<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-vulnerability-scanning-with-nessus
description: >-
  Configure, launch, and analyze Nessus vulnerability scans including policy
  creation, credentialed scanning, plugin families, compliance audits, and
  automated result parsing via the Nessus REST API.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - nessus
  - vulnerability-scanning
  - tenable
  - credentialed-scan
  - plugin-families
  - compliance-audit
  - rest-api
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1595.002"]
---

# Performing Vulnerability Scanning with Nessus

## Overview

Nessus Professional and Tenable.io provide comprehensive vulnerability scanning
across network infrastructure, web applications, and compliance configurations.
This skill covers scan policy creation, credentialed scan configuration, plugin
management, result analysis, and API-driven automation for continuous scanning
pipelines.

Mode: `[MODE: BLUE]` — Defensive vulnerability identification and remediation.

## Prerequisites

- Nessus Professional 10.x or Tenable.io subscription
- API keys: Settings → My Account → API Keys (access key + secret key)
- Network access to target hosts on scan ports
- Credentials for authenticated scanning (SSH keys, domain accounts)
- Python 3.10+ with `requests`

## Key Concepts

### Scan Policy Types

| Policy | Use Case | Auth Required | Depth |
|--------|----------|---------------|-------|
| Basic Network Scan | General vulnerability assessment | No | Medium |
| Advanced Scan | Custom plugin selection | Optional | Configurable |
| Credentialed Patch Audit | Missing OS/app patches | Yes | Deep |
| Web Application Tests | OWASP Top 10, SQLi, XSS | Optional | High |
| SCADA | Industrial control systems | No | Low (safe) |
| Compliance | CIS/DISA STIG benchmarks | Yes | Config-only |

### Scan Configuration via API

```bash
# Authenticate and get token
export NESSUS_URL="https://nessus.internal:8834"
export NESSUS_ACCESS_KEY="your-access-key"
export NESSUS_SECRET_KEY="your-secret-key"

# List scan policies
curl -sk "$NESSUS_URL/policies" \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS_KEY; secretKey=$NESSUS_SECRET_KEY" | jq '.policies[]'

# Create a new scan
curl -sk -X POST "$NESSUS_URL/scans" \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS_KEY; secretKey=$NESSUS_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "uuid": "TEMPLATE_UUID",
    "settings": {
      "name": "Weekly Internal Scan",
      "text_targets": "10.0.0.0/24",
      "launch": "ON_DEMAND",
      "enabled": true,
      "scanner_id": 1
    }
  }' | jq '.scan.id'

# Launch scan
curl -sk -X POST "$NESSUS_URL/scans/SCAN_ID/launch" \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS_KEY; secretKey=$NESSUS_SECRET_KEY"
```

### Credentialed Scanning Configuration

```bash
# Add SSH credentials to scan
curl -sk -X PUT "$NESSUS_URL/scans/SCAN_ID" \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS_KEY; secretKey=$NESSUS_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "settings": {
      "name": "Credentialed Linux Scan"
    },
    "credentials": {
      "add": {
        "Host": {
          "SSH": [{
            "auth_method": "public key",
            "username": "nessus_scan",
            "private_key": "/opt/nessus/keys/scan_key",
            "elevate_privileges_with": "sudo"
          }]
        }
      }
    }
  }'

# Add Windows domain credentials
curl -sk -X PUT "$NESSUS_URL/scans/SCAN_ID" \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS_KEY; secretKey=$NESSUS_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "settings": {
      "name": "Credentialed Windows Scan"
    },
    "credentials": {
      "add": {
        "Host": {
          "Windows": [{
            "domain": "CORP",
            "username": "svc_nessus",
            "auth_method": "Password",
            "password": "USE_VAULT_REFERENCE"
          }]
        }
      }
    }
  }'
```

### Result Analysis

```bash
# Get scan results
curl -sk "$NESSUS_URL/scans/SCAN_ID" \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS_KEY; secretKey=$NESSUS_SECRET_KEY" | \
  jq '.vulnerabilities[] | select(.severity >= 3) | {plugin_name, severity, count}'

# Export scan results as Nessus XML
curl -sk -X POST "$NESSUS_URL/scans/SCAN_ID/export" \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS_KEY; secretKey=$NESSUS_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"format": "nessus"}' | jq '.file'

# Download exported file
curl -sk "$NESSUS_URL/scans/SCAN_ID/export/FILE_ID/download" \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS_KEY; secretKey=$NESSUS_SECRET_KEY" \
  -o scan_results.nessus
```

## Workflow

### Step 1: Create Scan Policy

```bash
node scripts/agent.js --action create-scan \
  --targets 10.0.0.0/24 \
  --policy "credentialed-patch-audit" \
  --output /tmp/scan_config.json
```

### Step 2: Launch and Monitor

```bash
node scripts/agent.js --action launch-scan \
  --scan-id 42 \
  --wait \
  --output /tmp/scan_status.json
```

### Step 3: Export and Analyze Results

```bash
node scripts/agent.js --action export-results \
  --scan-id 42 \
  --min-severity high \
  --output /tmp/nessus_findings.json
```

### Step 4: Generate Remediation Report

```bash
cat /tmp/nessus_findings.json | \
  jq '.findings[] | select(.severity == "critical") | {plugin: .plugin_name, hosts: .affected_hosts, fix: .solution}'
```

## Detection

```yaml
title: Vulnerability Scanning With Nessus Detection
id: 5e5fbb33-860b-4ddd-878d-05075e6b5b98
status: experimental
description: Detects suspicious activity related to performing vulnerability scanning with nessus techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*vulnerability*"
  condition: selection
level: medium
tags:
  - attack.t1595.002
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

- [ ] Scan policies configured with appropriate plugin families
- [ ] Credentialed scanning achieving >95% authentication success
- [ ] Scan schedules aligned to asset criticality tiers
- [ ] Results exported and ingested into vulnerability management platform
- [ ] False positives documented and suppressed with justification
- [ ] Scan coverage metrics tracked (assets scanned vs. total inventory)
- [ ] Plugin feed updated within 24 hours of release

## References

- [Tenable Nessus REST API Documentation](https://docs.tenable.com/nessus/api)
- [MITRE ATT&CK T1595 — Active Scanning](https://attack.mitre.org/techniques/T1595/)
- [CIS Controls v8 — Control 7: Continuous Vulnerability Management](https://www.cisecurity.org/controls/continuous-vulnerability-management)
- [NIST SP 800-115 — Technical Guide to Information Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
