implementing-vulnerability-management-with-greenbone

name	implementing-vulnerability-management-with-greenbone
description	Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.
domain	cybersecurity
subdomain	vulnerability-management
tags	["openvas","greenbone","vulnerability-scanning","gmp","python-gvm","vulnerability-management","compliance"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"]

Implementing Vulnerability Management with Greenbone

Overview

Greenbone Vulnerability Management (GVM) is the open-source framework behind OpenVAS, providing comprehensive vulnerability scanning with over 100,000 Network Vulnerability Tests (NVTs). The python-gvm library provides a Python API to interact with GVM through the Greenbone Management Protocol (GMP), enabling programmatic creation of scan targets, task management, scan execution, and report retrieval. This skill covers connecting to GVM via Unix socket or TLS, authenticating, creating scan configs and targets, launching scans, and parsing XML-based vulnerability reports to produce actionable findings.

When to Use

• When deploying or configuring implementing vulnerability management with greenbone capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Detection Gaps & Validation

• Stale NVT feed — out-of-date feeds miss recent CVEs. Validate greenbone-feed-sync completed and check the NVT feed version in the report metadata.
• Unauthenticated scans — without SSH/SMB credentials, local package vulns are missed. Validate the report's authentication NVTs show success.
• Alive-test misconfiguration — hosts that don't answer ICMP are skipped entirely. Validate the host count scanned matches the target list; adjust the alive test if hosts are dropped.
• Port-list scope — the default port list misses high/uncommon ports. Validate the chosen port_list_id covers the services in scope.
• Scan config depth — "Full and fast" trades depth for speed. Validate critical hosts with a deeper config.
• Severity vs reality — validate high-CVSS findings against installed versions to cut QoD-driven false positives before reporting.

Prerequisites

• Greenbone Community Edition or Greenbone Enterprise Appliance installed
• Python 3.9+ with python-gvm (pip install python-gvm)
• GMP access credentials (username/password)
• Network connectivity to GVM daemon (Unix socket or TCP/TLS)
• Understanding of CVSS scoring and vulnerability classification

Steps

1. Install python-gvm: pip install python-gvm
2. Establish a GMP connection via UnixSocketConnection or