What Is Software and CVE Discovery?
Software Discovery is a feature that allows you to view the software running on any server, whether it is Linux or Windows-based.
CVE Discovery is a feature that allows you to view the vulnerabilities on any Linux server.
Linux Set-Up
To gather the information on all the running services on the Linux server, you need to provide credentials that are part of the SUDOers group and access needs to be allowed from the Faddom server or proxy on port 22 for SSH access to the target servers.
Windows Set-Up
For Windows, if the Faddom server is installed via Linux ova, this requires an additional proxy installed on an existing Windows server (see Server Installation - Proxy Installation). This also requires a user account with permissions to run the following WMI queries:
\ROOT\StandardCimv2 - SELECT * FROM MSFT_NetTCPConnection
\ROOT\CIMV2 - SELECT * FROM Win32_Process
Note: In order to use this you may need to adjust your firewall rules as per the table below
Port Number | Port Assignment |
135 | DCE RPC Endpoint Manager |
49152-65535 | DCOM |
139 | NetBios Session Software |
445 | Microsoft Directory Softwares SMB |
on
Testing the Connection
Faddom provides you with the ability to test the Software and CVE Discovery before enabling it on your system or for any other reason. To do this, you click Test Discovery, enter the server IP or host name you wish to test it on then select the credentials. You can either use All Credentials in Faddom or specify Specific Credentials. If you do not have any credentials saved, you can add them by navigating to Manage Credentials and adding the relevant username and password.
Note that if you have deployed Faddom on Linux (either via OVA or cloud marketplace) then you will need to use a Faddom proxy installed on a Windows server to run the test on Windows servers.
Setting Up Software and CVE Discovery
Select Settings > Software and CVE Discovery
Click on New Task and you will be presented with the credentials screen
Add New Host Credentials for the server(s) that you wish to see the software of, then enter the credentials as well as the server type, highlighted in blue.
Click on the on the right-hand side, select the subnet(s) that you wish to run the discovery on and click Save. Faddom will scan all the servers it finds in the selected subnets and attempt to connect to each one with the provided credentials.
You can set the schedule to determine when the software discovery will run below the discovery tasks table.
If you have any issues running this feature please see our guide Troubleshooting WMI Connections for Software or User Discovery