How to import Nessus reports and see results

[evang_26]

Hello users,

I recently installed Splunk add-on for Nessus hoping that it would be easy to somehow upload reports (even automatically) to compare results etc.

However, it seems that I cannot find how to do it.

Could you please help me a bit?

Kind regards,
Evangelos

[lvsteche]

With the default settings, the Nessus report files must be placed in the $SPLUNK_HOME/etc/apps/Splunk_TA_nessus/spool directory. The report files must be exported to the "dot nessus" XML format and have a file extension of .nessus.

[jcoates_splunk · Accepted solution]

digging this one out of the archives...

1. configure nessus or tenable security center to export xml reports into a spool directory
2. point the add-on for nessus at this directory. It will parse the reports into splunk-friendly data.
3. you may also want to configure the directory where the add-on for nessus will output the data, default is a local Splunk's input spool.

[bachube]

You need to use a forwarder.

[evang_26]

So, none of you have any clue regarding this question?

Regards,
Evangelos