Vulnerability scanning

Agentless Vulnerability & Threat Detection provides vulnerability scanning in order to identify security vulnerabilities in your AWS EBS, ECR, and Lambda resources. Scans occur daily from the time you first enable the feature for your AWS account. Scan times are not configurable.

To enable vulnerability scanning on a new AWS account:

1. Go to Service Management → Cloud Accounts → AWS and click Add Account.
2. Choose CloudFormation as the deployment method, select Single AWS Account, and click Next.
3. Enter the required information and click Next. For more detailed instructions, see Adding an AWS account using CloudFormation.
4. In Features and Permissions, enable Agentless Vulnerability & Threat Detection and select the deployment regions.

   Note Selected regions are the regions where Agentless Vulnerability & Threat Detection is deployed, not necessarily the region of your AWS account. You may select multiple deployment regions.

5. Click Scanner Settings and select the resource types you wish to include in vulnerability scans. All supported resource types are selected by default.
6. Click Save Changes and continue configuring the CloudFormation template.

You may also enable vulnerability scanning on connected accounts by selecting the account from the list and going to the Stack Update tab.

Once the feature is enabled and the first scan is complete, you may view any vulnerability detections in the following locations in the Trend Vision One console:

• Cloud Posture → Cloud Overview
• Executive Dashboard → Risk Overview → Cloud Assets → Risk Factors
• Executive Dashboard → Exposure Overview → Vulnerabilities
• Operations Dashboard → Risk Reduction Measures
• Operations Dashboard → All Risk Events
• Operations Dashboard → Vulnerabilities
• Cloud asset profile screens in Attack Surface Discovery → Cloud Assets → Cloud Asset List

When viewing vulnerability detections, expand the associated risk event on the list to see available remediation or mitigation options as well as metadata associated with the detection. Use the provided metadata to perform a query in the Search app and learn more about the detection.

Once remediated or mitigated, risk events associated with vulnerability detections in EBS volumes, Lambda functions, and Lambda layers no longer appear in Attack Surface Risk Management after the next daily scan. Vulnerabilities in ECR images remain in Operations Dashboard → Vulnerabilities for seven days after patching.