Note: if you choose to do this for your 4241 final project, make sure you work on something that includes a server component.
Nv is an interactive data visualization for analyzing Nessus Vulnerability scans. Prioritizing and patching vulnerabilities is a critical task in security operations. But before nv there wasn't a way for security analysts to get an overview of the vulnerabilities on their network without hiding many important details.
Nv bridges addresses this problem by providing an overview of an entire vulnerability scan. Interactions and data-integrations allow analysts to view which vulnerabilities are most severe on their network.
Originally developed in 2012, nv needs new parsers to be compatible with newer scan file formats.
The current parser works with the older Nessus NBE file format.
It returns an object for each entry in the scan:
return {"ip": (ip === undefined ? "" : ip),
"vulnid": (isNaN(code) ? 0 : code),
"vulntype":(holeNote === undefined ? "" : holeNote.indexOf('Note') !== -1 ? 'note' : 'hole'),
"cvss": score,
"value": 1,
"port":port};
The primary need are the new Nessus formats. These include:
Important: To obtain a sample file, try one of the following: a) constructing one from the PDF above, b) downloading the "Home" version of Nessus and running on your own machines. (It might be a bad idea to run it on the University Network.)
It might also be helpful to make a simulator that can produce Nessus v2 files of arbitrary size / complexity.
- Nessus v3 (lower priority)
These might be fun to work on. They're fairly ill-defined, but some early work in each direction can help us better identify requirements.
- Monitor a folder, ability to pick a date range. And see how long a vulnerability has been open for. (High priority)
- Start nv from the command line with a specified file.
- Move from backbone to react/redux
- Decoupling UI for parser and nessus visualization: make their UI modular so that we can hook in any rest service data-feeder to the visualization and not use their built in parser.
- Maven-ize it, or at least make it compile into a war for deployment in to a web container
- Make the tree-map groupings configurable: Right now the UI is coded explicitly to understand each layer in the zoomable tree – make those layers generic so it can be used for any data with minor modifications (ex: Instead of vulnerability, I may want to hook in data on network traffic and people by mission).
You might also come up with your own interesting directions.
- Official client (python): https://github.com/tenable/nessrest
- Ruby client: https://github.com/mephux/ruby-nessus
- Go client: https://github.com/mandreko/nessusgo (actually, a bunch of go libraries: https://github.com/search?l=Go&langOverride=&q=nessus&repo=&start_value=1&type=Repositories)
The ruby client has some examples: https://github.com/mephux/ruby-nessus/tree/master/examples
Oddly, it references a v3, which I didn't see on the Nessus site...
There is even a javascript node client, although no docs (https://github.com/AlexCline/nessus-api).