Configure IVR

Run the setup on the IVR Configuration page to point BigFix Insights for Vulnerability Remediation at its database, set the options that its service runs with, and connect the first scanner datasource. BigFix UI reports the application as Configured only after the background processes that the setup starts finish successfully.

Before you begin

Confirm that the prerequisites in IVR settings are met: the BigFix Insights for Vulnerability Remediation site is enabled and licensed, its version is greater than 0, and your role grants access to the application.

Collect the following before you start:

  • The host, port, database name, and schema name of the BigFix UI database, and the credentials of a database user who can create a schema in it. Alternatively, an ADO.NET connection string for that database.
  • The protocol, local web server port, and permitted cross-origin values that the IVR service runs with.
  • The host, port, and credentials of your outbound proxy, if IVR reaches the scanner through one.
  • The cloud URL, access key, and secret key of the scanner that you want to import from.
Important: The setup creates a new schema inside the existing BigFix UI database. The database user that you supply must hold the privilege to create a schema, or the connection test fails.

About this task

The setup has four steps: Database Configuration, Application configuration, Scanner Datasource configuration, and Summary. A stepper at the top of the page shows which step you are on. You do not configure the server here; the IVR service sets those values itself.

Each step validates against the system it describes before it lets you continue. Use Verify Connection on a step to test the values that you entered, and correct them there rather than at the end. Every field on a step is required, as the page states.

Procedure

  1. Expand Administration in the side navigation, and then select Application Configuration.

  2. In the Not Configured group, select the Integrated Vulnerability Management card.

    Use the search box in the upper right to find the card by name.

    The IVR Configuration page opens on the first setup step.
  3. On the Database Configuration step, read the IVR schema setup in BFUI Database banner.

    The banner states what this step does: the setup creates a new IVR schema inside the database that BigFix UI already uses. You are not creating a database here, and you are not pointing IVR at a database of its own. You are naming the BigFix UI database and the new schema to add to it.

    The page also states that all fields are required.

  4. From the Database Type list, select how you want to identify the database.
    • Microsoft SQL Server – Enter the server, port, credentials, and database name in separate fields. Choose this if you know these values individually.
    • Provide your own DSN – Enter one ADO.NET connection string. Choose this if your database administrator gave you a connection string, or if you need Windows authentication, which the separate fields do not offer.

    The fields below the list change to match your choice. If you switch between the two options, re-check the fields that remain.

  5. Optional: If you selected Microsoft SQL Server, enter the connection values.
    1. In SQL Server, enter the host name or IP address of the server that hosts the BigFix UI database.

      Use the same server that BigFix UI itself connects to. Pointing IVR at a different server creates the schema in the wrong place, and IVR finds no BigFix data to correlate its findings against.

    2. In SQL Server Port, enter the port that the database server listens on.

      The default for Microsoft SQL Server is 1433. If your deployment uses a named instance or a non-default port, ask your database administrator.

    3. In Database User and Database User Password, enter the credentials that IVR connects with.

      This account must be able to create a schema in the BigFix UI database. An account with read-only or data-only rights passes a plain login test but fails when the setup tries to create the schema.

      IVR stores these credentials and reuses them for every connection, so use a service account rather than a personal one.

    4. In Database Name, enter the name of the existing BigFix UI database.

      This database must already exist. The setup does not create it.

  6. Optional: If you selected Provide your own DSN, enter an ADO.NET connection string in the DSN field.

    Only Microsoft SQL Server connection strings are supported, and the database that the string names must already exist. The help text above the field gives two examples, one for SQL Server authentication and one for Windows authentication:

    • SQL Server authentication: server=192.168.0.5;database=myDataBase;user=myUsername;password=myPassword;port=1433
    • Windows authentication: Server=192.168.0.5;Database=myDataBase;Integrated Security=True;Trusted_Connection=True
    Note: The connection string contains the password in plain text. Follow your organization's handling rules when you copy it from another system.
  7. In Database Schema Name, enter a name for the schema that the setup creates.

    This field appears for both database types. Use a name that identifies the schema as belonging to IVR, and keep a record of it: administrators need it later when they query or back up the IVR data.

    Use a name that does not already exist in the database. Reusing the name of an existing schema can cause the setup to fail.

  8. Select Verify Connection.

    The control stays unavailable until every required field holds a value. Always verify before you continue: a wrong value that you carry forward surfaces later as a failed background process, which is harder to trace back to its cause.

    BigFix UI connects to the database server with the values that you entered and reports whether it succeeded. If the test fails, check the following before you try again:

    • The server name and port are correct, and the database server accepts connections from the BigFix UI server.
    • The database that you named exists on that server.
    • The credentials are valid and the account can create a schema.
    • For a DSN, the string is well formed and names a Microsoft SQL Server database.

    If the test keeps failing with values that you believe are correct, a firewall between the BigFix UI server and the database server is a common cause. Confirm that the port is open in that direction.

  9. Select Next.
  10. On the Application configuration step, set the options that the IVR service runs with.
    1. In Web protocol, enter the protocol that the service serves on.
    2. In Local web server port, enter the port that the service listens on.
    3. In CORS allowed origins, enter the origins that may call the service.
    4. To run IVR as a Windows service, select Install the application as a Windows Service.

      Installing the application as a Windows service requires administrative privileges.

    5. If IVR reaches the scanner through a proxy, turn on Setup proxy, and then enter the proxy host, port, user name, and password.

      The proxy host and port are required when the toggle is on. Leave the toggle off for a direct connection.

    6. Select Verify Connection.
  11. Select Next.
  12. On the Scanner Datasource configuration step, connect the scanner that IVR imports findings from.
    1. From the Create a New Datasource list, select Tenable IO.
    2. In Tenable cloud url, enter the URL of your Tenable instance.
    3. In Tenable access key and Tenable secret key, enter the API keys of the Tenable account that IVR reads with.

      Generate the keys in Tenable, from the API keys section of your user profile. IVR stores them; it cannot retrieve them from Tenable for you.

    4. In Alias, enter a name that identifies this datasource in the datasource list.
    5. Select Verify Connection.
      BigFix UI calls the scanner with the credentials that you entered and reports whether the connection succeeded.

    You can add more datasources later from the View Configuration page.

  13. Select Next.
  14. On the Summary step, review every value that you entered.

    The summary groups the values as Server Configuration, Database Configuration, and Application Configuration, and lists the datasources beneath them. To correct a value, return to the step that holds it by selecting that step in the stepper at the top of the page.

  15. Select Finish.

    BigFix UI saves the configuration and starts three background processes that build the IVR data set. The page returns to Application Configuration.

Results

When all three background processes complete successfully, the Integrated Vulnerability Management card moves to the Configured group and its status chip reads Configured. IVR then appears under Resolve and returns data.

If a process does not complete, the card stays in the Not Configured group and BigFix UI displays a message telling you to check the BigFix UI and IVR logs and then select Finish again to restart the service. Reopen the card, correct any values that the logs identify, and run the setup again.

What to do next

To review or change the saved values, or to connect another scanner, reopen the card and work from View Configuration. For a description of every value, see IVR configuration reference.