Implementing Vulnerability Management With Greenbone

---
name: implementing-vulnerability-management-with-greenbone
description: Use when deploy and operate Greenbone/OpenVAS vulnerability management
  using the python-gvm library to create scan targets, execute vulnerability scans,
  and parse scan reports via GMP protocol. Use when deploying and operate greenbone/openvas
  vulnerability management using the python-gvm library.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- openvas
- greenbone
- vulnerability-scanning
- gmp
- python-gvm
- vulnerability-management
- compliance
version: '1.0'
author: oyi77
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
category: cybersecurity
---

# Implementing Vulnerability Management with Greenbone

## Overview

Greenbone Vulnerability Management (GVM) is the open-source framework behind OpenVAS, providing comprehensive vulnerability scanning with over 100,000 Network Vulnerability Tests (NVTs). The python-gvm library provides a Python API to interact with GVM through the Greenbone Management Protocol (GMP), enabling programmatic creation of scan targets, task management, scan execution, and report retrieval. This skill covers connecting to GVM via Unix socket or TLS, authenticating, creating scan configs and targets, launching scans, and parsing XML-based vulnerability reports to produce actionable findings.


## When to Use
**Trigger phrases:**
- "implementing vulnerability management with greenbone"
- "Deploy and operate Greenbone/OpenVAS vulnerability management using the python-g"


- When deploying or configuring implementing vulnerability management with greenbone capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation

## Prerequisites

- Greenbone Community Edition or Greenbone Enterprise Appliance installed
- Python 3.9+ with `python-gvm` (`pip install python-gvm`)
- GMP access credentials (username/password)
- Network connectivity to GVM daemon (Unix socket or TCP/TLS)
- Understanding of CVSS scoring and vulnerability classification

## Steps

```python
# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
```

1. Install python-gvm: `pip install python-gvm`
2. Establish a GMP connection via `UnixSocketConnection` or `TLSConnection`
3. Authenticate with `gmp.authenticate(username, password)`
4. Create a target with `gmp.create_target(name, hosts=[...], port_list_id=...)`
5. Create a scan task with `gmp.create_task(name, config_id, target_id, scanner_id)`
6. Start the scan with `gmp.start_task(task_id)`
7. Monitor scan progress with `gmp.get_task(task_id)`
8. Retrieve results with `gmp.get_report(report_id, report_format_id=...)`
9. Parse the XML report for vulnerabilities, CVSS scores, and affected hosts
10. Generate a JSON summary report with severity distribution and remediation priorities

## Expected Output

A JSON report containing total vulnerabilities found, severity breakdown (critical/high/medium/low), per-host findings with CVE references and CVSS scores, and scan metadata including duration and NVT feed version.
## When NOT to Use

- You need to test the implementation (use performing-* skills)
- Task is about configuring existing tools (use configuring-* skills)
- You need to analyze security events (use analyzing-* skills)
- Task is about building detection rules (use building-* skills)
- You don't have access to the target environment
- Task requires vendor-specific expertise (consult vendor docs)


## Red Flags

- Performing actions without explicit written authorization from the asset owner
- Testing against production systems without a defined scope and rules of engagement
- Sharing sensitive findings or credentials in unencrypted communications
- Failing to properly scope and contain the assessment before starting

## Process

1. **Reconnaissance** — Gather target information, identify attack surface, enumerate services
1. **Analysis/Exploitation** — Execute the technique, analyze results, document findings
1. **Reporting** — Document IOCs, write findings, provide remediation recommendations

## Verification

- All steps executed successfully against a test environment before production use
- Output documented with screenshots or logs demonstrating expected behavior
- Results validated against known-good baselines or reference implementations
- Documentation complete enough for another analyst to reproduce findings

## Anti-Rationalization Table

| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |