Greenbone Community Edition: Network Vulnerability Scanning
Greenbone Community Edition, still widely called OpenVAS after its scanning engine, probes hosts on a network and reports known vulnerabilities. It is the main open-source option in a category otherwise dominated by commercial products.
What it does that a port scanner does not
Nmap tells you a port is open and often what service is behind it. Greenbone goes further: it runs tens of thousands of specific tests against the services it finds, checking for known vulnerabilities, default credentials, weak TLS configuration, and misconfiguration.
The output is a report of findings with severity ratings and references, rather than an inventory you then have to research yourself.
Authenticated scanning
Unauthenticated scans see what an outsider sees, which is genuinely useful and quite limited.
Providing credentials lets it log in and check installed package versions, configuration files, and local settings. The results are dramatically more complete, because most vulnerabilities are in software that is not exposed to the network at all.
If you are scanning your own machines, use authenticated scans. Anything less is answering a different question.
Expectations
It is heavy. The feed of vulnerability tests is large, the initial sync takes a long time, and the container stack wants several gigabytes of RAM. Budget an evening for the first setup, most of it waiting for feed synchronisation.
Findings need judgement. Severity ratings are generic and do not know your context. A finding rated high on a service reachable only from your LAN is a different proposition from the same finding on a public host.
Scanning is intrusive. Some tests can crash fragile services. Do not point it at production without understanding that, and never scan networks you do not own or have permission to test.
Where it fits
A homelab with a handful of machines, run periodically to catch the service you forgot to update.
A small organisation needing periodic vulnerability assessment without a commercial licence.
For container images specifically, Trivy is faster and more appropriate. For continuous host monitoring, Wazuh covers vulnerability detection alongside everything else. Greenbone is for scanning a network from the outside in.
License
Greenbone Community Edition components are released under the GPL-2.0 and AGPL-3.0 Licenses.