Nessus - Create and Launch Scan

Nessus - Create and Launch Scan creates a Nessus Network Vulnerability Scan or Web Application Scan from the assets returned by a query. It can launch the scan immediately or apply a schedule.

This action runs for:

• Assets returned by the selected query or assets selected on the relevant asset page.

APIs

Axonius uses the Nessus API:

• GET /policies to find the policy for a Network Vulnerability Scan.
• GET /editor/policy/templates to find an available Web Application Scan template.
• POST /scans to create the scan.
• POST /scans/{scan_id}/launch to launch the created scan when Launch scan immediately is selected.

Required Ports

Axonius must be able to communicate via the following ports:

• TCP port 443 (HTTPS) — confirm the exact port with your Nessus administrator.

Required Permissions

The following permissions and requirements are needed:

• Use a Nessus account that can list policies and scan templates, create scans, and launch scans.
• Authenticate with either a user name and password or an access key and secret key.

The JIRA ticket's permissions and requirements details were not available in the workspace. Confirm the exact permission names and scopes with your Nessus administrator, because the patch does not define vendor role or scope names.

Required Fields

These fields must be configured to run the Enforcement Action.

• Scan Type - Select Network Vulnerability Scan (default) or Web Application Scan.
• Scan Name - Enter a name for the scan created in Nessus.
• Use stored credentials from the Nessus adapter - Select this option to use credentials from an existing Nessus adapter connection. By default, the first connection is selected.

• When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Additional Fields

Required Additional Fields

Configure the following scan settings:

• Use public IP addresses - Select whether to include public IP addresses when the target source is Devices.

• Use private IP addresses - Select whether to include private IP addresses when the target source is Devices.

• Use hostnames - Select whether to include hostnames when the target source is Devices.

• Exclude IPv6 addresses - Select whether to exclude IPv6 addresses when the target source is Devices.

• Launch scan immediately - Select whether to launch the scan after it is created. This option is selected by default.

Optional Additional Fields

• Policy Name - Enter the name of an existing Nessus policy for a Network Vulnerability Scan. Policy matching first uses an exact name, then a case-insensitive name match.
• WAS Template Name - For a Web Application Scan, optionally enter the Nessus Web Application Scan (WAS) template name or title. When empty, the action uses the standard WAS template. Web Application Scans require a Nessus Expert WAS license.
• Target Source - Select the asset type that supplies scan targets: Devices (IPs), Networks (CIDRs), or Domains & URLs. The default is Devices (IPs).
• Source Adapter - Optionally limit target extraction to a specific source adapter.
• Scan schedule - Optionally enable a schedule and set its Frequency, Interval, Start Date (DD/MM/YYYY), Start Time, and Timezone. Weekly schedules also use Days of the week; monthly schedules use Repeat by.

For Web Application Scans, bare domain and host targets are sent to Nessus as HTTPS URLs.

Connection Settings

To learn more about Enforcement Actions, see Enforcement Actions.