Re: How to start exporting Nessus results to a DB

Brian Anon wrote:
> William and Javier,
> 
> I have been following your message threads on exporting Nessus scan 
> results to MySQL.  I see that you both are very active in this initiative.

Yep. The schema is not finished yet and there's still things that could 
be improved in it.

> 
> I am about to setup a Nessus server to begin scanning some systems on a 
> regular basis.  What do I need to do to start getting the scan results 
> into a MySQL DB server?
> 

For the moment, I have not tested the code in the CVS, William? In any 
case you would need to:

- checkout the CVS branch NESSUS_SQL
- compile the code using -DUSE_DATABASE
- probably tweak the Makefiles to include the proper libraries (Code is 
currently only available for MySQL but there should be Postgresql code soon)

I still have to apply a patch William sent me yesterday to update the 
structure but there's still a lot to do in order to make it 
autoconfigure & compile the code properly.

You can, however, use some of the tools in the CVS (NESSUS_SQL branch) 
to process nbe reports and put them in the database. I'm working on 
those while William is polishing the code (and updating to reflect the 
schema changes).

> Once the results are available in the DB I expect to begin creating 
> report templates using Crystal.
> 
> By the way, I happen to use VMWare for all my testing so I can make 
> these basic systems available for anyone interested.  I'm currently 
> creating a test environment with the following virtual machines (all 
> based on RH 7.3):
> 1. Snort IDS Sensor
> 2. MySQL DB Server, Apache Web Server, ACID, SnortCenter
> 3. Nessus Server

¿Three different virtual machines?

> 
> For #1 and #2 I am following the build docs from www.snort.org.  For #3 

I've found it very easy to setup 1+2 in a single system using Debian, 
all the software is already available, save for SnortCenter.

> I will build the OS similar to #1.
> 
> Other plans I have are to create some PHP scripts that will parse the 
> results of other scans (nmap and HFNETCHK) and application log files 
> (McAfee NetShield and WebShield) to store in a MySQL DB for reporting 
> with Crystal.

It would be nice to see those (once available).

> 
> If this is successful. I'd like to expand by creating a portal to all 
> this information using a content management system like Postnuke.
> 
> Any tips or suggestions would be greatly appreciated.
> 

Check out inprotect.com they have a portal to do automated vulnerability 
assessment with Nessus. IIRC plugin information and scans are introduced 
in the MySQL database.


Regards

	Javi