Proposed schema for the backend database for Nessus

More food for thought (or for discussion, whatever you prefer)

I have designed a schema (E/R diagram) based on the discussion on the 
list and my original ideas. I would like to know if this one holds all 
the information a user might pretty much need. Does it?  If it does I 
can turn into SQL and start coding around^Winside Nessus to test it a bit.

Some things I want to mark:

- the ExecutedPlugins table is there in order to note down all plugins 
that have been executed in a given session ID regardless of wether or 
not a vulnerability has been discovered

- I have included a KnowledgeBase table which is pretty much free-text. 
The information in the Knowledgebase is probably redundant with the 
(organised) information in the rest of the schema. I still haven't got 
around to analyse the KB code, though, and I want to take a proper look 
at it.

- I'm not sure if user information (and location, i.e. IP address from 
the nessus-client) should separated from the session information. The 
Session table should probably be merged with the UserSessions table.

- The DetectedService is a separate table intented for port-scanner 
plugins. Notice that an open port (of whatever protocol) is not in 
itself a vulnerability. This information, however, is useful for 
analysis (i.e. to answer questions like: which servers have port 389 
(ldap) open in my network?)

- Translations are not considered (yet) because translators of plugins 
would just need to drop-in replacements of the Nessus-plugin table 
changing the description/solution information. Reports generated then 
would include the translated descriptions.

You will see there is no such thing as a "report" in this schema. Other 
proposals (from front-ends) include directly the report information into 
the database. I'm not doing this since it is already redundant. If you 
check carefully, a report on a given session is just all the 
vulnerabilities that have been detected in a given session. I.e.

SELECT Nessus-plugin.Description, Vulnerability.Type, 
Vulnerability.AdditionalInformation from Vulnerability, ExecutedPlugins, 
NessusPlugin where Vulnerability.ExecutionID = 
ExecutedPlugins.ExecutionID AND 
ExecutedPlugins.PluginID=NessusPlugin.PluginID AND 
ExecutedPlugins.SessionID="A GIVEN SESSION"

Does this make sense at all?  :-)

Comments on the schema appreciated.

Regards

Javi