All Apps and Add-ons

Nessus vulnerability solution

keronedave
Explorer

I am trying to find all hosts affected by a specific vulnerability and the solution to remediate that vulnerability as suggested by nessus. Since the solution field is present in the nessus:plugin field and every other information needed present in the nessus:scan sourcetype, nothing I have come up with seems to work. The end result should look something like this.

Vulnerability | Host-IP(s) | Solution
XSS vulnerability | 10.10.10.10 | Patch it
10.10.10.20
10.10.10.30

Thanks

0 Karma
1 Solution

spayneort
Contributor

Do you have the Splunk Add-on for Tenable installed on your search head? This has automatic lookups to add the plugin data to the nessus:scan sourcetype. You need to enable the saved searches for this to work.

http://docs.splunk.com/Documentation/AddOns/released/Nessus/Enablesavedsearch

Do you get results when you run this search? It should contain all of the plugin data, including the solution:

|inputlookup nessus_plugin_lookup

If so, and the automatic lookup is not working, you can do the lookup manually by adding the following to your nessus:scan search:

|lookup nessus_plugin_lookup id AS plugin_id OUTPUTNEW

View solution in original post

0 Karma

spayneort
Contributor

Do you have the Splunk Add-on for Tenable installed on your search head? This has automatic lookups to add the plugin data to the nessus:scan sourcetype. You need to enable the saved searches for this to work.

http://docs.splunk.com/Documentation/AddOns/released/Nessus/Enablesavedsearch

Do you get results when you run this search? It should contain all of the plugin data, including the solution:

|inputlookup nessus_plugin_lookup

If so, and the automatic lookup is not working, you can do the lookup manually by adding the following to your nessus:scan search:

|lookup nessus_plugin_lookup id AS plugin_id OUTPUTNEW
0 Karma

keronedave
Explorer

Thanks spayneort, that totally did it for me.

0 Karma

DalJeanis
Legend

First, determine one host that you know has the vulnerability but not the patch. Using the host name, search the index to find an event that identifies the vulnerability. Once you find the event, determine a search that will find all hosts that have that kind of event. We will call this "Search 1"

Next, determine one host that has received the patch. Using the host name, search the index to find an event that documents the host receiving the patch. Once you find the event, determine a search that will find all hosts that have received the patch. We will call this "Search 2".

Then run this...

(Search 1) OR (search 2) 
| eval rectype=if(some test for search1,"Vulnerable","Patched")
| stats values(rectype) as rectype by host
| where (mvcount(rectype) < 1) AND (rectype="Vulnerable")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...