Tenable Nessus Integration

Overview

The Tenable Nessus integration brings vulnerability scan results into NetBox via the Diode SDK. It connects to a Nessus scanner with API keys, reads the results of every scan on the scanner, and records each scanned host as an IP address in NetBox. Each address carries the names of the scans that found it, its most severe finding level, and its vulnerability counts by severity. Discovered data is staged as deviations in NetBox Assurance, where you review and apply changes before they are written to NetBox.

After a sync you can filter IP addresses in NetBox by their Tenable custom fields to see which addresses have critical or high findings. Run the integration on a schedule to surface changes, such as newly scanned hosts or fixed vulnerabilities, as deviations in Assurance.

What Gets Synchronized

• IP addresses - one IP address for each host found by any scan, as a host address (/32 or /128)
• Most severe finding - the highest severity level with at least one finding, or none, in the tenable_max_severity custom field
• Vulnerability counts - each host's critical, high, medium, and low finding counts, in custom fields. When the host has at least one critical, high, medium, or low finding, the IP address description also lists the counts, with the info count
• Scan names - the names of the scans that found each host, in the IP address description
• DNS names - the host's fully qualified domain name, where Nessus reports one

Key Features

• Severity custom fields - the most severe level and a count for each severity, set on every run so that fixed findings clear after the next run
• Results from every scan - reads all scans on the scanner. For a host found by more than one scan, the values come from the scan that completed most recently
• Completed runs only - a scan that is running again, paused, or canceled contributes its last completed run, not partial results
• Scans by IP address or host name - hosts are recorded by IP address whether the scan targets addresses or names
• IPv4 and IPv6 - both address families are recorded
• DNS names from host details - fills the IP address's DNS name from the host-fqdn property in each host's details
• Optional reverse DNS lookup - looks up a DNS name for hosts that Nessus has none for, when USE_DNS_FALLBACK is enabled
• Bootstrap mode - creates the severity custom fields in NetBox before the first full sync
• Operational drift detection - run on a schedule to surface changes in scan results as deviations in NetBox Assurance

Integration Architecture

The Tenable Nessus integration is built on the NetBox Labs controller integrations framework:

• Standardized integration pattern - consistent approach across all controller integrations
• NetBox Assurance integration - uses NetBox Assurance for safe data ingestion and deviation management
• Agent based - runs as part of the NetBox Discovery agent ecosystem using the Orb Agent Pro image
• One-way sync - data flows from Nessus to NetBox only; nothing is written back to Nessus

Compatibility

Supported NetBox Versions

• NetBox Cloud and NetBox Enterprise with NetBox Assurance

Supported Tenable Products

• Tenable Nessus, through the Nessus API. Other Tenable products, such as Tenable Vulnerability Management and Tenable Security Center, are not supported in this release

Before You Start

The integration reads every scan that the Nessus user who owns the API keys can access. There is no setting to select which scans are synced. If some scans should not be recorded in NetBox, use API keys for a Nessus user that cannot access them.

Known Limitations

Hosts are recorded by IP address only, and a DNS name is recorded only where Nessus reports one. For a host found by more than one scan, the severity values describe the scan that completed most recently, not every finding known for the host. See Known Limitations for the full list.