Vulnwhisperer - Practice Actionable Information From Your Vulnerability Scans
Create actionable data from your vulnerability scans
VulnWhisperer is a vulnerability management tool in addition to study aggregator. VulnWhisperer volition line all the reports from the dissimilar Vulnerability scanners in addition to hit a file amongst a unique filename for each one, using that information afterward to sync amongst Jira in addition to feed Logstash. Jira does a unopen cycle sum Sync amongst the information provided past times the Scanners, acre Logstash indexes in addition to tags all of the information within the study (see logstash files at /resources/elk6/pipeline/). Data is thence shipped to ElasticSearch to live indexed in addition to ends upward inwards a visual in addition to searchable format inwards Kibana amongst already defined dashboards.
Currently Supports
Vulnerability Frameworks
- Nessus (v6/v7/v8)
- Qualys Web Applications
- Qualys Vulnerability Management
- OpenVAS (v7/v8/v9)
- Tenable.io
- Detectify
- Nexpose
- Insight VM
- NMAP
- Burp Suite
- OWASP ZAP
- More to come
Reporting Frameworks
Getting Started
- Follow the install requirements
- Fill out the department y'all desire to procedure inwards frameworks_example.ini file
- [JIRA] If using Jira, hit sum Jira config inwards the config file mentioned above.
- [ELK] Modify the IP settings inwards the Logstash files to adapt your environment in addition to import them to your logstash conf directory (default is /etc/logstash/conf.d/)
- [ELK] Import the Kibana visualizations
- Run Vulnwhisperer
Requirements
- Python 2.7
- Vulnerability Scanner
- Reporting System: Jira / ElasticStack 6.6
Install Requirements-VulnWhisperer(may require sudo)
Install OS packages requirement dependencies (Debian-based distros, CentOS don't demand it)
sudo apt-get install zlib1g-dev libxml2-dev libxslt1-dev virtualenv venv (will hit the python 2.7 virtualenv) source venv/bin/activate (start the virtualenv, at in 1 trial pip volition run at that topographic point in addition to should install libraries without sudo) deactivate (for quitting the virtualenv in 1 trial y'all are done)pip install -r /path/to/VulnWhisperer/requirements.txt cd /path/to/VulnWhisperer python setup.py installexport HTTP_PROXY=http://example.com:8080 export HTTPS_PROXY=http://example.com:8080Configuration
There are a few configuration steps to setting upward VulnWhisperer:
- Configure Ini file
- Setup Logstash File
- Import ElasticSearch Templates
- Import Kibana Dashboards
Run
To run, hit sum out the configuration file amongst your vulnerability scanner settings. Then y'all tin laissez passer the axe execute from the ascendence line.
(optional flag: -F -> provides "Fancy" log colouring, proficient for comprehension when manually executing VulnWhisperer) vuln_whisperer -c configs/frameworks_example.ini -s nessus or vuln_whisperer -c configs/frameworks_example.ini -s qualysenabled=true in addition to run them sequentially.
Docker-compose
ELK is a whole earth past times itself, in addition to for newcomers to the platform, it requires basic Linux skills in addition to unremarkably a flake of troubleshooting until it is deployed in addition to working every bit expected. As nosotros are non able to furnish back upward for each users ELK problems, nosotros pose together a docker-compose which includes:
- VulnWhisperer
- Logstash 6.6
- ElasticSearch 6.6
- Kibana 6.6
git clone, amongst but adding the Scanner config to the VulnWhisperer config file (/resources/elk6/vulnwhisperer.ini), it volition piece of occupation out of the box.It also takes aid to charge the Kibana Dashboards in addition to Visualizations automatically through the API, which needs to live done manually otherwise at Kibana's startup.
For to a greater extent than information well-nigh the docker-compose, banking concern check on the docker-compose wiki or the FAQ.
Getting Started
Our electrical flow Roadmap is every bit follows:
- Create a Vulnerability Standard
- Map every scanner results to the standard
- Create Scanner module guidelines for slow integration of novel scanners (consistency volition permit #14)
- Refactor the code to reuse functions in addition to enable sum compatibility amid modules
- Change Nessus CSV to JSON (Consistency in addition to Fix #82)
- Adapt unmarried Logstash to criterion in addition to Kibana Dashboards
- Implement Detectify Scanner
- Implement Splunk Reporting/Dashboards
The Vulnerability Standard volition initially live a novel unproblematic 1 score JSON amongst all the information that matches from the dissimilar scanners having standardized variable names, acre maintaining the remainder of the variables every bit they are. In the future, in 1 trial everything is implemented, nosotros volition evaluate moving to an existing criterion similar ECS or AWS Vulnerability Schema; nosotros prioritize functionality over perfection.
Video Walkthrough -- Featured on ElasticWebinar
Authors
Contributors
