PlexTrac supports importing asset information into the Clients module from Nmap in XML. Nmap, short for "Network Mapper," is an open-source network scanning tool that allows network administrators and security professionals to discover devices on a network, identify open ports and services, gather information about those services, perform OS fingerprinting, and automate tasks using custom scripts.
All <host/> elements with a child <status/> containing the state="up" property will be parsed as an asset.
If a field is not listed, then PlexTrac does not currently import.
Hostname: Derived from the inner <hostname name="host"/> element’s name property.
<hostnames> <hostname name="<hostname>"/> </hostnames>
If no hostname is found from the elements above, the hostname is derived from the IP Address address addr element’s value.
IP Address (for hostname): <address addr="<hostname>"/>. This is also added to the Known IPs field on the asset.
Description: Defaults to "This asset was originally discovered via Nmap import."
All Ports data comes from the following element:
<ports> <port protocol="${port protocol}" portid="${port number}"> <state="open"/> </port> </ports>
If a <port/> element does not have a <state="open"/> child element, it will not get imported with the rest of the asset’s ports.
Port number: <port portid="PORT NUMBER" .../>
Port protocol: <port protocol="PORT PROTOCOL" .../>
Port service: The service information for a Port can be found inside the parent <ports/> element
<service name="" product="" version="" extrainfo="" />
The Port service name and Port version derive from a combination of product, version and extrainfo from the <service/> element.
Vulnerable parameters are similar to ports and derived from the parent <ports/> element within the <script/> element.
Each <table/> element inside another <table/> element will be parsed as a vulnerable parameter.
For each of these vulnerable parameters, there will be multiple <elem /> elements containing the details for each parameter.
If the <elem .../> has the property key="id", this value will be added to the CVE information of the corresponding finding.
If the <elem .../> has the property key="cvss", this value will be added to the CVSS information of the corresponding finding and used to help set the severity.