Error when the Hurricane Labs Add-On for Nessus runs

[bbeltman]

I get the following error (in splunkd.log or when trying to run $SPLUNK_HOME/bin/splunk cmd scans.sh) each time one of the scripts is run:

scans.sh" Traceback (most recent call last):
File "./scans.py", line 66, in
nessus = NessusApi(cfg["username"], cfg["password"], endpoint=cfg["endpoint"])
File "/u01/app/splunkforwarder/etc/apps/TA-nessus/bin/nessus/init.py", line 20, in init
self.login(username, password)
File "/u01/app/splunkforwarder/etc/apps/TA-nessus/bin/nessus/init.py", line 34, in login
xml = ET.fromstring(r.text)
File "/usr/lib64/python2.6/xml/etree/ElementTree.py", line 963, in XML
parser.feed(text)
File "/usr/lib64/python2.6/xml/etree/ElementTree.py", line 1245, in feed
self._parser.Parse(data, 0)
xml.parsers.expat.ExpatError: not well-formed (invalid token): line 1, column 0

It does not appear to try to make a connection to the Nessus API. Any thoughts on what is causing it? I've configured it according to https://apps.splunk.com/app/1860/#/documentation

Additional info:
Red Hat Enterprise Linux Server release 6.6 (all)

Splunk Enterprise (Distributed) and Forwarder 6.2.0

Python 2.6.6

Nessus Version 6.1.1

Add-On for Nessus 1.0.2

[bbeltman]

Finally had some time to look more into this. The error appears to because of changes to the Nessus API between version 5 and 6 (makes sense, this app was written before version 6 was released 🙂 )

I don't want to go back to version 5 of Nessus, so I guess I will wait for a new version

[stevejfice]

for reference, I am still on Version 5 of Nessus (5.2.7) and I am still seeing the same error as above.

My config is:
Splunk 6.2.1
Universal forwarder 6.2.1
Latest Hurricane labs app (v3.0.1) and TA (1.0.2)

I'd love to see some more answers on this.

I have a really old bash script which works to connect to the XML API but I can't do anything beyond that...