Adding an eEye REM SNMP scan

You can add a scanner to collect vulnerability data over SNMP from eEye REM or CS Retina scanners.

1. Click the Admin tab.
2. Click the VA Scanners icon.
3. Click Add.
4. In the Scanner Name field, type a name to identify your SecureScout server.
5. From the Managed Host list, select an option that is based on one of the following platforms:
   • On the QRadar Console, select the managed host that is responsible for communicating with the scanner device.
   • On QRadar on Cloud, if the scanner is hosted in the cloud, the QRadar Console can be used as the managed host. Otherwise, select the data gateway that is responsible for communicating with the scanner device.
6. From the Type list, select eEye REM Scanner.
7. From the Import Type list, select SNMP.
8. In the Base Directory field, type a location to store the temporary files that contain the eEye REM scan data.
   The default directory is /store/tmp/vis/eEye/.
9. In the Cache Size field, type the number of transactions you want to store in the cache before the SNMP data is written to the temporary file. The default is 40.
   The default value is 40 transactions.
10. In the Retention Period field, type the time period, in days, that the system stores scan information.
    If a scan schedule did not import data before the retention period expires, the scan information from the cache is deleted.
11. Select the Use Vulnerability Data check box to correlate eEye vulnerabilities to Common Vulnerabilities and Exposures (CVE) identifiers and description information.
    .
12. In the Vulnerability Data File field, type the directory path to the eEye audits.xml file.
13. In the Listen Port field, type the port number that is used to monitor for incoming SNMP vulnerability information from your eEye REM scanner.
    The default port is 1162.
14. In the Source Host field, type the IP address of the eEye scanner.
15. From the SNMP Version list, select the SNMP protocol version.
    The default protocol is SNMPv2.
16. In the Community String field, type the SNMP community string for the SNMPv2 protocol, for example, Public.
17. From the Authentication Protocol list, select the algorithm to authenticate SNMPv3 traps.
18. In the Authentication Password field, type the password that you want to use to authenticate SNMPv3 communication.
    The password must include a minimum of 8 characters.
19. From the Encryption Protocol list, select the SNMPv3 decryption algorithm.
20. In the Encryption Password field, type the password to decrypt SNMPv3 traps.
21. To configure a CIDR range for your scanner:
    1. Type the CIDR range for the scan or click Browse to select a CIDR range from the network list.
    2. Click Add.
22. Click Save.
23. On the Admin tab, click Deploy Changes.