Bulk Finding Upload

[Nick-Rudy]

I am working on trying to be able to import bulk findings from Nessus in either the .nessus format or a generated .csv report. Is there something that I need to do in order to get the required field types to play nice that someone has already figured out? Below are all of the header options by default that can be included with a generated csv out of Nessus.

Nessus .csv Headers
Plugin ID
2CVE
CVSS v2.0 Base Score
Risk
Host
Protocol
Port
Name
Synopsis
Description
Solution
See Also
Plugin Output
STIG Severity
CVSS v3.0 Base Score
CVSS v2.0 Temporal Score
CVSS v3.0 Temporal Score
Risk Factor
References
Plugin Information
Exploitable With

[chrismaddalena]

There are a few things you probably want to do to prep this data for import:

• Group all results for each plugin ID
• Convert Name into a suitable title
• Combine Host, Protocol, and Port fields from each Nessus result into your list of affected hosts
• Map the other information to findings fields

For the last one, there are some obvious connections, like Description probably works as your description, References should work for references, and CVSS v3.0 Base Score should be correct for your CVSS score (Ghostwriter uses CVSS v3 currently).

You'll need to review fields like Synopsis, Solution, and Plugin Output to see what they offer and figure out how you want to use them (or not use them).

Nessus results will likely be specific to a report, not something you want added to your findings library. If you're making a script to convert the Nessus output to findings suitable for adding a report, I would start by writing a parser to take all the information you want from Nessus, clean it up, assemble it into a structure matching Ghostwriter's findings, and then use the API to add each finding to your report.