Prep

Company review, probes, and patching before a client review

Probe & credentials

Email DNS security

Client review

Start client review

Ad-hoc report downloader

Review sessions

Remediation

After the client review - check what is still open

Remediation status

Patching & suppressions

Setup

Client mappings

Backup & restore

Signed in as Manage users

Theme

CS Liongard CW

Remediation Rules

Ticket remediation text for Manage. Client Word and PDF reports do not use this page.

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- Disable TLS 1.0 on affected services where it is enabled
  - Prefer TLS 1.2 or 1.3 only - do not disable TLS 1.2/1.3
  - Confirm scope: app, server, appliance, or OS Schannel setting
  - Read protocol/cipher and port from the product name (ssl-enum-ciphers_TLSv1.0_3389 = TLS 1.0 on 3389/RDP)
  - Identify that listener first: 443/8443 web or admin UI; 3389 RDP; 25/465/587/993/995 mail; 636 LDAPS; otherwise Get-NetTCPConnection or the vendor service on that port
  - Windows (IIS, RDP, LDAPS, other Schannel services): prefer GPO or Intune over one-off registry edits
  - Disable TLS 1.0 and 1.1: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server and Client - Enabled=0, DisabledByDefault=1 (same for TLS 1.1)
  - Confirm TLS 1.2 or 1.3 already works before disabling 1.0/1.1
  - Non-Windows: change that product TLS settings (Apache/nginx ssl_protocols, appliance TLS page)
  - Restart the service or reboot, then verify the port no longer offers TLS 1.0/1.1
  - Test dependent applications after change

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- Disable TLS 1.1 on affected services where it is enabled
  - Prefer TLS 1.2 or 1.3 only - do not disable TLS 1.2/1.3
  - Confirm scope: app, server, appliance, or OS Schannel setting
  - Read protocol/cipher and port from the product name (ssl-enum-ciphers_TLSv1.0_3389 = TLS 1.0 on 3389/RDP)
  - Identify that listener first: 443/8443 web or admin UI; 3389 RDP; 25/465/587/993/995 mail; 636 LDAPS; otherwise Get-NetTCPConnection or the vendor service on that port
  - Windows (IIS, RDP, LDAPS, other Schannel services): prefer GPO or Intune over one-off registry edits
  - Disable TLS 1.0 and 1.1: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server and Client - Enabled=0, DisabledByDefault=1 (same for TLS 1.1)
  - Confirm TLS 1.2 or 1.3 already works before disabling 1.0/1.1
  - Non-Windows: change that product TLS settings (Apache/nginx ssl_protocols, appliance TLS page)
  - Restart the service or reboot, then verify the port no longer offers TLS 1.0/1.1
  - Test dependent applications after change

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- SMB-specific notes:
  - Examples: old copier/printer scan-to-folder, legacy NAS/backup appliances, medical/lab/manufacturing gear, very old Windows/embedded clients, failed mapped drives or batch jobs
  - Inventory dependent shares/clients; disable SMBv1 where possible; enable signing/encryption per vendor guidance
  - Upgrade or replace legacy devices where needed
- Harden SMB configuration
  - Disable SMBv1 where possible
  - Enable SMB signing/encryption per vendor guidance
  - Test file/print shares after changes

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- Sweet32 is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Disable 3DES, RC4, and other 64-bit block ciphers on that service
  - Prefer TLS 1.2 or 1.3 with AES-GCM or ChaCha20
  - Read protocol/cipher and port from the product name (ssl-enum-ciphers_TLSv1.0_3389 = TLS 1.0 on 3389/RDP)
  - Identify that listener first: 443/8443 web or admin UI; 3389 RDP; 25/465/587/993/995 mail; 636 LDAPS; otherwise Get-NetTCPConnection or the vendor service on that port
  - Windows Schannel: prefer GPO or Intune over one-off registry edits
  - Sweet32 / 3DES: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168\Enabled=0
  - If RC4 is listed: disable the RC4 keys under the same Ciphers key
  - Non-Windows: remove 3DES/RC4 from that product cipher list (Apache/nginx ssl_ciphers, appliance TLS page)
  - Restart the service or reboot, then verify the port no longer offers 3DES or RC4
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- SSLv3 is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Disable SSL 3.0 on that service
  - Enforce TLS 1.2 or 1.3 only
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- POODLE is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Disable SSLv3 and SSL/TLS fallback to obsolete protocols
  - Enforce TLS 1.2 or 1.3 with modern cipher suites
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- Weak cipher is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Disable NULL, RC4, DES, 3DES, and EXPORT ciphers
  - Enforce TLS 1.2 or 1.3 with AES-GCM or ChaCha20
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- SMB-specific notes:
  - Examples: old copier/printer scan-to-folder, legacy NAS/backup appliances, medical/lab/manufacturing gear, very old Windows/embedded clients, failed mapped drives or batch jobs
  - Inventory dependent shares/clients; disable SMBv1 where possible; enable signing/encryption per vendor guidance
  - Upgrade or replace legacy devices where needed
- Enable SMB signing on server and workstation roles
  - Use GPO: Microsoft network server/client > digitally sign communications
  - Or registry: RequireSecuritySignature=1 under LanmanServer/LanmanWorkstation
  - Test file/print and legacy devices after enforcing

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- SMB-specific notes:
  - Examples: old copier/printer scan-to-folder, legacy NAS/backup appliances, medical/lab/manufacturing gear, very old Windows/embedded clients, failed mapped drives or batch jobs
  - Inventory dependent shares/clients; disable SMBv1 where possible; enable signing/encryption per vendor guidance
  - Upgrade or replace legacy devices where needed
- Disable SMBv1 client/server where supported
  - Use GPO or Windows optional features
  - Inventory scan-to-folder, NAS, and legacy apps first

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- Confirm the real vendor, model, and current firmware on the device (scan names are often incomplete)
- Backup configuration before updating
- Plan a maintenance window; the device reboots and will drop LAN/WAN/Wi-Fi during the update
- Hardware network scanner (when that appliance is present):
  - Confirm a network scanner appliance is actually on this network - especially a hardware (non-VM) unit
  - Barracuda hardware scanners are the usual case; other vendor-managed scanner appliances use the same path
  - River Run typically has no internal access to these devices
  - Do not attempt to log in, guess credentials, or push firmware yourself
  - Reach out to the vendor (or the party that manages the scanner) with hostname/IP, model if known, CVE, and scan detail from Reports location
  - Hardware network scanners have a known false-positive history - ask the vendor to confirm affected vs not-affected / already fixed
  - Vendor not-affected / already-fixed → escalate to Security as a false positive with the vendor response - then stop
  - If the vendor will patch: record their case number and wait; do not treat this as an RMM/Windows update
  - If this is a ConnectWise / ConnectSecure VM network scanner that River Run operates, use the ConnectWise VM scanner path - not vendor outreach
  - If this is a VM scanner or a different product (email, WAF, backup), note that in the ticket - this path is for the hardware scanner when it is present
- Barracuda: confirm what is on the network (hardware network scanner vs VM vs email/WAF/backup)
  - Hardware (non-VM) network scanner present: vendor outreach - no internal login or firmware push
  - Confirm hostname/IP and device type (label, HTTPS admin page, or client inventory)
  - ConnectWise / ConnectSecure VM network scanner: use that VM path - River Run operates those

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- Confirm the real vendor, model, and current firmware on the device (scan names are often incomplete)
- Backup configuration before updating
- Plan a maintenance window; the device reboots and will drop LAN/WAN/Wi-Fi during the update
- ConnectWise VM network scanner (when that VM is present):
  - This is a ConnectWise / ConnectSecure network scanner VM that River Run operates - not Barracuda hardware
  - Confirm the hostname/IP is the site scanner VM (not a client workstation, firewall, or ConnectWise Control/Automate agent)
  - Do not use the hardware-scanner vendor-outreach path
  - Updates are on the scanner VM / ConnectSecure scanner image - not an RMM app install on a client
  - Coordinate before reboot; scanning for that site stops while the VM is down
  - Scanner VMs can still show Linux/appliance scan noise - confirm build and the vendor advisory
  - Vendor not-affected / already-fixed → escalate to Security as a false positive with the documentation link - then stop

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- Confirm the real vendor, model, and current firmware on the device (scan names are often incomplete)
- Backup configuration before updating
- Plan a maintenance window; the device reboots and will drop LAN/WAN/Wi-Fi during the update
- ConnectWise VM network scanner (when that VM is present):
  - This is a ConnectWise / ConnectSecure network scanner VM that River Run operates - not Barracuda hardware
  - Confirm the hostname/IP is the site scanner VM (not a client workstation, firewall, or ConnectWise Control/Automate agent)
  - Do not use the hardware-scanner vendor-outreach path
  - Updates are on the scanner VM / ConnectSecure scanner image - not an RMM app install on a client
  - Coordinate before reboot; scanning for that site stops while the VM is down
  - Scanner VMs can still show Linux/appliance scan noise - confirm build and the vendor advisory
  - Vendor not-affected / already-fixed → escalate to Security as a false positive with the documentation link - then stop

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- Confirm the real vendor, model, and current firmware on the device (scan names are often incomplete)
- Backup configuration before updating
- Plan a maintenance window; the device reboots and will drop LAN/WAN/Wi-Fi during the update
- ConnectWise VM network scanner (when that VM is present):
  - This is a ConnectWise / ConnectSecure network scanner VM that River Run operates - not Barracuda hardware
  - Confirm the hostname/IP is the site scanner VM (not a client workstation, firewall, or ConnectWise Control/Automate agent)
  - Do not use the hardware-scanner vendor-outreach path
  - Updates are on the scanner VM / ConnectSecure scanner image - not an RMM app install on a client
  - Coordinate before reboot; scanning for that site stops while the VM is down
  - Scanner VMs can still show Linux/appliance scan noise - confirm build and the vendor advisory
  - Vendor not-affected / already-fixed → escalate to Security as a false positive with the documentation link - then stop

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- ssl-enum-ciphers is a TLS / SSL configuration finding - not a software install
  - Read protocol/cipher and port from the product name (ssl-enum-ciphers_TLSv1.0_3389 = TLS 1.0 on 3389/RDP)
  - Identify that listener first: 443/8443 web or admin UI; 3389 RDP; 25/465/587/993/995 mail; 636 LDAPS; otherwise Get-NetTCPConnection or the vendor service on that port
  - If the name includes TLSv1.0 or TLSv1.1: disable that protocol only - do not disable TLS 1.2 or 1.3
  - Windows (IIS, RDP, LDAPS, other Schannel services): prefer GPO or Intune over one-off registry edits
  - Disable TLS 1.0 and 1.1: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server and Client - Enabled=0, DisabledByDefault=1 (same for TLS 1.1)
  - Confirm TLS 1.2 or 1.3 already works before disabling 1.0/1.1
  - Non-Windows: change that product TLS settings (Apache/nginx ssl_protocols, appliance TLS page)
  - Restart the service or reboot, then verify the port no longer offers TLS 1.0/1.1
  - If the name includes Sweet32, 3DES, RC4, or WeakCipher: disable those ciphers; leave TLS 1.2/1.3 on
  - Windows Schannel: prefer GPO or Intune over one-off registry edits
  - Sweet32 / 3DES: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168\Enabled=0
  - If RC4 is listed: disable the RC4 keys under the same Ciphers key
  - Non-Windows: remove 3DES/RC4 from that product cipher list (Apache/nginx ssl_ciphers, appliance TLS page)
  - Restart the service or reboot, then verify the port no longer offers 3DES or RC4
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, port, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- BEAST is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Prefer TLS 1.2 or 1.3; do not leave TLS 1.0 as the only option
  - Enforce server cipher order; avoid leftover TLS 1.0 CBC suites
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- FREAK is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Disable export-grade RSA and other EXPORT ciphers on that service
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- DROWN is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Disable SSLv2 on every service that shares this certificate (web, mail, VPN, appliances)
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- Lucky13 is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Disable TLS CBC cipher suites on that service
  - Prefer AES-GCM or ChaCha20 on TLS 1.2 or 1.3
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- Weak cipher (SSL_WeakCipher / ssl-enum-ciphers) is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Disable NULL, RC4, DES, 3DES, and EXPORT ciphers
  - Enforce TLS 1.2 or 1.3 with AES-GCM or ChaCha20
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- Enable TLS 1.2 or 1.3 before removing TLS 1.0/1.1.
- Weak DH parameters is a TLS / SSL configuration finding - not a software install
  - Confirm which service offers it (IIS / Schannel, Apache, nginx, appliance, mail, or VPN)
  - Replace weak DH parameters with a 2048-bit or larger group, or prefer ECDHE
  - If already hardened or the vendor documents not affected: escalate to Security as a false positive with hostname, service, and what you verified - then stop
  - After change, re-scan or verify the service no longer offers the weak protocol or cipher

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- Speculative Store Bypass (CVE-2018-3639) is a Windows CPU-mitigation registry setting - not a software install
  - Apply latest Windows quality/security updates first - the registry does nothing without those KBs
  - Enable the OS mitigation: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  - If FeatureSettingsOverride is missing: set FeatureSettingsOverride=8 and FeatureSettingsOverrideMask=3
  - If Override already has a value: add bit 8 (SSB) per Microsoft KB4072698 - do not wipe other Spectre bits already in use
  - Prefer domain GPO (or Intune) over one-off registry edits
  - Reboot, then verify: Install-Module SpeculationControl; Get-SpeculationControlSettings
  - If already patched and mitigations show enabled: escalate to Security as a false positive with hostname, build, and the cmdlet output - then stop
  - These mitigations can slow a busy server - discuss with the client if users will notice
  - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-3639

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- WARNING: research and testing required - removing or disabling legacy network protocols can break software and/or network functions
  - Removal can break legacy apps, devices, integrations, shares, printers/MFPs, mail, partner APIs, and other functions that still need this protocol
  - Inventory dependents; research vendor/client requirements; test on non-production before any production change
  - Plan a maintenance window; prefer a modern replacement protocol before removing the legacy one
- SMB-specific notes:
  - Examples: old copier/printer scan-to-folder, legacy NAS/backup appliances, medical/lab/manufacturing gear, very old Windows/embedded clients, failed mapped drives or batch jobs
  - Inventory dependent shares/clients; disable SMBv1 where possible; enable signing/encryption per vendor guidance
  - Upgrade or replace legacy devices where needed
- smb-security-mode is SMB hardening - not a software install
  - Enable SMB signing; disable SMBv1 where possible
  - Use GPO or registry (RequireSecuritySignature under LanmanServer/LanmanWorkstation)
  - Inventory shares and dependents; research and test before production change

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- Unquoted service path is Windows service hardening (CWE-428) - not a software install
- ConnectSecure names the hosts only - it does not name the service or ImagePath
- On each listed host, paste this into ScreenConnect Commands. The script only reports. It does not change the service:
#!ps
#timeout=180000
#maxlength=200000
$ProgressPreference='SilentlyContinue'; try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; $wc=New-Object Net.WebClient; $wc.Headers.Add('User-Agent','UnquotedServicePath-bootstrap/1.0.0'); $wc.Headers.Add('Accept','application/vnd.github.raw'); $script=$wc.DownloadString('https://api.github.com/repos/monobrau/mytools/contents/UnquotedServicePath/Get-UnquotedServicePath.ps1?ref=main'); & ([scriptblock]::Create($script)) -Exit
- Then stop if:
  - Safe, and no service needs a quote: escalate to Security as a false positive with the hostname and the script output
  - Safe, and the line says leave it or no user write: escalate that host to Security as accepted risk, not company-wide, with the hostname and the script output. A company-wide suppress hides the next third-party path
  - The line says leave it - Windows platform: do not quote it and do not turn off Tamper Protection
- Action needed: review the sc.exe command the script printed, then run it. Restart the service if it was running
- Prefer the vendor quoted path when they ship a fix
- Do not uninstall the application unless it is unused
- Verify ImagePath is quoted after the change

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

- Unquoted service path is Windows service hardening (CWE-428) - not a software install
- ConnectSecure names the hosts only - it does not name the service or ImagePath
- On each listed host, paste this into ScreenConnect Commands. The script only reports. It does not change the service:
#!ps
#timeout=180000
#maxlength=200000
$ProgressPreference='SilentlyContinue'; try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; $wc=New-Object Net.WebClient; $wc.Headers.Add('User-Agent','UnquotedServicePath-bootstrap/1.0.0'); $wc.Headers.Add('Accept','application/vnd.github.raw'); $script=$wc.DownloadString('https://api.github.com/repos/monobrau/mytools/contents/UnquotedServicePath/Get-UnquotedServicePath.ps1?ref=main'); & ([scriptblock]::Create($script)) -Exit
- Then stop if:
  - Safe, and no service needs a quote: escalate to Security as a false positive with the hostname and the script output
  - Safe, and the line says leave it or no user write: escalate that host to Security as accepted risk, not company-wide, with the hostname and the script output. A company-wide suppress hides the next third-party path
  - The line says leave it - Windows platform: do not quote it and do not turn off Tamper Protection
- Action needed: review the sc.exe command the script printed, then run it. Restart the service if it was running
- Prefer the vendor quoted path when they ship a fix
- Do not uninstall the application unless it is unused
- Verify ImagePath is quoted after the change

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

Pattern

Default rule (* fallback)

Guidance style

AutoUpdate uses ticket text even when ConnectSecure supplies a version fix. The target version still appears on tickets. OperatingSystem uses OS quality-update options (not install-a-package). DeviceFirmware uses firmware / device-software options (not a desktop installer).

Ticket text (bulleted ticket instructions / time estimate)

An unhandled error has occurred. Reload 🗙