Home
BigFix and QRadar User Guide
QRadar® provides security intelligence for protecting assets and information from advanced threats. BigFix provides a dashboard that is integrated with QRadar®. This dashboard is called the Manage Vulnerable Computers dashboard and is located within the Endpoint Protection domain in BigFix. From this dashboard, you can view enriched vulnerability and risk data, from which you can quickly identify the computers that are most at risk. You can remediate the vulnerabilities that are detected by QRadar® and you can also quarantine or un-quarantine computers.
Remediate vulnerabilities
Use the Manage Vulnerable Computers dashboard to view and remediate QRadar vulnerability data and quarantine or un-quarantine computers.
Un-quarantining computers
From the Manage Vulnerable Computers dashboard you can view all of the computers that you manage in BigFix and view CVEs, associated risk, and quarantine data for each computer. You can also quarantine and un-quarantine Microsoft™ Windows™ computers.

BigFix and QRadar User Guide
QRadar® provides security intelligence for protecting assets and information from advanced threats. BigFix provides a dashboard that is integrated with QRadar®. This dashboard is called the Manage Vulnerable Computers dashboard and is located within the Endpoint Protection domain in BigFix. From this dashboard, you can view enriched vulnerability and risk data, from which you can quickly identify the computers that are most at risk. You can remediate the vulnerabilities that are detected by QRadar® and you can also quarantine or un-quarantine computers.
- Overview and getting started
  HCL® BigFix provides the Manage Vulnerable Computers dashboard from which you can view and remediate QRadar® vulnerability data. The dashboard lists the QRadar® Computer Risk Score, CVEs, and CVE risk score, which you can use to quickly identify the computers that are at risk. The dashboard provides a list of the Fixlets and Baselines that are available to take action and remediate CVEs. You can also quarantine or unquarantine computers from the Manage Vulnerable Computers Manage Vulnerable Computers dashboard. An Actions tab shows the actions that you ran from the dashboard.
- Remediate vulnerabilities
  Use the Manage Vulnerable Computers dashboard to view and remediate QRadar vulnerability data and quarantine or un-quarantine computers.
  - Computer details
    From the Manage Vulnerable Computers dashboard, you can view the computers that you manage in BigFix for which QRadar® sends vulnerability information. You can view the QRadar® Computer Risk Score, number of CVEs, CVE risk score, and quarantine information for each computer. You can filter to view only the computers for which there are relevant Fixlets. You can also quarantine and un-quarantine computers.
  - Quarantining computers
    You can quarantine Microsoft™ Windows™ computers from the Manage Vulnerable Computers dashboard.
  - Un-quarantining computers
    From the Manage Vulnerable Computers dashboard you can view all of the computers that you manage in BigFix and view CVEs, associated risk, and quarantine data for each computer. You can also quarantine and un-quarantine Microsoft™ Windows™ computers.
  - Viewing Common Vulnerability Exposures (CVEs) and associated Fixlets
    The Manage Vulnerable Computers dashboard displays vulnerability data from QRadar®. The vulnerabilities detected by QRadar® are known as Common Vulnerability Exposures (CVEs). This CVE data is displayed in the dashboard for the computers that you control as an operator in BigFix. The Manage Vulnerable Computers dashboard does not display all CVEs detected for all computers by QRadar® Vulnerability Manager. Only CVEs with a risk score above a threshold defined in QRadar® are sent to the Manage Vulnerable Computers dashboard.
  - Viewing actions
    From the Actions tab on the Computers or CVEs view, you can track the progress of actions that you deployed from the Manage Vulnerable Computers dashboard.
  - Troubleshooting
    Read this section for information about any known issues using the Manage Vulnerable Computers dashboard.

Un-quarantining computers

From the Manage Vulnerable Computers dashboard you can view all of the computers that you manage in BigFix and view CVEs, associated risk, and quarantine data for each computer. You can also quarantine and un-quarantine Microsoft™ Windows™ computers.

Before you begin

You must have the policy action set up for un-quarantining, as described in the Requirements section.

About this task

You can view the computer ID, the computer name, QRadar Computer Risk Score, quarantine state, and CVEs associated with the computers that you manage. Using this enriched vulnerability information, you can quickly identify the computers that are at risk. You can also quarantine and un-quarantine computers.

You can un-quarantine only Microsoft™ Windows™ computers and you can un-quarantine only one computer at a time.

Complete the following steps to un-quarantine a Microsoft™ Windows™ computer.

Procedure

From the Manage Vulnerable Computers dashboard, click the Computers tab.
Select the computer that you want to un-quarantine.
Click Un-quarantine Computer.
From Execution tab on the Take Action dialog box, you can schedule a time for the computer to be un-quarantined, or click OK to un-quarantine the computer immediately.

Results

Only one action is generated for the un-quarantine Fixlet®. So for each subsequent computer that you un-quarantine, the existing un-quarantine action is updated to include the latest computer un-quarantined. To view an updated action, from the Endpoint Protection domain, select Actions and select the Un-quarantine action. Click Reported Computers and you can see the computers for which the un-quarantine action has run.