search

4sConsult / box4security

Open-source powered SIEM, Vulnerability Scanning, Host- & Network-IDS. Built upon Elastic Stack, OpenVAS, Suricata. Wrapped in a Python Flask web app.
Other
13 stars 5 forks source link

Scoring: Better indicator for enabled vulnerability scans #16

Open chmey opened 3 years ago

chmey commented 3 years ago

Currently, vulnerability scans are seen as not performed, if there are no vulnerabilities recorded.

This works, while scans find any vulnerability and are performed regularly.

In "perfect" networks or at least where vulnerabilities can't be discovered, the scans are falsely seen as disabled by the score calculation algorithm.

To solve this, the score calculation algorithm may query the OpenVAS API to inquire if tasks are scheduled or were performed recently.