nmap

edit

This codec is used to parse nmap output data which is serialized in XML format. Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. For more information on nmap, see https://nmap.org/.

Note: This codec can only be used for decoding data.

Event types are listed below

nmap_scan_metadata: An object containing top level information about the scan, including how many hosts were up, and how many were down. Useful for the case where you need to check if a DNS based hostname does not resolve, where both those numbers will be zero. nmap_host: One event is created per host. The full data covering an individual host, including open ports and traceroute information as a nested structure. nmap_port: One event is created per host/port. This duplicates data already in nmap_host: This was put in for the case where you want to model ports as separate documents in Elasticsearch (which Kibana prefers). nmap_traceroute_link: One of these is output per traceroute connection, with a from and a to object describing each hop. Note that traceroute hop data is not always correct due to the fact that each tracing ICMP packet may take a different route. Also very useful for Kibana visualizations.

 

Synopsis

edit

This plugin supports the following configuration options:

Required configuration options:

nmap {
  }

Available configuration options:

Setting Input type Required Default value

emit_hosts

boolean

No

true

emit_ports

boolean

No

true

emit_scan_metadata

boolean

No

true

emit_traceroute_links

boolean

No

true

Details

edit

 

emit_hosts

edit
  • Value type is boolean
  • Default value is true

Emit all host data as a nested document (including ports + traceroutes) with the type nmap_fullscan

emit_ports

edit
  • Value type is boolean
  • Default value is true

Emit each port as a separate document with type nmap_port

emit_scan_metadata

edit
  • Value type is boolean
  • Default value is true

Emit scan metadata

emit_traceroute_links

edit
  • Value type is boolean
  • Default value is true

Emit each hop_tuple of the traceroute with type nmap_traceroute_link