Excluding Assets From Scans (Scan Exclusion Policy) - IBM Proventia Network Enterprise Scanner User Manual

Table of Contents

Excluding Assets from Scans (Scan Exclusion Policy)

Introduction

Scope

Policy content

Excluding ports

Excluding assets

IBM Proventia Network Enterprise Scanner User Guide, Version 1.3

Use the Scan Exclusion policy to define specific ports and/or assets to exclude from a scan

of a group of assets. You should define the Scan Exclusion policy at a high level in your

group structure and allow the lower groups to inherit from it. If needed, you can then

override the policy at lower groups.

The Scan Exclusion policy applies to assessment scans that run as either background or ad

hoc scans. The policy does not apply to discovery scans.

Each Scan Exclusion policy defines the following information for the policy's associated

asset group (and the groups that inherit from it):

A list of ports against which no assessment checks will be run. (No checks run against

●

these ports on any host in the group. This applies to both TCP and UDP ports.)

A list of IP addresses not to scan.

●

To exclude ports from a scan:

1. In the SiteProtector Console, set up a tab to display asset policies. (See page 74.)

2. On the navigation pane, select a group, and then open the Scan Exclusion policy for

that group.

3. Use a combination of typing the ports numbers and choosing the port numbers as

follows:

Type the ports to exclude, separated by commas, in the Excluded Ports box.

■

Click Well Known Ports, and then select the ports to exclude.

■

You can use the standard multiple-select techniques of

Tip:

to select random ports.

CTRL

To exclude assets from a scan:

1. In the SiteProtector Console, set up a tab to display asset policies. (See page 74.)

2. On the navigation pane, select a group, and then open the Scan Exclusion policy for

that group.

3. Type the IP addresses (in CIDR or dotted-decimal notation) of the hosts to exclude in

the Excluded Hosts box as follows:

Type an IP address, and then press

■

Type a range of IP addresses, and then press

■

Example: 172.1.1.100-172.1.1.200

A red box may appear around the Excluded Hosts box as you type until the

Note:

data is validated.