nCircle IP360 scanner overview

QRadar® supports both nCircle and Tripwire versions of the IP360 scanner. Administrators can import XML2 scan reports from SSH servers that contain IP360 vulnerability information.

QRadar cannot connect directly with nCircle devices. You can configure an nCircle IP360 scanner device to export scan results in XML2 format to a remote SSH server. To import the most recent scan results from the remote server to QRadar, you can schedule a scan or poll the remote server for updates to the scan results.

The scan results contain identification information about the scan configuration from which it was produced. The most recent scan results are used when QRadar imports a scan. QRadar supports exported scan results only from the IP360 scanner in XML2 format.

To integrate an nCircle IP360 scanner, perform the following steps:
  1. On your nCircle IP360 scanner, configure your nCircle scanner to export scan reports. See Exporting nCircle IP360 scan results to an SSH server.
  2. On yourQRadar Console, add an nCircle IP360 scanner. See Adding a nCircle IP360 scanner
  3. On your QRadar Console, create a scan schedule to import scan result data. SeeScheduling a vulnerability scan