Vulnerability Management

I would love to have a way to mark vulnerabilities or groups of vulnerabilities as "accepted" instead of Suppressed. With this, it would be helpful to have an Accepted Risks area in which we can see them all and sort them. Plus, it would be helpful to have a risk acceptance documentation method. I imagine a pathway in which we could send a vulnerability detail set or group of vulns with details to a client wrapped in a templated risk acceptance document that they would then need to acknowledge / sign. Doing this with more than 1 risk on the doc would be great for handling multiple things at once and having the client sign only 1 document instead of one for each risk - too much for the client. Once signed and marked as accepted, the vuln should still show up in the portal but not count against the metrics (or have separate metrics for them) or SLAs. Perhaps a reminder could be set for X number of days on any given Accepted Risk or group of risks (tags?) - that would let us or the client know that it still remains and should be addressed. Additionally, perhaps there could be a status for these as "Compensated" - so that the risk exists but is documented as having a compensating control. Documentation on this would be helpful too.

Hello, We have begun validating the findings from the Microsoft 365 Security Inspector report against the live tenant configuration and have identified several items that appear to be false positives or may be based on stale detection data. Finding #12 – Mailbox Auditing Should be Enabled at Tenant Level We validated the tenant configuration using: Get-OrganizationConfig | Select AuditDisabled Resultes: AuditDisabled : False Finding #99 – Mailboxes Without Mailbox Auditing Enabled Because mailbox auditing is enabled globally (AuditDisabled : False), this finding may be relying on mailbox-level settings that have been superseded by the tenant-wide configuration. We would appreciate clarification on how this finding was generated. Finding #71 – Unified Audit Log Search Is Not Enabled Get-AdminAuditLogConfig UnifiedAuditLogIngestionEnabled : False However, when querying the Unified Audit Log: Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -ResultSize 5 the command successfully returned multiple recent audit events. This confirms that audit records are actively being collected and are searchable within the tenant. Based on this validation, the finding appears inconsistent with the current tenant state. Finding #72 – External Sender Message Tagging Not Enabled We validated using: Get-ExternalInOutlook Results: Enabled : True External sender tagging is currently enabled in the tenant, therefore this finding also appears to be a false positive. Request Could you please review the detection methodology and scan results associated with Findings #12, #71, #72, and #99 and advise why these findings were reported despite the current tenant configuration indicating otherwise? We are continuing validation of the remaining findings and wanted to raise these discrepancies before proceeding with remediation efforts. Thank you, Jason Johnson President Streamline Networks, Inc.

Create a filter that allows blocking PSA alerts for vulnerabilities for an officially unsupported OS.

Create a filter that allows blocking PSA alerts for vulnerabilities for an officially unsupported OS.

Currently a scan job (local probes and external scanner) can be hung up and fail for literal months, and there's no automated action or alerting. You're forced to manually dig through job logs in multiple places to manually validate scanning consistency.

For a few clients that have regular auditing sessions, we have been asked to provide details about when vulnerabilities were originally published. I'm wondering if it would be possible to have this as an available column in the Vulnerabilities Dashboard. In some cases, if a vulnerability hasn't been addressed otherwise, we are asked to provide additional context including original publish date.

Would really be great to be able to uninstall the agent as well as delete the agent from all reporting with one action without having to perform multiple steps.

Looking to enhance our Suppression capabilities. Is it possible to have the Include/Exclude Tags filter available when setting a Suppression? Example: I click to Suppress a set of vuls and in the menu we display the Include/Exclude Tags

Browser Extensions Vulnerability Scanning

Set Vulnerability SLA for remediations