Tenable Nessus

Tenable Nessus is a vulnerability scanning platform for auditors and security analysts.

Asset Types Fetched

• Devices, Aggregated Security Findings, SaaS Applications, Domains & URLs

Parameters

1. Host Address (required) - The hostname or IP address of the Tenable Nessus server.
2. Port (optional) - This adapter uses port 8834 by default. You can enter here a different port, if needed.
3. User Name and Password (optional) - The credentials for a user account that has the permissions to fetch assets.

4. Access API Key and Secret API Key (optional) - An API Key associated with a user account that has permissions to fetch assets. For details, see Tenable Nessus - Generate an API Key.

5. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Scan IDs include list (optional, default: empty) - Specify a comma-separated list of Tenable Nessus scan IDs.
   • If supplied, all connections for this adapter will only collect devices discovered by Tenable Nessus scan IDs provided in this list.
   • If not supplied, all connections for this adapter will collect devices discovered by any Tenable Nessus scan.
2. Only get devices with MAC, Hostname or correlatable IP address (required, default: False) - Choose whether to exclude fetching devices without MAC address, without hostname and without an IP address that can be correlated to other existing IP address.
   • If enabled, all connections for this adapter will only fetch devices having at least one of the following:
     • MAC address
     • Hostname
     • IP address that can be correlated with an existing IP address in Axonius.
   • If disabled, all connections for this adapter will fetch devices even if those do not have MAC address, no hostname and no IP address that can be correlated to other existing IP address.
3. Do not fetch devices with no MAC address and no hostname - Select whether to exclude fetching devices without a MAC address and without a hostname.
4. Fetch agents endpoint - Select this option to fetch agents (the Tenable Nessus endpoint called agents) as devices.
5. Fetch plugin output- Select this option to fetch plugin output.
6. Fetch scans from the last X days - Select the scans whose schedule started or whose last run ended in the last X days. For each of these scans, the adapter reads the latest run and the earlier completed runs that ended within the same period. A host that several runs report is taken from its newest run. When the value is empty or 0, every scan is read from its latest run only. A larger value can make the fetch longer, because the adapter reads more runs.
7. Fetch only enabled scheduled scans - Select this option to only fetch scans whose schedule is enabled. Scans that were launched on demand or manually are not fetched.
8. Parse Netbios name as the asset name. Scan name is the fallback option - Select this option to use the Netbios name of the asset as the asset name. If it does not exist, the Scan name will be used.
9. Classify Attack Surface Discovery assets as Domains & URLs - Select this option to parse Attack Surface Discovery assets as Domains & URLs (instead of parsing them as Devices). This is useful for better organizing and managing your external attack surface.
10. Classify Web Application Sitemap assets as Domains & URLs (default: disabled) - Select this option to parse assets where Nessus reports the Web Application Sitemap plugin (91815) as Domains & URLs instead of Devices. The asset type of these assets is Web Application Sitemap. When this option and Classify Attack Surface Discovery assets as Domains & URLs are both selected, a host that reports both plugins is classified as Attack Surface Discovery.

To select how this adapter saves Security Findings, see Security Findings: CVE and vendor IDs.

APIs

Axonius uses the following Tenable Nessus APIs:

• session
• scans
• scans/{scan_id}
• scans/{scan_id}/hosts/{host_id}
• scans/{scan_id}/hosts/{host_id}/plugins/{plugin_id}
• folders
• agents
• plugins/plugin/{plugin_id}

Related Enforcement Actions:

• Nessus - Add IPs to Scan
• Nessus - Delete Account
• Nessus - Add Agent to Agent Group
• Nessus - Delete Agent
• Nessus - Create and Launch Scan