Configure Compliance Audits

Required User Role: SCAN OPERATOR [24]

You can use the Create scan or Update scan endpoints to configure compliance audits for a scan. Compliance audits evaluate your systems against industry benchmarks, security policies, and best-practice configurations.

For background information about compliance scanning, see Compliance in Tenable Vulnerability Management Scans in the Tenable Vulnerability Management User Guide.

Overview

Compliance audits are configured in the audits object of the scan request body. The audits object supports two audit sources:

• Feed audits — Tenable-provided audit files based on industry standards such as CIS Benchmarks, DISA STIGs, and Tenable best practices. These are available under audits.feed.add.
• Custom audits — User-created .audit files that you upload. These are available under audits.custom.add. For information about creating custom audit files, see the Nessus Compliance Checks Reference.

📘

Note

Compliance checks require specific credentials configured for the scan (for example, SSH credentials for Unix checks, Windows credentials for Windows checks, or cloud provider credentials for cloud compliance checks). Ensure you configure the appropriate credentials in the credentials object of your request.

Before You Begin

Request Body Structure

The audits object is a top-level property in the scan request body, alongside uuid, settings, credentials, and plugins.

{
  "uuid": "<template_uuid>",
  "settings": { ... },
  "credentials": { ... },
  "audits": {
    "feed": {
      "add": [ ... ]
    },
    "custom": {
      "add": [ ... ]
    }
  }
}

Add Feed Audits (Tenable-Provided)

Feed audits are Tenable-provided compliance checks organized by category (for example, Amazon AWS, Windows, Cisco IOS, Unix). Each feed audit object requires at minimum an id and, if the audit has input variables, a variables object with the required values.

Feed Audit Object Properties

Example: Feed Audit with Variables

{
  "audits": {
    "feed": {
      "add": [
        {
          "id": "72426_CIS_Amazon_Web_Services_Foundations_v7.0.0_L1.audit",
          "variables": {
            "INACTIVE_ACCOUNT_DAYS": "90",
            "SUPPORT_ARN": "arn:aws:iam::123456789012:role/support-role",
            "PASSWORD_MINIMUM_LENGTH": "14",
            "PASSWORD_REUSE_MAX": "24"
          }
        }
      ]
    }
  }
}

Example: Feed Audit without Variables

Some audits (such as certain CIS benchmarks for cloud platforms) do not require input variables:

{
  "audits": {
    "feed": {
      "add": [
        {
          "id": "150078_CIS_Google_Kubernetes_Engine_GKE_v1.9.0_L2_GCP.audit"
        }
      ]
    }
  }
}

Example: Multiple Feed Audits

You can add multiple audits from different categories in a single scan:

{
  "audits": {
    "feed": {
      "add": [
        {
          "id": "72426_CIS_Amazon_Web_Services_Foundations_v7.0.0_L1.audit",
          "variables": {
            "INACTIVE_ACCOUNT_DAYS": "90",
            "SUPPORT_ARN": "arn:aws:iam::123456789012:role/support-role",
            "PASSWORD_MINIMUM_LENGTH": "14",
            "PASSWORD_REUSE_MAX": "24"
          }
        },
        {
          "id": "62679_CIS_Check_Point_Firewall_Level_1_v1.1.0.audit",
          "variables": {
            "TIMEZONE": "America/New_York",
            "DNS_PRIMARY": "192.0.2.10",
            "DNS_SECONDARY": "192.0.2.11",
            "NTP_PRIMARY": "192.0.2.20",
            "NTP_SECONDARY": "192.0.2.21",
            "BANNER_MSG": "Authorized access only."
          }
        }
      ]
    }
  }
}

Add Custom Audits (User-Uploaded)

Custom audits use .audit files that you create and upload. Before adding a custom audit to a scan, upload the file using the Upload file endpoint.

Custom Audit Object Properties

Example: Custom Generic SSH Audit

{
  "audits": {
    "custom": {
      "add": [
        {
          "type": "custom",
          "category": "Generic SSH",
          "file": "my-ssh-audit.txt",
          "variables": {
            "file": "my-ssh-audit.txt",
            "settings": {
              "generic_ssh_escalation_command": "enable",
              "generic_ssh_escalation_success": "[0-9]+"
            }
          }
        }
      ]
    }
  }
}

Remove Audits

To remove compliance audits from an existing scan, use the Update scan endpoint and submit the audits object without the audits you want to remove. The system replaces the existing audit configuration with the configuration you submit.

For example, to remove all audits from a scan, submit an empty audits object:

{
  "audits": {}
}

Compliance Categories

The following compliance categories are available for feed audits. Each category contains one or more Tenable-provided audit files targeting specific benchmarks or best practices:

Related Resources

• Create a Scan
• Manage Credentials
• Compliance in Tenable Vulnerability Management Scans in the Tenable Vulnerability Management User Guide
• Nessus Compliance Checks Reference