Nessus Aggregator

Nessus Aggregator is a Python-based tool that automates aggregation of Nessus vulnerability scan results into consolidated Excel reports. The config.py script generates a run file that can be automated through crontab. This tool utilizes and builds upon LimberDuck's Nessus File Reader. If you're looking for another powerful GUI-based solution for Nessus file aggregation, check out LimberDuck's Nessus File Analyzer.

Prerequisites

• Python 3.7 or higher
• python3-venv / python3-pip (install with apt if needed)
• Linux operating system
• Nessus Essentials, Professional, or Expert
• API keys from your Nessus instance (see API key generation documentation)

Installation

1. Ensure all prerequisites are met.
2. Create and activate a virtual environment: python-3 -m venv environment_name
source environment_name/bin/activate
3. Install with pip install nessus-aggregator

Program Execution

1. Run nessus-aggregator
2. Fill out the fields in the GUI and click "ENGAGE".
3. Run the generated run_nessus_aggregator.sh or click the “Execute Run Script” button in the GUI to generate the report.

Automation

• The run_nessus_aggregator.sh script can be scheduled via cron.

How It Works

• API Authentication: Uses Nessus API keys to connect to Nessus.
• Scan Collection: Retrieves all scans from the current calendar month or from a previous user-defined number of days.
• Report Generation: Processes scans and generates an Excel file with 3 tabs:
  • Scan Information: Overview of each scan.
  • Vulnerability Summary: Summary of hosts and findings by severity.
  • Vulnerability Details: Detailed findings with links to Tenable's plugin database.

Security Notes

• API keys are stored in ~/.nessus_env with restricted permissions (chmod 600). Your Nessus API keys are stored in this file. Delete it after running if you do not want this to be stored.
• SSL certificate verification is disabled by default due to common use of self-signed certificates.
• Downloads of scan files created through API calls are automatically deleted after processing.

Output Format

The generated Excel report includes:

• Scan metadata
• Vulnerability summary by host and severity (Critical, High, Medium and Low only)
• Detailed findings with clickable plugin IDs