Use this API to import vulnerability scan (eVR) files to the SMS. After you import
a vulnerability scan, you review the following on the SMS:
- Vulnerabilities (listed by CVE) that have been discovered in your network.
- Which assets impacted by those vulnerabilities.
- Which DV filters can defend those assets from the discovered vulnerabilities.
This API includes:
eVR specifications
The minimum data required for a native SMS-standard vulnerability scan is:
- IP Address - (host IP addresses) The maximum number of host IP address and vulnerability combinations that you can import on the SMS is 10 million. When the SMS reaches the maximum limit, it displays an error message, and you must delete vulnerability scans on the SMS before you can import a new scan using this API.
- CVE IDs - CVE must be in the format CVE-YYYY-NNNN where YYYY is a 4 digit year and NNNN is a sequence number.
- Severity - Vulnerabilities are assigned a severity levels to define the urgency associated with remediating each vulnerability. Rankings are based on a variety of industry standards including CVE.
CSV file specifications
Vulnerability scans must be in a native, comma-separated value (CSV) format before
they can be used on the SMS. If you use a supported vulnerability management product,
custom converters are available for Qualys®, Nexpose®, and Nessus®.
- The first line in the CSV file must be the column headers for each of the columns.
- Each row after the header must contain the same number of columns that are in the header.
- Each column must be delimited with a comma.
- The value within each column must be wrapped in double quotes; however, embedded double quotes are not permitted ("This is "invalid" data").
- Each row in a CSV file must be less than 65536 bytes.