OpenVAS Reporting,
Greenbone Results, Client Ready
Import OpenVAS and Greenbone GMP XML reports into Neuron. Every NVT lands as a scan issue with QoD, CVEs, and per-host evidence. OpenVAS reporting your client can read.
Import Once. Report From One Place.
OpenVAS is the scanner plenty of teams reach for when a commercial licence is not an option. Its reports are thorough and almost impossible to hand to a client as they are. Neuron imports the Greenbone XML and turns it into a triage queue.
Each NVT becomes one scan issue keyed by its OID, with the name, family, severity, CVSS base score, summary, insight, impact, affected software, solution and solution type, plus the Quality of Detection Greenbone assigned. Every host and port it fired on is listed with the result text as evidence.
It reads current GMP reports, where solutions and CVE references moved out of the tags field, as well as older ones, and it creates hosts and ports from the results unless you turn that off.
$ gvm-cli --gmp-username admin socket --xml \ "<get_reports report_id='$ID' details='1' \ ignore_pagination='1'/>" | neuron import - Importing into Acme Internal Q4 openvas: 58 hosts, 1,412 results✓ 203 scan issues queued for triage- 16:48 Finding Outdated OpenSSH (9 hosts)
- 16:31 Import OpenVAS: 58 hosts, 203 scan issues
- 16:30 Command gvm-cli socket get_reports | neuron import -
- 15:05 Import Nmap: 61 hosts, 344 ports
Why OpenVAS Reporting Takes So Long
Greenbone's report formats are made for the person running the scanner. The PDF runs to hundreds of pages, the XML repeats the NVT definition for every single result, and pseudo ports like general/tcp mix host-level checks in with real services.
Quality of Detection matters as well. A banner-based version guess and a remote active check look identical once flattened into CSV, so someone has to go back to the scanner to decide which results deserve a tester's time.
Turning all of that into findings usually means a conversion script someone wrote years ago, a spreadsheet, and a lot of copying and pasting.
Everything OpenVAS Produces, On the Engagement
Import OpenVAS output from the browser or with neuron import, and it lands the moment the import finishes.
Hosts and Ports
Hosts from each result's IP or hostname, and ports from real port and protocol pairs. Pseudo ports such as general/tcp stay host-level and never create a fake port.
One Issue per NVT
Each NVT OID as a single scan issue with its name, family, severity, and CVSS base score, and every affected host and port beneath it.
Quality of Detection
The QoD value and type Greenbone assigned, kept in the scanner details so remote active checks can be triaged ahead of banner-based guesses.
Summary, Insight, and Solution
The NVT summary, vulnerability insight, impact, affected software, solution, and solution type, ready to inform the finding.
CVEs and References
CVE IDs from both the legacy cve field and the newer refs element, plus reference URLs, so library entries keyed on a CVE match automatically.
Per-Host Evidence
The result description for each host and port, the output that shows exactly why the NVT fired there.
How to Import OpenVAS Results
- 01
Download the report as XML
In the Greenbone Security Assistant, open the finished report and download it with the XML report format. That is the GMP XML the importer reads, with every result, NVT, and QoD value intact.
- 02
Import it in the browser
In the engagement, choose Import, then OpenVAS. Set Minimum Severity, tick Only Findings with a CVE to skip checks that carry none, and choose whether to create hosts and ports.
- 03
Or pipe it from gvm-cli
Pull the report over GMP and pipe it into neuron import. The response is recognised as an OpenVAS report from its content, so no --source is needed.
$ gvm-cli --gmp-username admin socket --xml "<get_reports report_id='$ID' details='1' ignore_pagination='1'/>" | neuron import - - 04
Triage by Quality of Detection
Open each issue to see its QoD, solution type, and per-host result. Confirm the real ones, mark the rest False Positive, and promote what is left into findings.
Your Infrastructure. Your Data.
Neuron is self-hosted. Import OpenVAS results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
From OpenVASto the Final Report
A promoted OpenVAS issue becomes a finding with its affected hosts and result evidence attached, and with the description and remediation drawn from your Findings Library instead of raw NVT tags.
Library entries keyed on CVEs match OpenVAS issues the same way they match Nessus or Nexpose ones, so a network scanned with more than one tool still produces one finding per vulnerability.
For the retest, rerun the task in Greenbone and import the new report. NVTs that no longer fire are marked Fixed and the rest update in place, so the retest round starts from a clear comparison.
OpenVAS Integration FAQ
The questions teams ask most about OpenVAS and Neuron.
How do I import OpenVAS results into a pentest report?
Download the OpenVAS report in XML format and import it into the Neuron engagement, in the browser or with neuron import. Each NVT becomes a scan issue with its affected hosts, QoD, and result evidence, ready to confirm and promote into a finding.
Which OpenVAS export format does Neuron accept?
The GMP XML report from OpenVAS and Greenbone. Older reports and newer GMP versions are both supported, including the change that moved solutions and CVE references out of the NVT tags. PDF, CSV, and text reports are not imported.
Does the import work with Greenbone and GVM?
Yes. OpenVAS is the scanner inside Greenbone's Vulnerability Management stack, and the report XML is the same whether you download it from the Greenbone Security Assistant or fetch it over GMP with gvm-cli.
How does Neuron use OpenVAS Quality of Detection?
The QoD value and type are kept on every OpenVAS issue in the scanner details. That lets a tester confirm results from remote active checks first and treat banner-based version matches with the suspicion they deserve.
How are OpenVAS pseudo ports like general/tcp handled?
They stay host-level. Results on general/tcp, general/icmp, and similar pseudo ports are attached to the host without creating a port record, so the port list only ever shows real services.
Can I import only OpenVAS results that have a CVE?
Yes. Tick Only Findings with a CVE on the OpenVAS import page and NVTs without a CVE reference are left out of the triage queue.
More Neuron Integrations
Nessus Reporting and .nessus File Import
Vulnerability ScannersQualys Report Import for Pentest Reporting
Vulnerability ScannersNexpose and InsightVM Report Import
Vulnerability ScannersBloodHound Reporting and Attack Path Import
Active DirectoryPCAP Import: Hosts and Services From Captures
Network DiscoveryOpenAPI and Swagger Import for API Pentests
Web TestingNikto Reporting and Output Import
Web TestingAcunetix Report Import for Pentest Reports
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform