Security Advisories in Aria Operations v8.18 not working

[jeffj2000]

Is anyone else experiecing that the "security advisories" in the new Diagnostics menu simply isnt working? They all show "0". The Findings dashboard is working. Thank you.

[Carl Edgell]

I've just spun up Aria Ops 8.18 fresh and all of my dashboard values are 0 and no findings. I expected to see all the findings that Skyline Advisor flags, going back through setup to see if I've missed some outbound comms requirement.

[Sona Hovasapyan]

Hi Jeff, 

Here's what I see in my setup, so this is not an issue with Aria Ops 8.18 it seems. 

[jeffj2000]

The issue I found is, the Security Advisories and Findings are not as complete as Skyline was. Skyline gave many more Findings and Security Advisories. I believe VMware is working to improve it. This is a new, and awesome feature, and it will get better and more complete. 

So i would not rely on this Dashboard that those are the only Security Advisories you are exposed too.

[dwilde]

I certainly dont see that.

A big fat nothing.

[Sona Hovasapyan]

Hi Jeff,

Do you have Aria Operations for Logs? It is a requirement for Security Advisories to work. Please, see the article here.

Here's how my 8.18 looks like: 

[jeffj2000]

The issue I described in my other reply to you, is not because Logs is not installed. I believe VMware simply hasn't matched Skyline functionality yet, and hopefully are working towards doing that. 

[dwilde]

I dont see that. I have no findings at all....

[jeffj2000]

That means you are fairly up to date, though Aria will have findings and CVEs missing if you were to look closely.

[Carl Edgell]

Updating against my own comment, reached out to support, in summary Aria 8.18 only has a small subset of rules it tracks vulnerabilities against, more will follow in subsequent updates (8.18.1 and 9.0) but it's not going to reach Skyline Advisor level findings even then. That might be ok or might not depending on what yours shows and what you care about I guess. Mine showing nothing is actually accurate against the rules that this release is tracking. 

[jeffj2000]

I received the same answer from support as well. I urged them to reconsider and put every CVE in Aria. I hope that comes to fruition. 

[JPolanco]

Ok.  So i'm not the only one.  I thought i was doing something wrong.  

[Sona Hovasapyan]

For the initial VCF release with Aria Ops 8.18 only a subset of Skyline Advisor Property based findings and a subset of the Skyline Health Diagnostics log based findings are made available. These were selected based on how  frequent these issues were seen in Global Support, issues discovered after reviewing customer escalations, high priority VMSAs, and issues which are very impactful to customer's environments. 

The list of the Findings which are a part of Diagnostics for VMware Cloud Foundation 5.2 are documented here Diagnostics for VMware Cloud Foundation 5.2.xlsx.

For more details you might want to check Diagnostics for VMware Cloud Foundation 5.2.

[dwilde]

I meant to respond to this a few days ago.

I concur that it doesnt seem to work. Zero issues across 2 instances and 5 workload domains.

That doesnt seem correct

[jeffj2000]

I had put a ticket in, and VMware is aware of this and actively working to remedy and improve it. 

[Tara]

I'm having the same issue. I'm still getting an alert from Skyline for some reason, but I cannot login to change or disable. Aria is showing nothing. But we are updated to the latest versions available so that could be why I guess.