diff --git a/LICENSE b/LICENSE index d3d5a3b..261eeb9 100644 --- a/LICENSE +++ b/LICENSE @@ -1,21 +1,201 @@ -MIT License + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ -Copyright (c) 2017 Austin Taylor + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: + 1. Definitions. -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/README.md b/README.md index 288781f..1991ee1 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,4 @@

-

Create actionable data from your vulnerability scans

@@ -43,24 +42,27 @@ Requirements * Vulnerability Scanner * Optional: Message broker such as Kafka or RabbitMQ -Install Requirements +Install Requirements (may require sudo) -------------------- - +**First, install dependant modules** ```python -Install dependant modules cd deps/qualysapi python setup.py install - -Using requirements file: -sudo pip install -r /path/to/VulnWhisperer/requirements.txt - -cd /path/to/VulnWhisperer -sudo python setup.py install ``` +**Second, install requirements** + +```python +pip install -r /path/to/VulnWhisperer/requirements.txt +cd /path/to/VulnWhisperer +python setup.py install +``` + +Now you're ready to pull down scans. (see run section) + Configuration ----- diff --git a/docs/source/vulnWhispFull.png b/docs/source/vulnWhispFull.png new file mode 100644 index 0000000..029c811 Binary files /dev/null and b/docs/source/vulnWhispFull.png differ diff --git a/elasticsearch/logstash-nessus-template.json b/elasticsearch/logstash-nessus-template.json deleted file mode 100755 index 14928ca..0000000 --- a/elasticsearch/logstash-nessus-template.json +++ /dev/null @@ -1,245 +0,0 @@ -{ - "order": 0, - "template": "logstash-vulnwhisperer-*", - "settings": { - "index": { - "routing": { - "allocation": { - "total_shards_per_node": "2" - } - }, - "mapping": { - "total_fields": { - "limit": "3000" - } - }, - "refresh_interval": "5s", - "number_of_shards": "1", - "number_of_replicas": "1" - } - }, - "mappings": { - "_default_": { - "dynamic_templates": [ - { - "message_field": { - "mapping": { - "fielddata": { - "format": "disabled" - }, - "index": "analyzed", - "omit_norms": true, - "type": "string" - }, - "match_mapping_type": "string", - "match": "message" - } - }, - { - "string_fields": { - "mapping": { - "fielddata": { - "format": "disabled" - }, - "index": "analyzed", - "omit_norms": true, - "type": "string", - "fields": { - "raw": { - "ignore_above": 256, - "index": "not_analyzed", - "type": "string", - "doc_values": true - } - } - }, - "match_mapping_type": "string", - "match": "*" - } - }, - { - "ip_address_fields": { - "mapping": { - "type": "ip" - }, - "match": "*_ip" - } - }, - { - "ipv6_address_fields": { - "mapping": { - "index": "not_analyzed", - "type": "string" - }, - "match": "*_ipv6" - } - }, - { - "float_fields": { - "mapping": { - "type": "float", - "doc_values": true - }, - "match_mapping_type": "float", - "match": "*" - } - }, - { - "double_fields": { - "mapping": { - "type": "double", - "doc_values": true - }, - "match_mapping_type": "double", - "match": "*" - } - }, - { - "byte_fields": { - "mapping": { - "type": "byte", - "doc_values": true - }, - "match_mapping_type": "byte", - "match": "*" - } - }, - { - "short_fields": { - "mapping": { - "type": "short", - "doc_values": true - }, - "match_mapping_type": "short", - "match": "*" - } - }, - { - "integer_fields": { - "mapping": { - "type": "integer", - "doc_values": true - }, - "match_mapping_type": "integer", - "match": "*" - } - }, - { - "long_fields": { - "mapping": { - "type": "long", - "doc_values": true - }, - "match_mapping_type": "long", - "match": "*" - } - }, - { - "date_fields": { - "mapping": { - "type": "date", - "doc_values": true - }, - "match_mapping_type": "date", - "match": "*" - } - }, - { - "geo_point_fields": { - "mapping": { - "type": "geo_point", - "doc_values": true - }, - "match_mapping_type": "geo_point", - "match": "*" - } - } - ], - "_all": { - "omit_norms": true, - "enabled": true - }, - "properties": { - "plugin_id": { - "type": "integer" - }, - "last_updated": { - "type": "date", - "doc_values": true - }, - "geoip": { - "dynamic": true, - "type": "object", - "properties": { - "ip": { - "type": "ip", - "doc_values": true - }, - "latitude": { - "type": "float", - "doc_values": true - }, - "location": { - "type": "geo_point", - "doc_values": true - }, - "longitude": { - "type": "float", - "doc_values": true - } - } - }, - "risk_score": { - "type": "float" - }, - "source": { - "index": "not_analyzed", - "type": "string" - }, - "synopsis": { - "index": "not_analyzed", - "type": "string" - }, - "see_also": { - "index": "not_analyzed", - "type": "string" - }, - "@timestamp": { - "type": "date", - "doc_values": true - }, - "cve": { - "index": "not_analyzed", - "type": "string" - }, - "solution": { - "index": "not_analyzed", - "type": "string" - }, - "port": { - "index": "not_analyzed", - "type": "integer" - }, - "host": { - "type": "string" - }, - "@version": { - "index": "not_analyzed", - "type": "string", - "doc_values": true - }, - "risk": { - "index": "not_analyzed", - "type": "string" - }, - "assign_ip": { - "type": "ip" - }, - "cvss": { - "type": "float" - } - } - } - }, - "aliases": {} -} \ No newline at end of file diff --git a/elasticsearch/logstash-vulnwhisperer-template.json b/elasticsearch/logstash-vulnwhisperer-template.json new file mode 100755 index 0000000..60462cb --- /dev/null +++ b/elasticsearch/logstash-vulnwhisperer-template.json @@ -0,0 +1,138 @@ +{ + "order": 0, + "template": "logstash-vulnwhisperer-*", + "settings": { + "index": { + "routing": { + "allocation": { + "total_shards_per_node": "2" + } + }, + "mapping": { + "total_fields": { + "limit": "3000" + } + }, + "refresh_interval": "5s", + "number_of_shards": "1", + "number_of_replicas": "0" + } + }, + "mappings": { + "_default_": { + "_all": { + "enabled": true, + "norms": false + }, + "dynamic_templates": [ + { + "message_field": { + "path_match": "message", + "match_mapping_type": "string", + "mapping": { + "type": "text", + "norms": false + } + } + }, + { + "string_fields": { + "match": "*", + "match_mapping_type": "string", + "mapping": { + "type": "text", + "norms": false, + "fields": { + "keyword": { + "type": "keyword", + "ignore_above": 256 + } + } + } + } + } + ], + "properties": { + "plugin_id": { + "type": "integer" + }, + "last_updated": { + "type": "date", + "doc_values": true + }, + "geoip": { + "dynamic": true, + "type": "object", + "properties": { + "ip": { + "type": "ip", + "doc_values": true + }, + "latitude": { + "type": "float", + "doc_values": true + }, + "location": { + "type": "geo_point", + "doc_values": true + }, + "longitude": { + "type": "float", + "doc_values": true + } + } + }, + "risk_score": { + "type": "float" + }, + "source": { + "index": "not_analyzed", + "type": "string" + }, + "synopsis": { + "index": "not_analyzed", + "type": "string" + }, + "see_also": { + "index": "not_analyzed", + "type": "string" + }, + "@timestamp": { + "type": "date", + "doc_values": true + }, + "cve": { + "index": "not_analyzed", + "type": "string" + }, + "solution": { + "index": "not_analyzed", + "type": "string" + }, + "port": { + "index": "not_analyzed", + "type": "integer" + }, + "host": { + "type": "string" + }, + "@version": { + "index": "not_analyzed", + "type": "string", + "doc_values": true + }, + "risk": { + "index": "not_analyzed", + "type": "string" + }, + "assign_ip": { + "type": "ip" + }, + "cvss": { + "type": "float" + } + } + } + }, + "aliases": {} +} diff --git a/kibana/vuln_whisp_kibana/1000_vulnWhispererBaseVisuals.json b/kibana/vuln_whisp_kibana/1000_vulnWhispererBaseVisuals.json index 6ea9304..5b6707b 100755 --- a/kibana/vuln_whisp_kibana/1000_vulnWhispererBaseVisuals.json +++ b/kibana/vuln_whisp_kibana/1000_vulnWhispererBaseVisuals.json @@ -340,7 +340,7 @@ "_type": "visualization", "_source": { "title": "VulnWhisperer - Critical Assets", - "visState": "{\"title\":\"VulnWhisperer - Critical Assets\",\"type\":\"heatmap\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"enableHover\":true,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Green to Red\",\"setColorRange\":true,\"colorsRange\":[{\"from\":0,\"to\":3},{\"from\":3,\"to\":7},{\"from\":7,\"to\":9},{\"from\":9,\"to\":11}],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"color\":\"white\"}}],\"type\":\"heatmap\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"max\",\"schema\":\"metric\",\"params\":{\"field\":\"risk_score\",\"customLabel\":\"Residual Risk Score\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"terms\",\"schema\":\"split\",\"params\":{\"field\":\"risk_score\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"row\":true}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{},\"customLabel\":\"Date\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"asset.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Critical Asset\"}}],\"listeners\":{}}", + "visState": "{\"title\":\"VulnWhisperer - Critical Assets\",\"type\":\"heatmap\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"enableHover\":true,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Green to Red\",\"setColorRange\":true,\"colorsRange\":[{\"from\":0,\"to\":3},{\"from\":3,\"to\":7},{\"from\":7,\"to\":9},{\"from\":9,\"to\":11}],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":false,\"rotate\":0,\"color\":\"white\"}}],\"type\":\"heatmap\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"max\",\"schema\":\"metric\",\"params\":{\"field\":\"risk_score\",\"customLabel\":\"Residual Risk Score\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"terms\",\"schema\":\"split\",\"params\":{\"field\":\"risk_score\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"row\":true}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{},\"customLabel\":\"Date\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"asset.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Critical Asset\"}}],\"listeners\":{}}", "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 3\":\"rgb(0,104,55)\",\"3 - 7\":\"rgb(135,203,103)\",\"7 - 9\":\"rgb(255,255,190)\",\"9 - 11\":\"rgb(249,142,82)\"},\"colors\":{\"8 - 10\":\"#BF1B00\",\"9 - 11\":\"#BF1B00\",\"7 - 9\":\"#EF843C\",\"3 - 7\":\"#EAB839\",\"0 - 3\":\"#7EB26D\"},\"legendOpen\":false}}", "description": "", "version": 1, @@ -410,7 +410,7 @@ "_type": "visualization", "_source": { "title": "VulnWhisperer - Risk: Medium", - "visState": "{\"title\":\"VulnWhisperer - Risk: Medium\",\"type\":\"goal\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"type\":\"gauge\",\"gauge\":{\"verticalSplit\":false,\"autoExtend\":false,\"percentageMode\":false,\"gaugeType\":\"Metric\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"Background\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":false,\"color\":\"black\"},\"scale\":{\"show\":true,\"labels\":false,\"color\":\"#333\",\"width\":2},\"type\":\"simple\",\"style\":{\"bgFill\":\"white\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":\"34\"},\"extendRange\":false}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Medium Risk\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":{\"query_string\":{\"query\":\"risk_score:medium\"}}},\"label\":\"Medium Risk\"}]}}],\"listeners\":{}}", + "visState": "{\"title\":\"VulnWhisperer - Risk: Medium\",\"type\":\"goal\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"type\":\"gauge\",\"gauge\":{\"verticalSplit\":false,\"autoExtend\":false,\"percentageMode\":false,\"gaugeType\":\"Metric\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"Background\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":false,\"color\":\"black\"},\"scale\":{\"show\":true,\"labels\":false,\"color\":\"#333\",\"width\":2},\"type\":\"simple\",\"style\":{\"bgFill\":\"white\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":\"34\"},\"extendRange\":false},\"isDisplayWarning\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Medium Risk\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":{\"query_string\":{\"query\":\"risk_score_name:medium\"}}},\"label\":\"Medium Risk\"}]}}],\"listeners\":{}}", "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"},\"legendOpen\":true,\"colors\":{\"0 - 10000\":\"#EAB839\"}}}", "description": "", "version": 1, diff --git a/kibana/vuln_whisp_kibana/1001_vulnWhisperer_ReportingMitigationDashboard.json b/kibana/vuln_whisp_kibana/1001_vulnWhisperer_ReportingMitigationDashboard.json index 1c38611..7b51eac 100755 --- a/kibana/vuln_whisp_kibana/1001_vulnWhisperer_ReportingMitigationDashboard.json +++ b/kibana/vuln_whisp_kibana/1001_vulnWhisperer_ReportingMitigationDashboard.json @@ -19,7 +19,7 @@ "value": 0 }, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"-vulnerability_category:\\\"INFORMATION_GATHERED\\\"\"}}}],\"highlightAll\":true,\"version\":true}" + "searchSourceJSON": "{\"filter\":[{\"query\":{\"match_all\":{}}}],\"highlightAll\":true,\"version\":true}" } } }, @@ -34,16 +34,9 @@ "optionsJSON": "{\"darkTheme\":false}", "uiStateJSON": "{\"P-11\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-2\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-20\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-21\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":0,\"direction\":\"desc\"}}}},\"P-27\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-28\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":0,\"direction\":\"desc\"}}}},\"P-3\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":0,\"direction\":\"asc\"}}}},\"P-30\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-31\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-40\":{\"vis\":{\"defaultColors\":{\"0 - 3\":\"rgb(0,104,55)\",\"3 - 7\":\"rgb(135,203,103)\",\"7 - 9\":\"rgb(255,255,190)\",\"9 - 11\":\"rgb(249,142,82)\"}}},\"P-41\":{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"}}},\"P-42\":{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"}}},\"P-43\":{\"vis\":{\"defaultColors\":{\"0 - 1000\":\"rgb(0,104,55)\"}}},\"P-44\":{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"}}},\"P-45\":{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"}}},\"P-46\":{\"vis\":{\"legendOpen\":true}},\"P-47\":{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"},\"legendOpen\":false}},\"P-48\":{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"},\"legendOpen\":false}},\"P-49\":{\"vis\":{\"defaultColors\":{\"0 - 1000\":\"rgb(0,104,55)\"},\"legendOpen\":false}},\"P-5\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-50\":{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"}}},\"P-51\":{\"vis\":{\"defaultColors\":{\"0 - 10000\":\"rgb(0,104,55)\"}}},\"P-6\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-8\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}}", "version": 1, - "timeRestore": true, - "timeTo": "now", - "timeFrom": "now-30d", - "refreshInterval": { - "display": "Off", - "pause": false, - "value": 0 - }, + "timeRestore": false, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"-vulnerability_category:\\\"INFORMATION_GATHERED\\\"\"}}}],\"highlightAll\":true,\"version\":true}" + "searchSourceJSON": "{\"filter\":[{\"query\":{\"match_all\":{}}}],\"highlightAll\":true,\"version\":true}" } } } diff --git a/logstash/1000_nessus_process_file.conf b/logstash/1000_nessus_process_file.conf index 9e0a107..019b696 100644 --- a/logstash/1000_nessus_process_file.conf +++ b/logstash/1000_nessus_process_file.conf @@ -6,7 +6,7 @@ input { file { - path => "/opt/vulnwhisp/scans/**/*" + path => "/opt/vulnwhisperer/nessus/**/*" start_position => "beginning" tags => "nessus" type => "nessus" @@ -15,6 +15,9 @@ input { filter { if "nessus" in [tags]{ + # Drop the header column + if [message] =~ "^Plugin ID" { drop {} } + mutate { gsub => [ "message", "\|\|\|", " ", @@ -26,7 +29,7 @@ filter { } csv { - columns => ["plugin_id", "cve", "cvss", "risk", "host", "protocol", "port", "plugin_name", "synopsis", "description", "solution", "see_also", "plugin_output"] + columns => ["plugin_id", "cve", "cvss", "risk", "asset", "protocol", "port", "plugin_name", "synopsis", "description", "solution", "see_also", "plugin_output"] separator => "," source => "message" } @@ -57,10 +60,13 @@ filter { if [risk] == "Critical" { mutate { add_field => { "risk_number" => 4 }} } - + if [cve] == "nan" { mutate { remove_field => [ "cve" ] } } + if [cvss] == "nan" { + mutate { remove_field => [ "cvss" ] } + } if [see_also] == "nan" { mutate { remove_field => [ "see_also" ] } } @@ -81,11 +87,36 @@ filter { mutate { convert => { "risk_score" => "float" } } + if [risk_score] == 0 { + mutate { + add_field => { "risk_score_name" => "info" } + } + } + if [risk_score] > 0 and [risk_score] < 3 { + mutate { + add_field => { "risk_score_name" => "low" } + } + } + if [risk_score] >= 3 and [risk_score] < 6 { + mutate { + add_field => { "risk_score_name" => "medium" } + } + } + if [risk_score] >=6 and [risk_score] < 9 { + mutate { + add_field => { "risk_score_name" => "high" } + } + } + if [risk_score] >= 9 { + mutate { + add_field => { "risk_score_name" => "critical" } + } + } # Compensating controls - adjust risk_score # Adobe and Java are not allowed to run in browser unless whitelisted # Therefore, lower score by dividing by 3 (score is subjective to risk) - + #Modify and uncomment when ready to use #if [risk_score] != 0 { # if [plugin_name] =~ "Adobe" and [risk_score] > 6 or [plugin_name] =~ "Java" and [risk_score] > 6 { @@ -100,27 +131,27 @@ filter { # Add tags for reporting based on assets or criticality - #if [host] == "192.168.0.1" or [host] == "192.168.0.50" or [host] =~ "^192\.168\.10\." or [host] =~ "^42.42.42." { - # mutate { - # add_tag => [ "critical_asset" ] - # } - #} - #if [host] =~ "^192\.168\.[45][0-9][0-9]\.1$" or [host] =~ "^192.168\.[50]\.[0-9]{1,2}\.1$"{ + if [asset] == "dc01" or [asset] == "dc02" or [asset] == "pki01" or [asset] == "192.168.0.54" or [asset] =~ "^192\.168\.0\." or [asset] =~ "^42.42.42." { + mutate { + add_tag => [ "critical_asset" ] + } + } + #if [asset] =~ "^192\.168\.[45][0-9][0-9]\.1$" or [asset] =~ "^192.168\.[50]\.[0-9]{1,2}\.1$"{ # mutate { # add_tag => [ "has_hipaa_data" ] # } #} - #if [host] =~ "^192\.168\.[45][0-9][0-9]\." { + #if [asset] =~ "^192\.168\.[45][0-9][0-9]\." { # mutate { # add_tag => [ "hipaa_asset" ] # } #} - #if [host] =~ "^192\.168\.5\." { - # mutate { - # add_tag => [ "pci_asset" ] - # } - #} - #if [host] =~ "^10\.0\.50\." { + if [asset] =~ "^hr" { + mutate { + add_tag => [ "pci_asset" ] + } + } + #if [asset] =~ "^10\.0\.50\." { # mutate { # add_tag => [ "web_servers" ] # } @@ -133,7 +164,7 @@ output { #stdout { codec => rubydebug } elasticsearch { hosts => [ "localhost:9200" ] - index => "logstash-nessus-%{+YYYY.MM}" + index => "logstash-vulnwhisperer-%{+YYYY.MM}" } } } diff --git a/logstash/2000_qualys_web_scans.conf b/logstash/2000_qualys_web_scans.conf index 758bc43..cc8b0cb 100644 --- a/logstash/2000_qualys_web_scans.conf +++ b/logstash/2000_qualys_web_scans.conf @@ -6,7 +6,7 @@ input { file { - path => "/opt/vulnwhisperer/scans/**/*.json" + path => "/opt/vulnwhisperer/qualys/scans/**/*.json" type => json codec => json start_position => "beginning"