Graphite

Description

Graphite is badass. I love metrics and I love dashboards. Vanilla Nessus (i.e. not Nessus Security Center) doesn't offer a good way to chart scans. Graphite does.

Graphite Options

This feature uses a TCP graphite listener. If you use a UDP listener and can't change that open an issue and I'll take a look at what would take to add it. (Alternatively, fork the project, add the feature, and send a pull request).

Graphite expects you to send it three things.

1. The metric / path you're sending data to.
2. The value to graph.
3. The timestamp of the event you're graphing.

To send data to Graphite you need to use the --graphite-server and --graphite-metric flags. If you want to set your own timestamp you can use the --timestamp <s> flag to set the timestamp epoch style. If you don't it will default to the most recent midnight.

Metrics

Right now, nessus-analyzer sends four statistics to graphite.

1. The average CVSS base score.
2. The average number of open ports per host.
3. The percentage of hosts with at least one "high severity event"
4. The number of events per host.

Over time you want 1, 3, and 4 to trend downwards. 2 isn't a bona fide risk measurement, but if the average number of ports per host goes up without an explanation you may want to investigate.

Example

$ ./nessus-analyzer.rb --graphite-server graphite --graphite-metric security.scans.web_servers

This sends data to the graphite server under the security.scans.web_servers metric.

Home, James!