Drift Detection & Comparison
Relevant source files
The following files were used as context for generating this wiki page:
OWASP Nettacker includes a built-in drift detection and scan comparison system designed to track infrastructure changes over time. By leveraging its internal database, the framework allows users to compare results from different scan sessions to identify new hosts, changes in open ports, or newly discovered vulnerabilities. This feature is particularly useful in CI/CD pipelines and compliance monitoring to detect "drift" from a known secure state.
Sources: README.md:21-22, README.md:46-47
Architecture and Workflow
The comparison system operates by taking two unique scan IDs and analyzing the differences between their recorded events and targets. The process can be triggered via the CLI or the Web UI. When a comparison is initiated, the engine retrieves data for both scans from the local SQLite database (.nettacker/data/nettacker.db) and generates a comparative report in various formats (HTML, JSON, CSV, or TXT).
Sources: README.md:68, nettacker/web/static/js/main.js:148-185
Data Flow for Scan Comparison
The following diagram illustrates the flow from a user request to the generation of a comparison report.
Key Components
1. Comparison Engine
The engine is responsible for the logic of identifying differences. It specifically looks for:
- New Targets Discovered: Assets or services present in the current (second) scan but missing from the comparison (first) scan.
- Old Targets Not Detected: Assets or services that were found in the previous scan but are no longer visible in the current scan.
Sources: nettacker/web/static/report/compare_report.html:190-205, nettacker/locale/en.yaml:126-130
2. Web Interface (Comparison Area)
The Web UI provides a dedicated section for managing comparisons. Users input two Scan IDs and a desired output filename. The UI uses AJAX to communicate with the backend /compare/scans endpoint.
| Parameter | Type | Description |
|---|---|---|
scan_id_first | String | The unique ID of the baseline scan. |
scan_id_second | String | The unique ID of the new scan to compare against the baseline. |
compare_report_path | String | The filepath where the resulting report will be saved. |
Sources: nettacker/web/static/index.html:362-385, nettacker/web/static/js/main.js:148-155
3. Comparison Report Template
The comparison report is rendered using a specific HTML template that visualizes the drift. It breaks down the information into four main sections:
| Section | Content |
|---|---|
| Scan Details | IDs and dates for both the current and comparison scans. |
| Target Sets | The list of targets defined for each scan session. |
| Scan Results | Detailed results (Target, Scan Type, Port) for both sessions. |
| Changes Detected | Highlights new targets (Yellow) and missing targets (Red). |
Sources: nettacker/web/static/report/compare_report.html:154-205
Implementation Details
API Integration
The frontend sends a JSON payload to the /compare/scans endpoint. The response indicates the success of the report generation or provides an error message if IDs are invalid or not found.
// From nettacker/web/static/js/main.js
var tmp_data = {
scan_id_first: $("#scan_id_first").val(),
scan_id_second: $("#scan_id_second").val(),
compare_report_path: $("#compare_report_path").val(),
};
$.ajax({
type: "POST",
url: "/compare/scans",
data: data,
})
Sources: nettacker/web/static/js/main.js:148-166
Report Data Structure
The comparison data object (typically labeled jsonData in the template) contains specific arrays for comparison logic:
curr_scan_details: Metadata for the latest scan.comp_scan_details: Metadata for the older scan.new_targets_discovered: List of target/module/port tuples found only in the current scan.old_targets_not_detected: List of target/module/port tuples found only in the comparison scan.
Sources: nettacker/web/static/report/compare_report.html:150-205
Significance in Security Workflows
Drift detection allows organizations to maintain a "Shadow IT" discovery process by monitoring for unmanaged hosts or services appearing over time. It is a critical component for integrating Nettacker into automated security compliance monitoring.
Sources: README.md:46-51, nettacker/locale/en.yaml:126-130