How Osid Is Updated - IBM Proventia Network Enterprise Scanner User Manual

Chapter 12: Interpreting Scan Results

How OSID Is Updated

Introduction
When does
Enterprise Scanner
check for OSID?
Conditions for
reassessing OSID
Exception
Rules for updating
OSID
About user-supplied
OSIDs
172
Enterprise Scanner receives OSID information about assets it scans from SiteProtector.
This topic explains when Enterprise Scanner uses the information or reassesses the OSID
during an assessment scan, and it explains when SiteProtector updates OSID that it has
for an asset.
Enterprise Scanner receives OSID information about the assets it scans from SiteProtector.
Enterprise Scanner uses that information if it passes certain conditions. If the information
does not pass the conditions, Enterprise Scanner reassesses OSID when it runs an
assessment scan.
The following conditions must be met for Enterprise Scanner to use the OSID information
from SiteProtector:
The operating system name, the certainty of the OSID, and a timestamp must all be
●
available.
The OSID information was supplied by a user, or the age of the information is no
●
more than the acceptable age defined in the Assessment Policy.
The OSID matches a valid operating system.
●
The concept of certainty was introduced with SiteProtector SP6, so it is undefined for the
assets already in SiteProtector. Because OSID is undefined, SiteProtector accepts the first
reported OSID for each asset, regardless of its source.
SiteProtector updates OSID for existing assets based on the following rules:
Certainty of Old Data Certainty of New Data Updated?
Certain
Certain
Uncertain
Uncertain
Table 60: Rules for updating OSID
SiteProtector updates user-supplied OSIDs only in the following cases:
A local Desktop agent reports an OSID to SiteProtector for that asset.
●
A scan from Enterprise Scanner with authenticated access reports an OSID for that
●
asset.
If you enter user-supplied OSIDs and do not meet either of the preceding
Important:
conditions, you are responsible for maintaining any changes to the OSID.
Certain
Uncertain
Certain
Uncertain
Yes
No, unless both sources of OSID are
Enterprise Scanner
Yes
Yes, unless the new OSID is from Internet
Scanner and the old OSID is from Enterprise
Scanner
IBM Internet Security Systems