Nmap Import

Nmap Import

Import Nmap XML scan results to automatically populate your project with discovered assets, including IP addresses, hostnames, open ports, and services.

Overview

Nmap is the industry standard for network discovery and security auditing. NEURO can import Nmap XML output to:

• Populate asset inventory automatically
• Import port and service information
• Include OS detection results
• Speed up project setup

Supported Nmap Output

NEURO supports Nmap XML output format:

• File extension: .xml
• Generated with -oX flag
• Any Nmap version

Running Nmap for Import

Basic Discovery Scan

nmap -sn 192.168.1.0/24 -oX discovery.xml

Full Port Scan with Services

nmap -sV -sC -p- 192.168.1.0/24 -oX full_scan.xml

Recommended Scan for NEURO

nmap -sV -sC -O -p- --open 192.168.1.0/24 -oX neuro_import.xml

Options explained:

• -sV: Service version detection
• -sC: Default script scan
• -O: OS detection
• -p-: All ports
• --open: Only show open ports
• -oX: XML output

Web-Focused Scan

nmap -sV -p 80,443,8080,8443,8000,3000 --script http-title 192.168.1.0/24 -oX web_scan.xml

Importing Nmap Results

Step-by-Step Import

1. Open your project in NEURO
2. Navigate to the Assets tab
3. Click Import → Nmap XML
4. Upload your XML file
5. Preview discovered assets:
   • Host count
   • Port summary
   • Service summary
6. Select assets to import (all by default)
7. Click Import Selected

Import Preview

Before confirming, you’ll see:

Column	Description
IP Address	Discovered IP
Hostname	Resolved hostname
Ports	Open port count
OS	Detected operating system
Status	Host status

Selection Options

• Select All: Import all discovered hosts
• Deselect All: Clear selection
• Filter: Show only hosts matching criteria
• Individual: Check/uncheck specific hosts

Imported Data

Asset Fields Populated

Field	Source
Name	Hostname or IP
IP Address	Nmap address
Hostname	DNS resolution
Type	Inferred from services
OS	Nmap OS detection
Ports	Open ports list
Notes	Service details

Port Information

For each open port:

• Port number
• Protocol (TCP/UDP)
• Service name
• Service version
• State (open/filtered)

Service Details

Example service data:

Port 443/tcp
Service: https
Version: Apache httpd 2.4.41
Product: Apache
OS: Ubuntu

Advanced Import Options

Merge with Existing Assets

When importing into a project with existing assets:

1. Match by IP: Assets with same IP are merged
2. Update ports: New ports added to existing asset
3. Preserve data: Existing custom data retained
4. Add new: New hosts created as new assets

Duplicate Handling

Scenario	Behavior
Same IP, new ports	Merge ports
Same IP, same ports	Skip/update
New IP	Create new asset
Hostname match	Option to merge

Import Tags

Auto-tag imported assets:

1. In import dialog, click Tags
2. Add tags (e.g., “Nmap Import 2024-01-15”)
3. All imported assets receive tags

Scan Strategy Tips

Coverage

For comprehensive assessment:

# Phase 1: Quick discovery
nmap -sn -T4 192.168.1.0/24 -oX phase1_discovery.xml

# Phase 2: Top ports on live hosts
nmap -sV -T4 -iL live_hosts.txt -oX phase2_ports.xml

# Phase 3: Full scan on interesting hosts
nmap -sV -sC -O -p- target_hosts.txt -oX phase3_full.xml

Performance vs. Detail

Scan Type	Time	Detail	Use Case
-sn	Fast	Low	Initial discovery
-F	Medium	Medium	Quick assessment
-p-	Slow	High	Full assessment

Large Networks

For networks with many hosts:

• Scan in segments
• Import multiple files
• Use -T4 for faster scanning
• Consider splitting by subnet

Troubleshooting

Import Errors

“Invalid XML format”

• Ensure file is Nmap XML output
• Check file isn’t corrupted
• Verify -oX was used, not -oN or -oG

“No hosts found”

• Check scan actually found hosts
• Verify target was reachable
• Try broader scan parameters

“File too large”

• Split scan into smaller ranges
• Import in multiple batches
• Remove verbose script output

Missing Data

No hostnames

• Nmap couldn’t resolve DNS
• Add -n to skip resolution
• Or ensure DNS is accessible

No OS detection

• Requires root/admin privileges
• Use -O flag
• May need more ports open

Service version missing

• Use -sV flag
• Service may not respond to probes
• Check Nmap output directly

Best Practices

Before Scanning

1. Get authorization - Written permission for targets
2. Define scope - Know what’s in-scope
3. Plan timing - Schedule appropriately
4. Document settings - Record scan parameters

During Import

1. Review preview - Verify expected hosts
2. Use tags - Organize imported data
3. Check duplicates - Handle existing assets
4. Save originals - Keep scan files

After Import

1. Verify count - Confirm all hosts imported
2. Spot check - Review sample assets
3. Add context - Enhance with notes
4. Update status - Mark as tested

---

Next: Learn about Nessus Import