Archive
Highlighted

Nessus vulnerability solution

Explorer

I am trying to find all hosts affected by a specific vulnerability and the solution to remediate that vulnerability as suggested by nessus. Since the solution field is present in the nessus:plugin field and every other information needed present in the nessus:scan sourcetype, nothing I have come up with seems to work. The end result should look something like this.

Vulnerability | Host-IP(s) | Solution
XSS vulnerability | 10.10.10.10 | Patch it
10.10.10.20
10.10.10.30

Thanks

0 Karma
Highlighted

Re: Nessus vulnerability solution

SplunkTrust
SplunkTrust

First, determine one host that you know has the vulnerability but not the patch. Using the host name, search the index to find an event that identifies the vulnerability. Once you find the event, determine a search that will find all hosts that have that kind of event. We will call this "Search 1"

Next, determine one host that has received the patch. Using the host name, search the index to find an event that documents the host receiving the patch. Once you find the event, determine a search that will find all hosts that have received the patch. We will call this "Search 2".

Then run this...

(Search 1) OR (search 2) 
| eval rectype=if(some test for search1,"Vulnerable","Patched")
| stats values(rectype) as rectype by host
| where (mvcount(rectype) < 1) AND (rectype="Vulnerable")
0 Karma
Highlighted

Re: Nessus vulnerability solution

Contributor

Do you have the Splunk Add-on for Tenable installed on your search head? This has automatic lookups to add the plugin data to the nessus:scan sourcetype. You need to enable the saved searches for this to work.

http://docs.splunk.com/Documentation/AddOns/released/Nessus/Enablesavedsearch

Do you get results when you run this search? It should contain all of the plugin data, including the solution:

|inputlookup nessus_plugin_lookup

If so, and the automatic lookup is not working, you can do the lookup manually by adding the following to your nessus:scan search:

|lookup nessus_plugin_lookup id AS plugin_id OUTPUTNEW

View solution in original post

0 Karma
Highlighted

Re: Nessus vulnerability solution

Explorer

Thanks spayneort, that totally did it for me.

0 Karma