I have a fairly complicated set of searches to create reports for Nessus vulnerability data. One thing I notice is that when I output the results to csv using outputcsv, not all of the columns are ending up in quotes. This is what the header row looks like:
hostname,domainname,"dest_ip","service_name",protocol,"dest_port","result_type",risk,score,"nessus_plugin_name","cve_id","nessus_id","access_vector","access_complexity",authentication,"availability_impact","confidentiality_impact","integrity_impact","nessus_solution"
The problem is that I can't import the data into Excel because some of the fields that aren't in quotes have commas in them. As far as how those fields were generated:
hostname and domainname were created from a lookup table that took the output of the Nessus plugin for resolving host names and extracting the hostname and domainname from the FQDN.
The protocol and port fields are extracted using rex at search time, but for some reason protocol isn't in quotes and port is.
Risk is extracted from the Nessus plugin files using props/transforms.conf.
The score field is assigned to the search result using a lookup table.
So, we've got several different fields that are created using several different methods, but only some of them are missing quotes.
How do I go about troubleshooting this?
Thx.
Craig
