WYAE - VoNEv

The Nessus security scanner by http://www.tenablesecurity.com/ is a valuable tool for security consultants performing network audits. Unfortunately it does lack a quick overview over the vulnerabilities (supposedly) found.

This tool will extract such a re-sortable overview as CSV table from a Nessus HTML export.

Requirements

Perl
Nessus HTML export of version 3.0 or newer
a (Unix) shell

Usage

Assuming you exported the Nessus results to "nessusexports.html" call

	vonev.pl < nessusexport.html > nessusexport.csv

to receive a tab-separated CSV file "nessusexports.csv" containing the columns

Count

Text

Nessus-ID

CVSS

CVE

BID

Other References

IP(s)

You can import this CSV table into your favourite spreadsheet application, e.g. OpenOffice, Gnumeric, KOffice or MS-Office and re-sort and filter ad gusto.

You can unify multiple VoNEv CSV exports running

 	cat *.csv  | vonev_unify.pl > summary.csv

The reports can overlap - vonev-_unify.pl will always override the results of earlier CSVs (i.e. processed frist) with more current results (i.e. CSVs later in the input).

Evaluation

Each finding will be documented twice in the CSV table.

First you will find each single finding for each single IP with a count number of 0 (zero). After all single findungs are listed, all findings are listed again summed up per finding.

Thus you get a table similar to this (abridged) one:

Count	Title	IP(s)
0	Finding-AAA	10.1.1.2
0	Finding-AAA	10.1.1.3
0	Finding-AAA	10.1.1.4
0	Finding-B	10.1.1.4
0	Finding-CCCCC	10.1.1.4
0	Finding-AAA	10.1.1.5
0	Finding-CCCCC	10.1.1.5
4	Finding-AAA	10.1.1.2, 10.1.1.3, 10.1.1.4, 10.1.1.5,
1	Finding-B	10.1.1.4,
2	Finding-CCCCC	10.1.1.4, 10.1.1.5,

The "0" rows are ideal for GREPping, while the summary lines are ideal for a fast overview, for example:

Import the CSV into your spreadsheet
Sort by CVSS (this is the severity value set by Nessus)
Set filter: only show rows with count > 0
Done.

Beware:
Nessus results (and thus the ones of this tool) are a to be taken with a serious grain of salt. Don't trust them blindly but verify. Nessus is "only" a tool, a useful one, but not always a reliable one. Use Nessus (like NMAP or other scanners) for the brainless grunt work and start working.

If you need a security consultant to check your network, systems or architecture, or to help you with a security problem/incident or (a better approach) check your security architecture and risks, simply contact me.
;-)

Downloads

VoNEv (.tar.gz)

README - included with the web archive above

License

For details on licensing and support please see there.

This software is published under a "Modified BSD" License", an open source license.