Current Vulnerabilities Breakdown

Current Vulnerabilities Breakdown report provides a breakdown of current vulnerable hosts and vulnerability instances ranked by count severity with vulnerability detail. Use this report to gain insights into the effectiveness of your vulnerability management, help prioritize your efforts, and focus on specific areas in your environment.

To access the Current Vulnerabilities Breakdown report:

  1. In the Alert Logic console, click the menu icon (), and then click Validate.
  2. Click Reports, and then click Vulnerabilities.
  3. Under Current Vulnerability Breakdown, click VIEW.
  4. Click Current Vulnerabilities Breakdown.

Filter the report

To refine your findings, filter your report by Customer Account, Deployment Name, VPC/Network, Asset Type, Category, Severity, and CVSS Score.

Filter the report using drop-down menus

By default, Alert Logic includes (All) filter values in the report. You must select a single value in each filter to see the report.

Schedule the report

After you finish setting up the report, you can use CREATE REPORT to run it periodically and subscribe users or an integration (such as a webhook) to receive a notification when the report is generated. To learn how to schedule the report and subscribe notification recipients, see Scheduled Reports and Notifications.

Vulnerability categories

Alert Logic discovers several types of vulnerabilities, which are divided into categories, and referred to in sections of the report:

  • Agent: Security vulnerability results detected by agent-based scans (on hosts with Agent-Based Scanning)
  • Cloud Configuration: Security vulnerabilities detected by cloud/CIS compliance checks
  • Credentials: Security vulnerabilities detected by credentialed internal network scans
  • External: Security vulnerabilities detected by external network scans
  • Network: Security vulnerabilities detected by unauthenticated internal network scans

CVSS severity categories

Alert Logic uses CVSS scores to measure the severity of vulnerabilities, which are divided into levels, and referenced to in some sections of this report.

Alert Logic assigns each vulnerability instance with a severity rating based on the CVSS score set by the National Institute of Standards and Technology (NIST) and reported to the National Vulnerability Database. Alert Logic supports both CVSS v2 and CVSS v3 scores.

Severity rating CVSS v2 score range CVSS v3 score range
Critical Not applicable 9.0 - 10.0
High 7.0 - 10.0 7.0 - 8.9
Medium 4.0 - 6.9 4.0 - 6.9
Low 0.1 - 3.9 0.1 - 3.9
Informational 0.0 0.0

Some vulnerabilities in the National Vulnerability Database have both CVSS v2 and CVSS v3 scores. Alert Logic displays the newer CVSS v3 score and severity rating in prominent locations and both scores in detail views. If only one CVSS score exists, Alert Logic uses that score and severity rating.

Vulnerability Instances section

This section provides the current total number of vulnerability instances found in the selected filters.

Vulnerable Assets section

This section provides the current total number of assets with vulnerabilities in the selected filters.

Vulnerability Severities section

This section provides the current vulnerability count in each CVSS severity category in the selected filters.

Vulnerabilities by Age

This section provides the current vulnerability count in each age category in the selected filters.

Most Vulnerable Services

The list provides the current most vulnerable services based on vulnerability count in the selected filters. The list is organized by service name, count of vulnerabilities, percentage, and a bar graph representing the vulnerability count.

Top 10 Vulnerabilities by Asset Count

The list provides the current top 10 vulnerabilities based on asset count in the selected filters. The list is organized by vulnerability name, CVSS score, severity, asset count, and a bar graph representing the asset count.

Vulnerabilities Breakdown Details section

The list provides the current breakdown of vulnerabilities based on the vulnerability severity and impacted assets in a deployment in the selected filters. The list is organized by vulnerability, CVSS score, severity, deployment name, impacted asset name, IP address, protocol and port, the first it was seen, and the last time it was found in a scan.