[Autogenerated] in this demo,
we're going to configure the notifications because
open C V is an alerting platform,
we're going to subscribe to vendors and products,
we're going to verify the mail server settings,
which is very important since mill is currently the only way to be alerted.
And we're going to tag a specific vulnerability.
Let's open our web browser and go to the open C.
V.
web instance.
We can see that the full page for non logged in users.
If we click on the link at the top right sign in,
we can sign in using our admin account.
These are the credentials that we used in the previous
demo where we created the admin account.
Let's film the details and click on sign in.
If you entered the correct log in credentials,
you'll be greeted with your dashboard and as you can
see this dashboard is pretty empty.
Why?
Because we haven't subscribed yet to any notifications of any product or vendor.
Let's now assume we want to receive a notification for
any vulnerability in the product.
jQuery If you click on vendors and products at the left hand side,
we get an overview of all available vendors and products here.
We can search for vendors or products.
So let's search for jQuery This searches for jQuery in
defender as well as product name.
So now sometimes it's kind of a hit and miss to know exactly what
kind of fender or product you're looking for.
If you click on the link,
you will see all CV entries for that specific vendor or product,
this looks like the correct vendor.
Okay,
now we want to be notified if any new CV will be published for
this specific vendor we can do that by clicking on the
subscribe button and that's actually it.
That's how you get notified.
When anything changes.
With regards to this specific vendor you subscribe to changes.
The next step is configuring when you will receive
alerts email alerts in our instance,
you can do this by clicking on the top right on your account name and
then on account here you see an overview of all your subscriptions and
we just subscribe to the jQuery vendor.
If you now click on notifications,
here's when you can set when you receive an alert as you
can see you can choose multiple options.
What you want to make sure is that you don't overflow
yourself with too much information.
You want to keep the signal to noise ratio acceptable personally,
what I recommend doing is receiving a notification when a new CVI entry
for your product or vendor is generated for if one of your subscriptions
appears for the first time when it's so called CVS s score changes which
more or less signifies the impact of vulnerability and when its so
called C pe list changes.
Cp e stands for a common platform enumeration and matches a
vulnerability to a specific vendor and product version,
let's de select the rest.
Click on.
Save changes and now every time that a new vulnerability will be
found for jQuery we will receive a notification.
However we haven't tested whether the email settings worked yet.
How can we do that?
Well, there's a simple trick to check whether the email settings are correct.
Click on the account button at the top, right and click on sign out.
This will bring you to the log in page by default.
Anyone can register a new membership or in other words an account.
This of course is insecure.
I assume that when setting up openCV in a production environment that you place
it behind a reverse proxy server and also take care of encryption ssL TLS
traffic that falls outside of the scope of this course.
Now can we use to register a new membership function in order to
check whether the mail settings are correct,
fill in a new name and a valid email address,
then add a random passwords and if you click on register,
if you then get an error message like you see here,
then you know that the email settings are incorrect to validate that.
Let's go back to the console and type in Docker dash compose logs,
which will show you the log output of all the services.
Then we see here a message about incorrect sMTP settings.
This is how you can troubleshoot issues with email as
well as configuration settings.
Let's go back to the weapons or face,
let's log on using the administrative account that we created previously.
As soon as you log in.
You see the dashboard with all updates to the
vulnerabilities that you're subscribed to.
Currently this is pretty empty for us.
So let's say you want to be informed about the
progress of a specific vulnerability.
Let's click on the shield at the left hand side.
Vulnerabilities.
And search for an open ssl vulnerability.
Let's now select the second vulnerability to 022-3602.
And let's click on it.
As of recording of this course,
this is a relatively new vulnerability and as a system administrator,
I want to be informed when this vulnerability changes
anything with regard to this vulnerability.
What you can do for that is to tag a specific vulnerability.
Let's go to the right hand side of the screen and click on tags here.
You can attach a specific tag to a vulnerability.
We don't have defined any tags yet.
Let's click on manager tags here.
We can create a new tag.
Let's go with production and with the description running on live environment.
Let's click on create and now we created a tag called production.
If you now go back to our search results and refresh the page.
If you now click on text at the right hand side.
Now we can add the production tag to this specific vulnerability.
Let's click on production, then let's click on update associated tags.
And now, as you can see at the right hand side,
this specific vulnerability has been tagged production.
If you go back to the dashboard by clicking on the top left icon here,
you can see that we have a tax called production.
If you click on the tags, you can see all related vulnerabilities,
which is one that we just tagged.
So tagging can be an easy way to follow the progress of
one or more specific vulnerabilities.
That's it for this demo.
In the next demo, let's use the API of open CV to search for vulnerabilities.