Skip to content

Commit

Permalink
Added preprocess script and enhanced Wazuh parser
Browse files Browse the repository at this point in the history
1. Introduced wazuh-vulns-extractor.py to preprocess and improve Wazuh reporting.\n2. Modified the Wazuh parser to support endpoint creation based on agent_ip, enabling multi-agent support and better vulnerability-to-host correlation.
  • Loading branch information
vd0n committed Sep 28, 2023
1 parent e387452 commit 45d81af
Showing 1 changed file with 3 additions and 6 deletions.
9 changes: 3 additions & 6 deletions dojo/tools/wazuh/parser.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,12 @@

class WazuhParser(object):
"""
IMPORTANT: Please use the 'wazuh-vulns-extractor.py' script to generate
IMPORTANT: Please use the 'wazuh-vulns-extractor.py' script to generate
the report for DefectDojo. This script enhances the reporting by:
1. Handling multiple agents, thus allowing consolidated reporting.
2. Introducing the 'agent_ip' field, which DefectDojo uses to create distinct endpoints.
3. Correlating individual vulnerabilities with their respective vulnerable host.
All these improvements are combined into a single, comprehensive report for streamlined
All these improvements are combined into a single, comprehensive report for streamlined
integration with DefectDojo.
The vulnerabilities with condition "Package unfixed" are skipped because there is no fix out yet.
Expand Down Expand Up @@ -55,10 +55,7 @@ def get_findings(self, file, test):
else:
references = None

title = (
item.get("title") +
" (version: " + package_version + ")"
)
title = item.get("title") + " (version: " + package_version + ")"
dupe_key = title

if dupe_key in dupes:
Expand Down

0 comments on commit 45d81af

Please sign in to comment.