heimdall_tools 1.3.27 → 1.3.28

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec12dcca7139b389b594827c467624eb68c04b3c65c2f9cf978a79c191d1df5c
-  data.tar.gz: 13c5f3844677537895b7b66cae5bde9bcf1b62106d71becefe6b90a86cfd24bb
+  metadata.gz: 793e9f28cb98cddc239829d4164d2f316100b2157ae9e196d2c32e5271fca664
+  data.tar.gz: 267e61797626c6ec797fdffda2d03bee9de9ce5ed45f918d2cfcda9af86a9957
 SHA512:
-  metadata.gz: e889225ffead476f7d2563888081a95ed4fbc6486611a5102329ecdd1ab5744082b7fc8864a995b6b05a514419be2d4487072b462c4bb7e9231cb9c1823db1ff
-  data.tar.gz: b87c89909ccf8cb5d90abd4f8a306bcaddfcf6b2ef63c17ebe7f5f8f05f6883fd3ac71515463d698a8afcbb101a30312d6d64305ce132ef7092ea449cc8c3714
+  metadata.gz: 671713a138539ad4f68615aa1c74d727ddd221b27fb0d7ea22531b8c5caa19aed0d00eabab2b685edc00566b2098ea7514e3281e30fbcbc09ea4db31c0171762
+  data.tar.gz: 2f589a0a0db9cfd64cf23f25420f6609229bbc0dfc8e435e7bde4eb7c19c431a8446ccae650e2bb6820cee8a04e996eb205999a2ad2429063e491818127a8c86

data/CHANGELOG.md

@@ -2,10 +2,23 @@
 
 ## [Unreleased](https://github.com/mitre/heimdall_tools/tree/HEAD)
 
-[Full Changelog](https://github.com/mitre/heimdall_tools/compare/v1.3.26...HEAD)
+[Full Changelog](https://github.com/mitre/heimdall_tools/compare/v1.3.27...HEAD)
+
+**Closed issues:**
+
+- Map 'Policy Compliance' entries for nessus\_mapper [\#49](https://github.com/mitre/heimdall_tools/issues/49)
+
+**Merged pull requests:**
+
+- Add code to translate Policy compliance results [\#51](https://github.com/mitre/heimdall_tools/pull/51) ([rx294](https://github.com/rx294))
+
+## [v1.3.27](https://github.com/mitre/heimdall_tools/tree/v1.3.27) (2020-05-22)
+
+[Full Changelog](https://github.com/mitre/heimdall_tools/compare/v1.3.26...v1.3.27)
 
 **Merged pull requests:**
 
+- Updated the Dockerfile to run in an alpine ruby container [\#47](https://github.com/mitre/heimdall_tools/pull/47) ([jsa5593](https://github.com/jsa5593))
 - Require a newer version of git-lite-version-bump for Windows support [\#46](https://github.com/mitre/heimdall_tools/pull/46) ([rbclark](https://github.com/rbclark))
 
 ## [v1.3.26](https://github.com/mitre/heimdall_tools/tree/v1.3.26) (2020-05-06)

data/README.md

@@ -9,6 +9,7 @@ HeimdallTools supplies several methods to convert output from various tools to "
 - **fortify_mapper** - commercial static code analysis tool
 - **zap_mapper** - OWASP ZAP - open-source dynamic code analysis tool
 - **burpsuite_mapper** - commercial dynamic analysis tool
+- **nessus_mapper** - commercial vulnerability scanner
 
 Ruby 2.4 or higher (check using "ruby -v")
 

data/lib/heimdall_tools/nessus_mapper.rb

@@ -17,6 +17,10 @@ IMPACT_MAPPING = {
 
 DEFAULT_NIST_TAG = ["unmapped"].freeze
 
+# Nessus results file 800-53 refs does not contain Nist rev version. Using this default
+# version in that case
+DEFAULT_NIST_REV = 'Rev_4'.freeze
+
 NA_PLUGIN_OUTPUT = "This Nessus Plugin does not provide output message.".freeze
 
 # rubocop:disable Metrics/AbcSize
@@ -31,6 +35,8 @@ module HeimdallTools
         @cwe_nist_mapping = parse_mapper
         @data = xml_to_hash(nessus_xml)
 
+        File.write("273970.json", @data.to_json)
+
         @reports = extract_report
         @scaninfo = extract_scaninfo
       rescue StandardError => e
@@ -50,6 +56,9 @@ module HeimdallTools
         raise "Invalid Nessus XML file provided Exception: #{e}"
       end
     end
+    def parse_refs(refs, key)
+      refs.split(',').map { |x| x.split('|')[1] if x.include?(key) }.compact
+    end
 
     def extract_scaninfo
       begin
@@ -82,8 +91,20 @@ module HeimdallTools
 
     def finding(issue, timestamp)
       finding = {}
-      finding['status'] = 'failed'
-      finding['code_desc'] = issue['plugin_output'] || NA_PLUGIN_OUTPUT
+      # if compliance-result field, this is a policy compliance result entry
+      # nessus policy compliance result provides a pass/fail data
+      # For non policy compliance  results are defaulted to failed
+      if issue['compliance-result']
+        finding['status'] = issue['compliance-result'].eql?('PASSED') ? 'passed' : 'failed'
+      else
+        finding['status'] = 'failed'
+      end
+
+      if issue['description']
+        finding['code_desc'] = issue['description'].to_s || NA_PLUGIN_OUTPUT
+      else
+        finding['code_desc'] = issue['plugin_output'] || NA_PLUGIN_OUTPUT
+      end
       finding['run_time'] = NA_FLOAT
       finding['start_time'] = timestamp
       [finding]
@@ -96,14 +117,15 @@ module HeimdallTools
     end
 
     def impact(severity)
+      # Map CAT levels and Plugin severity to HDF impact levels
       case severity
       when "0"
         IMPACT_MAPPING[:Info]
-      when "1"
+      when "1","III"
         IMPACT_MAPPING[:Low]
-      when "2"
+      when "2","II"
         IMPACT_MAPPING[:Medium]
-      when "3"
+      when "3","I"
         IMPACT_MAPPING[:High]
       when "4"
         IMPACT_MAPPING[:Critical]
@@ -142,21 +164,54 @@ module HeimdallTools
     def to_hdf
       host_results = {}
       @reports.each do | report|
-        # Under current version of the converter `Policy Compliance` items are ignored
-        report_items = report['ReportItem'].select {|x| !x['pluginFamily'].eql? 'Policy Compliance'}
-
         controls = []
-        report_items.each do | item |
+        report['ReportItem'].each do | item |
           @item = {}
-          @item['id']                 = item['pluginID'].to_s
-          @item['title']              = item['pluginName'].to_s
-          @item['desc']               = format_desc(item).to_s
-          @item['impact']             = impact(item['severity'])
           @item['tags']               = {}
           @item['descriptions']       = []
           @item['refs']               = NA_ARRAY
           @item['source_location']    = NA_HASH
-          @item['tags']['nist']       = nist_tag(item['pluginFamily'],item['pluginID'])
+
+          # Nessus results field set are different for 'Policy Compliance' plug-in family vs other plug-in families
+          # Following if conditions capture compliance* if it exists else it will default to plugin* fields
+          # Current version covers STIG based 'Policy Compliance' results
+          # TODO Cover cases for 'Policy Compliance' results based on CIS
+          if item['compliance-reference']
+            @item['id']                 = parse_refs(item['compliance-reference'],'Vuln-ID').join.to_s
+          else
+            @item['id']                 = item['pluginID'].to_s
+          end
+          if item['compliance-check-name']
+            @item['title']              = item['compliance-check-name'].to_s
+          else
+            @item['title']              = item['pluginName'].to_s
+          end
+          if item['compliance-info']
+            @item['desc']              = item['compliance-info'].to_s
+          else
+            @item['desc']              = format_desc(item).to_s
+          end
+          if item['compliance-reference']
+            @item['impact']            = impact(parse_refs(item['compliance-reference'],'CAT').join.to_s)
+          else
+            @item['impact']            = impact(item['severity']) 
+          end
+          if item['compliance-reference']
+            # TODO: Cover cases where 800-53 refs are not provided in nessus `compliance-reference` field
+            @item['tags']['nist']     = parse_refs(item['compliance-reference'],'800-53') << DEFAULT_NIST_REV
+          else
+            @item['tags']['nist']     = nist_tag(item['pluginFamily'],item['pluginID'])
+          end
+          if item['compliance-solution']
+            # TODO: Cover cases where 800-53 refs are not provided in nessus `compliance-reference` field
+            @item['tags']['nist']     = parse_refs(item['compliance-reference'],'800-53') << DEFAULT_NIST_REV
+          else
+            @item['tags']['nist']     = nist_tag(item['pluginFamily'],item['pluginID'])
+          end
+          if item['compliance-solution']
+            @item['descriptions']       <<  desc_tags(item['compliance-solution'], 'check')
+          end
+
           @item['code']               = ''
           @item['results']            = finding(item, extract_timestamp(report))
           controls << @item

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: heimdall_tools
 version: !ruby/object:Gem::Version
-  version: 1.3.27
+  version: 1.3.28
 platform: ruby
 authors:
 - Robert Thew
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-05-22 00:00:00.000000000 Z
+date: 2020-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri