IBM Concert Vulnerability Management for Ubuntu VMs using Qualys Scan Reports

This document provides step-by-step guidance on how IBM Concert simplifies and automates OS vulnerability management and patch remediation for two Ubuntu virtual machines using Qualys scan reports.

IBM Concert enables the import of vulnerability scan reports from various tools. It processes these reports to identify vulnerabilities and generates the necessary patch advisories for the affected VMs. These advisories are then executed through Concert workflows, which automatically apply the required patches to Ubuntu and other supported operating systems.

Use Case

This section outlines the demo use case. In this scenario:

• A Qualys vulnerability scan report is available for two Ubuntu virtual machines.
• In addition, we have an Application S-bom that defines the structure of the application and its deployment environment.

This demo demonstrates how IBM Concert simplifies and automates OS vulnerability management and patch remediation for two Ubuntu VMs based on Qualys scan report.

Demo Flow

The following steps will be performed:

• Import the Application SBOM and vulnerability scan report into Concert.
• Analyze the data to identify vulnerabilities and automatically generate patch actions.
• Review and approve the generated actions.
• Execute Concert workflows to automatically apply the required patches to the two VMs.

1. Import Application SBOM

1.1 Create the Application SBOM File

Click for more info

1. Open the SBOM Json file.

2. Replace the below values with your actual VM details.

   • VM IP addresses: 9.30.167.125 and 9.46.72.158
   • Ubuntu versions: 24.04 and 22.04

Note: You can also create the Application SBOM file manually by following the instructions in this article

1.2 Upload the Application SBOM

Click for more info

1. Click on Inventory > Application Inventory menu to open the Application Inventory page.

2. Click on Define Application > From SBOM menu to upload Application SBOM file.

3. Drag and Drop the updated file
4. Click on Upload button.

5. The file is getting processed.

2. View SBOM details (Optional)

This section is optional and can be skipped if you are already familiar with Concert.

2.1 View Event Log

Click for more info

Let us view the Event Logs Page.

1. Click on Administraton > Event Log menu to open the Event Log page.

2. You can see the file Processing Completed status.

2.2 View Application Inventory

Click for more info

1. Return to Application Inventory and locate the created application.

2. Click and open the application APP-TVS1

3. Explore the Application versions, topology and Collaborators tabs in the application inventory.

4. Return back to the Versions tab
5. Click on the Version 1.0.0

6. Explore the topology, overview, SBOM compoenents, build artifacts of the application for that version.

7. View the CVE Findings section (currently empty).

2.3 View Environment Inventory

Click for more info

1. Click on Inventory > Environment Inventory.

2. You can see the tvs1-staging.

3. Click on that to see the details.

4. Explore the tDeploymentst and tTopologyt.

3. Import Discovery Advisories

To process the scan report and correlate Advisories, the Advisories should be imported into the Concert. Lets import the Discovery Ubuntu Advisories using the workflow.

3.1 Import the workflow

Click for more info

1. Click on Workflow menu in the top.

2. Click on the Workflows tile.

3. Click on Create Workflow > Select from Library menu

4. Enter the following.

• Current Version : v3.0.0
• Filter : Vulnerability
• Usecase: Discover Ubuntu Advisories title

5. Click on Import

The workflow is imported into the Concert Instance.

5. Click on the imported Discover_Ubuntu_Advisories workflow

3.2 Run the workflow

Click for more info

1. Click on Run button.

2. Click on Run button.

3. Click on Logs Menu in left navigation

You can see the execution of the workflow is completed in 51 minutes.

4. Click on the Green arrow to view the details.

You can see the 195K ubuntu advisories are imported.

4. Upload Vulnerability Scan Report

4.1 Prepare the Scan Report

Click for more info

1. Download the Qualys scan report from here

Note : The other sample scan reports are available here for the reference.

2. Update the Asset IPV4 column with the IPs of your 2 VMs.

4.2 Upload Scan report

Click for more info

1. Click on Dimensions > Vulnerability menu.

You can see the Vulnerability with empty records.

2. Click on the Upload vulnerability scan button.

3. Drag and Drop the above updated Qualys scan report for the Vulnerabilities.

4. Click on Upload button.

You can see the file Processing Completed status in the Event Logs screen.

5. View CVE details (Optional)

Click for more info

1. Click on Dimensions > Vulnerability

You can see the CVE's list.

2. Click on the CVE to see the details.

3. Explore the CVE Overview, Findings, Applications Impacted and Blast Radius tabs.

4. See the CVE Findings list in the Application Inventory page. Now it shows 7 CVEs.

6. Approve Actions in Action Center

Click for more info

We need to approve the generated actions so that Concert can proceed with applying the required patches to those VMs.

1. Goto the Action Center page.

You can see the 2 actions listed with Approval Pending state.

2. Click on Green down arrow to see the details of the Actions.

3. Click on Review and Approve link.

4. Click on Approve button.

5. Repeat the above steps for the second record as well.

After the approval both the actions are in the Approved status

7. Create Authentication for VM Patching

7.1 Create Authentication for VM1

Click for more info

1. Click on Workflow > Authentications tab.

2. Click on Create Authentication

3. Enter the following:

• Name: G-Linux_ssh_vm1**
• Service: Ansible
• Private Key : (include an empty line at the end)

-----BEGIN OPENSSH PRIVATE KEY-----
xxxxxxxxxxxxxxxxxxxxx
-----END OPENSSH PRIVATE KEY-----

• Inventory: Provide the inventory in the format shown below, specifying your VM’s IP address. If multiple VMs use the same private key, you can include them by adding additional lines to the inventory.

[canary]
9.30.167.125 ansible_user=root ansible_ssh_common_args='-o StrictHostKeyChecking=no'

6. Click on Create button.

Authentication is created.

7.2 Create Authentication for VM2

Click for more info

Need to repeat the above steps for VM2.

1. Click on Create Authentication

2. Create another Authentication in the same way for VM2.

• Give a name to this Authentication. Ex: G-Linux_ssh_vm2
• Give the IP address of the VM2 in the Inventory

Authentication is created.

7.3 Create Combined Authentication (Config Data)

Click for more info

Combining the above 2 authentication together we need to create another Authentication of ConfigData.

1. Click on Create Authentication

2. Enter the follwoing.

• Name : G-Linux_ssh
• Service : Config Data
• Property : Give the data like the below.

{
  "config": [
    {
      "auth": "ibmconcert/G-Linux_ssh_vm1",
      "host": ["9.30.167.125"]
    },
    {
      "auth": "ibmconcert/G-Linux_ssh_vm2",
      "host": ["9.46.72.158"]
    }

  ]
}

3. Click on Create button.

Authentication is created.

8. Execute Patch Workflow

8.1 Import Remediation_Master workflow

Click for more info

1. Goto the workflow home page.

2. Click on Create workflow

4. Enter the following.

• Current Version : Current
• Usecase : Remediation_Master tile

5. Click on Import button.

The workflow is imported.

8.2 Run the workflow

Click for more info

1. Click and Open the workflow

2. Enter ibmconcert/G-Linux_ssh in the linux_auth property
3. Click Save button
4. Click Run button to run the workflow

You can see the result of the workflow run.

8.3 View workflow result

Click for more info

1. Goto the workflow > Run page, you can see the workflow got executed info.

2. Click on Green arrow to see the results.

9. View Action center

Click for more info

In the action center status is changed to Success

Note

Change management tool

This demo assumes that IBM Concert is configured as the change management tool.

If an external change management tool is used instead, the demo flow will differ. In such cases, patch approvals must be handled in the external system (for example, ServiceNow). Instead of running a single Remediation_Master workflow, the following three workflows need to be executed:

• Create_Change_Request_For_Remediation_Action
• Monitor_Remediation_Action_Status
• Remediation_Master