Manage Vulnerability and Configuration Scans – Paramify

We know your pain and can empathize. You're tired of spending 40-60 hours a month documenting POA&Ms, reviewing many dozens of scans and hundreds of vulnerabilities. Constantly asking, “Is this a new or duplicate POA&M?”

Our goal is you never need to open scan files or spreadsheets again. Now you can automatically close resolved vulnerabilities and use duplicate detection to accurately create and update issues.

Set up your recurring assessments

Create assessment for the components in your boundary that require regular scanning. These assessments will help you track what needs to be continuously monitored and remediate the identified issues.

Set up monthly assesments of your relevant components that you run scans on.png

Select the component(s) that is the target of a monthly scan.

Select each component that is the target of a monthly scan..png

Open and close cycles based on assessment frequency. For example, your monthly FedRAMP ConMon Review. Closing cycles will automatically close resolved vulnerabilities and use duplicate detection to accurately create and update issues.

Open and close cycles based upon the assessment frequency. Each cycle will open and close and automatically update, create, and open issues.png

Start your intake workflow

During the initial assessment cycle, you must configure various properties and mappings. These settings are automatically saved, enabling you to bypass those steps in future cycles by clicking the 'Use Template from Last Cycle' option.

After setting up the assessment.png

Upload scans. These are automatically saved and associated as evidence of the issues discovered from your vulnerability and configuration scans.

Upload scans. Those will automatically be saved and associated with the issues discovered from your vulnerability and configuration scans.png

Sometimes column headers of CSV files do not start on the first row. Easily identify and set the correct row once for easy reuse month after month.

select start row.png

Map the key scan file fields one time and then reuse it for each cycle. Set it up once. Reuse again and again.

Map the key scan file fields one time and then reuse it for each cycle. Set it up once. Reuse again and again.png

If the scan file does not contain a detection date for new vulnerabilities discovered, you can set it to whenever the Scan Performed Date, which is by default the date you uploaded the file to Paramify.

use scan date.png

If needed, you can also set a different Scan Performed Date for each scan file.

select scan date.png

Identify records to be ignored

Some scan files contain results that you do not want to include with your issue and remediation management scope. Easily choose the fields and values that determine which records to ignore.

Map vulnerability risk levels to automatically set correct due dates.

Some risk levels should be ignored. You can set that by skipping those records.

After configuring the properties, select 'Process Intake Configurations' to assess all scan files, automatically generating, updating, or resolving issues as needed.

Evaluate the effect your scan files will have on your issues. Issues will automatically be created, updated, or closed.

If certain issues should remain open despite not appearing in the latest scan files, you can flag them to prevent automatic closure.

If for some reason some issues should not be closed even though they were not found in the most recent scan files, you can mark them to not automatically close..png

Evaluate your issues properly before merging. Issues in your cycle will not be merged with the rest of your issues until you close the cycle.
CAUTION: Once you close an assessment cycle those changes can NOT be undone.

Issues in your cycle will not be merged with the rest of your issues until you close the cycle. Giving you the chance to evaluate them properly before merging..png

Set up your recurring assessments

Start your intake workflow

Identify records to be ignored

Related articles