configuration checker

[RichardD2]

Does anyone know of tools that can confirm/deny if a network device is vulnerable to a particular alert based on configuration?

I.e. It's a simple matter to parse a listing of vulnerability notifications and then determine if there is a match between an affected version of software and a device on the network. Confirming if the feature implicated in the notification is actually present and enabled on the device is manual and error prone process and I'm looking to find out if there are products that address this issue.

thank you in advance

[Marvin Rhoads · Accepted solution]

Have a look at Cisco Active Advisor (CAA) for the parsing job. It's free and very easy to use.

http://www.cisco.com/c/en/us/products/cloud-systems-management/active-advisor/index.html

https://www.ciscolive.com/online/connect/sessionDetail.ww?SESSION_ID=90804

CAA will not check if a feature that exposes a vulnerability is configured. For that, you can use something like the Compliance feature in Cisco Prime Infrastructure. It will show you not only that a given PSIRT applies to the running code but also analyze the running configuration and tell you if the vulnerable feature is configured.

http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-1/user/guide/pi_ug/compliance.html