Last updated at Mon, 24 Jul 2017 14:29:02 GMT

   Los Angeles Office

     Toronto Office


Happy New Year!


While we are looking ahead to 2014, we want to pause and take a look back at some of our accomplishments in 2013. We had a big year at Nexpose and made a lot of improvements. Below are some of our Greatest Hits, and we look forward to bringing you more in the new year!


SQL query reporting is here! | product

You can run structured query language (SQL) queries directly against the Nexpose database and then output the results to comma-separated value (CSV) files. This gives you the flexibility to share rich asset, threat, and vulnerability data that is specific to the needs of your security team. For example, provide your team with a list of new assets in your environment as of the last week, so that they can better understand the surface area of risk. Or, report on which applications represent the most risk to your environment. Leveraging the capabilities of CSV format, you can create pivot tables, charts, and graphs to manipulate the query output for effective presentation. The possibilities are endless, and we have provided several examples to get you started!

See a video to help you get started with this new capability.


Be SCAP 1.2-ready! | product & content

The application is now SCAP 1.2-ready with the following features:

  • The application now supports the upload of SCAP configuration content in the SCAP datastream and datastream collection formats.
  • The application now utilizes CPE OVAL definitions, when provided, to restrict policy applicability at the benchmark, policy, group, and rule levels.  The application will include CPE 2.3 names in the Asset Report Format (ARF) report format.
  • Scan templates now include the option to store ARF data. If the data required to generate ARF reports has been stored for a site, you can generate ARF reports for that site. ARF reports include a detailed specification of the content used to evaluate compliance and the subsequent results, including the Asset Inventory (AI) data, the XCCDF results, the OVAL system characteristics, and the OVAL full results. Currently, this implementation is supported for scans of Red Hat Enterprise Linux targets.
  • The application now displays CCE to NIST 800-53 Controls mappings where applicable.
  • The application now supports the USGCB 1.0.5.0 RHEL Benchmark.

Run reports in Korean | product

You can now share critical asset, vulnerability, and remediation information with your Korean-speaking security teams by using the new multi-language reporting features in the Security Console:

  • In your user preferences, you can select between English and Korean as the default language for all new reports.
  • In a report configuration, you can override the default language by selecting English or Korean for that specific report.
  • Your Korean-speaking team members can learn how to make the most of rich reporting capabilities and other important features by viewing the online Help in Korean. The language for Help is another user preference option.

Prioritize validated vulnerabilities to save time and reduce real risk | product

Stop wasting your precious time patching vulnerabilities that may not be exploitable. Leverage the Metasploit penetration testing framework to confirm vulnerabilities discovered in scans. By exploiting vulnerabilities and then reporting that they have been validated, you can prioritize security flaws known to be exploitable. This helps your team allocate remediation resources where they are most needed to keep your organization secure.

Find important assets faster | product

A series of exciting updates to the Web interface continues with an overhaul of the Assets page. Now, just click the Assets tab and see all of your discovered assets in a single place. Find key assets that are grouped and sorted according operating systems, software, or services installed on them. Navigate quickly to find the assets that are most important to your security objectives.

See only the vulnerabilities you want to see | product

You can now tailor your view of the vulnerabilities displayed in the Vulnerability Listing table of the Web interface. By applying filters similar to those used for dynamic asset groups, you can display specific vulnerabilities based on criteria such as risk scores or certain sites that contain affected assets. This allows you to limit the sheer number of vulnerabilities displayed in the table or to see only high-priority vulnerabilities.

See a short video about this feature.


Update and activate more easily on private networks | product

If your network has limited or no Internet access, you can now activate your license or apply updates more quickly and easily.

  • To apply updates, simply run the latest installer, which detects an existing installation and applies any updates or file repairs as necessary. This process takes only minutes and maintains the data and configuration settings of the current installation. See a short video about this feature.
  • To activate your license without Internet access to the update server, you can upload a license file to the Security Console. The Account Management team provides the file directly to you. See a short videoabout this feature.

Making operations easier and faster | product

With a few simple steps you can now perform certain common operations in bulk mode, so that you can complete these tasks more easily and efficiently:

  • Remove multiple assets from your Asset Listing tables. You can manually select individual assets or quickly select all assets displayed in a table and delete them together.
  • Create multiple vulnerability exceptions or exception requests. You can manually select individual vulnerabilities or quickly select all vulnerabilities displayed in a table and mark all of them to be submitted, approved, or recalled for exclusion.

Tracking vulnerability trends | product

The new Vulnerability Trends report template allows you to view asset and vulnerability trends over a period of time that you can configure, so that you can track the success of your remediation program or changes to your environment and security posture.

Reporting | product

Vulnerability trend template

A new report template shows key vulnerability trends, so that you can easily track your security posture and the success of your remediation efforts over time. Trends include assets scanned, vulnerabilities discovered, vulnerability age, severity levels, and exploit and malware kit exposures. Learn more about the template and download it at Three-month Vulnerability Trend report in Nexpose. Then upload it using the Security Console Web interface. Find other report templates in Security Street at Nexpose Report Templates.

Reporting | product

New remediation report templates

New Top Remediations report templates provide short, actionable plans that allow you to make the most impactful decisions to reduce risk in your organization. One of these templates provides a high-level summary, and the other provides additional details about the remediation actions and the affected assets.

Report template search feature

When creating a report, you can now use a search field to help you find a specific template. Just enter a few letters from the template's name, and the template carousel displays all templates with names that include those letters. This convenient feature helps you find templates quickly and generate reports more efficiently.

Web interface & usability | product

A number of improvements make using the Web interface easier:

  • The Vulnerabilities page loads much more quickly, allowing you to assess your security issues more efficiently.
  • The Security Console now restarts automatically after successfully completing data maintenance and backup/restore routines.
  • The processes for editing and saving a site complete as quickly for sites with non-administrative users as for sites with only administrative users.
  • The Asset Group Listing table on the Home page is now located above the Ticket Listing table, giving it better visibility for you as you manage your asset groups.
  • Options on the Administration page are now sorted alphabetically, which makes it easier to perform administrative tasks.
  • The look and feel of the Security Console Web interface incorporates a cleaner, more open, look that maximizes visual space.