Filter alert report

Archive Greenbone Community Edition
1

Hello,

for the Email-Alert i want to have just a small report with high and medium only, is there an option to filter the report which is send by alert? In my search i just saw options to filter the Reports in the gsa.

Atm i try to Create a new Report Format which have a filter included, but till now its throw every time empty errors

Hope someone can help me,

kind regard,

ayinuha

GVM versions

gsa: 8.0.1
gvm: 8.0.1
openvas-scanner: 6.0.1
gvm-libs: 10.0.1
gvm-tools: 2.0.0.beta1

Environment Greenbone Server

**Operating system: Ubuntu Server 18.4
**Kernel: 4.15.0-58-generic
**Installation method / source: Github

2

Sure, reports generated by alerts can be filtered as well.

First configure a new results type filter.
Open the Report:Results view:
Web GUI > Scans > Reports > Date of the report
Open the New Filter dialogue
Icon: New Filter (top right)
Configure a filter to your likings and save by checking the box “Store filter as:” on the bottom of the dialogue
Now open the New Alert dialogue via
Web GUI > Configuration > Alerts > New Alert
Here you find the Content Composer in the row " Report". To open it click on “Compose”. Select a filter of your choice.

Please tell me if this worked for you.

1 Like
3

Hello, thanks for the nice tutorial.

i followed your guide and configurated a filter likle the following:

image
image803×473 18.9 KB

an in the alert i activate the Filter in the Compose of the Report Content
image
image803×442 16.4 KB

the problem is… i get an email with an filtered report… but the report is completle filtered, so no single result…When i check the filter in a normal report its show me what it should show…

4

To my dismay I wasn’t able to recreate this behavior. I tried the very same filter you used and I was able to get a filtered report by email. Does getting an email alert without any filter work for you?

5

Okay… i tested the same filter for an report with less results… and it works… But with a Scan over a complele subnetz with 250 Host (~5900 Results) its doesnt work…i dont understand whats wrong…

6

Just to be sure I get you right: With a hugh report, do you get an email with an empty report, or do you get no email at all?

7

I get an email with an report with no results:
image

But when i download the report with the same filter i get the filtered report…

image
image.png503×607 28.9 KB

8

Clicking the “Trigger Alert” button applies up to two filters.

  1. The currently seen filter in the Report View. This filter is also shown in the “trigger Alert for Scan Report” dialogue that opens
  2. The filter that might be configured in the selected alert.

Maybe both filters are colliding with each other here ?
That would explain why your first report reads: Before filtering there were 10 results, instead of 5940 results.
Set the least filtering filter in the Report:Results view: min_qod=0 apply_overrides=0 levels=hmlgf.
Save this and try to trigger the alert again.

9

Hey,

thank you for your good solutions, i fixxed it for few min. with taking the “gsad --timeout 600” command in my start script from gsa.