OpenVAS Scan Data Manipulation

Question

enter image description hereI'm attempting to write a Powershell script that takes an OpenVAS .csv file and outputs it in a format that I can upload into Jira. I've written one working script that takes each scan item and creates it's own entry, which definitely has some room for improvement. I've been attempting to create a script that takes all the hosts that has the vulnerability "TCP Timestamps" (as an example) and create only one csv entry.

Starting Input (heavily sanitized): enter image description here

First working script (makes an individual ticket for each item):

# Function for file picker
Function Get-FileName($initialDirectory)
{
    [System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") | Out-Null

    $OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
    $OpenFileDialog.initialDirectory = $initialDirectory
    $OpenFileDialog.filter = "CSV (*.csv)| *.csv"
    $OpenFileDialog.ShowDialog() | Out-Null
    $OpenFileDialog.filename
}

$scanImport = @()
$csvContents = @()
$inputFile = Get-FileName "C:\temp"
$scanImport = Import-CSV $inputFile

# Removes the Information vulnerabilities
$scanImport = @($scanImport | Where-Object {$_."Risk Level" -ne "Info"})

$scanImport | Sort Vulnerability | ForEach {
        $row = New-Object System.Object
        $row | Add-Member -MemberType NoteProperty -Name "Hostname" -Value $_.Hostname
        $row | Add-Member -MemberType NoteProperty -Name "IP Address" -Value $_."Host IP"
        $row | Add-Member -MemberType NoteProperty -Name "Vulnerability Base Rating" -Value $_."Risk Level"
        $row | Add-Member -MemberType NoteProperty -Name "Detection Method" -Value "OpenVAS"
        $row | Add-Member -MemberType NoteProperty -Name "Vulnerability Name" -Value $_.Vulnerability.Split("`n")[0]
        $row | Add-Member -MemberType NoteProperty -Name "Summary" -Value ($_.Hostname + " - " + $_.Vulnerability.Split("`n")[0])
        $row | Add-Member -MemberType NoteProperty -Name "References" -Value ("Observation:" + " " + $_.Observation + "`n`n" +  "Remediation:" + " " + $_.Remedation + "`n`n" +  "Consequences:" + " " + $_.Consequences + "`n`n" + "Test Output:" + " " + $_."Test Output") 
        $row | Add-Member -MemberType NoteProperty -Name "Assigned To" -Value user1
        $row | Add-Member -MemberType NoteProperty -Name "System Owner" -Value user2
        $row | Add-Member -MemberType NoteProperty -Name "Users Affected" -Value "Needs to be entered"
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals" -Value user3
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals1" -Value user4
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals2" -Value user5
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals3" -Value user6
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals4" -Value user7
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals5" -Value user8
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals6" -Value user9
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals7" -Value user10
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals8" -Value user11
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals9" -Value user12
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals10" -Value user13
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals11" -Value user14
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals12" -Value user15
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals13" -Value user16
        $csvContents += $row
}
$csvContents | Export-CSV -Path "\Users\$env:USERNAME\Desktop\OpenVAS_to_Jira.csv" -NoTypeInformation

First Script Output (hostnames and vuln names redacted. I used an old vuln scan but out of precaution): script output

Second Script Attempt (with the grouping functionality):

# Function for file picker
Function Get-FileName($initialDirectory)
{
    [System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") | Out-Null

    $OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
    $OpenFileDialog.initialDirectory = $initialDirectory
    $OpenFileDialog.filter = "CSV (*.csv)| *.csv"
    $OpenFileDialog.ShowDialog() | Out-Null
    $OpenFileDialog.filename
}

$scanImport = @()
$csvContents = @()
$hostnames = @()
$hostIPs = @()
$vulnList = @()
$counter = 0
$inputFile = Get-FileName "C:\temp"
$scanImport = Import-CSV $inputFile

# Removes the Information vulnerabilities
$scanImport = @($scanImport | Where-Object {$_."Risk Level" -ne "Info"} | Sort Vulnerability)

$scanImport | Sort Vulnerability | 
ForEach {
        $vulnName = $_.Vulnerability.Split("`n")[0]
        $row = New-Object System.Object
        if ($scanImport[$counter].Vulnerability -eq $scanImport[($counter+1)].Vulnerability) {
            $hostnames += $_.Hostname
            $hostIPs += $_."Host IP"
        }       
        else {
            if ($hostnames -eq $null) {
                $row | Add-Member -MemberType NoteProperty -Name "Summary" -Value ($_.Hostname + " - " + $_.Vulnerability.Split("`n")[0])
                $row | Add-Member -MemberType NoteProperty -Name "Hostname" -Value $_.Hostname
                $row | Add-Member -MemberType NoteProperty -Name "IP Address" -Value $_."Host IP"
            }
            else 
            {
                $row | Add-Member -MemberType NoteProperty -Name "Summary" -Value ("Multiple Systems" + " - " + $_.Vulnerability.Split("`n")[0])
                $row | Add-Member -MemberType NoteProperty -Name "Hostname" -Value $hostnames
                $row | Add-Member -MemberType NoteProperty -Name "IP Address" -Value $hostIPs
                $hostnames = @()
                $hostIPs = @()  
            }

            $row | Add-Member -MemberType NoteProperty -Name "Vulnerability Base Rating" -Value $_."Risk Level"
            $row | Add-Member -MemberType NoteProperty -Name "Detection Method" -Value "OpenVAS"
            $row | Add-Member -MemberType NoteProperty -Name "Vulnerability Name" -Value $_.Vulnerability.Split("`n")[0]     
            $row | Add-Member -MemberType NoteProperty -Name "References" -Value ("Observation:" + " " + $_.Observation + "`n`n" +  "Remediation:" + " " + $_.Remedation + "`n`n" +  "Consequences:" + " " + $_.Consequences + "`n`n" + "Test Output:" + " " + $_."Test Output") 
                       $row | Add-Member -MemberType NoteProperty -Name "Assigned To" -Value user1
        $row | Add-Member -MemberType NoteProperty -Name "System Owner" -Value user2
        $row | Add-Member -MemberType NoteProperty -Name "Users Affected" -Value "Needs to be entered"
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals" -Value user3
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals1" -Value user4
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals2" -Value user5
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals3" -Value user6
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals4" -Value user7
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals5" -Value user8
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals6" -Value user9
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals7" -Value user10
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals8" -Value user11
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals9" -Value user12
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals10" -Value user13
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals11" -Value user14
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals12" -Value user15
        $row | Add-Member -MemberType NoteProperty -Name "DS: Approvals13" -Value user16

            $csvContents += $row
            $counter += 1 
        }
}
$csvContents | Export-CSV -Path "\Users\$env:USERNAME\Desktop\OpenVAS_to_Jira.csv" -NoTypeInformation

Essentially, I want the output to look something like this (excel mock up): desired output

I know there's a high chance I made quite a bit of errors or didn't code something the right way, but I'd appreciate any feedback and help. Thanks in advance!

score 0 · Answer 1 · answered Mar 23 '18 at 08:35

$input = Import-Csv "C:\input.csv"

$Vulnerabilities = $input | Group-Object -Property Vulnerability -AsHashTable -AsString

foreach ($Vulnerability in ($Vulnerabilities.Keys | Sort-Object)) {

    $row = [PSCustomObject]@{
        "Hostname"                  = (($Vulnerabilities.$Vulnerability.HostName) -join ', ')
        "IP Address"                = (($Vulnerabilities.$Vulnerability."Host IP") -join ',')
        "Vulnerability Base Rating" = ($Vulnerabilities.$Vulnerability)[0]."Risk Level"
        "Detection Method"          = "OpenVAS"
        "Vulnerability Name"        = $Vulnerability
    }

    Export-Csv -InputObject $row -Path "C:\output.csv" -Append -NoTypeInformation
}

OpenVAS Scan Data Manipulation

1 Answers1