To better understand this particular Question it is important that it reflects on the intended usage of TA-Nessus. The Sourcetype nessus:plugin is primarily used to create and maintain several lookup-files with included saved searches. Those searches are not scheduled by default and can be run manually or scheduled as needed. All requested fields are automatically enriched via lookups to nessus:scan events, if the lookup-files are created or maintained. So my answer to this question is to run and/or schedule the included saved searches of TA-Nessus and all needed fields will be accessible for nessus:scan events without further Searches using Join. ... View more