Description on scans using Splunk Add-On for Nessus

[clymbouris]

When exporting a scan to .nessus format for splunk parsing i'm missing the description field. This contains some neat info like solution, PCI references and web links. I can get that exporting to csv and then creating a lookup but maybe I'm missing something here?

I'm using Nessus 5.2.5

Many thanks

Costas

[Rebeccakettler]

I added the .nessus file using the old method then I export the csv file then use the splunk spool to add it. Then I create a join to bring the .nessus results and the csv results togather. You have to join on multiple fields. It is a very costly search but it works since I deal with alot of data.

sourcetype=nessus
| rename dest as Host, signature_id as "Plugin ID, dest_ip as "Host_IP"
| join type=outer Host,"Plugin ID" [ search sourcetype=csv
| fields extracted_Host, "Plugin ID", "Plugin Output", Synopsis, Description, Solution, Protocol, "See Also"
| rename extracted_Host as Host ]
| table Host, "Host_IP", "Domain Name", etc...

Make sure you don't turn on use dns name in nessus because it will prevent you from using the IP as your primary key.

[robert_bucko]

any help?

It is very importent esspecialy for ..... Compliance Check where all points are the same plugin_id. Whitout filed name -> can not recognize which point are pass and which not