Discover how to set up advanced vulnerability scans with the Unified Security Stack agent, schedule scans automatically, and produce compliance reports. Network scans work well for external exposure, but agent-based scans provide deep insight into internal host vulnerabilities that network scans are unable to detect.
Understanding Scan Types
Selecting the appropriate scan type is essential for complete vulnerability management. Refer to the table below to identify the scan that matches your present requirements:
| Scan Type | Visibility | Primary Use Case |
|---|---|---|
| Network Scan | External | Determining what is visible to the network, including open ports and external services. |
| Application Scan | Internal (Agent) | Examining applications installed on the host and associating them with known CVEs. |
| Binary Scan | Internal (Agent) | Detecting vulnerable embedded libraries (like outdated log4j elements) concealed within applications. |
Never presume a network scan will check internal software or local host vulnerabilities. Agent-based scans are required to examine internal application and component issues.
Running Agent-Based Scans
After deploying your agents, you can perform application and binary scans to uncover internal vulnerabilities.
- 1
Verify target scope
Double-check your target IPs and scan scope so you know you are scanning the right systems. Make sure the agent is actively communicating with the server.
- 2
Run an application-level scan
Start an application scan to examine the software installed on the host. Review the findings to see which installed applications have vulnerabilities tied to known CVEs.
- 3
Run a binary scan
Choose a binary scan to examine application components at a deeper level. This step is essential for detecting vulnerable embedded libraries that standard application scans could overlook.
- 4
Prioritize remediation
Examine the results from both scans. Focus first on patching or mitigating vulnerable components embedded within critical applications, since they can leave the system open to compromise.
Scheduling Scans and Exporting Reports
To keep continuous visibility without depending on manual runs, set your scans to run on an automated schedule.
flowchart LR
A["Scheduled Scan"] --> B["Review Findings"]
B --> C["Update Statuses"]
C --> D["Export PDF Report"]Automate the schedule: Set your application and binary scans to run on a repeating schedule.
Clean up statuses: Check the dashboard and change the status of every finding (for example, mitigated, false positive, resolved).
Generate the report: Access the dashboard and export the results as a PDF. This exported PDF can serve as supporting documentation for compliance reviews and auditors.
Always update vulnerability statuses before exporting your reports. Generating reports after a status cleanup lessens follow-up work for auditors and engineers and ensures the report reflects the accurate remediation state.
Best Practices
Managing False Positives
Be careful when interpreting false positives. Always validate findings manually before closing them, so you do not overlook a legitimate threat.
Standardizing Status Updates
Maintain consistent reporting by standardizing status updates across your team. Reach agreement on when to apply particular tags such as mitigated, false positive, or resolved.
Combining Scan Strategies
For an optimal security posture, combine network scans for external exposure checks with agent scans for internal host visibility. Neither method is a substitute for the other.
Keep the contact information for the Unified Security Stack installation and configuration team close at hand for any credential or agent setup questions that arise during deployment.