nexpose_servicenow 0.4.15

data/lib/nexpose_servicenow/queries.rb

@@ -0,0 +1,245 @@
+module NexposeServiceNow
+  class Queries
+    def self.vulnerabilities(options={})
+      "SELECT
+        concat('R7_', vulnerability_id) as ID,
+        cve.ref as CVE,
+        cwe.ref as CWE,
+        concat('Rapid7 Nexpose') as Source,
+        to_char(date_published, 'yyyy-MM-dd hh:mm:ss') as date_published,
+        to_char(date_modified, 'yyyy-MM-dd hh:mm:ss') as Last_Modified,
+        dvc.category,
+        severity as Severity_Rating,
+        severity_score as Severity,
+        pci_status,
+        pci_adjusted_cvss_score as PCI_Severity,
+        title as Summary,
+        description as Threat,
+        ROUND(riskscore::numeric, 2) as Riskscore,
+        cvss_vector,
+        ROUND(cvss_impact_score::numeric, 2) as Impact_Score,
+        ROUND(cvss_exploit_score::numeric, 2) as Exploit_Score,
+        cvss_access_complexity_id as Access_Complexity,
+        cvss_access_vector_id as Access_Vector,
+        cvss_authentication_id as Authentication,
+        ROUND(cvss_score::numeric, 2) as Vulnerability_Score,
+        cvss_integrity_impact_id as Integrity_Impact,
+        cvss_confidentiality_impact_id as Confidentiality_Impact,
+        cvss_availability_impact_id as Availability_Impact,
+        CAST(CASE
+               WHEN exploits > 0
+                 THEN 1
+               ELSE 0
+             END AS bit) as Exploitability,
+        CAST(CASE
+               WHEN malware_kits > 0
+                 THEN 1
+               ELSE 0
+             END AS bit) as Malware_Kits,
+        sol.solutions as Solution
+
+      FROM
+        dim_vulnerability
+
+      LEFT OUTER JOIN
+      (SELECT DISTINCT on(vulnerability_id)
+         vulnerability_id,
+         dvr.reference as ref
+       FROM dim_vulnerability_reference dvr
+       WHERE source='CWE'
+       GROUP BY dvr.vulnerability_id, dvr.reference
+       ) cwe USING (vulnerability_id)
+
+      LEFT OUTER JOIN
+      (SELECT DISTINCT on (vulnerability_id)
+       vulnerability_id,
+       dvr.reference as ref
+       FROM dim_vulnerability_reference dvr
+       WHERE source='CVE'
+       GROUP BY dvr.vulnerability_id, dvr.reference
+      ) cve USING (vulnerability_id)
+
+      LEFT OUTER JOIN(SELECT DISTINCT on (dvc.vulnerability_id) dvc.vulnerability_id, dvc.category_name as category
+        FROM dim_vulnerability_category dvc
+        GROUP BY dvc.vulnerability_id, dvc.category_name) dvc USING (vulnerability_id)
+
+      LEFT OUTER JOIN(SELECT dvr.vulnerability_id, string_agg(dvr.source || ': ' || dvr.reference, '|') as references
+        FROM dim_vulnerability_reference dvr
+        GROUP BY dvr.vulnerability_id) ref USING (vulnerability_id)
+
+      LEFT OUTER JOIN(SELECT vulnerability_id,
+                        string_agg(concat('Fix: ' || fix,
+                       'Solution type: ' || solution_type,
+                       'URL: ' || url,
+                       'Estimate: ' || estimate,
+                       'Applies To: ' || applies_to,
+                       'Additional Data: ' || additional_data), '\n') as solutions
+        FROM dim_solution
+        JOIN dim_vulnerability_solution USING (solution_id)
+        GROUP BY vulnerability_id) sol USING (vulnerability_id)
+      WHERE date_modified >= '#{options[:vuln_query_date]}'"
+    end
+
+
+    def self.vulnerability_references(options={})
+      "SELECT concat('R7_', vulnerability_id) as ID, dvr.Source, dvr.Reference
+        FROM dim_vulnerability
+        LEFT OUTER JOIN
+                (SELECT vulnerability_id, dvr.Source, dvr.Reference
+                FROM dim_vulnerability_reference dvr) dvr USING (vulnerability_id)
+        WHERE date_modified >= '#{options[:vuln_query_date]}'"
+    end
+
+    def self.vulnerability_category(options={})
+      "SELECT concat('R7_', vulnerability_id) as ID, dvc.Category
+        FROM dim_vulnerability
+        LEFT OUTER JOIN
+                (SELECT vulnerability_id, category_name as Category
+                FROM dim_vulnerability_category dvc) dvc USING (vulnerability_id)
+        WHERE date_modified >= '#{options[:vuln_query_date]}'"
+    end
+
+    #Filter by site.
+    def self.assets(options={})
+      "SELECT coalesce(host_name, CAST(dim_asset.asset_id as text)) as Name,
+        dim_asset.ip_address,
+        dim_asset.mac_address,
+        concat('Rapid7 Nexpose') as Discovery_Source,
+                CAST(CASE 
+                     WHEN dim_host_type.description = 'Virtual Machine' or dim_host_type.description = 'Hypervisor'
+                       THEN 1 
+                     ELSE 0 
+                   END AS bit) as Is_Virtual,
+        dim_operating_system.description as Operating_System,
+        fact_asset.scan_finished as Most_Recent_Discovery,
+        dim_asset.asset_id as Nexpose_ID,
+        fact_asset.pci_status
+
+      FROM dim_asset
+      JOIN fact_asset USING (asset_id)
+      LEFT OUTER JOIN dim_operating_system on dim_asset.operating_system_id = dim_operating_system.operating_system_id
+      LEFT OUTER JOIN dim_host_type USING (host_type_id)"
+    end
+
+    def self.software_instance(options={})
+      "SELECT asset_id as Nexpose_ID, coalesce(da.host_name, CAST(da.asset_id as text)) as Installed_On, ds.name, ds.Product_Name, ds.version, ds.cpe
+      FROM fact_asset_scan_software
+      LEFT OUTER JOIN (SELECT software_id, name, vendor || ' ' || family as Product_Name, version, cpe FROM dim_software) ds USING (software_id)
+      LEFT OUTER JOIN (SELECT asset_id, host_name FROM dim_asset) da USING (asset_id)
+      WHERE scan_id = lastScan(asset_id)"
+    end
+
+    def self.service_instance(options={})
+      "SELECT ds.Service_Name, asset_id as Nexpose_ID, port, dp.protocol, dsf.name
+              FROM fact_asset_scan_service
+        LEFT OUTER JOIN (SELECT service_id, name as service_name FROM dim_service) ds USING (service_id)
+              LEFT OUTER JOIN (SELECT service_fingerprint_id, name FROM dim_service_fingerprint) dsf USING (service_fingerprint_id)
+        LEFT OUTER JOIN (SELECT protocol_id, name as protocol FROM dim_protocol) dp USING (protocol_id)
+        WHERE scan_id = lastScan(asset_id)"
+    end
+
+
+  #Need to wipe table each time
+    def self.group_accounts(options={})
+      "SELECT asset_id as Nexpose_ID, daga.name as Group_Account_Name
+        FROM dim_asset
+        JOIN dim_asset_group_account daga USING (asset_id)"
+    end
+
+  #Need to wipe table each time
+    def self.user_accounts(options={})
+      "SELECT da.asset_id as Nexpose_ID, daua.name as User_Account_Name,
+        daua.full_name as User_Account_Full_Name
+
+        FROM dim_asset da
+        JOIN dim_asset_user_account daua USING (asset_id)"
+    end
+
+#Need to wipe table each time
+    def self.asset_groups(options={})
+      "SELECT asset_id as Nexpose_ID, dag.name as Asset_Group_Name,
+        dag.dynamic_membership, dag.description
+        FROM dim_asset_group_asset daga
+        JOIN dim_asset_group dag on daga.asset_group_id = dag.asset_group_id"
+    end
+
+    #Need to wipe table each time
+    def self.sites(options={})
+      "SELECT asset_id as Nexpose_ID, ds.name as site_name
+        FROM dim_asset
+        JOIN dim_site_asset dsa USING (asset_id)
+        JOIN dim_site ds on dsa.site_id = ds.site_id
+        ORDER BY ip_address"
+    end
+
+    #Need to wipe table each time
+    def self.tags(options={})
+      "SELECT asset_id as Nexpose_ID, dt.tag_name
+        FROM dim_tag_asset dta
+        JOIN dim_tag dt on dta.tag_id = dt.tag_id"
+    end
+
+    def self.vulnerable_new_items(options={})
+      "SELECT 
+      coalesce(subq.host_name, CAST(subq.asset_id as text)) Configuration_Item,
+      TRUE as Active,
+      concat('R7_', subq.vulnerability_id) as Vulnerability,
+      fasv.first_discovered as First_Found,
+      fasv.most_recently_discovered as Last_Found,
+      subq.vulnerability_instances as Times_Found,
+      subq.ip_address as IP_Address,
+      favi.port as Port,
+      dp.name as Protocol
+
+      FROM (
+      SELECT fasv.asset_id, fasv.vulnerability_id, vulnerability_instances, s.current_scan, s.host_name, s.ip_address, baselineComparison(fasv.scan_id, s.current_scan) as comparison 
+              FROM fact_asset_scan_vulnerability_finding fasv
+              JOIN (
+                  SELECT asset_id, host_name, ip_address, previousScan(asset_id) AS baseline_scan, lastScan(asset_id) AS current_scan FROM dim_asset
+               ) s ON s.asset_id = fasv.asset_id AND (fasv.scan_id >= #{options[:last_scan_id]} OR fasv.scan_id = s.current_scan)
+               GROUP BY fasv.asset_id, fasv.vulnerability_id, s.current_scan, s.host_name, s.ip_address, vulnerability_instances
+               HAVING baselineComparison(fasv.scan_id, s.current_scan) = 'New'
+              ) subq
+      JOIN 
+              fact_asset_vulnerability_instance favi ON favi.asset_id = subq.asset_id AND favi.scan_id = subq.current_scan AND favi.vulnerability_id = subq.vulnerability_id
+            JOIN 
+              fact_asset_vulnerability_age fasv ON fasv.asset_id = subq.asset_id AND fasv.vulnerability_id = subq.vulnerability_id
+            JOIN
+              dim_asset da ON subq.asset_id = da.asset_id
+            JOIN 
+              dim_protocol dp ON dp.protocol_id = favi.protocol_id
+      ORDER BY fasv.asset_id, vulnerability"
+    end
+
+    def self.vulnerable_old_items(options={})
+      "SELECT 
+      coalesce(da.host_name, CAST(da.asset_id as text)) Configuration_Item,
+      FALSE as Active,
+      concat('R7_', subq.vulnerability_id) as Vulnerability,
+      da.ip_address as IP_Address
+      FROM (
+              SELECT fasv.asset_id, fasv.vulnerability_id, s.current_scan, baselineComparison(fasv.scan_id, s.current_scan) as comparison 
+              FROM fact_asset_scan_vulnerability_finding fasv
+              JOIN (
+                  select asset_id, lastScan(asset_id) AS current_scan from fact_asset_vulnerability_instance WHERE scan_id = lastScan(asset_id)
+               ) s ON s.asset_id = fasv.asset_id AND (fasv.scan_id >= #{options[:last_scan_id]} OR fasv.scan_id = s.current_scan)
+               GROUP BY fasv.asset_id, fasv.vulnerability_id, s.current_scan
+               HAVING baselineComparison(fasv.scan_id, s.current_scan) = 'Old'
+           ) subq
+      JOIN dim_asset da ON subq.asset_id = da.asset_id
+      ORDER BY da.ip_address"
+    end
+
+    def self.latest_scans(options={})
+      'SELECT ds.site_id, ds.last_scan_id, dsc.finished
+        FROM dim_site ds
+        JOIN dim_scan dsc ON ds.last_scan_id = dsc.scan_id'
+    end
+
+    def self.multiple_reports?(query_name)
+      single_queries = ['vulnerabilities', 'vulnerability_category', 
+                        'vulnerability_references', 'latest_scans']
+      return !(single_queries.include? query_name.to_s)
+    end
+  end
+end

data/lib/nexpose_servicenow/queries_original.rb

@@ -0,0 +1,162 @@
+module NexposeServiceNow
+	class Queries
+    def self.cmdb_ci_outofband_device(nexpose_url)
+      "SELECT coalesce(host_name, CAST(dim_asset.asset_id as text)) as Name,
+        host_name as Aliases,
+        ip_address as IP_Address,
+        concat('https://#{nexpose_url}/asset.jsp?devid=', dim_asset.asset_id) as URL,
+        dim_host_type.description as Type,
+        dim_operating_system.description as Product_Version,
+        fa.scan_finished as Most_Recent_Discovery,
+        fa.vulnerabilities as Vulnerabilities,
+        fa.critical_vulnerabilities as Critical_Vulnerabilities,
+        fa.severe_vulnerabilities as Severe_Vulnerabilities,
+        fa.moderate_vulnerabilities as Moderate_Vulnerabilities,
+        fa.malware_kits as Malware_kits,
+        fa.exploits as Exploits,
+        fa.vulnerabilities_with_malware_kit as Vulnerabilities_With_Malware_Kit,
+        fa.vulnerabilities_with_exploit as Vulnerabilities_With_Exploit,
+        fa.vulnerability_instances as Vulnerability_Instances,
+        dim_asset.asset_id as Nexpose_ID,
+        fa.riskscore as Risk_Score,
+        ga.group_accounts as Group_Accounts,
+        ag.asset_groups as Asset_Groups,
+        serv.services as Services,
+        softw.software as Software,
+        use.user_accounts as User_Accounts,
+        site.sites as Sites,
+        tag.tags as Tags,
+        fa.pci_status as PCI_Status
+
+
+        FROM dim_asset
+        LEFT OUTER JOIN dim_host_type on dim_asset.host_type_id = dim_host_type.host_type_id
+        LEFT OUTER JOIN dim_operating_system on dim_asset.operating_system_id = dim_operating_system.operating_system_id
+        
+        JOIN fact_asset fa USING (asset_id)
+
+        LEFT OUTER JOIN (SELECT daga.asset_id, string_agg(daga.name, '|') as Group_Accounts
+          FROM dim_asset_group_account daga
+          GROUP BY daga.asset_id) ga USING (asset_id)
+
+
+        LEFT OUTER JOIN (SELECT daga.asset_id, string_agg(dag.name, '|') as Asset_Groups
+          FROM dim_asset_group_asset daga
+          JOIN dim_asset_group dag on daga.asset_group_id = dag.asset_group_id
+          GROUP BY daga.asset_id) ag USING (asset_id)
+
+
+        LEFT OUTER JOIN (SELECT das.asset_id, string_agg(ds.name, '|') as Services
+          FROM dim_asset_service das
+          JOIN dim_service ds on das.service_id = ds.service_id
+          GROUP BY das.asset_id) serv USING (asset_id)
+
+        LEFT OUTER JOIN (SELECT dauc.asset_id, string_agg(dauc.name, '|') as User_Accounts
+          FROM dim_asset_user_account dauc
+          GROUP BY dauc.asset_id) use USING (asset_id)
+
+        LEFT OUTER JOIN (SELECT dsa.asset_id, string_agg(ds.name, '|') as Sites
+          FROM dim_site_asset dsa
+          JOIN dim_site ds on dsa.site_id = ds.site_id
+          GROUP BY dsa.asset_id) site USING (asset_id)
+
+        LEFT OUTER JOIN (SELECT das.asset_id, string_agg(ds.name, '|') as Software
+          FROM dim_asset_software das
+          JOIN dim_software ds on das.software_id = ds.software_id
+          GROUP BY das.asset_id) softw USING (asset_id)
+
+        LEFT OUTER JOIN (SELECT dta.asset_id, string_agg(dt.tag_name, '|') as Tags
+          FROM dim_tag_asset dta
+          JOIN dim_tag dt on dta.tag_id = dt.tag_id
+          GROUP BY dta.asset_id) tag USING (asset_id)
+
+        GROUP BY dim_asset.host_name, dim_asset.asset_id, dim_asset.ip_address, fa.pci_status, dim_host_type.description, 
+        dim_operating_system.description, fa.scan_finished, fa.vulnerabilities, fa.critical_vulnerabilities, fa.severe_vulnerabilities,
+        fa.moderate_vulnerabilities, fa.malware_kits, fa.exploits, fa.vulnerabilities_with_malware_kit, fa.vulnerabilities_with_exploit,
+        fa.vulnerability_instances, fa.riskscore, ga.group_accounts, softw.software, ag.asset_groups, serv.services, use.user_accounts, site.sites, tag.tags"
+    end
+    
+    def self.sn_vul_vulnerable_item(options={})
+      "SELECT 
+        asset_id as Configuration_Item,
+        concat('R7_', vulnerability_id) as Vulnerability,
+        fasv.first_discovered as First_Found,
+        fasv.most_recently_discovered as Last_Found,
+        fact_asset_vulnerability_finding.vulnerability_instances as Times_Found,
+        dim_asset.ip_address as IP_Address,
+        port as Port,
+        dim_protocol.name as Protocol
+
+      FROM 
+        fact_asset_vulnerability_instance
+      JOIN 
+        fact_asset_vulnerability_finding USING (asset_id, vulnerability_id)
+      JOIN 
+        fact_asset_vulnerability_age fasv USING (asset_id, vulnerability_id)
+      JOIN
+        dim_asset USING (asset_id)
+      JOIN 
+        dim_protocol USING (protocol_id)"
+    end
+
+    def self.sn_vul_third_party_entry(options={})
+      "SELECT
+        concat('R7_', vulnerability_id) as ID, 
+        cve.ref as CVE,
+        cwe.ref as CWE,
+        concat('Rapid7 Nexpose') as Source,
+        date_published,
+        date_modified as Last_Modified,
+        dvc.categories,
+        severity_score as Severity,
+        title as Summary,
+        description as Threat,
+        ROUND(riskscore::numeric, 2) as Riskscore,
+        cvss_vector,
+        ROUND(cvss_score::numeric, 2) as CVSS_Score,
+        exploits,
+        ref.references,
+        sol.solutions
+
+      FROM
+        dim_vulnerabilityYep
+
+      LEFT OUTER JOIN
+      (SELECT 
+         vulnerability_id, 
+         string_agg(dvr.reference, '|') as ref
+       FROM dim_vulnerability_reference dvr
+       WHERE source='CWE'
+       GROUP BY dvr.vulnerability_id
+       ) cwe USING (vulnerability_id)
+
+      LEFT OUTER JOIN
+      (SELECT 
+       vulnerability_id,
+       string_agg(dvr.reference, '|') as ref
+       FROM dim_vulnerability_reference dvr
+       WHERE source='CVE'
+       GROUP BY dvr.vulnerability_id
+      ) cve USING (vulnerability_id)
+
+      LEFT OUTER JOIN(SELECT dvc.vulnerability_id, string_agg(dvc.category_name, '|') as categories
+        FROM dim_vulnerability_category dvc
+        GROUP BY dvc.vulnerability_id) dvc USING (vulnerability_id)
+
+      LEFT OUTER JOIN(SELECT dvr.vulnerability_id, string_agg(dvr.source || ': ' || dvr.reference, '|') as references
+        FROM dim_vulnerability_reference dvr
+        GROUP BY dvr.vulnerability_id) ref USING (vulnerability_id)
+
+      LEFT OUTER JOIN(SELECT vulnerability_id, 
+                        string_agg(concat('Fix: ' || fix, 
+                       'Solution type: ' || solution_type, 
+                       'URL: ' || url,
+                       'Estimate: ' || estimate,
+                       'Applies To: ' || applies_to,
+                       'Additional Data: ' || additional_data), '|') as solutions
+        FROM dim_solution
+        JOIN dim_vulnerability_solution USING (solution_id)
+        GROUP BY vulnerability_id) sol USING (vulnerability_id)"
+    end
+  end
+end

data/lib/nexpose_servicenow/version.rb

@@ -0,0 +1,5 @@
+module NexposeServiceNow
+  VERSION = "0.4.15"
+  VENDOR = "ServiceNow"
+  PRODUCT = "CMDB"
+end

data/nexpose_servicenow.gemspec

@@ -0,0 +1,25 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'nexpose_servicenow/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "nexpose_servicenow"
+  spec.version       = NexposeServiceNow::VERSION
+  spec.authors       = ["David Valente", 'JJ Cassidy']
+
+  spec.require_paths = ["lib"]
+  spec.summary = %Q{Gem for Nexpose-ServiceNow marketplace application integration. Requires Servicenow Application component available on Servicenow application store.}
+  spec.description = %Q{Provides an interface to Nexpose for the Rapid7 ServiceNow MarketPlace application.}
+  spec.executables   = ["nexpose_servicenow"]
+  spec.email         = ['support@rapid7.com']
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  spec.bindir        = "bin"
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "bundler", "~> 1.11"
+  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_dependency 'nexpose', '~> 3.2'
+end

metadata

@@ -0,0 +1,106 @@
+--- !ruby/object:Gem::Specification
+name: nexpose_servicenow
+version: !ruby/object:Gem::Version
+  version: 0.4.15
+platform: ruby
+authors:
+- David Valente
+- JJ Cassidy
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-06-16 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.11'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.11'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: nexpose
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '3.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '3.2'
+description: Provides an interface to Nexpose for the Rapid7 ServiceNow MarketPlace
+  application.
+email:
+- support@rapid7.com
+executables:
+- nexpose_servicenow
+extensions: []
+extra_rdoc_files: []
+files:
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- bin/nexpose_servicenow
+- bin/setup
+- lib/nexpose_servicenow.rb
+- lib/nexpose_servicenow/arg_parser.rb
+- lib/nexpose_servicenow/chunker.rb
+- lib/nexpose_servicenow/historical_data.rb
+- lib/nexpose_servicenow/nexpose_helper.rb
+- lib/nexpose_servicenow/nx_logger.rb
+- lib/nexpose_servicenow/queries.rb
+- lib/nexpose_servicenow/queries_original.rb
+- lib/nexpose_servicenow/version.rb
+- nexpose_servicenow.gemspec
+homepage: 
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
+specification_version: 4
+summary: Gem for Nexpose-ServiceNow marketplace application integration. Requires
+  Servicenow Application component available on Servicenow application store.
+test_files: []