Integrate OpenVAS (Greenbone Community Edition) with Vulnetix. Deploy via Docker, run scans, and export XML or JSON results for ingestion.
Install & scan
$ # Deploy Greenbone Community Edition via Docker Compose git clone https://github.com/greenbone/community-containers.git cd community-containers docker compose -f greenbone-community-edition.yml pull docker compose -f greenbone-community-edition.yml up -d # Access web UI at http://localhost:9392 (admin/admin default) $ # Export report via gvm-cli docker compose -f greenbone-community-edition.yml exec gvm-tools gvm-cli socket --sockpath /run/gvmd/gvmd.sock --xml "<get_reports report_id='YOUR-REPORT-UUID' filter='min_qod=70' format_id='c1645568-627a-11e3-a660-406186ea4fc5'/>" > openvas-report.xml
Run OpenVAS / Greenbone in CI
Scan on every push and upload the report as a workflow artifact:
- name: Export OpenVAS report
run: |
docker compose exec gvm-tools gvm-cli socket --sockpath /run/gvmd/gvmd.sock --xml "<get_reports report_id='$REPORT_UUID' format_id='c1645568-627a-11e3-a660-406186ea4fc5'/>" > openvas.xml
- name: Upload to Vulnetix
run: vulnetix upload --file openvas.xml
How Vulnetix compares: better together
Vulnetix does not replace OpenVAS / Greenbone. Keep running it. Vulnetix sits on top of OpenVAS / Greenbone (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
OpenVAS / Greenbone is strongest at its core category and also carries features in Compliance & Policy Engines, just as Vulnetix spans categories.
| Capability | Vulnetix | OpenVAS / Greenbone |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ~ Authenticated scans enumerate installed OS packages/patch levels and match to CVEs (host-package, not app-dependency SCA) |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✓ Core: NVT-based unauthenticated + authenticated host/network CVE scanning via Greenbone Community Feed |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ CVSS severity + CERT/SCAP feeds; EPSS integrated in Greenbone Enterprise Feed editions, no CISA KEV/ESS-native queue in Community |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What OpenVAS / Greenbone does well
- Fully open-source infrastructure/network vulnerability scanner with a 160k+ NVT Community Feed covering CVEs, default credentials, and service misconfigurations
- Strong authenticated scanning (SSH/SMB/ESXi) that logs in to inspect installed packages, registry keys, and patch levels rather than only probing ports
- Self-hostable GVM stack (openvas-scanner, gvmd, GSA web UI) with no per-asset licensing, plus SCAP/CERT feeds and CIS-style compliance policy scans
- Broad protocol coverage including industrial/OT and low-level network protocols, with tuning for large-scale scans
Where Vulnetix adds to it: Vulnetix ingests and orchestrates OpenVAS/Greenbone findings. It does not run network scans itself. It dedups OpenVAS host CVEs into one cross-scanner queue alongside SAST/SCA/container results and re-prioritises them with EPSS, CISA KEV, Coalition ESS and Vulnetix LEV, then adds versioned VEX, SSVC and EOL policy that GVM's report model lacks.
No migration, no rip-and-replace. OpenVAS / Greenbone keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise OpenVAS / Greenbone results in Vulnetix
Upload OpenVAS / Greenbone XML, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.