Re: How to start exporting Nessus results to a DB

Tony,
  Right now Javi and I are working on abstracting the database code
from the Nessus main code and getting the configure file to properly
setup the flags and include the database libraries.

Once that is finished, to add another database, you'll be able to use
my mysql code as a guideline and change the mysql library calls and
queuries to whatever database you want.  This will ensure that the
databases are layed out according to the schema and allow someone with
very little C knowledge to add their own database to the mix.

I am sure something will be posted to the nessus-dev list once
Javi and I feel that enough progress has been made detailing how
people can add their own database to Nessus.  Until that time,
you may want to follow our development in this list and in the
NESSUS_SQL CVS tree.


----------------------
William Heinbockel
Information Security Incident Response Assistant
Co-op Risk & Safety Management
Rochester Institute of Technology
E-mail: [email protected]


On Fri, 21 Feb 2003, Tony Carter wrote:

> Gentlemen,
> I'm very interested in helping with integrating Nessus results to a
> database. Is anyone working on the Postgres code? If not, I'd be more than
> happy to do so.
> 
> -Tony
> 
> 
> Brian Anon wrote:
> > William and Javier,
> >
> > I have been following your message threads on exporting Nessus scan
> > results to MySQL.  I see that you both are very active in this initiative.
> 
> Yep. The schema is not finished yet and there's still things that could
> be improved in it.
> 
> >
> > I am about to setup a Nessus server to begin scanning some systems on a
> > regular basis.  What do I need to do to start getting the scan results
> > into a MySQL DB server?
> >
> 
> For the moment, I have not tested the code in the CVS, William? In any
> case you would need to:
> 
> - checkout the CVS branch NESSUS_SQL
> - compile the code using -DUSE_DATABASE
> - probably tweak the Makefiles to include the proper libraries (Code is
> currently only available for MySQL but there should be Postgresql code soon)
> 
> I still have to apply a patch William sent me yesterday to update the
> structure but there's still a lot to do in order to make it
> autoconfigure & compile the code properly.
> 
> You can, however, use some of the tools in the CVS (NESSUS_SQL branch)
> to process nbe reports and put them in the database. I'm working on
> those while William is polishing the code (and updating to reflect the
> schema changes).
> 
> > Once the results are available in the DB I expect to begin creating
> > report templates using Crystal.
> >
> > By the way, I happen to use VMWare for all my testing so I can make
> > these basic systems available for anyone interested.  I'm currently
> > creating a test environment with the following virtual machines (all
> > based on RH 7.3):
> > 1. Snort IDS Sensor
> > 2. MySQL DB Server, Apache Web Server, ACID, SnortCenter
> > 3. Nessus Server
> 
> ¿Three different virtual machines?
> 
> >
> > For #1 and #2 I am following the build docs from www.snort.org.  For #3
> 
> I've found it very easy to setup 1+2 in a single system using Debian,
> all the software is already available, save for SnortCenter.
> 
> > I will build the OS similar to #1.
> >
> > Other plans I have are to create some PHP scripts that will parse the
> > results of other scans (nmap and HFNETCHK) and application log files
> > (McAfee NetShield and WebShield) to store in a MySQL DB for reporting
> > with Crystal.
> 
> It would be nice to see those (once available).
> 
> >
> > If this is successful. I'd like to expand by creating a portal to all
> > this information using a content management system like Postnuke.
> >
> > Any tips or suggestions would be greatly appreciated.
> >
> 
> Check out inprotect.com they have a portal to do automated vulnerability
> assessment with Nessus. IIRC plugin information and scans are introduced
> in the MySQL database.
> 
> 
> Regards
> 
> Javi
> 
>