Nmap (Assets)
Last updated
Was this helpful?
Last updated
Was this helpful?
PlexTrac supports importing asset information into the Clients module from Nmap in XML. Nmap, short for "Network Mapper," is an open-source network scanning tool that allows network administrators and security professionals to discover devices on a network, identify open ports and services, gather information about those services, perform OS fingerprinting, and automate tasks using custom scripts.
All <host/> elements with a child <status/> containing the state="up" property will be parsed as an asset.
If a field is not listed, then PlexTrac does not currently import.
Hostname: Derived from the inner <hostname name="host"/> element’s name property.
<hostnames> <hostname name="<hostname>"/> </hostnames>
If no hostname is found from the elements above, the hostname is derived from the IP Address address addr element’s value.
IP Address (for hostname): <address addr="<hostname>"/>. This is also added to the Known IPs field on the asset.
Description: Defaults to "This asset was originally discovered via Nmap import."
All Ports data comes from the following element:
<ports> <port protocol="${port protocol}" portid="${port number}"> <state="open"/> </port> </ports>
If a <port/> element does not have a <state="open"/> child element, it will not get imported with the rest of the asset’s ports.
Port number: <port portid="PORT NUMBER" .../>
Port protocol: <port protocol="PORT PROTOCOL" .../>
Port service: The service information for a Port can be found inside the parent <ports/> element
<service name="" product="" version="" extrainfo="" />
The Port service name and Port version derive from a combination of product, version and extrainfo from the <service/> element.
Vulnerable parameters are similar to ports and derived from the parent <ports/> element within the <script/> element.
Each <table/> element inside another <table/> element will be parsed as a vulnerable parameter.
For each of these vulnerable parameters, there will be multiple <elem /> elements containing the details for each parameter.
If the <elem .../> has the property key="id", this value will be added to the CVE information of the corresponding finding.
If the <elem .../> has the property key="cvss", this value will be added to the CVSS information of the corresponding finding and used to help set the severity.
