Re: How to start exporting Nessus results to a DB

On Thu, 20 Feb 2003, Javier Fernandez-Sanguino wrote:

> Brian Anon wrote:
> > William and Javier,
> > 
> > I have been following your message threads on exporting Nessus scan 
> > results to MySQL.  I see that you both are very active in this initiative.
> 
> Yep. The schema is not finished yet and there's still things that could 
> be improved in it.
> 
> > 
> > I am about to setup a Nessus server to begin scanning some systems on a 
> > regular basis.  What do I need to do to start getting the scan results 
> > into a MySQL DB server?
> > 
> 
> For the moment, I have not tested the code in the CVS, William? In any 
> case you would need to:
> 
> - checkout the CVS branch NESSUS_SQL
> - compile the code using -DUSE_DATABASE
> - probably tweak the Makefiles to include the proper libraries (Code is 
> currently only available for MySQL but there should be Postgresql code soon)
> 
> I still have to apply a patch William sent me yesterday to update the 
> structure but there's still a lot to do in order to make it 
> autoconfigure & compile the code properly.
> 
> You can, however, use some of the tools in the CVS (NESSUS_SQL branch) 
> to process nbe reports and put them in the database. I'm working on 
> those while William is polishing the code (and updating to reflect the 
> schema changes).
> 
No, the code in CVS has not been tested.  I've been quite busy and am
waiting for the schema to get stablized.  I also need to setup a MySQL
server to test it on ;)  I'll probably try to test it tomorrow.


To compile the Nessus code you need to do the following:
   Get the newest code from the NESSUS_SQL CVS (after Javi updates it)
   Add the following options to the end of nessus-core/nessusd/cflags:
       -I/usr/local/include/mysql
       -DUSE_DATABASE
       -DUSE_MYSQL
   Apply the attached diff patch to nessus-core/nessusd/Makefile
       % patch nessus-core/nessusd/Makefile < Makefile.diff
   Run make

NOTE: The nessus-core/configure script has to be run BEFORE these steps
      are done.

> > Once the results are available in the DB I expect to begin creating 
> > report templates using Crystal.
> > 
> > By the way, I happen to use VMWare for all my testing so I can make 
> > these basic systems available for anyone interested.  I'm currently 
> > creating a test environment with the following virtual machines (all 
> > based on RH 7.3):
> > 1. Snort IDS Sensor
> > 2. MySQL DB Server, Apache Web Server, ACID, SnortCenter
> > 3. Nessus Server
> 
> ¿Three different virtual machines?
> 
> > 
> > For #1 and #2 I am following the build docs from www.snort.org.  For #3 
> 
> I've found it very easy to setup 1+2 in a single system using Debian, 
> all the software is already available, save for SnortCenter.
> 
> > I will build the OS similar to #1.
> > 
> > Other plans I have are to create some PHP scripts that will parse the 
> > results of other scans (nmap and HFNETCHK) and application log files 
> > (McAfee NetShield and WebShield) to store in a MySQL DB for reporting 
> > with Crystal.
> 
> It would be nice to see those (once available).
> 
> > 
> > If this is successful. I'd like to expand by creating a portal to all 
> > this information using a content management system like Postnuke.
> > 
> > Any tips or suggestions would be greatly appreciated.
> > 
> 
> Check out inprotect.com they have a portal to do automated vulnerability 
> assessment with Nessus. IIRC plugin information and scans are introduced 
> in the MySQL database.
> 
> 
> Regards
> 
> 	Javi
> 
> 

----------------------
William Heinbockel
Information Security Incident Response Assistant
Co-op Risk & Safety Management
Rochester Institute of Technology
E-mail: [email protected]

--- ../Makefile	2003-02-20 09:11:51.000000000 -0500
+++ Makefile	2003-02-20 09:11:47.000000000 -0500
@@ -29,6 +29,7 @@
        nessusd.o \
        save_tests.o \
        save_kb.o \
+       save_db.o \
        detached.o \
        pluginlaunch.o \
        locks.o \
@@ -118,6 +119,9 @@
 save_kb.o : cflags save_kb.c save_kb.h
 	$(CC) $(CFLAGS) $(NESSUS_INCLUDE) -c save_kb.c
 
+save_db.o : cflags save_db.c save_db.h
+	$(CC) $(CFLAGS) $(NESSUS_INCLUDE) -c save_db.c
+
 detached.o : cflags detached.c detached.h
 	$(CC) $(CFLAGS) $(NESSUS_INCLUDE) -c detached.c