Vulnerability Management: Nessus Agent Info-level Reporting
A new scan setting called Info-level Reporting is now available for Nessus Agent vulnerability scan templates. The setting specifies how often an agent scan should report unchanged info-level vulnerability findings. There are several new parameters that can be used when creating or updating a scan to support this new feature.
Note
The Info-level Reporting setting can only be used by agents version 10.5.0 and later. Any agents on earlier versions always perform baseline scans.
Background
Info-level findings can account for up to 90% of agent scan findings. Most info-level findings do not change from scan to scan and have minimal impact on your overall network exposure. Configuring info-level reporting can help minimize your scan processing times by decreasing the number of unchanged info-level findings that Tenable Vulnerability Management processes after every agent scan.
After you configure an agent scan, the first execution of that scan always reports all detected findings regardless of severity level. This is known as a baseline scan. Subsequent scans return all vulnerability findings with a severity of Low or higher and any new or changed info-level findings. Agents do not re-report existing, unchanged info-level findings to Tenable Vulnerability Management until a new baseline scan is performed.
New Parameters
To enable info-level reporting for agent scans through the API, Tenable has added several new body parameters that can be specified in the settings object when creating or updating a scan. The new parameters are described in the following table:
| Body Parameter | Data Type | Description |
|---|---|---|
| refresh_reporting_type | string | For Nessus Agent scans, specifies how often the agent should report unchanged info-level vulnerability findings. This setting corresponds to Info-level Reporting in Basic Settings in the user interface. For more information about info-level reporting, see Info-level Reporting in the Tenable Vulnerability Management User Guide. You can configure agent scans to launch a new baseline scan after a certain interval, either number of scans or number of days. By default, Tenable Vulnerability Management uses the
Note: This setting for info-level reporting can only be used by agents version 10.5.0 and later. Any agents on earlier versions always perform baseline scans. |
| refresh_reporting_frequency_scans | integer | Determines the number of scans after which the Nessus Agent scan reports all findings. This setting applies to Nessus Agent scans with the info-level reporting type (refresh_reporting_type) set to scans. |
| refresh_reporting_frequency_days | integer | Determines the number of days after which the Nessus Agent scan reports all findings. This setting applies to Nessus Agent scans with the info-level reporting type (refresh_reporting_type) set to days. |
| disable_refresh_reporting | string | Indicates whether or not the Nessus Agent should force a refresh of all info-level findings on the next scan. After the next scan completes and reports all findings, the Note: All vulnerability findings with a severity of low or higher and new or changed info-level vulnerabilities are always reported after every scan. |
These new parameters can be used with the following endpoints:
| Endpoint | Name | Description |
|---|---|---|
| POST /scans | Create scan | Creates a scan configuration. |
| POST /scans/{scan_id} | Update scan | Updates the specified scan configuration. |
New Response Properties
In addition to the new parameters, the scan details and scan history endpoints now return a reporting_mode property for agent scans that specifies whether the agent scan was a baseline, differential, or null (normal) scan.
| Property | Data Type | Description |
|---|---|---|
| reporting_mode | string | Indicates the reporting mode for Nessus Agent scans:
|
This new property is returned by the following endpoints:
| Endpoint | Name | Description |
|---|---|---|
| GET /scans/{scan_id} | Get scan details | Returns scan details and history for the specific scan. |
| GET /scans/{scan_id}/history | Get scan history | Returns a list of objects, each of which represent an individual run of the specified scan. |
| GET /scans/{scan_id}/history/{history_uuid} | Get scan history details | Returns the details of a previous run of the specified scan. Scan details include information about when and where the scan ran, as well as the scan results for the target hosts. |