Create a CSV file with aggregated list of vulnerable services and versions from .nessus xml file. Based on regex matching

gen_agg_vuln_list.py

import os
import xml.etree.cElementTree as etree
import csv
import re
import argparse



parser = argparse.ArgumentParser(description='Create a CSV with aggregated vulnerabilities')

parser.add_argument('report', metavar='<nessus report location>', help=" nessus report file to analyze")
parser.add_argument('vuln', metavar='<vuln match string>', help="vuln to aggregate")
parser.add_argument('vregx', metavar='<version extract regex>', 
    help='regular expression to extract version from plugin output')


parsed = parser.parse_args()
vregx = parsed.vregx
vuln = parsed.vuln

report = parsed.report
output_fulldir = os.path.split(report)[0]
outputfile = os.path.join(output_fulldir,"aggvulns.csv")


def  get_etree_from_nessus_scan_in_local_directory():
    if ".nessus" in report:
        print "parsing"
        mainTree = etree.parse(report)
        print "getting root"
        root = mainTree.getroot()
        return root
    print "ERROR PLEASE PROVIDE A .NESSUS FILE"



def scan_filter(item):
    name = item.attrib['pluginName']
    if item.attrib["severity"] == "0":
        return False
    if vuln.lower() not in name.lower():
        return False
    else:
        return True




def build_ordered_vuln_list_from_nessus_root(root, filter, regx):


    vulnerabilities = []
    for host in root.findall('.//ReportHost'):
        try:
            for item in host.findall('ReportItem'):
                issueTitle = item.attrib['pluginName']

                if filter is None or filter(item):
                    hostname = host.attrib["name"]
                    service = item.attrib["svc_name"]
                    port = item.attrib["port"]

                    issueTitle = item.attrib['pluginName']
                    
                    cvssNode = item.find("cvss_base_score")
                    cvss = 0
                    if cvssNode is not None:
                        cvss = float(cvssNode.text)

                    description = item.find("description").text

                    plugin_output = item.find("plugin_output").text

                    version_search = re.search(regx,plugin_output)
                    if version_search:
                        version = ''.join(version_search.groups())
                    else:
                        continue


                    vulnerability = {
                            "Host" : hostname, "Port" : port, "Version" : version
                    }
                    vulnerabilities.append(vulnerability)
                    break
        except:
            continue

    return vulnerabilities




root = get_etree_from_nessus_scan_in_local_directory()
regx = re.compile(vregx)
vuln_hosts =  build_ordered_vuln_list_from_nessus_root(root, scan_filter, regx)

print vuln_hosts
with open(outputfile,'w') as csvfile:
    writer = csv.DictWriter(csvfile,["Host","Port","Version"])
    writer.writeheader()
    writer.writerows(vuln_hosts)