# openvas/ — vulnerability scanning fed from the GLPI CMDB

> Ticket [#389](https://projects.knownelement.com/issues/389) (Greenbone on
> kali-tsys) · umbrella [#311](https://projects.knownelement.com/issues/311) ·
> lane index https://community.turnsys.com/t/297

## Pipeline (GLPI → scan targets)

```
GLPI CMDB (computers, read-only via mglpi identity)
  └─ glpi-to-openvas.sh --format csv   # review artifact
  └─ glpi-to-openvas.sh --format gmp   # <create_target> fragments
        └─ GVM (OpenVAS) — app-test stack: ../docker/gvm-test/
```

- `glpi-to-openvas.sh` reads the computer inventory (GLPI REST, read-only),
  parses the `ts=<ip> | mgmt <ip>` comment convention (mixed `=` and space —
  both accepted), and emits GMP `<create_target>` fragments or a review CSV.
- `--fixture FILE` transforms a saved GLPI response offline (deterministic
  test path — `fixtures/glpi-computers-sample.json` is a real 80-record pull).
- Verified 2026-09-05: 63 scan targets parsed from 80 GLPI records (the rest
  have no parsable IP and are skipped; `--include-no-ip` overrides).

## Rules of engagement (non-negotiable)

1. Scans against PROD hosts require an approved GLPI Change + an Uptime Kuma
   maintenance window. sectestbed VMs are always fair game (that is their job).
2. Tailscale addresses are included in targets deliberately — scanning runs
   over tailnet, not LAN, unless a CR says otherwise.
3. Findings stay in this PRIVATE repo and Redmine. Never leave the boundary.
4. App-test GVM binds loopback only (127.0.0.1:9392). Production engine
   placement = kali-tsys VM per #389, deployed under its own CR.

## Status

- [x] GLPI feed script, dual-shellcheck green, fixture-tested (2026-09-05)
- [x] GVM app-test compose (loopback, pinned version tags; digest-pin at proof)
- [ ] GVM bring-up + first feed import (next run: feeds download several GB)
- [ ] First sectestbed scan + findings triage into Redmine
- [ ] kali-tsys production engine under CR (#389)