3.9 Scan filters

Scan results typically present a substantial amount of information. You might however at times require only specific information to achieve a particular targets - such as for example, identifying only which patches are missing in your system.

Screenshot 23 - Scan filter nodes

GFI LANguard ships with a default set of scan result filters that allow you to sift scan results data and display only the relevant information. Scan filters are organized in three categories:

•	Complete Scans

•	Vulnerability Assessment

•	Network & Software Audit

The filters, which ship with GFI LANguard, are:

Scan result filter	Description
Full report	Displays all the information that was collected during a network vulnerability scan including system OS information, outdated anti-virus signatures, and missing patches and service packs.
Vulnerabilities [All]	Displays all Critical, High and Medium severity vulnerabilities discovered during a network security scan.
Vulnerabilities [High security]	Displays only severe vulnerabilities such as missing critical security patches and service packs.
Vulnerabilities [medium security]	Displays only moderate severity vulnerabilities, which may need to be addressed by the administrator. Such as average threats and medium vulnerability patches.
Auto-remediation	Displays auto-remediation actions triggered.
High vulnerability level computers	Use this filter to access list of computers and vulnerability details for which vulnerability level is high.
Missing patches and service packs	Use this filter to access list of missing patches and service packs discovered on scanned target computer(s).
Missing service packs	Use this scan filter to display a list of all computers and computer details of computers, which have a missing service pack.
Missing critical patches	Displays all missing patches marked as critical.
Open ports	Shows all open TCP and UDP ports discovered on the scanned target computer(s).
Open shares	Shows all open shares and the respective access rights.
Groups and users	Shows the users and groups detected on the scanned target computer(s).
Computer properties	Shows the properties of each target computer.
Hardware audit	Displays information about the hardware configuration of the scanned computer(s).
Important devices - USB	Shows all the USB devices attached to the scanned target computer(s).
Important devices - Wireless	Shows all the wireless network cards, (both PCI and USB) attached to the scanned target computer(s).
Installed Applications	Shows all the installed applications (including security software) discovered during target computer scanning.
Non-Updated security software	Shows only the installed security applications (i.e. anti-virus/anti-spyware software) that have missing updates and outdated signature definition files.
Virtual machines	Shows a list of non-updated security software on the scanned target computer(s).

3.9.1 Filtering scan results

To apply a scan result filter on security scan results:

1. Launch and complete a security scan of your network or load the scan results of past scans from your database or XML file.

Screenshot 24 - Scan filters: Full report

2. Click Network Audit ► Analyze.

3. Select the Results Filtering node and expand the Complete Scans node.

4. Select the scan filter to apply against scan results.

3.9.2 Creating a custom scan filter

Apart the scan filters that ship by default; you can create custom filters based on your requirements and network infrastructure. To create a custom scan filter:

1. Click Network Audit ► Analyze

2. Right click on the scan filter category where the new filter will be added and select Create new results filter…

Screenshot 25 - The new Scan filter properties dialog: General tab-page

3. In the General tab, specify the name of the new scan filter.

Screenshot 26 - Filter properties dialog

4. Click Add… and select the required filter property from the provided list. This defines what type of information is extracted from the scan results (i.e. the area of interest of the scan filter). Click Next to continue.

Screenshot 27 - Filter condition properties dialog

5. Select the required filter condition from the drop down provided.

6. Specify the filter value. This is the reference string with the specified condition to filter information from scan results. Click Add to continue.

NOTE: You can create multiple filter conditions for every scan filter. This allows you to create powerful filters that more accurately isolate the scan results information that you may want to analyze.

Screenshot 28 - The new Scan-Filter properties dialog: Report Items tab-page

7. Click Report Items tab and select the information categories/sub-nodes to display. Click OK to save and create the new filter.

The new filter will be added as a new permanent sub-node under the Results Filtering node.
NOTE: To delete or customize a scan filter, right-click target filter and select Delete filter or Edit filter properties.