Filter task result and generate report with specific hosts

Can I generate filtered delta report for mail alert with specific hosts?

  • collect the hosts in a report and then create a host list
  • gerate a filtered delta report with host list

But there is no OR option to specify multiple host ip adresses host=[IPx, IPy, …] in the filter options?
Is this even possible with gvm?

Here is how this should work:

  1. Create a filter that selects the hosts from the report results
  2. Create an alert with your conditions
  3. Use the Compose section to set a report filter that selects the hosts you want from the scan.
  4. Select the Delta scan report alert option
  5. Assign the alert to a scan task

That should do it. As long as the hosts are in the scan task that you attach the alert to, the filter will allow only those hosts to be delivered in the report. If you need help with creating a filter for the scan results, see the documentation for Greenbone’s filters

Create the filter

2 Likes

Yes, this is an interesting feature.
The filter regex doesn’t give me any result so far, I tested:

regex 192.168.179.0[1-9]|1[0-8]
regex 192.168.179.[0-9]

My thought was to use the GVM protocol so that I can generate the IP lists dynamically with Python during runtime.

Check the documentation for Greenbone’s filters

The regular expression operator is regexp not regex. :slight_smile:

1 Like

Sorry my fault, the regex was wrong.

How can I to extract the host names or IPs from a report in gvm?

Depends on what type of report you are taking about the report page in the web-interface (GSA), or a downloaded report file. :slight_smile:

It’s about getting the reports over GMP via Python. I would like to create individually filtered reports. To do this, I need the host list from a report which I can use the filter to create the individual reports with the desired partial host list using a script.

I understand. However, this doesn’t tell me the report format you are using.

You can create separate report results filters and then set the report results filter when you download the report via python-gvm. That way you don’t have to parse and filter the report.

Otherwise, if you are interested in manually filtering a complete report results or or or manually filtering an already filtered report results via Python - it the method depends on which report format you are downloading via python-gvm / GMP

Sorry, I’m lost in your process here. If you want help with a another issues, can you please create a separate thread for it and titled appropriately. Thanks~

1 Like

@rippledj Thanks.

Filtering by specific host IPs from the first post is still unsolved.
According to the filter keywords list, I can only find host (for one IP), not hosts (for a list of IPs) as option. :wink:

For example, the search is not limited to the Hosts column, it is no clean separation.
regexp (127\.0\.0\.10|127\.0\.0\.16)

Did you read the docs I linked to in my first answer? They explain how to use the conditional operators.

You meant this possibility?
host=127.0.0.10 or host=127.0.0.16 or ...

Number of characters in a filter is apparently limited to 1000 on the web-interface.

I typically don’t create scan tasks with large numbers of hosts, so I don’t have to navigate this problem. I usually create one target host per scan task. Sounds like this approach would avoid the complexity of having to extract what you want from the task.

Since you are using Python-gvm, you can fetch each IP’s report from a list and assemble your own report, or CSV, etc.