Sunday, June 18, 2017
Code accepted into Splunk App!
Code accepted into Splunk App!
Bill Matthews informed me that the script I wrote and referenced in a previous post has made it into the Hurricane Labs Vulnerability Management v 1.5 app for Splunk!
http://apps.splunk.com/app/
They cleaned it up and put it in /opt/splunk/etc/apps/HurricaneVulnerabilityManagement/bin/Nessus.sh
#!/bin/bash
#Variables
SPLUNK_NESSUS=/mnt/nessus
SERVER="x.x.x.x"
#Retrive AUTH Token
token="$(/usr/bin/wget -q --no-check-certificate --post-data login=USERNAME&password=PASSWORD https://$SERVER:8834/login -O - | grep -Po (?<=token>)[^<]+(?=</token))"
#Get list of reports
/usr/bin/wget -q --no-check-certificate --post-data "token=$token" https://$SERVER:8834/report/list -O - | grep -Po (?<=name>)[^<]+(?=</name) > /tmp/reports
#Get Friendly Names
/usr/bin/wget -q --no-check-certificate --post-data "token=$token" https://$SERVER:8834/report/list -O - | grep -Po (?<=readableName>)[^<]+(?=</readableName) > /tmp/names
#Merge two files
/usr/bin/pr -tmJ --sep-string=" " /tmp/reports /tmp/names > /tmp/named.reports
for i in $(cut -d -f1 /tmp/named.reports);
do
#Get Filenames for reports
FILENAME=$(/usr/bin/wget -q --no-check-certificate --post-data token=$token&report=$i&xslt=csv.xsl https://$SERVER:8834/file/xslt -O - | grep -Po (?<=/file/xslt/download/?fileName=)[^"]+(?=">))
#Get files
#build Readable name to report number match
READABLENAME=$(grep $i /tmp/named.reports | cut -d -f2- --output-delimiter=)
sleep 5
/usr/bin/wget -q --no-check-certificate --post-data token=$token&fileName=$FILENAME&step=2 https://$SERVER:8834/file/xslt/download -O $SPLUNK_NESSUS/$READABLENAME.csv;
done;
#Cleanup
#rm /tmp/reports
#rm /tmp/names
#rm /tmp/named.reports
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment