Open naranek opened 9 years ago
This is something that we've looked at doing. Right now we don't have great data structures to store this kind of information - as a result, our Nessus importer works for some use cases but not great for others. However we are seriously looking at what we would need to do to better capture infrastructure attack surface information alongside our better native support for SAST, DAST, IAST, and CLM results.
When handling vulnerabilities of production systems, it would be nice to also have the port scan data in the same place as found vulnerabilities. Would you consider adding a nmap parser to Threadfix? The XML format is pretty straightforward: