View the Shodan Exploit Integration import run status

Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.

始める前に

To view the Shodan import run status:

• The Vulnerability Response application and the Shodan Exploit Integration must be installed and configured.
• The Shodan Exploit Integration imports must be scheduled and running.

Role required: sn_vuln.admin

このタスクについて

During integration execution, multiple processes are generated, and data is received in the form of pages. Each process can contain one or more import queue entries with attached data in pages. These entries must process the data within the one-hour time limit. However, if the payload size is large, the processing time may exceed one hour or get stuck, resulting in an integration timeout error. The integration continues to process the data despite the timeout error. To avoid this miscommunication, starting from version 18.2.4 of Vulnerability Response, timestamps (heartbeats) are sent periodically to indicate if the queue is active and processing data. The Last Record Processed field in the Import Queue Entry page is updated based on the count of records the import queue creates or updates. In case an import queue entry exceeds the one-hour time limit, the system checks the Last Record Processed field to see if it is also older than one hour. If it is, this indicates that the import queue entry is stuck, and it is timed out to prevent any further delays in processing.

注:

The Last Record Processed field is updated based on what is defined in the following system properties:

• sn_sec_cmn.record_threshold_heartbeat: Defines the number of processed records, after which the heartbeat (timestamp) is sent to the import queue entry.
• sn_sec_cmn.maximum_heartbeat_delay: Defines the time after which the import queue entry must be timed out.

手順

1. Navigate to All > Shodan Exploit Integration > Integrations.
2. Select an integration.
3. Click the Vulnerability Integration Runs related list.
4. Verify that all imports have succeeded.
   The most common causes for a failed run include:

   • Network interruption
   • Bit decay in the data transfer resulting in corrupted data during the transform

   If you encounter any of these conditions, select the Full data import check box, click Execute Now, and rerun the integration.