When exporting a scan to .nessus format for splunk parsing i'm missing the description field. This contains some neat info like solution, PCI references and web links. I can get that exporting to csv and then creating a lookup but maybe I'm missing something here?
I'm using Nessus 5.2.5
Many thanks
Costas
I added the .nessus file using the old method then I export the csv file then use the splunk spool to add it. Then I create a join to bring the .nessus results and the csv results togather. You have to join on multiple fields. It is a very costly search but it works since I deal with alot of data.
sourcetype=nessus
| rename dest as Host, signature_id as "Plugin ID, dest_ip as "Host_IP"
| join type=outer Host,"Plugin ID" [ search sourcetype=csv
| fields extracted_Host, "Plugin ID", "Plugin Output", Synopsis, Description, Solution, Protocol, "See Also"
| rename extracted_Host as Host ]
| table Host, "Host_IP", "Domain Name", etc...
Make sure you don't turn on use dns name in nessus because it will prevent you from using the IP as your primary key.
any help?
It is very importent esspecialy for ..... Compliance Check where all points are the same plugin_id. Whitout filed name -> can not recognize which point are pass and which not