Nessus Audit Compliance Scans and Templates

When you upload an audit compliance scan result (*.nessus) information is the XML result file is parsed, matched to a checklist template type, and then merged into a new checklist in a system. There is information on creating checklists by uploading audit compliance scans and matching them automatically to templates in the Checklist Help Area.

You can also name the template yourself on the upload page and skip benchmark matching entirely, which is the reliable choice for scans whose benchmark name covers several component STIGs. Or, if the checklist already exists, start from its record and use its Upload button, which updates that record rather than matching one. Both are described in Uploading Checklists.

When an audit compliance scan result is uploaded without a template chosen, it is first matched to any checklist that shares the same hostname and checklist type in the system it is being uploaded in. If that is not matched, the scan’s DISA benchmark id is used, which names a single template exactly; a template found that way is only kept if it actually matches results in the scan. Failing that, the benchmark name is searched for templates by custom template, then CIS template, then DISA template in that order.

Currently the Audit Compliance scans should be based on the DISA Benchmark so it matches on the vulnerability information in the DISA based checklists. Or a CIS .audit file uploaded to generate a CIS-based checklist as well.

---