Axonius Static Analysis

Axonius Static Analysis identifies Common Vulnerabilities and Exposures (CVEs) within the installed software reported by adapters. To achieve this, Axonius leverages Common Platform Enumerations (CPEs) and the National Vulnerability Database (NVD).

The process includes the following steps:

1. Axonius maps every installed software on each device.
2. Based on the data extracted from adapter reports, Axonius collects information on each installed software, normalizes and deduplicates the data, to extract the software's name, vendor and version.
3. Axonius converts the normalized data into the calculated CPE of the installed software.
4. Axonius sends the CPE to NVD to identify all CVEs associated with it.
5. Based on the information received from NVD, Axonius lists all CVEs associated with the software installed on each device. Any CVE found in NVD that matches the generated CPE is reported as Static Analysis Findings in Axonius. Such assets have the Axonius Static Analysis icon under the Adapter Connection column.
6. Security Findings Page assets are created based on the connection made between CVEs and Devices.

Enabling Axonius Static Analysis

To enable Axonius Static Analysis in the system settings:

1. Navigate to the System Settings page.
2. Select Enrichment and scroll down to Static Analysis Enrichment.
3. Enable Fetch software vulnerabilities from NVD DB.

Enriching Vulnerability Data Based on OS

Static Analysis can also fetch CVEs based on data received from operating systems.

To enable this fetch:

1. Navigate to System Settings > Enrichment > Static Analysis Enrichment.
2. Enable the following setting (disabled by default): Fetch OS vulnerabilities from NVD DB. (This product uses the NVD API but is not endorsed or certified by the NVD)

The Operating systems supported for this enrichment method are as follows:

• Ubuntu
• Red Hat
• Amazon
• Alma
• Debian
• Fedora
• FreeBSD
• Gentoo
• Arch
• Centos Stream
• Centos
• Rocky
• openSUSE
• SLES
• Cumulus
• iOS
• Oracle Linux
• Oracle Solaris
• IBM AIX
• IBM VIOS
• macOS / OS X
• Arista EOS
• Android
• Cisco
• Fortinet
• VMWare
• PanOS
• Juniper
• HP
• Adtran

Additional Static Analysis Settings

To improve the accuracy of Security Findings generated by static analysis, configure the following, optional settings:

• Exclude CVEs without specific affected versions - Enable this to include only CVEs with an exact software/OS configuration version or a defined version range. When enabled, CVEs whose CPE doesn't identify a specific affected version, or that have a version range with only a start bound and no end bound, are excluded - regardless of whether a version was detected on the asset.
• Exclude CVEs published on or before [date] - Enabe this to set a publication date cutoff to filter out aged CVEs.
• Exclude devices matching this query - Enable this to exclude devices from static analysis based on a selected Devices query. For each device matching this query, static analysis doesn't run against it at all and leaves no CVE fingerprinting.