Skip to content
  • There are no suggestions because the search field is empty.

How to create NVD Reports with Nipper InfraSight

The NIST National Vulnerability Database (NVD) report identifies known vulnerabilities (CVEs) affecting the operating system versions running on your audited devices. Every Nipper InfraSight release includes up-to-date NVD vulnerability resources. For even more up-to-date vulnerabilities, NVD resources can also be manually downloaded from your Titania Customer Portal and imported into Nipper InfraSight; these are updated hourly.

 For more information, see Updating Resources.

Creating the NVD Report 

  1. To begin, go to File, New Report.
  2. Add one or more devices to the audit using Config File, Config Dir, Remote Device or Remote List methods.
  3. On the Reporting Options screen, select the NIST NVD report check box.
  4. On the Report Comparison screen, if you wish to perform a comparison with a previously generated report, select the report here.
  5. Begin the report generation by pressing the Next button.
  6. After a short time generating, your report is then available.

Improving accuracy with manually specified version information

Nipper InfraSight determines the device operating system version from its configuration file. For some platforms this version information is incomplete, so NVD vulnerabilities are matched against a broader version range than necessary. For example, Cisco IOS XE configuration files only ever report a MAJOR.MINOR version (such as 17.15), while NVD records vulnerabilities against the full release including its patch number. As Nipper cannot determine the patch version from the configuration file alone, it cannot automatically narrow the match down to the exact release.

When no patch version has been specified, Nipper InfraSight flags every vulnerability that matches the known MAJOR.MINOR version, regardless of patch. For example, a detected version of 17.15 will show vulnerabilities affecting 17.15.1, 17.15.3a and any other patch within the 17.15 release. These vulnerabilities will only be removed from the report once the full, exact version is specified. This behaviour is intentional: Nipper InfraSight errs on the side of caution, presenting vulnerabilities that may not actually be present on your device rather than risk omitting a vulnerability that does apply.

You can manually supply the missing version detail so that the report matches vulnerabilities more precisely:

  1. In the New Report window, tick the Advanced check box.
  2. On the Modify Devices screen, click the settings cog icon next to the device you want to update.
  3. Manually add the patch version for that device's operating system.

You can also control how Nipper InfraSight treats partial version numbers when an exact patch version has not been specified. This is configured from Settings, Reports, NIST NVD, where a setting lets you choose how partial versions are handled when matching against the NVD data.

Viewing the NVD report

The NVD report will be displayed in HTML format by default, within the Nipper InfraSight report Browser. From here, you can scroll through the report, navigate to key sections via the navigation window shown to the right of the screen and search for key text or phrases within the report.

Saving the report

All reports can be saved in several formats:

  • ASCII Text
  • HTML
  • JSON
  • LaTeX
  • Table to CSV, Excel, JSON, SQL, XML
  • XML

For more information on saving Nipper InfraSight reports, please see Saving Your Reports.