Installment three of fourteen. Today: devices your vulnerability scanner never touches.
Aggregating asset data tells you what each tool knows. It doesn’t tell you what none of them know — and that blind spot is exactly where unscanned devices live. Reconciling the sources is what lets you ask a negative question: which devices show up in the directory, or in the EDR, but never in a scan result?
That’s the “unknown unknowns” problem. It’s answerable — just not from inside the scanner.
Gulp. It’s the cybersecurity equivalent of “unknown unknowns.”
But don’t sweat it! 🥵
This is what we at SJULTRA solve with CAASM (Cyber Asset Attack Surface Management) and cybersecurity observability shine.
Book your Free 30-day CAASM Trial
Gain Complete Visibility of Your Cybersecurity Assets with the SJULTRA CAASM free trial.
The Invisible Threat: Unscanned Devices
Here’s the deal: Your vulnerability assessment tools are great at finding issues on devices they know about. But what about the devices they don’t know exist? These could be:
- A forgotten server in a remote office
- A new VM spun up without proper documentation
- An employee’s personal laptop connected to the network
These invisible assets are like open windows in your digital fortress. And the worst part? Your vulnerability scanner’s admin console won’t tell you about them because it doesn’t know they exist!
Enter SJULTRA's Cybersecurity Observability Service
This is where SJULTRA’s CAASM service comes to the rescue. It’s like giving your security team x-ray vision for your network.
Our CAASM pulls data from multiple sources:
- Your vulnerability scanner console
- Directory services like Active Directory or Azure AD
- Network and infrastructure data
By cross-referencing these sources, CAASM can spot the devices that should be scanned but aren’t. It’s like finding the missing pieces in your security puzzle!
Let's get querying
Once we have CAASM set up (remember, SJULTRA offers a free 30-day trial), we can begin identifying those elusive malfunctioning agents.
Want to find all devices missing vulnerability scanner coverage? Here’s how we do it:
3. Query Language (SQL):
This query finds devices missing Vulnerability Scanner coverage by showing anything not known to security solutions categorized as Vulnerability Assessment Tools. Here’s an example of the returned results:
Simple, right? But incredibly powerful.
Finding Windows Devices Without a Vulnerability Scanner Solution
Let’s get more specific. Say your policy requires all Windows devices to be scanned. We can modify our wizard query:
Or in AQL…
Results in…
…and so on.
But if you have a large estate and lots of results, you can filter down the most recently seen windows devices by adding an extra line to your query: “Last Seen (Days) 7”
We've found the unscanned devices - now what?
Great, we’ve uncovered these hidden devices. What’s next? This is where the “action” part of our cybersecurity observability comes in. We’ve got four tricks up our sleeves:
- Notify: Send alerts via email, Slack, Syslog, or CSV (because who doesn’t love another alert, right?)
- Create Incident: Generate tickets in systems like ServiceNow, Jira, or Zendesk
- Update VA Coverage: Automatically add the device to the next scheduled vulnerability assessment scan
- Deploy Files and Run Commands: Execute shell commands or initiate scans on the newly discovered devices
Summary
And there you have it, champions!
That’s how we turn the invisible threat of unscanned devices into a manageable, observable process.
It’s not just about finding vulnerabilities; it’s about making sure we’re looking in all the right places.
Remember, this is just 3 out of 14 standard use cases we help our customers with as part of our CAASM Concierge service. And guess what? You can get it for free!
In the world of cybersecurity, what you don’t know can hurt you. But with the right tools and a bit of observability magic, we can shine a light on those hidden threats.
Stay vigilant, keep querying, and may all your devices be scanned and secure!
Get your free 30-day CAASM trial now!
Documentation and Videos
Read the documentation on Finding Devices Not Being Scanned For Vulnerabilities.
