Changes for page Schwachstellen Management

Summary

• Page properties (1 modified, 0 added, 0 removed)

Details

Page properties

Content

...	...	@@ -3,19 +3,19 @@
3	3	= General =
4	4
5	5	Vulnerabilities management is a software solution that enables automatic detection of predefined security gaps. Due to increasing threats on the Internet and deprecated and unupdated programmes, vulnerabilities management combines all these points and offers centralised management to prevent problems: Vulnerabilities found in your network are clearly listed and displayed, and also provide insight into the individual clients affected by the security gaps.
6		-Vulnerability Management is full integrated into ACMP and essentially goes through three steps: First, the ACMP Server must download or update the vulnerability definition file. Then, the vulnerability scanner must run on the client. Once the scan has been completed, the findings are transmitted to the ACMP Server and are available for continuing evaluation in ACMP.
	6	+Vulnerability Management is full integrated into acmp and essentially goes through three steps: First, the acmp Server must download or update the vulnerability definition file. Then, the vulnerability scanner must run on the client. Once the scan has been completed, the findings are transmitted to the acmp Server and are available for continuing evaluation in acmp.
7	7	The entries are summarised for you in a table, in a grid. There you will find various info about the vulnerability (CVE ID and caption), as well as the respective severity and how many clients are affected by the security vulnerability.
8	8
9		-If you see a need for action to eliminate the vulnerabilities found, you can now create dynamic containers that can then be sent to the affected clients using a [[Client Command>>doc:ACMP.69.ACMP-Solutions.Desktop Automation.Client Commands.Client Command erstellen.WebHome]], a [[Windows Update Collection>>doc:ACMP.69.ACMP-Solutions.Patch Management.Windows Update Management.Windows Update Collection.WebHome]] or a [[Managed Software Updates>>doc:ACMP.69.ACMP-Solutions.Patch Management.Managed Software.Managed Software verteilen.WebHome]] Alternatively, you can also send the desired action directly to the affected clients. The aim of vulnerability management is to identify potential security vulnerabilities so that they can be eliminated.
	9	+If you see a need for action to eliminate the vulnerabilities found, you can now create dynamic containers that can then be sent to the affected clients using a [[Client Command>>doc:ACMP.610.ACMP-Solutions.Desktop Automation.Client Commands.Client Command erstellen.WebHome]], a [[Windows Update Collection>>doc:ACMP.610.ACMP-Solutions.Patch Management.Windows Update Management.Windows Update Collection.WebHome]] or a [[Managed Software Updates>>doc:ACMP.610.ACMP-Solutions.Patch Management.Managed Software.Managed Software verteilen.WebHome]] Alternatively, you can also send the desired action directly to the affected clients. The aim of vulnerability management is to identify potential security vulnerabilities so that they can be eliminated.
10	10
11	11	{{box}}
12	12	**What is a vulnerability?**
13		-In the ACMP context, a vulnerability refers to a known and publicly documented security gap within software or hardware. The data is based on the CVE (Common Vulnerabilities and Exposures) system, which is based on the US standard and is commonly used worldwide. The vulnerabilities listed here are structured according to a clear naming convention: they consist of the prefix "CVE", the year and the ID, which stands for the sequential identifier (e.g. "CVE-2024-4450").
	13	+In the acmp context, a vulnerability refers to a known and publicly documented security gap within software or hardware. The data is based on the CVE (Common Vulnerabilities and Exposures) system, which is based on the US standard and is commonly used worldwide. The vulnerabilities listed here are structured according to a clear naming convention: they consist of the prefix "CVE", the year and the ID, which stands for the sequential identifier (e.g. "CVE-2024-4450").
14	14	{{/box}}
15	15
16	16	== Strucuture of Vulnerability Management ==
17	17
18		-The //Vulnerability Management// plugin consists of various tabs, starting with the dashboard, where you can view relevant information about vulnerabilities in your company in a clearly summarised form (see "The Dashboard in Vulnerability Management"). The //[[detected Vulnerabilities>>doc:||anchor="HEntdeckteSchwachstellen"]] //tab lists all security vulnerabilities that have been discovered on at least one client in your environment. Under [[globally excluded Vulnerabilities>>doc:||anchor="HGlobalundlokalausgeschlosseneSchwachstellen"]], you will find vulnerabilities that have been excluded globally (for all known findings and possible future ones). This affects the entire vulnerability. [[Locally excluded Vulnerabilities>>doc:||anchor="HGlobalundlokalausgeschlosseneSchwachstellen"]] are only explicitly excluded for the selected clients and not for all of them.
	18	+The //Vulnerability Management// plugin consists of various tabs, starting with the dashboard, where you can view relevant information about vulnerabilities in your company in a clearly summarised form (see "The Dashboard in Vulnerability Management"). The //[[detected Vulnerabilities>>doc:||anchor="HDetectedVulnerabilities"]] //tab lists all security vulnerabilities that have been discovered on at least one client in your environment. Under [[globally excluded Vulnerabilities>>doc:||anchor="HGlobalandlocallyexcludedVulnerabilites"]], you will find vulnerabilities that have been excluded globally (for all known findings and possible future ones). This affects the entire vulnerability. [[Locally excluded Vulnerabilities>>doc:||anchor="HGlobalandlocallyexcludedVulnerabilites"]] are only explicitly excluded for the selected clients and not for all of them.
19	19
20	20	== Preparations for Vulnerability Management ==
21	21
...	...	@@ -24,20 +24,20 @@
24	24	=== **Pre-Configurations:** ===
25	25
26	26	|**Valid licence**|Ensure that you have a valid license for vulnerability management. You will also need this when testing the module. The license can be requested or activated via your sales representative.
27		-|**Enable vulnerability scanner**|By default, the vulnerability scanner is disabled when ACMP is started up and must therefore be enabled. The scanner should generally be enabled in the [[Agent Tasks>>doc:ACMP.69.ACMP-Solutions.Client-Management.Agentenplaner.WebHome]] (//Client Management// > //Agent Tasks//) so that all clients are scanned. Navigate to the console area, select the //Vulnerability Scanner// job for the //Windows// operating system, and open the start conditions by double-clicking. Tick the //Enabled //checkbox and change the start condition as required (default: start interval: once a day).
28		-Alternatively, the vulnerability scanner can also be executed manually for individual Clients via the [[Query Management>>doc:ACMP.69.ACMP-Solutions.Client-Management.Abfrageverwaltung.WebHome]].{{aagon.warnungsbox}}Bear in mind that executing the vulnerability scanner puts a load on your systems. Therefore, set the start conditions so that the scanner is not executed at times when the load is generally high.{{/aagon.warnungsbox}}
29		-|**Zugriff auf ein File Repository**|It is also necessary that the clients to be scanned for vulnerabilities have access to a [[File Repository>>doc:ACMP.69.ACMP-Solutions.System.Verteilte File Repositories.WebHome]] containing the content of the "vulnerability definition files". These files are responsible for detecting new security vulnerabilities in your system and synchronising the list. Also ensure that the ACMP Server is connected to the internet so that it can download the updates. To do this, check that the [[necessary URLs>>doc:ACMP.69.ACMP installieren.Checkliste zur Installation.WebHome]] are shared via network share so that the resources can be accessed.
	27	+|**Enable vulnerability scanner**|By default, the vulnerability scanner is disabled when acmp is started up and must therefore be enabled. The scanner should generally be enabled in the [[Agent Tasks>>doc:ACMP.610.ACMP-Solutions.Client-Management.Agentenplaner.WebHome]] (//Client Management// > //Agent Tasks//) so that all clients are scanned. Navigate to the console area, select the //Vulnerability Scanner// job for the //Windows// operating system, and open the start conditions by double-clicking. Tick the //Enabled //checkbox and change the start condition as required (default: start interval: once a day).
	28	+Alternatively, the vulnerability scanner can also be executed manually for individual Clients via the [[Query Management>>doc:ACMP.610.ACMP-Solutions.Client-Management.Abfrageverwaltung.WebHome]].{{aagon.warnungsbox}}Bear in mind that executing the vulnerability scanner puts a load on your systems. Therefore, set the start conditions so that the scanner is not executed at times when the load is generally high.{{/aagon.warnungsbox}}
	29	+|**Zugriff auf ein File Repository**|It is also necessary that the clients to be scanned for vulnerabilities have access to a [[File Repository>>doc:ACMP.610.ACMP-Solutions.System.Verteilte File Repositories.WebHome]] containing the content of the "vulnerability definition files". These files are responsible for detecting new security vulnerabilities in your system and synchronising the list. Also ensure that the acmp Server is connected to the internet so that it can download the updates. To do this, check that the [[necessary URLs>>doc:ACMP.610.ACMP installieren.Checkliste zur Installation.WebHome]] are shared via network share so that the resources can be accessed.
30	30
31	31	=== **Assign permissions** ===
32	32
33		-To be prepared for later work in Vulnerabilities Management, you should check the user permissions in advance to ensure that they are correct. To do this, open the permissions for the respective user group or user in [[User Management>>doc:ACMP.69.ACMP-Solutions.System.Benutzerverwaltung.WebHome]] (//System// > //User Management//). To do this, navigate to the wizard page //"Rights// //of the// //user"// > //Security// > //Vulnerability// //Management// and tick the necessary checkboxes. In order to be able to use all functions of the plugin, you should assign full rights (e.g. to exclude vulnerabilities later or to reverse this exclusion).
	33	+To be prepared for later work in Vulnerabilities Management, you should check the user permissions in advance to ensure that they are correct. To do this, open the permissions for the respective user group or user in [[User Management>>doc:ACMP.610.ACMP-Solutions.System.Benutzerverwaltung.WebHome]] (//System// > //User Management//). To do this, navigate to the wizard page //"Rights// //of the// //user"// > //Security// > //Vulnerability// //Management// and tick the necessary checkboxes. In order to be able to use all functions of the plugin, you should assign full rights (e.g. to exclude vulnerabilities later or to reverse this exclusion).
34	34
35		-[[Distribute necessary permissions for Vulnerability Management>>image:69_Schwachstellen Management_Rechtevergabe_1119.png]]
	35	+[[Distribute necessary permissions for Vulnerability Management>>image:69_Schwachstellen Management_Rechtevergabe_1119.png||data-cmp-info="10"]]
36	36
37		-Once you have completed the necessary preparatory work, you can begin the actual task. Navigate to Vulnerabilities Management (//Security// > //Vulnerabilities Management//) and first ensure that the definition files are current. To do this, click on the ribbon bar [[image:1762153038500-794.png]] //Update vulnerability definition file//. The scheduled server task will start shortly. You can view the status of the job directly in the dashboard, in the //Download Statistics// widget. Otherwise, no data is available yet and the widgets remain empty.
	37	+Once you have completed the necessary preparatory work, you can begin the actual task. Navigate to Vulnerabilities Management (//Security// > //Vulnerabilities Management//) and first ensure that the definition files are current. To do this, click on the ribbon bar [[image:1762153038500-794.png||data-cmp-info="10"]] //Update vulnerability definition file//. The scheduled server task will start shortly. You can view the status of the job directly in the dashboard, in the //Download Statistics// widget. Otherwise, no data is available yet and the widgets remain empty.
38	38
39	39	{{box}}
40		-**General note on the duration of the definition file download**: Depending on the load on the ACMP Server and the SQL Server, updating the definition file may take a long time. If you perform a vulnerabilities scan during this time, it will end in an error. Recommendation: When updating the definition file for the first time, check the CPU load of the ACMP Server service and the SQL Server service in Task Manager. Once the load of both processes has returned to normal, the definitions have been updated in full.
	40	+**General note on the duration of the definition file download**: Depending on the load on the acmp Server and the SQL Server, updating the definition file may take a long time. If you perform a vulnerabilities scan during this time, it will end in an error. Recommendation: When updating the definition file for the first time, check the CPU load of the acmp Server service and the SQL Server service in Task Manager. Once the load of both processes has returned to normal, the definitions have been updated in full.
41	41	{{/box}}
42	42
43	43	= The dashboard in Vulnerability Management =
...	...	@@ -51,23 +51,23 @@
51	51	* Vulnerabilities with highest score
52	52
53	53	{{box}}
54		-**Tip**: If you want to make changes to the display or positioning of the widgets, you can do so by following the corresponding [[instructions>>doc:ACMP.69.Arbeiten mit der ACMP Console.Aufbau der Console.Arbeitsbereich.Dashboards.WebHome]].
	54	+**Tip**: If you want to make changes to the display or positioning of the widgets, you can do so by following the corresponding [[instructions>>doc:ACMP.610.Arbeiten mit der ACMP Console.Aufbau der Console.Arbeitsbereich.Dashboards.WebHome]].
55	55	{{/box}}
56	56
57	57	If the widgets have not yet been filled with dates, you may need to take the necessary precautions mentioned above.
58	58
59	59
60		-[[Overview of widgets in the Vulnerabilities Management Dashboard>>image:69_Schwachstellen Management Übersicht_1919.png]]
	60	+[[Overview of widgets in the Vulnerabilities Management Dashboard>>image:69_Schwachstellen Management Übersicht_1919.png||data-cmp-info="10"]]
61	61
62	62	|**Widget**|**Description**
63	63	|Download statistics|(((
64	64	The download statistics in Vulnerability Management provide you with info about when the last update was checked for and when the definition file was last downloaded. When finding updates, various status messages may be listed after the time (e.g. ‘OK’, ‘Latest vulnerability definition files have already been downloaded’), which may also indicate an error message. This may be the case, for example, if the server could not be reached and therefore no new file could be imported. In this case, click on //Update vulnerability definition file //in the ribbon bar again and wait for the new result.
65	65
66		-Please note that only one file will be downloaded if a new version is available. The file is updated based on the start condition specified in the [[scheduled server tasks>>doc:ACMP.69.ACMP-Solutions.System.Einstellungen.ACMP Server.WebHome||anchor="HGeplanteServeraufgaben"]] (//System// > //Settings //> //ACMP// //Server// > //Scheduled Server Tasks//) (Default: Start every five hours).
	66	+Please note that only one file will be downloaded if a new version is available. The file is updated based on the start condition specified in the [[scheduled server tasks>>doc:ACMP.610.ACMP-Solutions.System.Einstellungen.ACMP Server.WebHome||anchor="HScheduledServerTasks"]] (//System// > //Settings //> //acmp// //Server// > //Scheduled Server Tasks//) (Default: Start every five hours).
67	67	\\If you manually initiate the download during working time and the message "Latest vulnerability definition files have already been downloaded" is displayed, there have been no changes to the file and you are up to date. However, if a file is updated on the update server during the day, it will be reinstalled with the next download.
68	68	)))
69	69	|All Clients grouped by severity|(((
70		-This widget displays all clients, group by the severity levels found. You can view this information in detail in a query. The widget itself presents the results in the form of a pie chart. The adjacent legend uses colours to indicate the highest security vulnerability found on the client and its weighting (see also "[[Weighting and severity of Vulnerabilities>>doc:||anchor="HGewichtungundSchweregradvonSchwachstellen"]]").
	70	+This widget displays all clients, group by the severity levels found. You can view this information in detail in a query. The widget itself presents the results in the form of a pie chart. The adjacent legend uses colours to indicate the highest security vulnerability found on the client and its weighting (see also "[[Weighting and severity of Vulnerabilities>>doc:||anchor="HWeightingandseverityofVulnerabilities"]]").
71	71	)))
72	72	|Clients with most vulnerabilities|(((
73	73	The widget displays the clients with the most vulnerabilities. If you would like more information and details, you can click on //Display details in query// in the lower right corner. The query opens in a new window. If you click on the client in the bar chart, you can also display the individual client details from there. There, in the //Discovered Vulnerabilities //tab, you will see the individually listed vulnerabilities, including all details.
...	...	@@ -74,7 +74,7 @@
74	74	)))
75	75	|Vulnerabilities affecting most Clients|This widget shows the vulnerabilities that occur most frequently in the scanned environment. The results are collected according to their frequency and displayed in a table. As in the other areas of the dashboard, you can also view the details in a query.
76	76	|Vulnerabilities with highest score|(((
77		-The widget displays the vulnerabilities sorted by the highest (CVSS) rating. By default, the sorting is from high to low. The grid items can be filtered, sorted and grouped as desired (see also chapter [[Setting up a grid in ACMP>>doc:ACMP.69.Arbeiten mit der ACMP Console.Aufbau der Console.Arbeitsbereich.Aufbau eines Grids in ACMP.WebHome]]). Call up more info about the results via Details in //Query Display//.
	77	+The widget displays the vulnerabilities sorted by the highest (CVSS) rating. By default, the sorting is from high to low. The grid items can be filtered, sorted and grouped as desired (see also chapter [[Structure of a grid in acmp>>doc:ACMP.610.Arbeiten mit der ACMP Console.Aufbau der Console.Arbeitsbereich.Aufbau eines Grids in ACMP.WebHome]]). Call up more info about the results via Details in //Query Display//.
78	78	)))
79	79
80	80	== Properties of the fields in the Vulnerability grid ==
...	...	@@ -82,7 +82,7 @@
82	82	Below you will find explanations and meanings for the fields that provide a summary of the information in the vulnerability grid.
83	83
84	84	{{aagon.infobox}}
85		-Please note that the availability of the properties depends on which tab you are in (for example, ‘Vulnerability Exclusion Description’ and ‘Vulnerability Exclusion Creation of’ are only available in the global/local excluded vulnerabilities tabs and not under detected vulnerabilities).
	85	+Please note that the availability of the properties depends on which tab you are in (for example, "Vulnerability Exclusion Description" and "Vulnerability Exclusion Creation of" are only available in the global/local excluded vulnerabilities tabs and not under detected vulnerabilities).
86	86	{{/aagon.infobox}}
87	87
88	88	|**Properties**|**Description**
...	...	@@ -101,7 +101,7 @@
101	101	|Computer Name|Returns the computer name on which the vulnerability was found.
102	102
103	103	{{box}}
104		-**Tip**: In the chapter "[[Structure of a grid in ACMP>>doc:ACMP.69.Arbeiten mit der ACMP Console.Aufbau der Console.Arbeitsbereich.Aufbau eines Grids in ACMP.WebHome]]", you will find general tips and advice on how to sort, filter or group items according to your preferences.
	104	+**Tip**: In the chapter "[[Structure of a grid in acmp>>doc:ACMP.610.Arbeiten mit der ACMP Console.Aufbau der Console.Arbeitsbereich.Aufbau eines Grids in ACMP.WebHome]]", you will find general tips and advice on how to sort, filter or group items according to your preferences.
105	105	{{/box}}
106	106
107	107	== Weighting and severity of Vulnerabilities ==
...	...	@@ -112,31 +112,31 @@
112	112
113	113	|**(CVSS) Severity**|**CVSS Weighting**|**Description**
114	114	|(((
115		-[[image:Kritisch.png]] Critical
	115	+[[image:Kritisch.png||data-cmp-info="10"]] Critical
116	116	)))|10,0 – 9,0|A security vulnerability with a severity rating of ‘critical’ requires immediate action, as it indicates a high risk of potential attackers. This type of vulnerability can be mitigated, for example, by installing a suitable patch that fixes the vulnerability.
117	117	|(((
118		-[[image:Hoch.png]] High
	118	+[[image:Hoch.png||data-cmp-info="10"]] High
119	119	)))|8,9 – 7,0|A vulnerability with a severity rating of ‘high’ indicates a security vulnerability that can have serious consequences for a system and enable attackers to gain unauthorised access to sensitive systems. This may result in the loss of large amounts of data or system failures.
120	120	|(((
121		-[[image:Mittel.png]] Medium
	121	+[[image:Mittel.png||data-cmp-info="10"]] Medium
122	122	)))|6,9 – 4,0|A medium-level vulnerability often refers to security gaps characterised by social engineering (i.e. the same presence in the same network) or restricted access to an affected system. The severity also depends on various metrics (e.g. technical exploitability of the security gap and the impact on the affected system).
123	123	|(((
124		-[[image:Niedrig.png]] Low
	124	+[[image:Niedrig.png||data-cmp-info="10"]] Low
125	125	)))|3,9 – 0,1|Security vulnerabilities classified as ‘low’ pose a significantly lower risk than the severity levels listed above. With a low security vulnerability, it is often necessary to have local or physical access to a system in order to cause damage.
126	126	|(((
127		-[[image:Informativ.png]] Informational
	127	+[[image:Informativ.png||data-cmp-info="10"]] Informational
128	128	)))|0|A CVE vulnerability with an informative value does not pose any threat.
129	129	|(((
130		-[[image:Kein Schweregrad definiert.png]] Severity not defined
	130	+[[image:Kein Schweregrad definiert.png||data-cmp-info="10"]] Severity not defined
131	131	)))|-1|A vulnerability with a value of -1 is a security vulnerability for which no severity has (yet) been defined.
132	132	|(((
133		-[[image:Keine Schwachstelle.png]] No Vulnerabilities
	133	+[[image:Keine Schwachstelle.png||data-cmp-info="10"]] No Vulnerabilities
134	134	)))|-|Clients on which no vulnerabilities were found receive this classification.
135	135	|(((
136		-[[image:Management nicht möglich.png]] Management not possible
	136	+[[image:Management nicht möglich.png||data-cmp-info="10"]] Management not possible
137	137	)))|-|"Management not possible" may appear as a status, for example, if you have created manual clients in your network that cannot be managed continuing.
138	138	|(((
139		-[[image:Keine Scandaten.png]] No Scan Data
	139	+[[image:Keine Scandaten.png||data-cmp-info="10"]] No Scan Data
140	140	)))|-|Clients that can be scanned but have not yet been scanned and have not submitted vulnerability data have this severity rating.
141	141
142	142	= Detected Vulnerabilities =
...	...	@@ -147,11 +147,11 @@
147	147	If you select the Show all vulnerabilities option, this may result in very long loading times, as a large amount of data must be loaded.
148	148	{{/aagon.infobox}}
149	149
150		-[[Example of a selected vulnerability in the Discovered Vulnerabilities tab>>image:69_Schwachstellen Management_Entdeckte Schwachstellen_131.png]]
	150	+[[Example of a selected vulnerability in the Discovered Vulnerabilities tab>>image:69_Schwachstellen Management_Entdeckte Schwachstellen_131.png||data-cmp-info="10"]]
151	151
152		-Actions can be conveniently executed via the ribbon bar or from the context menu. Here you can decide, for example, whether to exclude a security vulnerability globally or locally. An exclusion is used to remove irrelevant vulnerabilities from the count. Global exclusions apply to all known and possible future findings of a vulnerability (all clients), while local exclusions only apply to the selected clients. Select the desired number of vulnerabilities in the grid and select the respective button for a global ([[image:1762157012971-571.png]]) or local ([[image:1762157012971-207.png]]) exclusion of the vulnerability and enter a reason for the exclusion. Refresh ([[image:1762157012971-547.png]]) the current view of the discovered vulnerabilities or create a container for the selected vulnerability directly from the window ([[image:1762157012971-618.png]]). The action //Add selected vulnerabilities to an existing container //also allows you to add selected vulnerabilities to an existing container. If you have already created a container for a vulnerability, you can navigate to it using the [[image:1762157012972-692.png]] //Switch to Container// button; otherwise the button will be greyed out.
	152	+Actions can be conveniently executed via the ribbon bar or from the context menu. Here you can decide, for example, whether to exclude a security vulnerability globally or locally. An exclusion is used to remove irrelevant vulnerabilities from the count. Global exclusions apply to all known and possible future findings of a vulnerability (all clients), while local exclusions only apply to the selected clients. Select the desired number of vulnerabilities in the grid and select the respective button for a global ([[image:1762157012971-571.png||data-cmp-info="10"]]) or local ([[image:1762157012971-207.png||data-cmp-info="10"]]) exclusion of the vulnerability and enter a reason for the exclusion. Refresh ([[image:1762157012971-547.png||data-cmp-info="10"]]) the current view of the discovered vulnerabilities or create a container for the selected vulnerability directly from the window ([[image:1762157012971-618.png||data-cmp-info="10"]]). The action //Add selected vulnerabilities to an existing container //also allows you to add selected vulnerabilities to an existing container. If you have already created a container for a vulnerability, you can navigate to it using the [[image:1762157012972-692.png||data-cmp-info="10"]] //Switch to Container// button; otherwise the button will be greyed out. You can also attach the selected vulnerability directly to the container using the //[[image:Schwachstelle dem Container hinzufügen Icon.png||data-cmp-info="10" height="21" width="19"]]Add vulnerability to container //action.
153	153
154		-The grid contains various details about the vulnerabilities detected, providing you with initial notes on the severity, the affected Clients and the time when the vulnerability was detected. A detailed list of the properties of the fields in the grid can be found [[here>>doc:||anchor="HEigenschaftenderFelderimSchwachstellenGrid"]].
	154	+The grid contains various details about the vulnerabilities detected, providing you with initial notes on the severity, the affected Clients and the time when the vulnerability was detected. A detailed list of the properties of the fields in the grid can be found [[here>>doc:||anchor="HPropertiesofthefieldsintheVulnerabilitygrid"]].
155	155
156	156	At the bottom, you will find three more tabs with detailed information about the selected vulnerability: //General//, //Affected Products//, and //Affected Elements//.
157	157
...	...	@@ -166,30 +166,30 @@
166	166	As long as you have not selected a client, the elements of all affected clients will be displayed.
167	167	{{/aagon.infobox}}
168	168
169		-The tab is divided into two areas: On the left, you can see the clients affected by the vulnerability. Double-click on the client to open the [[Client Details>>doc:ACMP.69.ACMP-Solutions.Client-Management.Abfrageverwaltung.Abfragen auswerten.WebHome]] for the Vulnerability. Alternatively, you can use the window to exclude the vulnerability locally on the selected client ([[image:1762157042989-970.png]]), so that it is listed under the //Locally excluded vulnerabilities //tab and removed from the count of affected clients.
	169	+The tab is divided into two areas: On the left, you can see the clients affected by the vulnerability. Double-click on the client to open the [[Client Details>>doc:ACMP.610.ACMP-Solutions.Client-Management.Abfrageverwaltung.Abfragen auswerten.WebHome||anchor="HOpenandworkwithClientDetails"]] for the Vulnerability. Alternatively, you can use the window to exclude the vulnerability locally on the selected client ([[image:1762157042989-970.png||data-cmp-info="10"]]), so that it is listed under the //Locally excluded vulnerabilities //tab and removed from the count of affected clients.
170	170
171	171	{{aagon.infobox}}
172	172	As this is a client-based exclusion for the selected client, the exclusion appears under the "local" tab and not under the "global" tab.
173	173	{{/aagon.infobox}}
174	174
175		-In addition you can execute a Windows job on all or selected Clients ([[image:1762157042990-669.png]]) (e.g. to manually fix the Vulnerability using a previously created Client Command) or to rescan ([[image:1762157042990-817.png]]) the Windows Client (to execute an [[Agent Task or Maintenance Task>>doc:ACMP.69.ACMP-Solutions.Client-Management.Agentenplaner.WebHome]]). The affected items for all clients are listed on the right, allowing you to see at a glance the name of the item, the local path, and continuing information about the last access, type, or version number.
	175	+In addition you can execute a Windows job on all or selected Clients ([[image:1762157042990-669.png||data-cmp-info="10"]]) (e.g. to manually fix the Vulnerability using a previously created Client Command) or to rescan ([[image:1762157042990-817.png||data-cmp-info="10"]]) the Windows Client (to execute an [[Agent Task or Maintenance Task>>doc:ACMP.610.ACMP-Solutions.Client-Management.Agentenplaner.WebHome]]). The affected items for all clients are listed on the right, allowing you to see at a glance the name of the item, the local path, and continuing information about the last access, type, or version number.
176	176	)))
177	177
178	178	== Create Container for a Vulnerability ==
179	179
180		-From Vulnerability Management, you can create a container for a security vulnerability directly. This can be done either via the context menu or via the action [[image:1762157557134-524.png]] //Create Container// in the ribbon bar.
	180	+From Vulnerability Management, you can create a container for a security vulnerability directly. This can be done either via the context menu or via the action [[image:1762157557134-524.png||data-cmp-info="10"]] //Create Container// in the ribbon bar.
181	181
182		-To create a container, you must first select a vulnerability from the grid and then click on the action. The [[wizard for adding>>doc:ACMP.69.ACMP-Solutions.Client-Management.Container.Container verwalten.WebHome||anchor="HContainererstellen"]] a new ACMP container opens. The main difference to the regular creation process is that the //Name //field is already filled in with the CVE ID and the vulnerability has been inserted under the //dynamic client link//. Once you have created the container, the view automatically switches to the containers (//Client Management// > //Containers//) and you will see a list of clients that fall under the vulnerability. Alternatively, you can also access it via the action [[image:1762157557134-888.png]] //Switch to Container //in the ribbon bar.
	182	+To create a container, you must first select a vulnerability from the grid and then click on the action. The [[wizard for adding>>doc:ACMP.610.ACMP-Solutions.Client-Management.Container.Container verwalten.WebHome||anchor="HManagecontainers"]] a new acmp container opens. The main difference to the regular creation process is that the //Name //field is already filled in with the CVE ID and the vulnerability has been inserted under the //dynamic client link//. Once you have created the container, the view automatically switches to the containers (//Client Management// > //Containers//) and you will see a list of clients that fall under the vulnerability. Alternatively, you can also access it via the action [[image:1762157557134-888.png||data-cmp-info="10"]] //Switch to Container //in the ribbon bar.
183	183
184	184	= Global and locally excluded Vulnerabilites =
185	185
186	186	{{aagon.infobox}}
187		-Please note that you must have the necessary permissions to exclude Vulnerabilities (see "[[Preparation for working with Vulnerabilitiy Management>>doc:||anchor="HVorbereitungenfFCrdieArbeitenimSchwachstellenManagement"]]").
	187	+Please note that you must have the necessary permissions to exclude Vulnerabilities (see "[[Preparation for working with Vulnerabilitiy Management>>doc:||anchor="HPreparationsforVulnerabilityManagement"]]").
188	188	{{/aagon.infobox}}
189	189
190		-You can specify global and locally excluded Vulnerabilities by clicking either //global //([[image:1762157671398-337.png]])// //or //exclude locally //([[image:1762157671399-248.png]]) under //Detected Vulernabilities //in the ribbon bar. The process for both types of exclusion is identical: Select the vulnerability or vulnerabilities you want to exclude in the grid and click the corresponding button. Enter a reason for the exclusion and confirm the window with //Yes//. You can then see the reason for the exclusion in the grid field in the other tabs (global or local).
	190	+You can specify global and locally excluded Vulnerabilities by clicking either //global //([[image:1762157671398-337.png||data-cmp-info="10"]])// //or //exclude locally //([[image:1762157671399-248.png||data-cmp-info="10"]]) under //Detected Vulernabilities //in the ribbon bar. The process for both types of exclusion is identical: Select the vulnerability or vulnerabilities you want to exclude in the grid and click the corresponding button. Enter a reason for the exclusion and confirm the window with //Yes//. You can then see the reason for the exclusion in the grid field in the other tabs (global or local).
191	191
192		-[[Example of global excluded vulnerabilities>>image:Screenshot 2025-09-30 155504.png]]
	192	+[[Example of global excluded vulnerabilities>>image:Screenshot 2025-09-30 155504.png||data-cmp-info="10"]]
193	193
194	194
195	195	In the event of a global exclusion, the discovered vulnerability is removed from the table and listed in the other tab (global).
...	...	@@ -209,7 +209,7 @@
209	209	Please note that local exclusions are based on client-based information. Therefore, if you have selected a vulnerability for multiple clients that is excluded locally, the information will be listed multiple times in the grid under the "CVE ID" entry.
210	210	{{/aagon.infobox}}
211	211
212		-To undo or remove an exclusion, select the vulnerability in the relevant tab (global or locally excluded vulnerabilities) and then click on [[image:1762157798308-610.png]] //Remove exclusion //in the ribbon bar or open the action field via the context menu. Confirm the security question here as well so that the security vulnerability is removed and listed under the //Discovered Vulnerabilities //tab.
	212	+To undo or remove an exclusion, select the vulnerability in the relevant tab (global or locally excluded vulnerabilities) and then click on [[image:1762157798308-610.png||data-cmp-info="10"]] //Remove exclusion //in the ribbon bar or open the action field via the context menu. Confirm the security question here as well so that the security vulnerability is removed and listed under the //Discovered Vulnerabilities //tab.
213	213
214	214	If you would like to edit the reason for an exclusion afterwards, you can do so using the context menu action of the same name (//Edit Reason for Exclusion//).
215	215
...	...	@@ -221,19 +221,19 @@
221	221
222	222	Actions in the client details can only be executed via the quick selection menu at the top. The view is divided into individual tabs and the vulnerabilities listed in a table. If you select a vulnerability in the grid, you can find detailed information in the lower area.
223	223
224		-[[Example view of a client's vulnerabilities>>image:69_Schwachstellen Management_ Beispielansicht der Schwachstellen eines Clients_894.png]]
	224	+[[Example view of a client's vulnerabilities>>image:69_Schwachstellen Management_ Beispielansicht der Schwachstellen eines Clients_894.png||data-cmp-info="10"]]
225	225
226	226
227	227	= Vulnerabilities History =
228	228
229		-Starting with ACMP version 6.9, you have the option of displaying the vulnerability history using the display fields. To do this, use "Clients" as the query base and then select the fields to be included in the query from the left-hand navigation bar (Available Fields > Vulnerabilities > Vulnerabilities History) and insert them on the right-hand side.
	229	+Starting with acmp version 6.9, you have the option of displaying the vulnerability history using the display fields. To do this, use "Clients" as the query base and then select the fields to be included in the query from the left-hand navigation bar (Available Fields > Vulnerabilities > Vulnerabilities History) and insert them on the right-hand side.
230	230
231		-[[Configuration for the vulnerabilities history>>image:69_Schwachstellen Management_Historie_926.png]]
	231	+[[Configuration for the vulnerabilities history>>image:69_Schwachstellen Management_Historie_926.png||data-cmp-info="10"]]
232	232
233	233	Complete the remaining wizard and specify any continuing configurations if necessary.
234	234
235	235	{{box}}
236		-General fnformation on the query base can also be found in the chapter of the same name in [[Query Management>>doc:ACMP.69.ACMP-Solutions.Client-Management.Abfrageverwaltung.Abfragen erstellen.Basis der Abfrage.WebHome]].
	236	+General fnformation on the query base can also be found in the chapter of the same name in [[Query Management>>doc:ACMP.610.ACMP-Solutions.Client-Management.Abfrageverwaltung.Abfragen erstellen.Basis der Abfrage.WebHome]].
237	237	{{/box}}
238	238
239	239	Important information about vulnerabilities discovered on a client is stored in historical data, allowing you to track the development of your vulnerability management or retrieve this information in the event of an audit. As soon as a new vulnerability is found on a client, a new dataset is created in the history and listed below. This includes, for example, info about when the scanner first found a vulnerability (display field "First vulnerability found") and when it last detected it ("Last known finding"). For more accurate tracking, both the date and time are stored.
...	...	@@ -248,18 +248,18 @@
248	248	|CVE ID|The CVE ID is a globally assigned identifier for a security vulnerability. It consists of the prefix ‘CVE’, the year in which the vulnerability was discovered, and the identification number, which stands for the sequential identifier (e.g. ‘CVE-2024-4450’).
249	249	|Vulnerabilities Description|The description summarises general fnformation about the vulnerability.
250	250	|Vulnerabilities Caption|The designation indicates the official name of the vulnerability. Often, the affected versions are also listed there, as well as the CVE ID again.
251		-|Exclusion created by|The creator (ACMP username) who excluded the vulnerability is specified.
	251	+|Exclusion created by|The creator (acmp username) who excluded the vulnerability is specified.
252	252	|Date of exclusion|The time of exclusion (date and time) at which the exclusion was created is recorded.
253	253	|CVSS Severity|The severity is classified into four categories of vulnerability: ‘Critical’, ‘High’, “Medium” or ‘Low’.
254	254
255	255
256	256
257		-[[Insight into the history of vulnerabilities>>image:Screenshot 2025-10-28 121918.png]]
	257	+[[Insight into the history of vulnerabilities>>image:Screenshot 2025-10-28 121918.png||data-cmp-info="10"]]
258	258
259	259	{{box}}
260	260	**How long are Vulnerability History Dates stored?**
261	261
262		-The [[server job>>doc:ACMP.69.ACMP-Solutions.System.Einstellungen.ACMP Server.WebHome||anchor="HGeplanteServeraufgaben"]] "Cleanup vulnerability history" is responsible for deleting deprecated history entries. The default value for deleting entries is 90 days. You can customize the number of days in the clean-up options and specify a different time period for how long the logs should be kept. To do this, click (double-click) on the scheduled server task and enter a different number of days. The server job should execute once a day.
	262	+The [[server job>>doc:ACMP.610.ACMP-Solutions.System.Einstellungen.ACMP Server.WebHome||anchor="HScheduledServerTasks"]] "Cleanup vulnerability history" is responsible for deleting deprecated history entries. The default value for deleting entries is 90 days. You can customize the number of days in the clean-up options and specify a different time period for how long the logs should be kept. To do this, click (double-click) on the scheduled server task and enter a different number of days. The server job should execute once a day.
263	263
264	264	**Note**: The deletion time refers to the date and time specified in the ‘Closed since’ field. Only data older than the information specified here will be deleted. Vulnerabilities that are still open will not be deleted and are not affected by the server job.
265	265	{{/box}}