If you scan Rocky Linux from CIQ Pro (RLC Pro) hosts with Tenable Nessus, a CVE that CIQ has fixed on a pinned LTS release, or in a package CIQ adds beyond community Rocky Linux, now resolves in your scan results. Tenable has published detection plugins built from the security advisories CIQ issues for RLC Pro and RLC Pro LTS.
Nessus scans of RLC Pro hosts now more accurately reflect the breadth of CVE remediation CIQ performs, down to each pinned LTS release.
Clear false positives on pinned LTS hosts
RLC Pro LTS lets you pin a host to a minor release and keep receiving security fixes there. Even-numbered minor releases receive four years of security patching, and CIQ documents those fixes in its own advisories.
Tenable's existing Rocky Linux plugins are built from community Rocky Linux advisories, which don't include CIQ's. Without CIQ's advisories, Nessus compared a pinned host against the latest release, so a CVE CIQ had already fixed there could still appear as unpatched.
Get scan results that count CIQ's fixes, release by release
Tenable made two changes. New plugins flag a package when a CIQ patch is available for it, and Tenable's existing unpatched vulnerability plugins now check for a CIQ patch before raising a finding.
Nessus also matches each host to the CIQ product and release it runs. An LTS host is checked against CIQ's advisories for the respective pinned release, and a host on the current release is checked against the advisories for the current release.
Know what each finding on your next scan means
If you keep your hosts current on CIQ patches, your finding count should only go down after the update, as CVEs CIQ has fixed resolve. Hosts missing an available CIQ patch will show new findings for the vulnerabilities that patch addresses.
A finding that stays open on a subscribed RLC Pro host points you to the CIQ advisory for its fix.
Resolution depends on an active CIQ subscription for the product each host runs, such as RLC Pro LTS for a pinned host.
Run your next scan against CIQ's advisories
The new detection is available in Tenable's plugin set now. Talk to your CIQ account team about coverage across your fleet.
