#!/usr/bin/env bash

die(){
	echo "$@" > /dev/stderr
	exit 1
}

printhelp(){
	echo "Nessus Compliance Filter"
	echo "This command should be given a nessus xml file on stdin"
	echo "Stdout will contain a tsv file for each compliance issue (not pass)"
	echo "Positional Arguments can be given and each will regex match the Check Name"
	echo ""
	echo "e.g."
	echo "cat example.nessus | nessusComplianceFilter \"^18.\" \"Defender\""
	echo "will output a tsv containing all failures (or warnings) that start with '18.' and contain the word 'Defender'"
	echo ""
	echo "It has been built with extensability in mind. It should work well with other unix-y tools"
	echo ""
	echo "e.g. Only show the name and ip addresses grouped"
	echo "cat example.nessus | nessusComplianceFilter | awk awk -F \$'\t' 'NR>1{arr[\$1] = arr[\$1] \$6 \", \"}END{for (a in arr) print a \"\\t\" arr[a]}'"

	exit 0
}

type -p xq >/dev/null || die -e "You need to install xq\nhttps://github.com/kislyuk/yq"

[ "$1" = "-h" ] && printhelp

filters=""

while [ "$#" -gt 0 ]; do
	filters="$filters | select( .\"cm:compliance-check-name\" | test(\"$1\"))"
	shift
done

echo  "Compliance Check	Compliance Result	Profile	Current	Expected	IP"
cat - | xq -r ".NessusClientData_v2.Report.ReportHost | if (. | type == \"array\") then .[] else . end |
	(.ReportItem[] + {ip:.\"@name\"}) |
	select(.compliance == \"true\") |
	select(.\"cm:compliance-result\" != \"PASSED\") $filters |
	[.\"cm:compliance-check-name\", .\"cm:compliance-result\", ( .\"cm:compliance-audit-file\" | match(\"L(evel_)?[12]\").string | sub(\"_\";\" \") | sub(\"L1\"; \"Level 1\") | sub(\"L2\"; \"Level 2\") ), .\"cm:compliance-actual-value\", .\"cm:compliance-policy-value\", .ip]
	| @tsv" | sort -V