Vulnerability Management - Agent Deployment Coverage

Description

The percentage of systems with up-to-date vulnerability management agents deployed, providing critical visibility into security gaps and enabling swift action to protect the organization from exploitable weaknesses.

How we measure it

Find all computers managed by Kandji (checked in within the last 30 days) or Workspace ONE (enrolled and seen within the last 30 days), and match them by serial number to CrowdStrike hosts. CrowdStrike Spotlight assesses vulnerabilities through the Falcon sensor, so computers are considered compliant if the sensor has reported in within the last 7 days.

Meta Data

Attribute	Value
Metric id	vm_coverage
Category	Vulnerability Management
SLO	80.00% - 95.00%
Weight	0.4
Type

References

Framework	Ref	Domain	Control
ISO 27001:2022	A.8.8	8 Technological controls	Management of technical vulnerabilities
CIS 8.1	7.5	Continuous Vulnerability Management	Perform Automated Vulnerability Scans of Internal Enterprise Assets
CIS 8.1	7.6	Continuous Vulnerability Management	Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
NIST CSF v2.0	ID.RA-01	Risk Assessment (ID.RA)	ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded
Essential8-ML1	ISM-1698	Patch applications	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.
Essential8-ML2	ISM-1698	Patch applications	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.
Essential8-ML3	ISM-1698	Patch applications	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.
Essential8-ML1	ISM-1699	Patch applications	A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.
Essential8-ML2	ISM-1699	Patch applications	A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.
Essential8-ML3	ISM-1699	Patch applications	A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.
Essential8-ML1	ISM-1701	Patch operating systems	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.
Essential8-ML2	ISM-1701	Patch operating systems	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.
Essential8-ML3	ISM-1701	Patch operating systems	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.
Essential8-ML1	ISM-1702	Patch operating systems	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.
Essential8-ML2	ISM-1702	Patch operating systems	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.
Essential8-ML3	ISM-1702	Patch operating systems	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.
Essential8-ML3	ISM-1703	Patch operating systems	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers.
Essential8-ML3	ISM-1900	Patch operating systems	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware.

Code

WITH inventory AS (
  SELECT upper(serial_number) AS serial, device_name AS name, 'Kandji' AS source
  FROM {{ ref('kandji_devices') }}
  WHERE NOT is_missing AND NOT is_removed
    AND CURRENT_DATE - CAST(last_check_in AS DATE) <= 30
  UNION ALL
  SELECT upper(serial_number), device_friendly_name, 'Workspace ONE'
  FROM {{ ref('workspaceone_computers') }}
  WHERE enrollment_status = 'ENROLLED'
    AND CURRENT_DATE - CAST(last_seen AS DATE) <= 30
),
devices AS (
  SELECT serial, any_value(name) AS name, string_agg(DISTINCT source, ', ') AS sources
  FROM inventory
  WHERE serial IS NOT NULL AND serial <> ''
  GROUP BY serial
),
sensors AS (
  SELECT upper(serial_number) AS serial,
         max(last_seen) AS last_seen,
         arg_max(reduced_functionality_mode, last_seen) AS reduced_functionality_mode
  FROM {{ ref('crowdstrike_hosts') }}
  GROUP BY 1
)
SELECT
  devices.name || ' (' || devices.serial || ')' AS resource,
  'host' AS resource_type,
  CASE
    WHEN sensors.serial IS NULL THEN 0
    WHEN CURRENT_DATE - CAST(sensors.last_seen AS DATE) > 7 THEN 0
    ELSE 1
  END AS compliance,
  CASE
    WHEN sensors.serial IS NULL THEN 'No CrowdStrike Spotlight sensor (serial ' || devices.serial || ', managed by ' || devices.sources || ')'
    WHEN CURRENT_DATE - CAST(sensors.last_seen AS DATE) > 7 THEN 'CrowdStrike sensor last seen ' || CAST(CAST(sensors.last_seen AS DATE) AS VARCHAR)
    ELSE 'CrowdStrike sensor reporting'
  END AS detail
FROM devices
LEFT JOIN sensors ON sensors.serial = devices.serial