Re: [sacm] Identifying Vulnerability Assessment Code

[Adam Montville <[e-mail]>]

I'm resending this call to the list. We have some contributions already
indicated, but we could use more. Specifically, we don't have an endpoint
repository at this point. Does anyone have any ideas of what we might use
for that?

I know there are some free/open source tools out there targeting
endpoint/asset management. Here's a list of a few of them:

   - Assetview: https://www.qualys.com/free-tools-trials/
   - NEWT Professional Network Inventory:
   http://www.komodolabs.com/network-inventory/
   - OCS Inventory-NG: http://www.ocsinventory-ng.org/en/
   - Open-AudIT: http://www.open-audit.org/
   - Snipe-IT: https://snipeitapp.com/


CIS will provide an operational environment with endpoints in AWS.

Kind regards,

Adam

On Tue, May 16, 2017 at 8:07 AM Adam Montville <[e-mail]>
wrote:

> All:
>
> Last week a list of goals were sent to this list [1]. I did see some
> back-channel conversation, but nothing that made its way to the list. Then,
> those are our stated goals, and it is now time to start considering what
> code may already exist for our agreed upon components. Once again, these
> components are listed at [2] and repeated here:
>
> * Vulnerability Detection Data Repository
> * Vulnerability Assessor
> * Endpoint Repository
> * Collector
> * Target Endpoint
> * Assessment Results Repository
>
> We need to drive this to some conclusion relatively quickly. If you have
> or know of components filling these roles, please respond by the end of
> this week. Note that the target endpoint component will likely be
> determined based on which real-world vulnerability(ies) we choose to deal
> with as part of this exercise.
>
> Kind regards,
>
> Adam
>
>
> [1] https://mailarchive.ietf.org/arch/msg/sacm/LskQ7tj9Wvy1-0DSlEN_VakYj64
>
> [2] https://mailarchive.ietf.org/arch/msg/sacm/w_kL2vzDBPk0NN9N1WQcpb3Qwfw
>
>