Nessus Professional

View as Markdown

Community Platform

runZero imports data from Nessus Professional through the Tenable API.

Getting started with Nessus Professional

To set up the Nessus Professional integration:

  1. Create an Administrator API key in an access group with Can View permission to Manage Assets.
  2. Add the Nessus Professional credential to runZero.
  3. Choose whether to run the integration as a scan probe or a connector task.
  4. Activate the integration to pull your data into runZero.

Requirements

  • Administrator access to the Nessus Professional portal.

Step 1: Create an Administrator API key

  1. Sign in to Nessus Professional with the Administrator account you’re using for the runZero integration.
  2. Go to My Profile > My Account > API Keys.
  3. Click Generate, then download or copy the API token.
    • When you create the runZero credential, either configure it to skip TLS verification or provide the TLS thumbprint.

Step 2: Add the Nessus Professional credential to runZero

  1. Go to the Credentials page in runZero and name the credential, for example Nessus Professional.
  2. Choose Nessus Professional Access & Secret from the list of credential types.
  3. Generate your Tenable access and secret keys from your account page in the Tenable portal, then fill in the fields:
    • Enter your 64-character Tenable access key in Access key.
    • Enter your 64-character Tenable secret key in Secret key.
    • Enter the API URL of your Nessus Professional instance in Nessus API URL, in the form https://ip:port or https://domain.tld:port. The default Nessus Professional port is 8834.
    • Set Nessus insecure to Yes to attempt authentication without a verified thumbprint.
    • Optionally, enter a set of IP=SHA256:B64HASH pairs to trust for authentication in Nessus thumbprints.
    • If Nessus insecure is No and you provide no thumbprints:
      • With a self-signed certificate, the connection fails because the certificate chain can’t be verified.
      • With a valid certificate from a public CA, the connection can work without thumbprints.
  4. To share this credential with other organizations, select Make this a global credential. Otherwise, you can grant access per organization.
  5. Save the credential.

Step 3: Choose how to configure the Nessus Professional integration

You can run the Nessus Professional integration as a scan probe or a connector task. A scan probe gathers integration data during a scan task. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync. A connector task works if you’re self-hosting runZero or your Nessus Professional instance is publicly accessible.

Step 4: Set up and activate the integration to sync data

Step 4a: Configure the Nessus Professional integration as a connector task

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new Tenable-only assets.

  1. Activate a connection to Nessus Professional. You can also reach every third-party connection from the integrations page, your inventory, or the tasks page.
  2. Choose the credentials you added earlier. If they aren’t listed, check that they have access to your current organization.
  3. Set the severity and risk levels to import (optional). Much of the host information from Tenable comes from Info-level plugins, so if you import only higher severities, assets runZero hasn’t scanned may show little information.
  4. Set the Fingerprint only toggle to Yes to use vulnerability records for fingerprint analysis without storing them in your runZero vulnerability inventory (optional).
  5. Enter a name for the task, like Nessus Professional sync (optional).
  6. Choose the Explorer that runs this connector task (optional).
  7. Choose the site for your assets. runZero stores all newly discovered assets there.
  8. Enter a description for the task (optional).
  9. To leave out assets runZero hasn’t scanned, switch the Exclude unknown assets toggle to Yes. The import includes them by default.
  10. To include assets that haven’t been assessed for vulnerabilities, switch the Include unscanned assets toggle to Yes.
  11. Schedule the sync to run once or on a recurring schedule, starting on the date and time you set.
  12. Activate the connection. The sync runs on your schedule, and the Scheduled tasks page shows when the next one will run.

Step 4b: Configure the Nessus Professional integration as a scan probe

Run the Nessus Professional integration as a scan probe to have the runZero Explorer pull your vulnerability data into the runZero Console.

In a new or existing scan configuration:

  • Set the NESSUS option to Yes in the Probes and SNMP tab and change any default options you need.
  • Set the correct Nessus credential to Yes in the Credentials tab.
  • Optionally, set the severity and risk levels for ingested vulnerability scan results.

Step 5: View Tenable assets and vulnerabilities

After a successful sync, your Tenable assets appear in your inventory with a Tenable icon in the Source column.

The integration also gathers the vulnerabilities Nessus Professional detected. Go to Inventory > Vulnerabilities to view the vulnerability data from Nessus Professional.

To filter by Tenable assets, run this query:

Open an asset to see the attributes runZero gathered from the Tenable scan data.

Troubleshooting

If you’re having trouble with the integration, start with these questions and answers.

Why is the Nessus Professional integration unable to connect?

  1. Check whether the Nessus Professional integration is returning any data.
    • Query the inventory rather than the task details to review all the data available from this integration.
    • In some cases, an integration’s configuration limits how much data reaches the runZero console.
  2. Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
  3. If the Nessus Professional integration can’t connect, check the task log for errors. Common errors include:
    • 500: server error, unable to connect to the endpoint
    • 404: hitting an unknown endpoint on the server
    • 403: not authorized, likely a credential issue
  4. If Nessus Professional is on-premises, verify that the integration task runs from an Explorer with access to the Tenable host.

How do I solve the following error in Nessus Professional:

  • "error-message":"no tenable assets match import criteria","level":"error","msg":"could not load scan result data to writer" {#nessuspro-import-error}

Enabling the Include Unscanned Assets toggle in the Tenable task configuration usually resolves this error, which Tenable returns intermittently. The toggle disables the filters runZero applies for live assets scanned in the last 30 days.

Updated