________________________________
Subject: Re: Nessus Risk Factors
Thanks, that list helps define how they score various risks, but is there
documentation on
how they correlate to the Nessus risk factors? And is there a list of all
of the currently > used risk factors (by Nessus)?
Risk factors as they appears in Nessus' output are uniquely and somewhat
arbitrarily assigned by each script that Nessus runs. These ratings are
simple text inside the desc field of each nasl script. Therefore, the best
way to identify all possible values would be to actually parse those files.
A quick grep through my plugins directory yielded 17 generally unique values
(including puzzling things like "None / High" or "None at this time") and 79
unique fields (meaning that due to punctuation, capitalization, or spacing,
uniq decided they were unique). So if you're writing parsers, be prepared
to spend some time writing case statements to properly handle them all.
It might actually be faster and more efficient to modify the nasls and
impose your own risk factor consistency there prior to running a scan
(especially since there are nearly 1K nasl scripts that don't output a risk
factor value, so you could add your own). Then you could just maintain a
diff of your plugins directory to apply each time you update. I started
doing something close to this (an Oinkmaster-type script for Nessus nasl
scripts instead of Snort rules), but the work it would've been supporting
never came to pass.
PaulM
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
