Implementing Vulnerability Management with Greenbone

Overview

Greenbone Vulnerability Management (GVM) is the open-source framework behind OpenVAS, providing comprehensive vulnerability scanning with over 100,000 Network Vulnerability Tests (NVTs). The python-gvm library provides a Python API to interact with GVM through the Greenbone Management Protocol (GMP), enabling programmatic creation of scan targets, task management, scan execution, and report retrieval. This guide covers connecting to GVM via Unix socket or TLS, authenticating, creating scan configs and targets, launching scans, and parsing XML-based vulnerability reports to produce actionable findings.

Prerequisites

• Greenbone Community Edition or Greenbone Enterprise Appliance installed
• Python 3.9+ with python-gvm (pip install python-gvm)
• GMP access credentials (username/password)
• Network connectivity to GVM daemon (Unix socket or TCP/TLS)
• Understanding of CVSS scoring and vulnerability classification

Steps

1. Install python-gvm: pip install python-gvm
2. Establish a GMP connection via UnixSocketConnection or TLSConnection
3. Authenticate with gmp.authenticate(username, password)
4. Create a target with gmp.create_target(name, hosts=[...], port_list_id=...)
5. Create a scan task with gmp.create_task(name, config_id, target_id, scanner_id)
6. Start the scan with gmp.start_task(task_id)
7. Monitor scan progress with gmp.get_task(task_id)
8. Retrieve results with gmp.get_report(report_id, report_format_id=...)
9. Parse the XML report for vulnerabilities, CVSS scores, and affected hosts
10. Generate a JSON summary report with severity distribution and remediation priorities

Expected Output

A JSON report containing total vulnerabilities found, severity breakdown (critical/high/medium/low), per-host findings with CVE references and CVSS scores, and scan metadata including duration and NVT feed version.

Verification Criteria

Confirm successful execution by validating:

• [ ] All prerequisite tools and access requirements are satisfied
• [ ] Each workflow step completed without errors
• [ ] Output matches expected format and contains expected data
• [ ] No security warnings or misconfigurations detected
• [ ] Results are documented and evidence is preserved for audit

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

• SOC 2: CC7.1 (Monitoring), CC8.1 (Change Management)
• ISO 27001: A.12.6 (Technical Vulnerability Management)
• NIST 800-53: RA-5 (Vulnerability Scanning), SI-2 (Flaw Remediation), CM-6 (Configuration Settings)
• NIST CSF: ID.RA (Risk Assessment), PR.IP (Information Protection)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add implementing-vulnerability-management-with-greenbone

# Or load dynamically via MCP
grc.load_skill("implementing-vulnerability-management-with-greenbone")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

• SHA-256 chain hashing ensures no step can be modified after execution
• Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
• Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.