CAASM Use Case #11 – Managing Windows and Linux Servers

CAASM Use Case #11 – Managing Windows and Linux Servers

In the world of cybersecurity, an unmanaged server is like an unlocked door in your digital fortress. And it only takes one unlocked door to give them the keys to the castle.

Welcome to the eleventh installment in our series exploring the practical applications of Cyber Asset Attack Surface Management (CAASM).

Today, we’re diving into a critical use case: managing Windows and Linux servers across your organization.

Imagine this scenario: You’re a system administrator tasked with ensuring all servers in your environment are up-to-date, properly configured, and secure.

But with servers scattered across on-premises data centers and multiple cloud platforms, how can you maintain a comprehensive view of your server landscape?

Your server inventory must be three things:

  1. Credible.
  2. Accurate.
  3. Comprehensive.

This blog post introduces how to start improving your server inventory with Axonius CAASM.

Why is a credible, accurate, comprehensive server inventory important? Because if it's not, then you're going to miss problems, and when incidents happen you won't have the information to make timely and correct decisions -- further compounding your bad situation.

Table of Contents

The Server Management Challenge

Servers are the backbone of any organization’s IT infrastructure.

Whether on-premises or in the cloud, Windows and Linux servers host critical business applications and often process sensitive data.

Maintaining an accurate inventory of these servers, including their operating systems, versions, resources, configurations, installed software, and associated users, is crucial for protecting your organization’s infrastructure.

Server Administration Challenges

Managing servers and their operating systems comes with several challenges.

Not addressing these challenges is leaving the proverbial door open to bad actors.

  1. Outdated operating systems: Servers running outdated OS versions are vulnerable to attacks.
  2. Misconfigured servers: Improperly configured servers can open security gaps in your network.
  3. Resource management: Lack of insight into server resources (RAM, hard drive space) can lead to performance issues.
  4. Diverse environments: Managing servers across on-premises and multiple cloud platforms adds complexity.

Enter SJULTRA's Cybersecurity Observability Service

This is where SJULTRA’s CAASM services, powered by Axonius, becomes your incident response nitrous boost.

It’s like giving your security team a time machine and a crystal ball, all rolled into one.

Axonius pulls data from a smorgasbord of sources:

  • Endpoint Agents
  • Configuration and Patch Management Tools
  • Ticketing & Helpdesk Platforms
  • Networking Tools
  • Vulnerability Assessment Tools
  • IAM Solutions
  • Cloud Infrastructure

By correlating this data, Axonius creates a rich, unified view of your entire digital ecosystem. It’s like having a digital map of your entire IT landscape, with every device, user, and cloud instance clearly labeled.

Book your free CAASM trial now

Get visibility on all 14 cybersecurity observability use cases in less than 30 days with SJULTRA.

Technical Deep Dive

Let’s explore how to use SJULTRA CAASM to manage your Windows and Linux servers:

Connect Data Sources

Start by connecting to key data sources such as:

  • Cloud Infrastructure platforms
  • Infrastructure Monitoring tools
  • Networking monitoring systems
  • MDM/EMM solutions
  • EDR/EPP tools
  • Configuration/Patch Management systems
  • ITAM/ITSM platforms
  • Vulnerability Analysis (VA) tools
  • IAM solutions
  • UEM platforms
  • Virtualization monitoring tools

Track operating systems and versions

There are a couple of steps to this.

First, create a chart of known operating systems from your data sources — let’s see what you’ve got!

Second, use the Axonius Query Wizard to create targeted queries such as “Find all Linux servers and their distributions”

sjultra axonius caasm use case 11 managing linux and windows query result Servers by OS Type
Axonius chart of all known operating systems

To start focusing on Linux and Windows, you can create a new query and a new chart for that.

For example, this query and chart combination will first find all your Windows serers:

sjultra axonius caasm use case 11 Windows Server Query

Then you can create a chart based on that query:

sjultra axonius caasm use case 11 Windows Server Chart

Monitor Server Resources

Create queries to track server resources. 

Add columns for Total RAM, Free RAM, Hard Drives: Size, and Hard Drives: Free Size to your query results.

sjultra axonius caasm use case 11 Windows Server Chart Add Colums

Now, based on your query… and then your chart… you can quickly see server resources across your whole estate in one place. 

Identify Servers with Critical vulnerabilities

Find servers with critical vulnerabilities:

Identify servers with no vulnerability software

Identify servers without vulnerability assessment tools:

sjultra axonius caasm use case 11 query wizard Windows Server Missing Vuln Software

Identify Installed Software and Agent Versions

This level of detail is particularly useful when you need to quickly find if you are exposed to X threat on Y software. 

For example, threats can apply to only specific product versions so being able to quickly find if you have that version is key to accelerating incident response.

sjultra axonius caasm use case 11 query wizard Windows Servers - Installed Software

Taking action with Axonius enforcement actions

Once you’ve identified issues or discrepancies in your server inventory, SJULTRA CAASM allows you to take immediate action:

  1. Send notifications to preferred platforms (e.g., email, Slack) about critical issues.
  2. Create helpdesk tickets in ServiceNow, Zendesk, or Jira for follow-up actions.
  3. Enrich device data with custom tags or third-party sources like Shodan or Censys.
  4. Update vulnerability scans on specific servers.
  5. Deploy files or run custom commands on servers requiring attention.
  6. Isolate or unisolate devices from the network in case of security incidents.

Summary

Maintaing a Windows and Linux server inventory — that is accurate, credible, comprehensive — is crucial for maintaining a robust and secure IT infrastructure.

With SJULTRA CAASM, you can transform this challenging task into a streamlined, automated process.

Remember, this is just one of the 14 powerful use cases for CAASM. Stay tuned for our next instalment to discover more ways to enhance your cybersecurity posture.

Ready to sort out your user inventory?  Start your free trial of SJULTRA CAASM today!

Axonius documentation and Videos

Read the Axonius documentation: Manage Windows and Linux Servers.