All Apps and Add-ons

Nessus vulnerability solution

keronedave
Explorer

I am trying to find all hosts affected by a specific vulnerability and the solution to remediate that vulnerability as suggested by nessus. Since the solution field is present in the nessus:plugin field and every other information needed present in the nessus:scan sourcetype, nothing I have come up with seems to work. The end result should look something like this.

Vulnerability | Host-IP(s) | Solution
XSS vulnerability | 10.10.10.10 | Patch it
10.10.10.20
10.10.10.30

Thanks

0 Karma
1 Solution

spayneort
Contributor

Do you have the Splunk Add-on for Tenable installed on your search head? This has automatic lookups to add the plugin data to the nessus:scan sourcetype. You need to enable the saved searches for this to work.

http://docs.splunk.com/Documentation/AddOns/released/Nessus/Enablesavedsearch

Do you get results when you run this search? It should contain all of the plugin data, including the solution:

|inputlookup nessus_plugin_lookup

If so, and the automatic lookup is not working, you can do the lookup manually by adding the following to your nessus:scan search:

|lookup nessus_plugin_lookup id AS plugin_id OUTPUTNEW

View solution in original post

0 Karma

spayneort
Contributor

Do you have the Splunk Add-on for Tenable installed on your search head? This has automatic lookups to add the plugin data to the nessus:scan sourcetype. You need to enable the saved searches for this to work.

http://docs.splunk.com/Documentation/AddOns/released/Nessus/Enablesavedsearch

Do you get results when you run this search? It should contain all of the plugin data, including the solution:

|inputlookup nessus_plugin_lookup

If so, and the automatic lookup is not working, you can do the lookup manually by adding the following to your nessus:scan search:

|lookup nessus_plugin_lookup id AS plugin_id OUTPUTNEW
0 Karma

keronedave
Explorer

Thanks spayneort, that totally did it for me.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

First, determine one host that you know has the vulnerability but not the patch. Using the host name, search the index to find an event that identifies the vulnerability. Once you find the event, determine a search that will find all hosts that have that kind of event. We will call this "Search 1"

Next, determine one host that has received the patch. Using the host name, search the index to find an event that documents the host receiving the patch. Once you find the event, determine a search that will find all hosts that have received the patch. We will call this "Search 2".

Then run this...

(Search 1) OR (search 2) 
| eval rectype=if(some test for search1,"Vulnerable","Patched")
| stats values(rectype) as rectype by host
| where (mvcount(rectype) < 1) AND (rectype="Vulnerable")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...