Configure Integrations
Integration with Email allows CTEM to send outbound emails for notification and report scheduling.
- Settings < CTEM < 'Integrations'
Setup required to configure Integrations
Credentials
Complete the required fields and tap Update to continue:
- Name: Enter a name of your choice for the SMTP email credentials.
- SMTP Host: Enter the hostname of the SMTP server. (Example: email-smtp.us-east-1.amazonaws.com)
- SMTP Port: Enter the port to be used for SMTP (Example: 465)
- SMTP Username: Enter the SMTP username for authentication.
- SMTP Password: Enter the password for the username used for authentication.
- Email Address to Send From: Enter the email address used for send as / send from.
- SSL Status: Select the checkbox for SSL encryption on the port connection.
- TLS Status: Select the checkbox for TLS encryption on the port connection.
- Email for Test Email Check: Enter the email address to get a test email.
Event Set
In CTEM, Event Sets are the predefined events that can trigger an alert using the supported integrations. Categories organize them and can be enabled with a simple checkbox.
Note: You will not see the Event Set options until you have provided the credentials for the selected integration.
Events by Category
Event Set categories include:
System Changes, Problems, Solutions, Job Failed, Certificate Expire in 30 Days.
Below is a breakdown of each category and the available 'events' you can monitor for each.
System Changes
| Event | Description |
| New Asset Added | A new asset is added to the All Asset section; this can happen when agents are installed or assets are detected by probe scanning. |
| Agent has Outdated Version | The agent version for a lightweight or probe agent is behind the current version release. |
| New Company Created | A new company is created in the ConnectSecure portal, using local or PSA options. |
| New Open Port Discovered (Probe Scan) | A new port is discovered on an internal asset during a probe scan; port discovery and scanning are only done by a Probe agent. |
| Probe Went Down | The probe agent is offline and can not be reached |
Problems
| Event | Description |
| CISA Vulnerabilities Found | Vulnerabilities found that are published by CISA |
| Critical Network Vulnerabilities Found | Vulnerabilities found during a network (probe/external) scan with a critical severity as found in the CVSS Base Score (9.0–10.0). |
| Critical Vulnerabilities Found | Vulnerabilities found with a critical severity as found in the CVSS Base Score (9.0–10.0). |
| High Severity Network Vulnerabilities Found | Vulnerabilities found during a network (probe/external) scan with a high severity as found in the CVSS Base Score (7.0–8.9). |
| High Severity Vulnerabilities Found | Vulnerabilities found with a critical severity as found in the CVSS Base Score |
| Low Severity Network Vulnerabilities Found | Vulnerabilities found during a network (probe/external) scan with a low severity as found in the CVSS Base Score (0.1–3.9). |
| Low Severity Vulnerabilities Found | Vulnerabilities found with a low severity as found in the CVSS Base Score |
| Medium Severity Network Vulnerabilities Found | Vulnerabilities found during a network (probe/external) scan with a medium severity as found in the CVSS Base Score (4.0–6.9). |
| Medium Severity Vulnerabilities Found | Vulnerabilities found with a critical severity as found in the CVSS Base Score |
| Registry Vulnerability Found | Vulnerability is found in the Windows Registry |
| Remote Login Vulnerabilities Found | Problems related to remote login or remote access problems; IE: RDP-NTLM |
| SMB Vulnerabilities Found | Problems related to the SMB protocol; IE: SMB_Signing |
| SSL/TLS Vulnerabilities Found | Problems related to SSL/TLS certificates and ciphers; IE: TLSv1.1, Sweet32, SSL_Heartbleed |
| UnQuoted Service Path Found | Windows-based vulnerability for improperly formatted or unquoted file paths when defining the executable path; IE: C:Program FilesMy Serviceservice.exe |
| Vulnerabilities Found With EPSS Score > 95 | Vulnerability is found where the EPSS score is equal to or above 95% exploitability. |
| Vulnerabilities Found With EPSS Score between 0.85 and 0.9 | Vulnerability is found where EPSS score is between 90% & 85% exploitability |
| Vulnerabilities Found With EPSS Score between 0.9 and 0.95 | Vulnerability is found where EPSS score is between 95% & 90% exploitability |
Solutions
| Event | Description |
| Application Baseline plans Available | Application and/or Service listed in the application baseline is found. |
| Pending Remediations Found With Critical Severity | Solutions found with a critical severity as found in the CVSS Base Score |
| Pending Remediations Found With High Severity | Solutions found with a high severity as found in the CVSS Base Score |
| Pending Remediations Found With Low Severity | Solutions found with a low severity as found in the CVSS Base Score |
| Pending Remediations Found With Medium Severity | Solutions found with a medium severity as found in the CVSS Base Score |
| Remediation Available | Solutions found with any severity in the CVSS Base Score, or no severity/informational |
| Remediation Found With EPSS >= 0.95 | Solution is found where the EPSS score is equal to or above 0.95 |
| Remediation Found With EPSS between 0 and 0.85 | Solution is found where the EPSS score is between 0 and 0.85 |
| Remediation Found With EPSS between 0.85 and 0.9 | Solution is found where the EPSS score is between 0.85 and 0.9 |
| Remediation Found With EPSS between 0.9 and 0.95 | Solution is found where the EPSS score is between 0.9 and 0.95 |
Job Failed
| Event | Description |
| Scheduler Patch Job Failed | Patch Scheduler jobs that report a failure |
| Scheduler Report Job Failed | Report Scheduler jobs that report a failure |
Certificate Expires in 30 Days
| Event | Description |
| Certificate expires in 30 Days | SSL Certificates that are set to expire in 30 days. |
Integration Rules
Here, we define which email address will be notified based on the above-configured Event Set(s).
Complete the required fields to save.
Name: Give the integration rule a name of your choice.
Email ID: Enter the email address(s) comma separated to receive any configured Event Set alert.
Event Set: Select the Event Set for the associated email profile to use.
Company Mapping
This is where you map your CTEM company to the Integration Rule(s) and can enable the ‘Create Email Alert’ box to enable this rule.
