Although Log4j checks have been included in SAINT’s Full Vulnerability Scan policy for nearly a month, we have now also added a new scan policy specifically for Log4j. You can use this scan policy to quickly identify vulnerable Log4j versions in your environment. The policy includes checks for remote attack vectors, a filesystem search for vulnerable versions, and checks for other software known to include vulnerable Log4j versions. And the policy is dynamically generated at runtime to ensure that the latest checks are included in every scan. Credentialed or agent-based scanning is recommended with this policy for the most thorough scan.
Even if you’re not already a SAINT user, you can get started with the Log4j scan policy in minutes from the AWS marketplace. Simply launch the “SAINT (with license)” product, and your SAINT usage will appear on your AWS bill – no upfront purchase required.
If you need assistance updating SAINT to the current version or help on other SAINT topics, contact support at support@saintcorporation.com. If you need assistance getting SAINT for your organization, please contact sales at be.secure@carsoninc.com.
For a full Log4j Analysis video from Carson & SAINT experts, click the link below:
https://share.hsforms.com/1xjb7mEbcRyWIDh1yFrdugg3ogjz
Find out what it is, what impacts it could have, and how you can fix it with SAINT’s new scan policy specifically for Log4j. Presentation by CTO Sam Kline and VP of Business Development Randy Laudermilk.
Follow us on social media for the latest on SAINT updates and our security services below:
Is this based on self-reported version numbers of log4j or is the scanner’s vulnerability report actually verifying that the self reported version number is accurate?
Great question. We rely on Log4j’s self-reported version number.