Risks table

The Risks table provides information about risks found by Arctic Wolf Agent, Internal Vulnerability Assessment (IVA) scanners, and External Vulnerability Assessment (EVA) scanners.

The table has these tabs:

All tab

In the Risks table, on the All tab, you can view individual risks.

The table has these columns:
  • Actions — A menu of controls for your risks. For example, View Risk and Edit Risk.
  • Asset Category — The category of the asset. For example, Desktop, Laptop, or Printer. This information helps you to identify the purpose of the asset.
    Note:

    If there is not enough information to classify an asset, the asset appears in the Unassigned category.

  • Asset Criticality — The criticality of the asset to your daily operations. For example, None, Low, or Critical. The higher the criticality, the larger the business disruption in the event of an incident.

    For more information, see Edit asset criticality.

  • Asset Name — The name of the asset in the Unified Portal. Click the asset name to view detailed information about the asset. For more information, see View an asset profile.
    Note: The device name defaults to the value found by the scan source, but you can edit the device name in the Risk Dashboard. For more information, see Edit a device name.
  • Asset Tags — The tags that are associated with the asset. They can help group assets for risk remediation.

  • Asset OS Type — The OS type of the asset where the vulnerability was discovered. Options include: Linux, macOS, Windows, or Unknown if a non-standard OS is identified.

  • Assignee — The user assigned to remediate the risk.

  • CISA KEV — Indicates whether the risk is present in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. Options include: Yes or No.

  • CVE — Links to any known Common Vulnerabilities and Exposures (CVE) that this risk is part of. If multiple CVE links are provided, the primary CVE is first.

  • CVSSv3 — The Common Vulnerability Scoring System version 3 (CVSSv3) score, which is an open framework for communicating the severity of information security vulnerabilities. Arctic Wolf uses this framework as an objective metric for prioritizing vulnerabilities.

  • Due Date — The date by which the risk is expected to be resolved.

  • First Detected Time — The date and time when this risk was first detected.

  • ITSM Ticket ID — The ID of the ITSM ticket associated with the risk. This information is only available if you have your ITSM software integrated with the Unified Portal. For more information, see Integrate your ITSM solution with the Unified Portal and Create an ITSM ticket for the risks in your organization. Options include:

    • - — A ticket ID does not exist.

    • Ticket ID with hyperlink — The ticket number for the risk. Click the link to open the ticket in your ITSM software.

  • ITSM Ticket Status — The status of the ITSM ticket. This information is only available if you have your ITSM software integrated with the Unified Portal. For more information, see Integrate your ITSM solution with the Unified Portal and Create an ITSM ticket for the risks in your organization. Options include:

    • - — The risk does not currently have any ITSM tickets associated with it.

    • <#> Initiated — The number of tickets that were requested for the risk, but are not yet created in your ITSM software.

    • <#> Created — The number of tickets created for the risk in your ITSM software.

  • Last Detected Time — The date and time when the risk was most recently detected. This value updates each time a source detects the risk.

  • Resolution Date — The date when the risk was resolved.

  • Resolution Reason — The action that resolved the risk. Options include:

    • Scan — The latest successful vulnerability scan did not detect the risk.

    • Asset Deleted — The asset that the risk was associated with was deleted.

    • Stale — A vulnerability scan has not successfully completed within the last 45 days.

  • Risk Severity — The severity of the risk, based on risk score. The higher the risk score, the more severe the risk.

  • Score — The risk rating. Options include any number between 0.1 and 10, with 0.1 representing the lowest risk level.

  • State — The state of the risk, which is manually assigned by a user.

    For more information, see Risk states.

  • Status — The status of the risk, which is automatically assigned by the scanner. Options include: Resolved or Unresolved.

    For more information, see Risk statuses.

  • Source — The scan that discovered the risk. Options include: Agent, IVA, or EVA.

  • Title — The risk name.

Group by Vulnerability tab

In the Risks table, on the Group by Vulnerability tab, you can view risks grouped into vulnerability categories.

The table has these columns:

  • CISA KEV — Indicates whether the risk is present in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. Options include: Yes or No.

  • CVE — Links to any known Common Vulnerabilities and Exposures (CVE) that this risk is part of. If multiple CVE links are provided, the primary CVE is first.

  • CVSSv3 — The Common Vulnerability Scoring System version 3 (CVSSv3) score, which is an open framework for communicating the severity of information security vulnerabilities. Arctic Wolf uses this framework as an objective metric for prioritizing vulnerabilities.

  • First Detected Time — The date and time when this risk was first detected.

  • Last Detected Time — The date and time when the risk was most recently detected. This value updates each time a source detects the risk.

  • Resolved Risks — The number of risks that are resolved. Click the link to view these risks in the Risks table on the All tab.

  • Risk Severity — The severity of the risk, based on risk score. The higher the risk score, the more severe the risk.

  • Score — The risk rating. Options include any number between 0.1 and 10, with 0.1 representing the lowest risk level.

  • Source — The scan that discovered the risk. Options include: Agent, IVA, or EVA.

  • Title — The risk name.

  • Unresolved Risks — The number of risks that are not resolved. Click the link to view these risks in the Risks table on the All tab.

  • Vulnerability Publish Time — The date when the vulnerability was first identified.

  • Vulnerability Update Time — The date when the vulnerability details were last changed.

Group by Remediation tab

In the Risks table, on the Group by Remediation tab, you can view vulnerabilities grouped by the suggested remediation. The table only includes data for risks that have a Status of Unresolved, and the remediations are grouped by Remediation Title and Asset OS Type. For example, a software version to upgrade to, software patch to apply, or configuration change to apply.

The table has these columns:
  • Actions — A menu of controls. Click to view the Impacted Assets page.
  • Addressed CVEs — Links to any known Common Vulnerabilities and Exposures (CVEs) that the risk is part of. If multiple CVEs exist, the primary CVE is first.
  • Addressed CVEs Count — The number of CVEs that will be resolved if the suggested remediation is completed.

  • Asset OS Type — The OS type of the asset where the vulnerability was discovered. Options include: Linux, macOS, Windows, or Unknown if a non-standard OS is identified.

  • CISA KEV — Indicates whether the risk is present in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. Options include: Yes or No.

  • Highest CVSSv3 Score — The Common Vulnerability Scoring System version 3 (CVSSv3) score of the highest-risk issue affected by the remediation.
  • Highest Risk Score — The risk score of the highest-risk issue affected by the suggested remediation. Options include any number between 0.1 and 10, with 0.1 representing the lowest risk level.

    For more information, see View your risk score.

  • Highest Risk Severity — The severity of the highest-risk issue, based on risk score, affected by the suggested remediation. The higher the risk score, the more severe the risk. Options include: Critical (red), High (orange), Medium (yellow), or Low (green).
  • Impacted Assets — The number of assets that have at least one risk in the remediation group. Click the link to view these assets in the Impacted Assets table.
  • Remediation Title — The description of the suggested remediation. This could be the recommended software version to upgrade to, software patch to apply, or configuration change to apply.

  • Unresolved Risks — The number of risks that are not resolved. Click the link to view these risks in the Risks table on the All tab.