Analyze scan from 2 different machines. about attacksurfaceanalyzer HOT 4 CLOSED

I think you can do something similar with the the current version. As ASA runs it saves the data collected into an SQLite database, you can move that database to the other machine and run another collection.

For example:

On machine 1:

1. Run your collection scan
2. Copy all of the SQLite db shards (or set sharding factor to 1, so there's only one file to copy) to the second machine
   Then, on machine 2:
3. Run the collection scan, using the same database you created in 1.

Then, take that database with records from both scans and on any machine with the db that contains both results:
4. Run export-collect to do the comparison

from attacksurfaceanalyzer.

That looks correct to me. The argument for export collect should be the same —databasefilename argument.

By default, if no run ids are provided to export collect it will export a comparison of the last two collection runs. If you don't want that behavior it's best to set run ids on the collect command and reference those with the export command.

A note: There’s a trade off here between collection performance and ease of transfer with choosing a single shard or multiple. In my testing (shown in the benchmarks in the repo if you want to check in your environment) collection performance is much higher with multiple shards, but it does mean you need to copy all the shards to the new location(s) if you want to use the db somewhere else.

from attacksurfaceanalyzer.

Thank you for the quick response! Need some clarification with the command for the steps (especially #3 and #4),

1. On Machine 1, run "Asa.exe collect -a --databasefilename scan.sqllite --shards 1"
2. Copy scan.sqllite to Machine 2 to the path where asa.exe tool will run from
3. On Machine 2, run "Asa.exe collect -a --databasefilename scan.sqllite --shards 1"
4. asa.exe export-collect <how to pass the database file as input?>

from attacksurfaceanalyzer.

Considering this closed with moving the database. Please reach out again or reopen if you encounter any other issues.

from attacksurfaceanalyzer.