This script initializes the credentials used for Ivanti checks done via the Web API.

To set the credentials, edit your scan policy and go to the 'Credentials' section.

The scan was configured to use Kerberos for Windows authentication, but Kerberos failed at least once for this host.  There are many causes for Kerberos failure in a Windows environment.  They include:

  * Lack of time synchronization between the DC, scanner and target.
  * DC or targets were not specified as FQDNs in the scan policy.
  * DNS name resolution of the DC or target failed at the scanner.
  * Reverse DNS resolution of the DC or target failed at the scanner.
  * Duplicate or missing SPNs on the DC or target.
  * Misconfigured scan credentials.

Nessus attempted to use NTLM instead to preserve scan continuity.

Note regarding the see-also link:
  Nessus does not require the scanner to be registered to the   same domain as the DC or target.  Nessus can be running on   any platform; Windows, Linux or MacOS.

Nessus was able to find one or more Windows LAPS Credentials

This plugin configures the Cisco Meraki Integration.

This script initializes the credentials used for Google Cloud Platform services.

To set the credentials, edit your scan policy and go to the 'Preferences -> Snowflake' section.

This script initializes the credentials used for VMware checks done via the REST and SOAP API.
To set the credentials, edit your scan policy. Under 'Preferences', select 'VMware vCenter REST and SOAP API Settings'.

This scan was executed with signature checking for Nessus plugins disabled by a scan setting. This permits plugins to run which have not been vetted by Tenable. Unless you have an extremely good reason for enabling this setting, it is recommended that you disable that setting.

This script initializes the credentials used for Workspace ONE checks done via the Web API.

To set the credentials, edit your scan policy and go to the 'Preferences' section.

This plugin configures miscellaneous search variables for Nessus plugins. It does not perform any security checks but may disable or change the behavior of others.

This script initializes the credentials used for Splunk.

To set the credentials, edit your scan policy and go to the 'Preferences -> Splunk API' section.

If the 'Always report SSH commands' advanced preference is selected in the scan policy, this plugin will report all commands run over SSH on the host in a machine readable format.

This script initializes the credentials used for Zoom.

To set the credentials, edit your scan policy and go to the 'Preferences -> Zoom' section.

This script initializes the credentials used for OpenShift services.

To set the credentials, edit your scan policy and go to the 'Preferences -> OpenShift Settings' section.

This plugin initializes the HCL BigFix server settings as set by the user. To set the settings, edit your scan policy and go to the section 'Preferences'. This does not connect to the target host.

This plugin configures the Nutanix Integration.

This plugin checks for data in from the Trusted CAs UI input, and stores the info (if any) in the KB

This script initializes the credentials used for Citrix Application Delivery.

To set the credentials, edit your scan policy and go to the 'Preferences -> Citrix NITRO REST API' section.

Nessus found problems running commands on the target host which are used to find software that is not managed by the operating system.
Details of the issues encountered are reported by this plugin.

Failure to properly execute commands used to find and characterize unmanaged software on the target host can lead to scans that do not report known vulnerabilities.  There may be little in the scan results of unmanaged software plugins to indicate the missing availability of the source commands except audit trail messages.

Commands used to find unmanaged software installations might fail for a variety of reasons, including:

   * Inadequate scan user permissions,
   * Failed privilege escalation,
   * Intermittent network disruption, or
   * Missing or corrupt executables on the target host.

Please address the issues reported here and redo the scan.

Nessus was able to determine that it is possible for plugins to find and identify versions of software on the target host. Software that is not managed by the operating system is typically found and characterized using these commands.  This was measured by running commands used by unmanaged software plugins and validating their output against expected results.

Nessus was able to log in to the remote host using the provided credentials. The provided credentials have the highest privilege possible on the remote host.  Yet Nessus encountered permissions issues while accessing items during the scan.

It is likely that this condition is caused by one or more of the following:

1)  A plugin tried to access a resource that requires a special     privilege level such as NT_AUTHORITY on Windows.  The resource     may have had its permissions altered since the plugin was     written.
2)  Environmental issues may have caused an intermittent failure     in authentication that caused Nessus to stop attempting     privilege escalation.
3)  A resource on the host that Nessus attempts to access multiple     times may be configured with access limits.  Related lockouts may     look like permissions failures.
4)  Nessus may have tried to access a resource that does not exist     on a target that fails to properly report permissions issues.
    For instance, on some legacy unix systems such as AIX or HP-UX     there is no way to distinguish a missing resource from a     permissions error.

If you believe that the plugin indicated attempted to access the wrong resource or a resource that has recently received special OS protection, please contact Tenable Support.

This script initializes the credentials used for Google Cloud Platform services.

To set the credentials, edit your scan policy and go to the 'Preferences -> Google Cloud Platform' section.

This plugin manages the lifecycle of the code signing key used by the Nessus scanner or agent to verify the integrity of plugins.
Updates to this plugin will update the signing key before the plugin database is rebuilt.  It is possible that some version of this plugin will also be used to clean up accumulated code signing keys.

To perform a full credentialed scan, Nessus needs the ability to connect to the remote server service (LanmanServer). If the service is down and if Nessus automatically enabled the server service for the duration of the scan, this plugin will stop it afterwards.

To perform a full credentialed scan, Nessus needs the ability to connect to the remote server service (LanmanServer). If the service is disabled, this plugin will attempt to start for the duration of the scan.

For this plugin to work, you need to select the option 'Start the server service during the scan' on the credentials page when you add your Windows credentials.

Nessus was able to determine that valid credentials were provided for an authentication protocol available on the remote target because it was able to successfully authenticate directly to the remote target using that authentication protocol at least once. Authentication was successful because the authentication protocol service was available remotely, the service was able to be identified, the authentication protocol was able to be negotiated successfully, and a set of credentials provided in the scan policy for that authentication protocol was accepted by the remote service. See plugin output for details, including protocol, port, and account.

Please note the following :

- This plugin reports per protocol, so it is possible for   valid credentials to be provided for one protocol and not   another. For example, authentication may succeed via SSH   but fail via SMB, while no credentials were provided for   an available SNMP service.

- Providing valid credentials for all available   authentication protocols may improve scan coverage, but   the value of successful authentication for a given   protocol may vary from target to target depending upon   what data (if any) is gathered from the target via that   protocol. For example, successful authentication via SSH   is more valuable for Linux targets than for Windows   targets, and likewise successful authentication via SMB   is more valuable for Windows targets than for Linux   targets.

This plugin is for use to help with   deployment of optimized libraries on agents.

This plugin just sets global variables for datapower

This script collects information about the feed version, scanner and platform where Tenable products are running.

Initializes the scratchpad tables which will be used to log the details of missing patches and missing updates as they are discovered throughout the scan.

This plugin does not produce any text output. Check the audit trail for success / failure information.

This plugin gathers and stores the Intune parameters to be used in Intune mobile plugins.

This plugin gathers and stores the Blackberry UEM parameters to be used in Blackberry UEM mobile plugins.

Nessus was not able to execute patch management checks because it was not possible to log into the designated patch management system using the credentials that have been provided.

Nessus was able to execute credentialed checks because it was possible to log in to the remote patch management system using provided credentials.

Nessus was able to determine OS security patch levels by logging into the remote host and running commands to determine the version of the operating system and its components.  The remote host was identified as an operating system or device that Nessus supports for patch and update assessment.  The necessary information was obtained to perform these checks.

OS Security Patch Assessment is not available on the remote host.
This does not necessarily indicate a problem with the scan.
Credentials may not have been provided, OS security patch assessment may not be supported for the target, the target may not have been identified, or another issue may have occurred that prevented OS security patch assessment from being available. See plugin output for details.

This plugin reports non-failure information impacting the availability of OS Security Patch Assessment. Failure information is reported by plugin 21745 : 'OS Security Patch Assessment failed'.  If a target host is not supported for OS Security Patch Assessment, plugin 110695 : 'OS Security Patch Assessment Checks Not Supported' will report concurrently with this plugin.

Nessus was able to successfully authenticate to the remote host on an authentication protocol at least once using credentials provided in the scan policy.

However, one or more plugins failed to authenticate to the remote host on the same port and protocol using the same credential set that was previously successful. This may indicate an intermittent authentication problem with the remote host, which could be caused by session rate limits, session concurrency limits, or other issues preventing consistent authentication success.

These intermittent authentication failures may have affected the results of some plugins. See plugin output for failure details.

This plugin displays the list of launched plugins in a semicolon delimited list.

Nessus was not able to successfully authenticate directly to the remote target on an available authentication protocol. Nessus was able to connect to the remote port and identify that the service running on the port supports an authentication protocol, but Nessus failed to authenticate to the remote service using the provided credentials. There may have been a protocol failure that prevented authentication from being attempted or all of the provided credentials for the authentication protocol may be invalid. See plugin output for error details.

Please note the following :

- This plugin reports per protocol, so it is possible for   valid credentials to be provided for one protocol and not   another. For example, authentication may succeed via SSH   but fail via SMB, while no credentials were provided for   an available SNMP service.

- Providing valid credentials for all available   authentication protocols may improve scan coverage, but   the value of successful authentication for a given   protocol may vary from target to target depending upon   what data (if any) is gathered from the target via that   protocol. For example, successful authentication via SSH   is more valuable for Linux targets than for Windows   targets, and likewise successful authentication via SMB   is more valuable for Windows targets than for Linux   targets.

OS Security Patch Assessment is not available for this host because the checks may be infeasible or are not supported by Nessus. The credentials supplied in the scan policy may have been successful, but OS Security Patch Assessment cannot be performed at this time.

Nessus was able to execute credentialed checks because it was possible to log in to the remote host using provided credentials, however the credentials were not sufficiently privileged to complete all requested checks.

Valid credentials were provided for an authentication protocol on the remote target and Nessus did not log any subsequent errors or failures for the authentication protocol.

When possible, Nessus tracks errors or failures related to otherwise valid credentials in order to highlight issues that may result in incomplete scan results or limited scan coverage. The types of issues that are tracked include errors that indicate that the account used for scanning did not have sufficient permissions for a particular check, intermittent protocol failures which are unexpected after the protocol has been negotiated successfully earlier in the scan, and intermittent authentication failures which are unexpected after a credential set has been accepted as valid earlier in the scan. This plugin reports when none of the above issues have been logged during the course of the scan for at least one authenticated protocol. See plugin output for details, including protocol, port, and account.

Please note the following :

- This plugin reports per protocol, so it is possible for   issues to be encountered for one protocol and not another.
  For example, authentication to the SSH service on the   remote target may have consistently succeeded with no   privilege errors encountered, while connections to the SMB   service on the remote target may have failed   intermittently.

- Resolving logged issues for all available authentication   protocols may improve scan coverage, but the value of   resolving each issue for a particular protocol may vary   from target to target depending upon what data (if any) is   gathered from the target via that protocol and what   particular check failed. For example, consistently   successful checks via SSH are more critical for Linux   targets than for Windows targets, and likewise   consistently successful checks via SMB are more critical   for Windows targets than for Linux targets.

The remote has is behind a load balancer either with a non-identical configurations to its peers, or is not synced with its peers.

The remote host appears to be operational technology device. Such devices often react very poorly when scanned. To avoid problems, Nessus will not continue to scan this device.

If you would like to safely assess security vulnerabilities on this device, Tenable suggests contacting your account representative to discuss employing Tenable.OT, which is purpose built to address vulnerability management on devices of this type.
Note: OT devices often have nested interfaces or additional attached devices that may not be accounted for in a traditional scan

Nessus failed to successfully authenticate directly to the remote target on an available authentication protocol. Nessus was able to connect to the remote port and identify that the service running on the port supports an authentication protocol, but Nessus failed to authenticate to the remote service using the provided credentials.

There may have been a failure in protocol negotiation or communication that prevented authentication from being attempted or all of the provided credentials for the authentication protocol may have been invalid. A protocol failure may indicate a compatibility issue with the protocol configuration. A protocol failure due to an environmental issue such as resource or congestion issues may also prevent valid credentials from being identified. See plugin output for error details.

Please note the following :

- This plugin reports per protocol, so it is possible for   valid credentials to be provided for one protocol and not   another. For example, authentication may succeed via SSH   but fail via SMB, while no credentials were provided for   an available SNMP service.

- Providing valid credentials for all available   authentication protocols may improve scan coverage, but   the value of successful authentication for a given   protocol may vary from target to target depending upon   what data (if any) is gathered from the target via that   protocol. For example, successful authentication via SSH   is more valuable for Linux targets than for Windows   targets, and likewise successful authentication via SMB   is more valuable for Windows targets than for Linux   targets.

The remote host required a privilege escalation in order to run one or more SSH commands, or a privilege escalation was forced by a plugin for one or more SSH commands.

Note that this plugin only reports if 'Attempt least privilege' is enabled in the scan policy.

This plugin reports the SSH commands that failed with a response indicating that privilege escalation is required to run them. Either privilege escalation credentials were not provided, or the command failed to run with the provided privilege escalation credentials. 

NOTE: Due to limitations inherent to the majority of SSH servers, this plugin may falsely report failures for commands containing error output expected by sudo, such as 'incorrect password', 'not in the sudoers file', or 'not allowed to execute'.

If plugin debugging is enabled, this plugin writes the SSH commands run on the host to a combined log file in a machine readable format.
This log file resides on the scanner host itself.

Get the system name that was input into the UI and set it locally for use in other plugins.

This plugin initializes the credentials used for MaaS360 checks done via the Web Services API.

To set the credentials, edit your scan policy and go to the 'Credentials' section.

ID	Name	Severity
269806	Ivanti API Settings	info
242431	SMB Kerberos Not Working	info
237981	Windows LAPS	info
237713	Cisco Meraki Settings	info
206113	Snowflake API Settings	info
186662	VMware vCenter API Settings	info
179042	NASL Plugin Signature Checks Disabled	info
174452	Workspace ONE API Settings	info
171013	Scan Search settings	info
166551	Splunk API Settings	info
168017	SSH Per-Host Command Logging	info
163518	Zoom Settings	info
161407	OpenShift Settings	info
160247	Patch Management: HCL BigFix Server Settings	info
160184	Nutanix Settings	info
156594	Parse CAs from UI Input	info
154869	Citrix NITRO API Settings	info
152743	Unix Software Discovery Commands Not Available	info
152742	Unix Software Discovery Commands Available	info
150799	Target Access Problems by Authentication Protocol - Maximum Privilege Account Used in Scan	info
150079	Google Cloud Platform Settings	info
146991	Nessus Signing Key Management	info
144456	Stop the Server Service after the scan (WMI)	info
144455	Start disabled Server Service during the scan (WMI)	info
141118	Target Credential Status by Authentication Protocol - Valid Credentials Provided	info
137405	Agent deployment helper plugin	info
137233	Datapower Settings	info
133441	Report Feed Telemetry	info
133440	Report Feed Telemtry End	info
128277	Missing Patch Logging Initialization	info
125030	Intune Settings	info
124860	Blackberry UEM Settings	info
122503	Integration Credential Status by Authentication Protocol - Failure for Provided Credentials	info
122502	Integration Credential Status by Authentication Protocol - Valid Credentials Provided	info
117887	OS Security Patch Assessment Available	info
117886	OS Security Patch Assessment Not Available	info
117885	Target Credential Issues by Authentication Protocol - Intermittent Authentication Failure	info
112154	Nessus Launched Plugin List	info
110723	Target Credential Status by Authentication Protocol - No Credentials Provided	info
110695	OS Security Patch Assessment Checks Not Supported	info
110385	Target Credential Issues by Authentication Protocol - Insufficient Privilege	info
110095	Target Credential Issues by Authentication Protocol - No Issues Found	info
109582	PCI Scan Accuracy cannot be verified through Load Balancer with non-identically configured or non-synced systems	high
109142	Do not scan operational technology devices	info
104410	Target Credential Status by Authentication Protocol - Failure for Provided Credentials	info
102095	SSH Commands Ran With Privilege Escalation	info
102094	SSH Commands Require Privilege Escalation	info
100158	SSH Combined Host Command Logging (Plugin Debugging)	info
92440	Set System Name	info
92000	MaaS360 Settings	info

Detections

Analytics

Settings Family for Nessus

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

high

info

info

info

info

info

info

info