provides viewing options such as search, zoom in and out, and print. It also allows you the ability to save the report in several formats including PDF, HTML, MHT, RTF, XLS, Text, and XPS.Generate User Rights Review Reports
Different reports are available depending on the view you are in (Objects, Roles, and Users). All reports generated for User Rights Review results are created as a CSV file. Like the other results sections, click the Report icon to see the available reports.You must mark off the desired checkboxes in the results grid to generate any of the reports. You are limited to selecting five objects, roles, or users for any of the reports.
- Objects View: There are two available reports:
- Objects: generates a list of all objects checked off in the results grid.
- Object Access: generates a list of all the objects checked off in the results grid and all the details of how access was granted.
- Roles View: There are four available reports:
- Roles: This report will generate a list of all roles checked off in the results grid.
- All Effective Members for a Role(s): This report will generate a list of all roles checked off in the results grid and the details of each user granted to the role.
- All Roles for a Role(s): This report will generate a list of all roles checked off in the results grid and the details of all roles granted to the role.
- All Effective Privileges for a Role(s): This report will generate a list of all roles checked in from the results grid and the details of each privilege granted to the role.
- Users View: There are three available reports:
- User Information: This report replaces the old Users (CSV format) report from previous versions prior to version 8.4. This report will generate the list of all users from a selected User Rights Scan with detailed information about each user’s status.
- All Roles for a User(s): This report will generate a list of all users checked off in the results grid and the details of each role granted to the user.
- All Effective Privileges for a User(s): This report will generate a list of all users checked off in the results grid and the details of each privilege granted to the user.
Working in Policies
Policies represent the complete list of items you want to review for your assessment. Policies are a list of all controls to be reviewed for the assessment. These controls may contain checks that will be analyzed during the scan process (Pen Test, Audit, Application Scan). Policy scans (Pen Test, Audit, Application Scan) can be customized to either throttle up or down what you want to test for. Additionally, parameters and exceptions can be changed or added to match your environment settings. Custom policies can be exported from AppDetectivePRO and imported (back into the same installation, or into any other installation of AppDetectivePRO). To work with Policies, select the Policies section from the top of the UI next to Sessions.Use Frameworks, Controls, and Checks
Frameworks, controls, and checks help you to set up the ultimate policies you want to use.- Framework is a container of total controls possible to be added to policies.
- The built-in default Framework in AppDetectivePRO is the SHATTER framework, which represents all the controls available out of the box.
- Additionally, there are built-in DISA STIG and CIS Benchmark frameworks with specific policies for different database types.
- Policies can be created within a single framework.
- You select controls to add to policies within that single framework.
- With the built-in SHATTER framework, AppDetectivePRO has several built-in policies, including SOX, PCI, Baseline, Evaluation, and more.
- Controls are the items in a policy that are used to review during an assessment.
- You can associate check(s) with a control.
- With the built-in SHATTER framework, AppDetectivePRO has over 1,000 built-in checks that can be associated with any custom control.
- Checks are specific, executable tests that AppDetectivePRO runs against the database that provides results.
Policies
A policy is set up as either an Audit type, Pen Test type or Application Scan type. Policies include controls from within frameworks; that is, a policy can contain a sub-set of controls that you include from existing frameworks. A control can contain one or many checks. Essentially, a policy selects a group of controls relevant to a particular security issue, and each of these controls contains relevant checks. AppDetectivePRO includes built-in policies for all policy types.Built-in policies cannot be modified. However, you can clone any built-in policy and save it as a new name and customize any of it, by adding or removing controls, changing any parameter values, or adding exceptions.
Customize Policies
You can create a new policy or clone an existing policy and customize it to meet your specific needs. To add controls, click the Add Controls icon in the left toolbar. This opens a grid of all possible controls not already included in your policy. You can add individual controls or an entire control category from an Asset type by marking the checkbox in the grid and clicking the Add button. If you need to read more about the control, you can expand the Knowledgebase Article within the grid. Once controls are added, they are listed in the main Controls grid and not visible in the Add Controls grid. If you want to remove a control from your policy, simply select the control (or CTRL + select to multi-select controls) in the grid and select the Remove icon on the left tool bar. In addition to choosing the controls you want in your policy, there are other elements that can add further customization. Within the Controls grid you can expand the control to check level to see Parameters and Exceptions.- Exceptions allow you to add known environmental variables to the policy that will in effect not show finding occurrences for them. In essence, if a check examines if a user has a certain privilege, you can create an exception for a certain user that should be examined for that privilege grant.
- Parameters allow you to change the behavior of a check to inspect for a certain value. In essence, if a check examines a certain number value setting, you can change the default value as you see fit for your requirements.
Delete Policies
Any custom policy that you created can also be deleted. To do so, select the policy from the grid and click the Delete button.You can only delete custom policies that have not been used and associated with policy results.
Add/Remove Controls
Any custom policy that you create allows you to choose precisely which controls are included in that policy. To associate a control with a custom policy, select the desired control(s) from the grid and click the Add button.Frameworks
A framework is a collection of controls possible to be added to policies. AppDetectivePRO has multiple built-in frameworks available: SHATTER, CIS, and DISA STIG. Other frameworks may be added to future versions of the software. The SHATTER framework is the default framework which comes with controls and checks that can be used within policies. This framework is maintained by LevelBlue’s research and development group, SpiderLabs. The SHATTER framework and policies associated with it are updated regularly via ASAP Updates. It is the only framework that can be cloned. The CIS and DISA STIG frameworks cannot be cloned because they represent defined third party standards. The CIS and DISA STIG frameworks are frameworks associated with their respective industry specific guidance standards. CIS is associated with the Center for Internet Security, and DISA STIG is associated with the Defense Information Systems Agency. Within Frameworks, you can create your own custom frameworks or view the current built-in ones. You can further customize a user-created framework as described in the following sections.Customize Frameworks
Users can create, clone, and delete frameworks in the Frameworks tab.Create/Clone/Delete Framework
Users can create their own frameworks or clone the existing non-built-in frameworks and the built-in SHATTER framework. To create a framework, click the Create a Framework icon in the left toolbar. If a user would like to delete a non-built-in framework or clone a framework, simply select the control and choose the desired Delete or Clone button from the main window.Add/Create/Edit/Remove Control
With non-built-in frameworks, you can manipulate and modify the controls which belong to the framework that they are customizing. When the control edit panel is in use, you cannot change the control that is currently selected. Controls can be added, created, edited or removed from framework. To add an existing control, click the Add Controls icon on the left tool bar and select the controls to be added to the framework. To create a control, click the Add Controls icon in the left tool bar then select Create a Control. To edit a control, click the Edit Control icon on the left tool bar and to remove a control, click on the Remove icon on the left tool bar.Add/Create/Edit/Remove Check
Similarly, with non-built-in frameworks, you can manipulate and modify the checks which belong to the framework you are customizing and the control you selected. When you use the Add Checks panel, you cannot change the currently selected check. Checks can be added to a framework, created in a framework, edited or removed. To add an existing check to a framework, click Add Checks on the left tool bar and then click Add Existing Check to specify desired checks. To create a check to be added to a framework, click Add Checks on the left tool bar and then click Create a Check. To edit checks in a framework, click Edit Check on the left tool bar. To remove a check, click Remove on the left tool bar.System Settings
System Settings allow you to configure users of the product, run ASAP Updates, see the version of the product, change log file trace settings, and view licensing information. The following sections are available:- About: displays the versions of each component of AppDetectivePRO. You may need to provide this information to the Customer Support team if working on an issue.
- ASAP Updater allows you to stay up to date with the latest product version and SHATTER Knowledgebase. When logged in as an administrator, you can launch the update to download the latest available versions. You can also configure a proxy if needed. The disable ASAP Updates checkbox will disable this functionality ensuring the AppDetectivePRO installation will not change (updates may drop support for older database versions).
- Log Files: allows you to change the tracing level for log files and collect the files in a zip file to send to the Customer Support team if needed to help troubleshoot an issue.
- User Configuration: allows you to configure any Windows Login to access the application after an Administrator has installed it.
- Backend Configuration (advanced feature): allows you to change the location where the backend database file is stored.
- Licensing: allows you to view licensing information and apply the license to the application. You are able to see how many UUT’s you have available for scans and other information about the licenses.
- Password Scan Settings: Configures whether passwords are displayed and stored in clear text or masked.
Advanced ScanEngine Configuration
Target x509 Certificate Validation: ScanEngine v3.25 and later can be configured to validate x509 certificates provided by the scan target. This is a system wide setting in the ScanEngine configuration file. To enable this, add the following two values toappsettings.json in the ScanEngineHost installation folder (typically at %ProgramFiles%\LevelBlue\ScanEngineHost\appsettings.json)
User Account Privileges Needed for Audit and User Rights Review Scans
Audit policy scans and User Rights Review scans require read-only access to the asset. While you can use an Administrator account to run the scans, it is not required. To set up the appropriate databases access on the assets, User Creation Scripts are provided within the product, specifically from the SHATTER Knowledgebase component. In the directory, you see a readme file that provides more information about each script. The basic guidance is as follows, where [Asset] = asset type and version (where needed):CreateUser[Asset].sql: creates a user called ‘aduser’ and will grant read-only permissions needed to run Audit policy scans.CreateUser[Asset]URR.sql: creates a user called ‘aduserURR’ and will grant read-only permissions needed to run Audit policy and User Rights Review scans.CreatePowerUser[Asset].sql: creates a user called ‘aduser_admin’ will grant elevated privileges (i.e. SYSDBA for Oracle).CreateUser[Asset]SA.sql: specific for Microsoft SQL Server and create a user called ‘aduser’ and grant sysadmin rights.UserPermissionsDB2Mainframe.sql: creates a user called ‘aduser’ and will grant read-only permissions needed to run Audit policy scans against IBM DB2 z/OS.
Permissions for Unix Access
Specifically for certain target databases need to have system variables to specify the location of the database instances.
Target Database Permissions for Unix
For Microsoft SQL Server, you can also choose to use Windows Authentication for database credentials. You will need to enter the domain or hostname, username, and password. (for example, if your Windows login is domain\aduser, you enter domain in the Domain or IP/Hostname field, and aduser in the User Name field).
If any fields are encrypted and the account used for the Audit policy scan does not have access to those fields, some checks may not work properly.