Skip to main content

Vulnerability Management Requirements

Cloudaware Vulnerability Management relies on a combination of Cloudaware platform services, connected scanners, and correct CMDB configuration.

This guide summarizes the prerequisites for rolling out Vulnerability Management at scale.

Platform and Licensing​

Inventory and Breeze Agent​

For agent‑based vulnerability scanning and accurate ownership mapping:

  • Breeze Agent installed on in‑scope Windows and Linux servers (cloud and on‑prem).
  • Breeze Agent deployment to Kubernetes worker nodes if you plan to scan containers and Kubernetes workloads (see Breeze Installation for Kubernetes).
  • CMDB populated with key metadata:
    • Environment (prod/non‑prod).
    • Application or service.
    • Organization Unit (OU)/team.
    • Criticality and data sensitivity.

See also: Breeze Agent.

Scanner Connectivity and Permissions​

Depending on which scan types you use:

  • Agent‑based scans.
    • Outbound network access from agents to scanner backends (or Cloudaware VSaaS).
    • Local permissions on hosts to enumerate installed packages, services, and configuration.
  • IP‑based network scans.
    • A defined list of target IP ranges and ports.
    • Approvals from cloud and network providers where necessary.
    • Security groups, NACLs, and firewalls configured to allow scanning during agreed-upon windows.
  • URL and web application scans.
    • A curated list of URLs and authentication details if required.
    • Acceptance that test/staging endpoints may receive active checks (OWASP Top 10 style testing).
  • Container and image scans.
    • Access to container registries (e.g., ECR, ACR, GCR, private registries; see also Containers & Kubernetes).
    • Permissions to pull and scan images.

For Cloudaware Vulnerability Scanning (VSaaS), assets (IPs, URLs, registries) must be explicitly reported to Cloudaware or marked in CMDB as eligible for scanning.

Cloud‑Native and Third‑Party Integrations​

To ingest existing vulnerability data instead of (or in addition to) running your own scans:

  • Configure connectors for cloud‑native scanners (e.g., AWS Inspector on EC2, container registries, or ECR).
  • Enable integrations for external tools such as Qualys, Rapid7 InsightVM, Tenable Security Center, or others used in your environment.
  • Verify that:
    • Scanner assets can be mapped to CMDB CIs (instances, containers, registries, repositories).
    • You understand rate limits and API permissions for each provider.

CMDB Configuration and Ownership​

Effective Vulnerability Management depends on having clean ownership and routing data:

  • Maintain accurate relationships between:
    • Assets and applications.
    • Applications and OUs/teams.
    • Assets and cloud accounts/subscriptions.
  • Define default owners for:
    • Unassigned assets.
    • Shared infrastructure (e.g., load balancers, shared databases).
  • Ensure that key fields used by routing and SLA logic (e.g., risk scores, OU) are populated for in‑scope CIs; see Ownership & Routing and Exceptions & SLAs.

ITSM and Ticketing​

If you plan to push remediation tasks into external systems:

  • Set up integrations with ServiceNow, Jira, or other ITSM tools.
  • Agree on routing rules (e.g., by OU, application, platform team).
  • Confirm that Cloudaware can create and update tickets (stateful synchronization) for the relevant projects/queues.

Once these requirements are in place, proceed to Sources & Scanners and Findings & Data Model to configure collection and normalization.