[Openvas-discuss] Severity overrides don't work in OpenVAS-Client

[Stefan Schwarz]

Am 06.09.2010 14:23, schrieb Stefan Schwarz:
> Matthew Mundell schrieb:
>>> When testing gsad i couldn't even find a way to define overrides. The
>>> "overrides"-page doesn't seem to have a Create-Task.
>>
>> On the results page of a task there is a button at the top right of each
>> result. This will create an override based on the result.
>
> Thanks Matthew for pointing this out, this works well with gsad.
>
> Any ideas why overrides currently don't work within OpenVAS-Client? As
> far i can remember it has been working in the past. OpenVAS-Client
> currently is our preferred client.
>
> Stefan

Just found out what's "wrong" with OpenVAS-Client and severity 
overrides. It works as designed, i only had to find out how to use it 
correctly :-(

For all of you who want to know the details:

1) Create override within a report, give a reason and new mapping and 
"Apply to global filter". This creates/changes a file 
~/.openvas/severity_overrides.xml

2) Have a look at "Extras->severity overrides manager" which tells you 
about current overrides. Ignore the mapping, which shows always as 
"security note"

3) Be aware that all overrides only map to the specified host (case 
sensitive!). If you want to change host-settings you have to edit 
severity_overrides.xml. Use Wildcards like * to match for a set of hosts.

4) Overrides are never applied automatically. You have to set them on 
the generated reports each time by Report->Override severities which can 
also be undone during the session. These actions are applied to the 
currently selected report immediately.


Happy overriding,
	Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6299 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.wald.intevation.org/pipermail/openvas-discuss/attachments/20100909/ec2083f2/smime.bin