Reducing the number of false positive vulnerabilities

In IBM® QRadar® Vulnerability Manager, you can automatically create exception rules for vulnerabilities that are associated with a specific type of server.

When you configure server types, QRadar Vulnerability Manager creates exception rules and automatically reduces the vulnerabilities that are returned by searching your data.

Procedure

  1. Click the Assets tab.
  2. In the navigation pane, select Server Discovery.
  3. To automatically create false positive exception rules for vulnerabilities on specific server types, from the Server Type list, select one of the following options:
    • FTP Servers
    • DNS Servers
    • Mail Servers
    • Web Servers
    It might take a few minutes for the Ports field to refresh.
  4. Optional: From the Network list, select the network for your servers.
  5. Click Discover Servers.
  6. In the Matching Servers pane, select the servers where the vulnerability exception rules are created.
  7. Click Approve Selected Servers.

Results

Depending on your server type selection, the following vulnerabilities are automatically set as false positive exception rules:
Table 1. Server type vulnerabilities
Server Type Vulnerability
FTP Servers FTP Server Present
DNS Servers DNS Server is Running
Mail Servers SMTP Server Detected
Web Servers Web Service is Running