Start your 14-day free trial today

No Credit Card Required

Try Logit.io Free

Already have an account? Sign In

Send data via OpenVAS to your Logstash instance provided by Logit.io

OpenVAS

Ship OpenVAS reports to logstash

Step 1 - Create OpenVAS ReportCopy

OpenVAS reports are typically generated manually.

After completing a scan in OpenVAS, perform the following steps to generate a CSV report.

Click the Scans tab, then select Reports.

Select a report from the list of results.

This will open the report summary.

Select CSV Results from the drop-down menu and click the download option.

Step 2 - Install FilebeatCopy

deb (Debian/Ubuntu/Mint)

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-amd64.deb
sudo dpkg -i -oss-7.15.1-amd64.deb

rpm (CentOS/RHEL/Fedora)

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-x86_64.rpm
sudo rpm -vi -oss-7.15.1-x86_64.rpm

macOS

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-darwin-x86_64.tar.gz
tar xzvf -oss-7.15.1-darwin-x86_64.tar.gz

Windows

  • Download and extract the Windows zip file.
  • Rename the -<version>-windows directory to ``.
  • Open a PowerShell prompt as an Administrator.
  • Run the following to install as a Windows service:
.\install-service-.ps1
If script execution is disabled on your system, you need to set the execution policy for the current session to allow the script to run. For example: PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-.ps1.
My OS isn't here! Chat to support now

Step 3 - Configure FilebeatCopy

Copy and use the Filebeat configuration below.

Update the file path placeholder with the file path of the folder where you’ll be keeping your OpenVAS reports.

For use with version 7.x Filebeats.
# ============================== Filebeat inputs ==============================
filebeat.inputs:

- type: log
  paths:
    - <INSERT_PATH_TO_OPENVAS_REPORT>*.csv
  
  fields:
    type: openvas
  
  fields_under_root: true
  encoding: utf-8
  ignore_older: 3h
  
  multiline:
    pattern: '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}'
    negate: true
    match: after

  filebeat.registry.path: /var/lib/filebeat

# ================================== Outputs ===================================
<div class="sw-warning">
    <b>No input available! </b> Your stack is missing the required input for this data source <a href="#" onclick="Intercom('showNewMessage')" class="btn btn-info btn-sm">Talk to support to add the input</a>
</div> 

Step 4 - Start FilebeatCopy

Ok, time to start ingesting data!

deb/rpm

sudo systemctl enable filebeat
sudo systemctl start filebeat

macOS

./filebeat

Windows

PS C:\Program Files\Filebeat> Start-Service filebeat

Step 5 - how to diagnose no data in StackCopy

If you don't see data appearing in your Stack after following the steps, visit the Help Centre guide for steps to diagnose no data appearing in your Stack or Chat to support now.

Toggle View

Expand View

Return to Search

© 2022 Logit.io Ltd, All rights reserved.