My task is to parse a csv file and remove certain plugin id's (there are multiples to remove - determined to be false positives) which are located in column one but I still need to keep the first row headings and then write the results minus the plugins removed (entire rows) to a new file.
I also need to parse the same file above for the same plugin id's that are excluded and write all of those to a new file as well.
Any help would be greatly appreciated.
Here is some sample data (nessus scan results):
Code:
"Id","Port","Protocol","Address","Severity","Plugin","Family","FirstSeen","LastSeen","Raw-Offset","Raw-Length","Desc","Plugin Output","CVE","Bugtraq","Conversation"
"10180","0","tcp","xxx.xxx.xxx.xxx","Low","Ping the remote host","Port scanners"," on 2010-07-03"," on 2010-07-03","2953397","110","The remote host is up "," The remote host replied to a TCP SYN packet (built-in port list). ","NOCVE","NOBID",""
"10114","0","icmp","xxx.xxx.xxx.xxx","Low","ICMP Timestamp Request Remote Date Disclosure","General"," on 2010-07-03"," on 2010-07-03","2952825","572","Synopsis : It is possible to determine the exact time set on the remote host. Description : The remote host answers to an ICMP timestamp request. This allows an attacker to know the date which is set on your machine. This may help him to defeat all your time based authentication protocols. Solution : Filter out the ICMP timestamp requests (13) and the outgoing ICMP timestamp replies (14). Risk factor : None "," The remote clock is synchronized with the local clock. ","CVE-1999-0524","NOBID",""
Here is what I have so far.
Script for stripping certain "Plugin-IDs" from the list:
Code:
# Variables
ORIG=original_file_vulndata.csv
NEW=original_file_vulndata_clean.csv
egrep -v "40802|40803|40804|40805|42119|43875|44643|4550|44060|18405" $ORIG > $NEW
Script for stripping certain "Plugin-IDs" from the list and placing them in their own file:
Code:
ORIG=original_file_vulndata.csv
NEW=original_file_vulndata_exceptions.csv
egrep "Raw-Offset|40802|40803|40804|40805|42119|43875|44643|4550|44060|18405" $ORIG > $NEW
Now the problem, with the code above, is that some rows contain the search string elsewhere in the data set (ie... not just in the plugin-id column) which in turn is removing data that should not be.
I need the script to search only the plugin-id column (first column) for the search strings in question. Sed or awk could do this but I stink at those two.
