How to report vulnerabilities for running and non-running Linux kernels using the VM Detection API?

Use the VM Detection API with the arf_kernel_filter parameter to identify vulnerabilities affecting running and non-running Linux kernels.

To report vulnerabilities for running and non-running Linux kernels using the VM Detection API:

1. Replace the deprecated parameter Do not use active_kernels_only. It is deprecated. Use arf_kernel_filter={0|1|2|3|4}.
2. Run the following:
   VM Detection API requestVM Detection API request

   API Request

   curl -u "User:Password" -H "X-Requested-With: Curl" -X "POST" \ -d "action=list&max_days_since_last_vm_scan=45&show_results=1&show_igs=0&show_reopened_info=1&output_format=CSV&suppress_duplicated_data_from_csv=0&truncation_limit=0&status=New,Active,Re-Opened,Fixed&arf_kernel_filter=0" \ "https://qualysapi.qualys.com/api/2.0/fo/asset/host/vm/detection/"
   

3. Run this command multiple times with different arf_kernel_filter values.
4. Understand kernel filtering.
   A Linux host can have multiple kernels. The scan identifies the running kernel in Information Gathered QID 45097.
   The following are the filter values:
   1. 0: Returns all vulnerabilities
   2. 1: Excludes non-running kernel vulnerabilities
   3. 2: Only non-running kernel vulnerabilities
   4. 3: Only running kernel vulnerabilities
5. Interpret the output as follows.
   • Blank: Not kernel-related
   • 0: Affects a non-running kernel
   • 1: Affects the running kernel

If you do not specify a kernel filter, the API does not filter vulnerabilities based on kernel activity. One host can have multiple installed kernels.

For more information, we recommend Instructor Led - Advanced Vulnerability Management training.