Scanning Profiles Keep Changing

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

Scanning Profiles Keep Changing

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Networking & Security] >> GFI LANguard >> Scanning Profiles Keep Changing

Page: [1]

Message

<< Older Topic Newer Topic >>

Scanning Profiles Keep Changing - 7.Aug.2009 1:01:43 PM

cmajewsk

Posts: 18
Joined: 6.May2009
Status: offline

I've created a few different scanning profiles so that certain scans I can limit the results to just the most recent released patches. On occasion when I run the scans with that particular scanning profile, I've noticed it's changed the profile and added other patches that I never selected. For example, I created one that would only scan for MS09-002. When I went to rerun the scan with that profile a month later there were a bunch of other patches that were also reporting within the scan results. I then checked the scanning profile and saw a lot of other patches had been added to the profile. This happens on other scanning profiles as well. It doesn't add vulnerabilities (as I have that turned off) or change anything else for that matter - just patches. Any ideas?

Trying to filter the overall results within ReportCenter is next to near impossible since not all patches/updates/hotfixes/service packs can be noted in the syntax that the report filter specifies: <Bulletin ID. (QNumber). Or can they? If they can I wouldn't use the Scanning Profiles Editor; I would just remove the patches I didn't want t see with a customized report within ReportCenter. That would be the best option because then I would have all the data and could simply manipulate it � instead of having to perform individual scans to obtain the necessary data.

Thanks

Post #: 1

RE: Scanning Profiles Keep Changing - 10.Aug.2009 3:12:53 PM

DrewE

Posts: 1058
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

Will you please open a support request with us online at http://support.gfi.com/Support/support.aspx?lcode=en so we can best assist you?

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to cmajewsk)

Post #: 2

RE: Scanning Profiles Keep Changing - 13.Aug.2009 1:04:43 PM

cmajewsk

Posts: 18
Joined: 6.May2009
Status: offline

Actually, the more I look into this the more I think it has to do with GFI LANguard updating. I pulled up my scanning profile for MS09-002. I saw that it did indeed change. Not only are all the patches for MS09-002 checked but also the most recently released Microsoft security patches:

EDIT: I see it's also added the August released security patches to all my customized scanning profiles. Is there a setting where I can turn this off? One possible workaround would be to create the scanning profile and then immediately export it. And then re-import it when I am going to use it or after GFI updates it's scanning engine/latest patches. Would that work?

As expected, if I use it to scan a machine it will find the August released missing patches.

< Message edited by cmajewsk -- 13.Aug.2009 1:16:05 PM >

(in reply to DrewE)

Post #: 3

RE: Scanning Profiles Keep Changing - 13.Aug.2009 1:25:31 PM

cmajewsk

Posts: 18
Joined: 6.May2009
Status: offline

I can say that the proposed workaround does not work. When I went to import the clean version of the MS09-002 scanning profile it asked if I wanted to overwrite the current one. I of course choose yes, and it still retained the check marked patches for August.

(in reply to cmajewsk)

Post #: 4

RE: Scanning Profiles Keep Changing - 13.Aug.2009 1:38:53 PM

cmajewsk

Posts: 18
Joined: 6.May2009
Status: offline

I can also add that it can affect some scanning profiles positively. For example, I have a scanning profile that only detects missing security patches - i.e. no service packs, language packs, updates (like the Daylight Saving Time update), and I see it did add the August released security patches to it, while leaving the unchecked service packs and other updates alone. Is this by design?

(in reply to cmajewsk)

Post #: 5

RE: Scanning Profiles Keep Changing - 13.Aug.2009 3:29:58 PM

DrewE

Posts: 1058
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

Yes, the scanning profiles are designed to add new patches once downloaded from our update servers.

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to cmajewsk)

Post #: 6

RE: Scanning Profiles Keep Changing - 13.Aug.2009 3:36:34 PM

cmajewsk

Posts: 18
Joined: 6.May2009
Status: offline

quote:

ORIGINAL: DrewE

Yes, the scanning profiles are designed to add new patches once downloaded from our update servers.

No wonder. What's too bad is even if I create a new scanning profile in August. Then try to use it in September after GFI has updated - even if I re-import the original profile from back in August - it will have already added September's patches to it, huh?

(in reply to DrewE)

Post #: 7

RE: Scanning Profiles Keep Changing - 17.Aug.2009 12:36:41 PM

mblinde

Posts: 62
Status: offline

quote:

ORIGINAL: cmajewsk

quote:

ORIGINAL: DrewE

Yes, the scanning profiles are designed to add new patches once downloaded from our update servers.

No wonder. What's too bad is even if I create a new scanning profile in August. Then try to use it in September after GFI has updated - even if I re-import the original profile from back in August - it will have already added September's patches to it, huh?

You are not the only one to mention this and honestly I think it has to be on everyones top 10 list of things they'd like changed if GFI ever gets around to it. I think I've mentioned this a few times to Gill and Jim on phone support but there still hasn't been resolution to this.

(in reply to cmajewsk)

Post #: 8