Nessus vulnerability solution

[keronedave]

I am trying to find all hosts affected by a specific vulnerability and the solution to remediate that vulnerability as suggested by nessus. Since the solution field is present in the nessus:plugin field and every other information needed present in the nessus:scan sourcetype, nothing I have come up with seems to work. The end result should look something like this.

Vulnerability | Host-IP(s) | Solution
XSS vulnerability | 10.10.10.10 | Patch it
10.10.10.20
10.10.10.30

Thanks

[spayneort · Accepted solution]

Do you have the Splunk Add-on for Tenable installed on your search head? This has automatic lookups to add the plugin data to the nessus:scan sourcetype. You need to enable the saved searches for this to work.

http://docs.splunk.com/Documentation/AddOns/released/Nessus/Enablesavedsearch

Do you get results when you run this search? It should contain all of the plugin data, including the solution:

|inputlookup nessus_plugin_lookup

If so, and the automatic lookup is not working, you can do the lookup manually by adding the following to your nessus:scan search:

|lookup nessus_plugin_lookup id AS plugin_id OUTPUTNEW

[keronedave]

Thanks spayneort, that totally did it for me.

[DalJeanis]

First, determine one host that you know has the vulnerability but not the patch. Using the host name, search the index to find an event that identifies the vulnerability. Once you find the event, determine a search that will find all hosts that have that kind of event. We will call this "Search 1"

Next, determine one host that has received the patch. Using the host name, search the index to find an event that documents the host receiving the patch. Once you find the event, determine a search that will find all hosts that have received the patch. We will call this "Search 2".

Then run this...

(Search 1) OR (search 2) 
| eval rectype=if(some test for search1,"Vulnerable","Patched")
| stats values(rectype) as rectype by host
| where (mvcount(rectype) < 1) AND (rectype="Vulnerable")