Re: can nessus client sort by number of holes instead of sorting by IP?

On Wed, Apr 27, 2005 at 01:00:37PM +1200, Jason Haar wrote:

> Currently the "-T html" output mode generates an HTML
> report where the found IP addresses are sorted by IP. So
> if you have 50+ machines, you can spend some time reading
> every one trying to discover which is the "nastiest" (i.e.
> the one with the most "Security Hole"s) to deal with
> first.
...
> Should this be a feature request,

Sure, I personally think improvements in reporting would be
nice, but I'll leave it to others to decide how high a
priority this should have.

> and has anyone else
> found a way of doing this?

Here's a one-liner in AWK that takes an NBE file and
produces a count of notes / warnings / holes for each host. 

awk -F '|' 'BEGIN { printf "%-30s  %-5s  %-5s  %-5s\n",
"Host", "Notes", "Warns", "Holes";} $1 == "results"
{hosts[$3]++; counts[$3,$6]++;} END {for (host in hosts) {
printf "%-30s  ]  ]  ]\n", host ":", counts[host,"Security
Note"], counts[host,"Security Warning"], counts[host,
"Security Hole"];} }'

Output will be something like this:

Host                            Notes  Warns  Holes
10.1.0.1:                          10      4      0
10.1.0.2:                           7      1      1
10.1.0.3:                           7      2      1

Pipe output into sort if you want the results ranked; eg,
"sort -gr --key=4 --key=3 --key=2".


George

--
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus