Managing the Common Platform Enumeration (CPE) Feature

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to enable and configure the Common Platform Enumeration (CPE) feature.

Environment

• App Control Console: Version 8.10.2 and Higher

Resolution

1. Verify network requirements to the remote NIST API:
   • If SSL/Packet Inspection is enabled, add an exception for the communication to/from services.nvd.nist.gov to prevent rejection of modified packets.
   • Use PowerShell from the application server to test communication to the NVD website on Port 443:

     TNC -ComputerName services.nvd.nist.gov -Port 443

2. Log in to the Console.
3. Go to Assets > Applications > CPE Applications.
4. Click the Configure CPE button (or the gear icon next to the Applications page title).
5. Choose the desired Mode.
   • Off: Turn CPE matching and synchronization off.
   • Automatic: Specify the automatic interval for synchronization.
   • Manual: Only synchronize and match when initiated on demand.
6. If desired, choose the option to Execute sync and matching now.
7. Click Save

Additional Information

• This feature relies upon communication between the application server and (by default) the NVD services owned by NIST.
• The Default URL for CPE is: https://services.nvd.nist.gov/rest/json/cpes/2.0
• The CPE Applications must be enabled for the CVE Instances feature to be populated.
• More information is available in the User Guide on VMware Docs > Server Documentation > User Guide.