What it does. Tenable Nessus is the industry-leading vulnerability scanner used to Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/scanning-infrastructure-with-nessus/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill scanning-infrastructure-with-nessus, or copy the skill folder into ~/.claude/skills/scanning-infrastructure-with-nessus/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-infrastructure-with-nessus/SKILL.md

SKILL.md (verbatim)

name: scanning-infrastructure-with-nessus
description: Tenable Nessus is the industry-leading vulnerability scanner used to
  identify security weaknesses across network infrastructure including servers, workstations,
  network devices, and operating systems.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- vulnerability-management
- cve
- nessus
- tenable
- infrastructure-scanning
- risk
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068
- T1046

Scanning Infrastructure with Nessus

Overview

Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. This skill covers configuring scan policies, running authenticated and unauthenticated scans, interpreting results, and integrating Nessus into continuous vulnerability management workflows.

When to Use

• When conducting security assessments that involve scanning infrastructure with nessus
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Nessus Professional or Essentials license installed and activated
• Network access to target systems (firewall rules allowing scanner IP)
• Administrative credentials for authenticated scanning
• Understanding of TCP/IP networking and common services
• Written authorization for scanning target environments

Core Concepts

Nessus Architecture

Nessus operates as a client-server application where the Nessus scanner engine runs as a service (nessusd) on the host system. It uses a plugin-based architecture with over 200,000 plugins updated weekly by Tenable's research team. Each plugin tests for a specific vulnerability, misconfiguration, or compliance check.

Scan Types

1. Host Discovery - Identifies live hosts using ICMP, TCP, UDP, and ARP
2. Basic Network Scan - Default policy covering common vulnerabilities
3. Advanced Scan - Custom policy with granular plugin selection
4. Credentialed Patch Audit - Authenticated scan checking installed patches
5. Web Application Tests - Scans for web-specific vulnerabilities
6. Compliance Audit - Checks against CIS, DISA STIG, PCI DSS benchmarks

Plugin Families

Nessus organizes plugins into families including:

• Operating Systems: Windows, Linux, macOS, Solaris
• Network Devices: Cisco, Juniper, Palo Alto, Fortinet
• Web Servers: Apache, Nginx, IIS, Tomcat
• Databases: Oracle, MySQL, PostgreSQL, MSSQL
• Services: DNS, SMTP, FTP, SSH, SNMP

Workflow

Step 1: Initial Configuration

# Start Nessus service
sudo systemctl start nessusd
sudo systemctl enable nessusd

# CLI management with nessuscli
/opt/nessus/sbin/nessuscli update --all
/opt/nessus/sbin/nessuscli fix --list

# Verify plugin count
/opt/nessus/sbin/nessuscli update --plugins-only

Step 2: Create Scan Policy

Configure a custom scan policy through the Nessus web UI at https://localhost:8834:

1. Navigate to Policies > New Policy > Advanced Scan
2. Configure General settings: name, description, targets
3. Set Discovery settings:
   • Host Discovery: Ping methods (ICMP, TCP SYN on ports 22,80,443)
   • Port Scanning: SYN scan on common ports or all 65535 ports
   • Service Discovery: Probe all ports for services
4. Configure Assessment settings:
   • Accuracy: Override normal accuracy (reduce false positives)
   • Web Applications: Enable if scanning web servers
5. Select Plugin families relevant to target environment

Step 3: Configure Credentials

For authenticated scanning, configure credentials under the Credentials tab:

• SSH: Username/password or SSH key pair
• Windows: Domain credentials via SMB, WMI
• SNMP: Community strings (v1/v2c) or USM credentials (v3)
• Database: Oracle, MySQL, PostgreSQL connection strings
• VMware: vCenter or ESXi credentials

Step 4: Run the Scan

# Using Nessus REST API via curl
# Authenticate and get token
curl -k -X POST https://localhost:8834/session \
  -d '{"username":"admin","password":"password"}' \
  -H "Content-Type: application/json"

# Create scan
curl -k -X POST https://localhost:8834/scans \
  -H "X-Cookie: token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "uuid": "<TEMPLATE_UUID>",
    "settings": {
      "name": "Infrastructure Scan Q1",
      "text_targets": "192.168.1.0/24",
      "enabled": true,
      "launch": "ON_DEMAND"
    }
  }'

# Launch scan
curl -k -X POST https://localhost:8834/scans/<SCAN_ID>/launch \
  -H "X-Cookie: token=<TOKEN>"

# Check scan status
curl -k -X GET https://localhost:8834/scans/<SCAN_ID> \
  -H "X-Cookie: token=<TOKEN>"

Step 5: Analyze Results

Nessus categorizes findings by severity:

• Critical (CVSS 9.0-10.0): Immediate remediation required
• High (CVSS 7.0-8.9): Remediate within 7-14 days
• Medium (CVSS 4.0-6.9): Remediate within 30 days
• Low (CVSS 0.1-3.9): Remediate during next maintenance window
• Informational: No immediate action required

Step 6: Export and Report

# Export via REST API
curl -k -X POST "https://localhost:8834/scans/<SCAN_ID>/export" \
  -H "X-Cookie: token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"format":"nessus"}'

# Supported formats: nessus (XML), csv, html, pdf

Best Practices

1. Schedule scans during maintenance windows to minimize production impact
2. Use authenticated scanning for 45-60% more vulnerability detection
3. Exclude fragile systems (medical devices, legacy SCADA) from aggressive scans
4. Maintain separate scan policies for different network segments
5. Update plugins before every scan to catch recently disclosed CVEs
6. Validate critical findings manually before escalating to remediation teams
7. Implement scan result trending to track remediation progress over time
8. Store scan results in Tenable.sc or Tenable.io for centralized management

Common Pitfalls

• Running unauthenticated scans only (misses 45-60% of vulnerabilities)
• Scanning without written authorization (legal and ethical violations)
• Ignoring scan performance impact on production systems
• Failing to tune plugins leading to excessive false positives
• Not validating scanner network connectivity before launching scans
• Using default scan policies without customization for the environment

Related Skills

• performing-authenticated-vulnerability-scan
• prioritizing-vulnerabilities-with-cvss-scoring
• implementing-continuous-vulnerability-monitoring
• performing-network-vulnerability-assessment

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Nessus Infrastructure Scan Report Template

Scan Information

Field	Value
Scan Name	[SCAN_NAME]
Scan Date	[YYYY-MM-DD HH:MM]
Scanner	Tenable Nessus Professional [VERSION]
Policy	[POLICY_NAME]
Target Range	[TARGET_CIDR]
Scan Type	Authenticated / Unauthenticated
Duration	[HH:MM:SS]

Executive Summary

This vulnerability assessment identified [TOTAL] findings across [HOST_COUNT] hosts in the [ENVIRONMENT] environment. The scan was conducted on [DATE] using [AUTHENTICATED/UNAUTHENTICATED] scanning with the [POLICY] scan policy.

Severity Distribution

Severity	Count	Percentage
Critical	[N]	[%]
High	[N]	[%]
Medium	[N]	[%]
Low	[N]	[%]
Informational	[N]	[%]
Total	[N]	100%

Key Metrics

• Unique CVEs Identified: [N]
• Exploitable Vulnerabilities: [N]
• Hosts with Critical Findings: [N]
• Average CVSS Score: [N.N]

Critical and High Findings

Finding 1: [PLUGIN_NAME]

• Plugin ID: [NESSUS_PLUGIN_ID]
• Severity: Critical / High
• CVSS Score: [N.N]
• CVE: [CVE-YYYY-NNNNN]
• Affected Hosts: [COUNT]
• Synopsis: [Brief description of the vulnerability]
• Impact: [Description of potential impact if exploited]
• Solution: [Recommended remediation steps]
• Affected Systems:

  Host	IP Address	Port	Service
  [hostname]	[IP]	[port]	[service]

Finding 2: [PLUGIN_NAME]

[Repeat structure for each critical/high finding]

Remediation Priorities

Immediate (0-48 hours)

1. [Critical finding requiring immediate patching]
2. [Exploitable vulnerability with public PoC]

Short-term (1-2 weeks)

1. [High severity findings with available patches]
2. [Configuration weaknesses with easy remediation]

Medium-term (30 days)

1. [Medium severity findings]
2. [Hardening recommendations]

Long-term (90 days)

1. [Architecture improvements]
2. [Legacy system migration plans]

Host Risk Rankings

Rank	Hostname	IP Address	OS	Risk Score	Critical	High	Medium
1	[host]	[IP]	[OS]	[score]	[N]	[N]	[N]
2	[host]	[IP]	[OS]	[score]	[N]	[N]	[N]

Scan Coverage

Successfully Scanned

• Total targets: [N]
• Successfully scanned: [N]
• Credentialed checks successful: [N]

Scan Gaps

• Unreachable hosts: [N] - [list IPs]
• Authentication failures: [N] - [list IPs]
• Scan timeouts: [N] - [list IPs]

Trending (if applicable)

Metric	Previous Scan	Current Scan	Change
Critical	[N]	[N]	[+/-N]
High	[N]	[N]	[+/-N]
Medium	[N]	[N]	[+/-N]
Total Findings	[N]	[N]	[+/-N]
Mean Time to Remediate	[N days]	[N days]	[+/-N]

Appendices

A. Scan Configuration

• Port Range: [1-65535 / Common Ports]
• Plugin Families Enabled: [List families]
• Credentials Used: [SSH / WinRM / SNMP / Database]
• Excluded Hosts: [List if applicable]

B. Methodology

This assessment follows NIST SP 800-115 guidelines for vulnerability scanning. Scans were performed with [authenticated/unauthenticated] access using Nessus Professional with current plugin feed.

C. Disclaimers

• This scan represents a point-in-time assessment
• New vulnerabilities may be discovered after this scan
• False positives may exist; manual verification is recommended for critical findings
• Scan coverage may be affected by network segmentation and firewall rules

references/api-reference.md (verbatim)

API Reference: Scanning Infrastructure with Nessus

Nessus REST API Endpoints

Method	Endpoint	Description
POST	/session	Authenticate and get token
GET	/scans	List all scans
POST	/scans	Create new scan
POST	/scans/{id}/launch	Launch a scan
GET	/scans/{id}	Get scan results
POST	/scans/{id}/export	Export scan results
GET	/scans/{id}/export/{fid}/status	Check export status
GET	/scans/{id}/hosts/{hid}	Get host details

Scan Types

Type	Template UUID	Use Case
Basic Network Scan	ab4bacd2-...	Standard vulnerability scan
Advanced Scan	ad629e16-...	Custom plugin selection
Credentialed Patch Audit	0c3a6b1f-...	Authenticated patch check
Web Application Tests	1c35d5a5-...	Web vulnerability scan
Compliance Audit	bbd4f805-...	CIS/STIG/PCI checks

Severity Levels

Level	Value	CVSS Range	SLA
Critical	4	9.0 - 10.0	Immediate
High	3	7.0 - 8.9	7-14 days
Medium	2	4.0 - 6.9	30 days
Low	1	0.1 - 3.9	Next window
Info	0	N/A	No action

Export Formats

Format	Description
nessus	XML format for import into other tools
csv	Comma-separated for spreadsheet analysis
html	Human-readable HTML report
pdf	Formatted PDF report

Python Libraries

Library	Version	Purpose
requests	>=2.28	Nessus REST API calls
json	stdlib	Parse API responses
urllib3	>=1.26	SSL warning suppression

References

• Nessus REST API: https://developer.tenable.com/reference/navigate
• Tenable Documentation: https://docs.tenable.com/nessus/
• Nessus CLI: https://docs.tenable.com/nessus/Content/NessusCLI.htm

references/standards.md (verbatim)

Standards and References - Scanning Infrastructure with Nessus

Industry Standards

• NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
• NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning control family
• PCI DSS v4.0 Requirement 11.3: Internal and external vulnerability scanning
• CIS Controls v8 Control 7: Continuous Vulnerability Management
• ISO 27001:2022 A.8.8: Management of technical vulnerabilities

Tenable Documentation

• Tenable Nessus User Guide: https://docs.tenable.com/nessus/
• Nessus REST API Reference: https://docs.tenable.com/nessus/api/
• Nessus Command Line Reference (January 2026): https://docs.tenable.com/nessus/command-line-reference/
• Nessus Plugin Families: https://www.tenable.com/plugins/nessus/families
• Tenable Agent CLI Commands: https://docs.tenable.com/agent/Content/NessusCLIAgent.htm

CVE and Vulnerability Databases

• National Vulnerability Database (NVD): https://nvd.nist.gov/
• MITRE CVE Program: https://cve.mitre.org/
• Tenable Plugin Database: https://www.tenable.com/plugins
• CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Compliance Audit Files

• CIS Benchmarks: https://www.cisecurity.org/benchmark
• DISA STIGs: https://public.cyber.mil/stigs/
• PCI DSS ASV Scanning: https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors

Scan Configuration Standards

Parameter	Recommended Value	Notes
Port Range	1-65535 (full)	For comprehensive scanning
Scan Speed	Normal	Balance between speed and accuracy
Max Concurrent Hosts	30	Adjust based on network capacity
Max Concurrent Checks per Host	5	Prevent host overload
Network Timeout	5 seconds	Increase for high-latency networks
Plugin Timeout	320 seconds	Default; increase for slow targets

references/workflows.md (verbatim)

Workflows - Scanning Infrastructure with Nessus

Workflow 1: Initial Infrastructure Assessment

┌─────────────────┐     ┌──────────────────┐     ┌────────────────────┐
│  Asset Discovery │────>│  Policy Creation │────>│  Credential Config │
│  (Host Enum)     │     │  (Custom/Default)│     │  (SSH/WinRM/SNMP)  │
└─────────────────┘     └──────────────────┘     └────────────────────┘
                                                          │
        ┌────────────────────────────────────────────────┘
        v
┌──────────────────┐     ┌──────────────────┐     ┌────────────────────┐
│   Launch Scan    │────>│  Monitor Status  │────>│   Export Results   │
│   (On-Demand)    │     │  (API Polling)   │     │   (CSV/HTML/PDF)   │
└──────────────────┘     └──────────────────┘     └────────────────────┘
                                                          │
        ┌────────────────────────────────────────────────┘
        v
┌──────────────────┐     ┌──────────────────┐     ┌────────────────────┐
│ Analyze Findings │────>│ Prioritize Vulns │────>│  Create Tickets    │
│ (Severity/CVSS)  │     │ (Risk-Based)     │     │  (Jira/ServiceNow) │
└──────────────────┘     └──────────────────┘     └────────────────────┘

Workflow 2: Recurring Scheduled Scanning

1. Weekly: Scan DMZ and internet-facing assets
2. Bi-weekly: Scan internal production servers
3. Monthly: Full infrastructure scan including workstations
4. Quarterly: Comprehensive scan with compliance audits
5. Ad-hoc: Post-patch verification scans

Workflow 3: Scan Result Processing Pipeline

Nessus Export (.nessus XML)
    │
    ├──> Parse with Python (xml.etree / defusedxml)
    │        │
    │        ├──> Filter by severity (Critical/High)
    │        ├──> Deduplicate findings across hosts
    │        ├──> Enrich with EPSS scores
    │        └──> Map to MITRE ATT&CK techniques
    │
    ├──> Import to Vulnerability Management Platform
    │        │
    │        ├──> Tenable.sc / Tenable.io
    │        ├──> DefectDojo
    │        └──> Faraday
    │
    └──> Generate Executive Report
             │
             ├──> Vulnerability count by severity
             ├──> Top 10 most critical findings
             ├──> Remediation progress trending
             └──> Risk score by business unit

Workflow 4: API Automation Flow

# Nessus API Workflow Steps:
# 1. POST /session -> Get auth token
# 2. GET /editor/scan/templates -> List available templates
# 3. POST /scans -> Create scan with template UUID
# 4. POST /scans/{id}/launch -> Start the scan
# 5. GET /scans/{id} -> Poll until status == "completed"
# 6. POST /scans/{id}/export -> Request export (format: nessus/csv/html)
# 7. GET /scans/{id}/export/{file_id}/status -> Poll export status
# 8. GET /scans/{id}/export/{file_id}/download -> Download results
# 9. DELETE /session -> Logout

Workflow 5: Multi-Scanner Coordination

For large enterprises with multiple Nessus scanners:

1. Central Management: Use Tenable.sc to manage multiple scanners
2. Zone Assignment: Assign scanners to specific network zones
3. Scan Windowing: Stagger scans to prevent network saturation
4. Result Aggregation: Consolidate results in central repository
5. Deduplication: Merge findings from overlapping scan ranges

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.