FEATURE: Nessus + CIS CAT Converters

[ejohn20]

Creates a new converter + unit tests for Nessus (XML format) and CIS CAT (JSON format) covered in #2531

[yongyan-gh]

@ejohn20 thanks for sharing the sample CisCat/Nessus SARIF files generated by the converters for review. Have couple suggestions pls review.

cc @michaelcfanning

[yongyan-gh]

1. Both converted CisCat and Nessus SARIF files' results don't contain location object in locations property.

GitHub Advanced Security code scanning will not display a result unless it provides a location that specifies the URI of the artifact that contains the result.

If plan to be ingested by GHAS pls consider generate a location for the results.

[yongyan-gh]

2. Considering adding a help URI for each rule through helpUri property of the rule object for both CisCat and Nessus SARIF log if possible.

Providing a URI where users can find detailed information about the rule helps users to understand the result and how they can best address it. The varies SARIF viewers can render a hyperlink for users easily navigate to the Uri contains detailed information.

E.g. the rule id RUSTSEC-2019-0001 has a help Uri 'https://rustsec.org/advisories/RUSTSEC-2019-0001'

[yongyan-gh]

3. Please provide version information through 'version', 'semanticVersion', 'dottedQuadFileVersion' properties of driver object for Nessus SARIF log.

Providing version information enables the log file consumer to determine whether the file was produced by an up to date version, and to avoid accidentally comparing log files produced by different tool versions.

[yongyan-gh]

run.Tool.Driver.Rules.Add(CreateReportDescriptor(rule));

Suggest to only log a rule if its referenced by a result and avoid logging duplicated rules.

This can be done in the results loop below and checking if the rule already exists in the `log.Rules' list.

[michaelcfanning]

Picking this up to see how close it is to landing.

Status now:

• Merges dev cleanly; full solution builds with 0 warnings, 0 errors.
• Pushed a baseline-refresh commit — the converter tests fail purely on stale `` URL and string-array formatting introduced by serializer changes since 2023. After regenerating the 5 expected SARIF files via the multitool, Test.UnitTests.Sarif.Converters filtered to the two converters is 10/10 green.

Still open (from @yongyan-gh's Jan-2023 review):

1. Results have no locations[]. GHAS code scanning won't render results without an artifact location. Nessus has the host (targetId) and CIS CAT has the benchmarked system; either could synthesize a physicalLocation.artifactLocation.uri (e.g. host://<hostname>) so the results are renderable.
2. Rules have no helpUri. Nessus has CVEs available — https://nvd.nist.gov/vuln/detail/<CVE> is a natural mapping. CIS CAT could point at the CIS Workbench rule URL.
3. Nessus driver is missing version metadata. version is best-effort from sc_version; semanticVersion and dottedQuadFileVersion are unset. CIS CAT already sets both from BenchmarkVersion.

Each is a small, well-bounded change.

@ejohn20 — are you in a position to address these and update the PR, or would you like us to take it over?

[ejohn20]

@michaelcfanning Wow, it's been a minute since we opened this 😂 If you've got bandwidth, feel free to take it over.

I've got a deadline a couple weeks out before I'd have time to finish this one out. Let me know if you'd rather wait and I'll get it on my radar.