Nessus automatic scan upload with Nessus Prof. API

[QuaiGoner]

Hello. How hard would it to implement importing Nessus Scan Results with an Nessus API in real-time?

[damiencarol]

It depends on the complexity of the API, if we had a Python module ready to use the API.
Also it could help if the data of the API is close to what we have in the XML export, as we will be able to reuse some code.

[blackaichi]

Hi all,

Any update on this? If not perhaps I can help you

[Anillaerdal]

Hi all,

Any update on this? If not perhaps I can help you

Hi Still no one reply on this, please help on this it is very help full for me.

[Stamka]

Hi, In our company we developed a python script that it parses folders in nessusPro by api than upload reports in csv to defectdojo by crontab

[QuaiGoner]

@Stamka hello! How do you get around duplicates and previously made automatic Jira issues?
Do you upload new scan results in the same engagement with close old finding option?

[Stamka]

@QuaiGoner Our engineers and devops working directly in defectodojo without jira.

Do you upload new scan results in the same engagement with close old finding option?

I create new engagement and do deduplication and autoclosing old findings for the whole project

[manuel-sommer]

Hi all,

I guess an additional API parser will not be integrated / accepted as a PR from DefectDojo side. The reason can be found here:
https://defectdojo.github.io/django-DefectDojo/contributing/how-to-write-a-parser/#api-parsers

"DefectDojo has a limited number of API parsers. While we won’t remove these connectors, adding API connectors has been problematic and thus we cannot accept new API parsers / connectors from the community at this time for supportability reasonsing. To maintain a high quality API connector, it is necessary to have a license to the tool. To get that license requires partnership with the author or vendor. We’re close to announcing a new program to help address this and bring API connectors to DefectDojo."

Thus, I would recommend to build your own automation to upload the files to DefectDojo or use the official support.

Best,

Manuel

[Noonster77]

Here is my custom dojo script. It connects to a tenable.sc instance and allows you to export queries into a .csv file, then automatically imports the findings into a defect dojo project, and engagement with the same key words as the tenable.sc query. It will reimport the findings under the same test so it keeps track of how many were opened or closed.