[ Applies to ] StorageGuard 9.x and later / Vulnerability and Security Misconfiguration reports / CSV export
StorageGuard can export its Vulnerability and Security Misconfiguration reports as CSV files. This article describes the fields in each export, so you can map them when you import the data into another tool.
In this article
Overview
StorageGuard reports can be generated in PDF, Word, or CSV format and scheduled to run automatically. A scheduled report can be emailed to recipients or saved to a local or remote folder.
CSV exports are designed for other tools to consume. For example, Splunk or another log platform can read the file on a schedule, or you can load the data into a CMDB or use it to open incidents in an ITSM system.
Tip: If you want to pull the same data on demand rather than on a schedule, use the StorageGuard Risk API.
Vulnerability CSV export
The Vulnerability CSV export contains one row per vulnerability finding, with the following fields.
| Field | Description | Values or example |
|---|---|---|
| Risk Id | The risk ID in StorageGuard. | — |
| First Detected | When StorageGuard first detected the risk. | Timestamp Example: 12/12/2021 8:25:21 PM |
| CI Site | The site where the affected CI is located. | — |
| CI Name | The name of the affected configuration item (CI). | — |
| CI Type | The type of the affected CI. | Example: Pure FlashArray |
| Result | Whether the check passed or failed for the CI, or wasn't applicable. | PASS, FAIL, N/A |
| Check Name | The system type followed by the words "vulnerability analysis". | Example: NetApp cDOT vulnerability analysis |
| CVSSV3 Score | The CVSS v3 score of the vulnerability, from 0 to 10. | 0–10 Example: 9.8 |
| Security Advisory ID | The vendor's security advisory ID. | Example: NTAP-20190905-0003 |
| CVE Labels | A comma-separated list of the CVEs associated with the risk. | Example: CVE-2018-5498 |
| Source Publication | A link to the security advisory or CVE publication. | — |
| Severity | The severity of the risk. | Low, Medium, High, Critical |
| Risk Status | The current status of the risk. | OPEN, REOPEN, CLOSED |
| Vulnerable Version | The installed version that is vulnerable. | Example: 9.6P6 |
| CVE Description | A paragraph describing the vulnerability. | — |
| Action Item | Remediation guidance for the vulnerability. | — |
| Impact | A paragraph describing what the vulnerability can lead to. | — |
| CI Last Successful Scan | When the CI was last scanned successfully. | Timestamp |
| Risk Note | The note a user entered for the risk. | — |
| CI Note | The note a user entered for the CI. | — |
| Last Detected | When StorageGuard last detected the risk. | Timestamp |
| CI Policy Name | The StorageGuard policies associated with the CI, comma-separated. | — |
| CI IP Address | The IP address of the CI. | Example: 192.168.65.3 |
Security misconfiguration CSV export
The Security Misconfiguration CSV export contains one row per configuration check result, with the following fields.
| Field | Description | Values or example |
|---|---|---|
| Risk ID | The risk ID in StorageGuard. | — |
| First Detected | When StorageGuard first detected the risk. | Timestamp Example: 12/12/2021 8:25:21 PM |
| CI Site | The site where the affected CI is located. | — |
| CI Name | The name of the affected configuration item (CI). | — |
| CI Type | The type of the affected CI. | Example: Pure FlashArray |
| Result | Whether the check passed or failed for the CI, or wasn't applicable. | PASS, FAIL, N/A |
| Check Name | The check UID followed by the check name. | Example: K030CI000377: Root squash is enforced |
| Security Principle | The high-level security best practice the check relates to. | Example: Data at-rest encryption |
| Impact Category | The security area the finding belongs to. | Example: Authentication Encryption |
| Security Labels | A comma-separated list of the standards and sources behind the security requirement. | Example: CIS Control 4.1, NIST SP800-53 AC-2, PCI DSS 7.1 |
| Violation Details | The misconfigured setting and its current value. | — |
| Customizable Parameters | The check's customizable parameters, if any, and their configured values. | Example: Minimum password length: 8 |
| Risk Status | The current status of the risk. | OPEN, REOPEN, CLOSED |
| Summary | A one-sentence description of the risk. | — |
| Description | A paragraph describing the risk in detail. | — |
| Resolution | The steps, commands, or API calls that remediate the risk. | Example: security login banner modify -message {param1} |
| Impact | A paragraph describing what the issue can lead to. | — |
| CI Last Successful Scan | When the CI was last scanned successfully. | Timestamp |
| Risk Note | The note a user entered for the risk. | — |
| CI Note | The note a user entered for the CI. | — |
| Last Detected | When StorageGuard last detected the risk. | Timestamp |
| CI Policy Name | The StorageGuard policies associated with the CI, comma-separated. | — |
| CI IP Address | The IP address of the CI. | Example: 192.168.65.3 |
| Risk Labels | A comma-separated list of IT labels describing the affected system type. | Example: NetApp |
Note: Placeholders such as {param1} in the Resolution field stand for values you supply. StorageGuard explains each one in the text that follows, for example the legal notice to display in a login banner.
Related articles
[ Still need help? ]
If an export doesn't contain what you expect, submit a request and include the report name and a sample row with sensitive values removed.
Comments
0 comments
Please sign in to leave a comment.