Skip to content
Claroty CTD

Risks & Vulnerabilities: Insights

Risks and Vulnerabilities frequently are over simplified as an exercise of CVE scanning. We’ll want to take more holistic view to additionally understand device behaviors, human behaviors, and additional environmental telemetry to present a broader risk perspective of the environment.

TASKS

Section titled “TASKS”

  1. Navigate to Risks & Vulnerabilities > Insights.

  2. On the Insights page there will be a list of different reports ordered by criticality. Insights provide ‘insight’ into current potential risks and vulnerabilities, grouping them into reports based on similar communications, behaviors, etc.

  3. Briefly explore at least three different insight reports and note whether each insight report provides the same information, or if the information provided differs between them.

  4. Select the report titled ”# assets are running operating systems that are no longer supported” to expand it and consider the Results (#) table.

    • The expired operating systems are listed in the left column, followed by a column detailing their respective EOL dates, a column that leads to the Assets page with a filter applied to show those specific assets, and an Actions column.

  5. In the Affected Assets column, select one of the # assets - click to filter options to follow it to the filtered Assets page, then select any asset from that list.

  6. Navigate to the Risks & Vulnerabilities page for that asset, then scroll down to Insights. You should see Unsupported OS as one of the options.

  7. Add a comment noting that the risk for the unsupport OS has been accepted, then select Mark as Completed.

REFLECTION

Section titled “REFLECTION”
  • How can insights be used to understand an environment’s current security posture and prioritize remediation efforts?
  • How could insights be used to help tackle specific issues within the environment?