nessus_transformer

Fetch Vulnerability data from Nessus and ingest into PE

15 downloads

0 latest version

Version information

  • 1.0.1 (latest)
  • 1.0.0 (deleted)
  • 0.1.0 (deleted)
released Apr 2nd 2025
This version is compatible with:
  • Puppet Enterprise 2025.2.x, 2025.1.x, 2023.8.x, 2023.7.x, 2023.6.x, 2023.5.x, 2023.4.x, 2023.3.x, 2023.2.x, 2023.1.x, 2021.7.x
  • Puppet >= 7.24 < 9.0.0
  • , , , ,
Tasks:
  • run_nessus_transformer

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation

Add this module to your Puppetfile:

mod 'puppetlabs-nessus_transformer', '1.0.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add puppetlabs-nessus_transformer
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install puppetlabs-nessus_transformer --version 1.0.1

Documentation

puppetlabs/nessus_transformer — version 1.0.1 Apr 2nd 2025

nessus_transformer

Table of Contents

  1. Description
  2. Setup - The basics of getting started with nessus_transformer
  3. Overview of Modes
  4. Usage
  5. Scheduling
  6. Tested operating systems

Description

The nessus_transformer module can be used to read data from your Tenable Nessus Vulnerability Scanner and send to to your Puppet Enterprise Instance.

Setup

Setup Requirements

Patching Entitlement is required within PE to avail of this functionality.

We recommend that any sensitive parameter used is node encrypted before being encrypted via hiera-eyaml. Hence node encrypt and hiera-eyaml need to be available before starting.

The transformer can run on any node with network access to Puppet Enterprise and the Tenable Nessus Instance.

node_encrypt

If the node_encrypt module is not available, please install puppetlabs-node_encrypt to be used on your CA or any compile server. See node_encrypt for further info.

hiera-eyaml

Create hiera-eyaml keys if not already generated on your PE Instance. See hiera-eyaml and hiera for further info.

These are the module sensitive parameters;

  • pe_token
  • scan_reports_source_access_key
  • scan_reports_source_secret_key
  • scan_reports_source_ca_certificate

pe_token

A PE Token is always required and can be generated via your puppet enterprise console. See https://www.puppet.com/docs/pe/2025.0/rbac_token_auth_intro#rbac-token-auth-generate-token-console

scan_reports_source_access_key and scan_reports_source_access_secret

Nessus Access Key and Secret Key also maybe required depending on mode of operation. If required, they can be generated on your Tenable Nessus Instance. See nessus for further info.

scan_reports_source_ca_certificate

A CA certificate can also optionally be provided.

Overview of Modes

There are two main modes of operation.

Requesting Data from Nessus

For this mode, scan_reports_source_access_key and scan_reports_source_access_secret must be provided.  A request is made to Tenable Nessus and the latest scan data is downloaded

Reading Data from file path

For this mode, the user manually downloads the Nessus Scan Data and specifies the file path in scan_reports_source_filepath

Hence either scan_reports_source_address/access_key/access_secret or scan_reports_source_filepath must be provided.

Both cannot be specified at the same time.

Usage

Example walkthrough when Requesting data from Nessus

Classify the Nessus Transformer node and include required non sensitive data using the puppet docs with the following details:

  • class name - "nessus_transformer"
  • scan_name
  • scan_reports_source_address

Node and Hiera Encrypt PE Token

# puppet node encrypt -t nessus-transformer.puppet.net my-pe-token > token
# eyaml encrypt --file token --output=string --pkcs7-public-key=/etc/puppetlabs/puppet/eyaml/public_key.pkcs7.pem
ENC[PKCS7,MIIS……A==]

Node and Hiera Encrypt Nessus Access Key

# puppet node encrypt -t nessus-transformer.puppet.net my-nessus-key > key
# eyaml encrypt --file key --output=string --pkcs7-public-key=/etc/puppetlabs/puppet/eyaml/public_key.pkcs7.pem
ENC[PKCS7,MIIS……B==]

Node and Hiera Encrypt Nessus Secret Key

# puppet node encrypt -t nessus-transformer.puppet.net my-nessus-secret > secret
# eyaml encrypt --file secret --output=string --pkcs7-public-key=/etc/puppetlabs/puppet/eyaml/public_key.pkcs7.pem
ENC[PKCS7,MIIS……C==]

Add Encrypted yaml data to eyaml (PE Token, Nessus Access Key, and Nessus Secret Key)

# vi /etc/puppetlabs/code/environments/production/data/nodes/nessus-transformer.puppet.net.eyaml
nessus_transformer::pe_token: ENC[PKCS7,MIIS……A==]
nessus_transformer::scan_reports_source_access_key: ENC[PKCS7,MIIS……B==]
nessus_transformer::scan_reports_source_access_secret: ENC[PKCS7,MIIS……C==]

Configure Hiera to use the encrypted data

# vi /etc/puppetlabs/code/environments/production/hiera.yaml
---
version: 5
defaults:
  datadir: data
hierarchy:
  - name: User Data
    paths:
      - nodes/%{trusted.certname}.eyaml
    lookup_key: eyaml_lookup_key
    options:
      pkcs7_private_key: /etc/puppetlabs/puppet/eyaml/private_key.pkcs7.pem
      pkcs7_public_key: /etc/puppetlabs/puppet/eyaml/public_key.pkcs7.pem

Run Puppet on Nessus Transformer node

[root@nessus-transformer ~]# puppet agent -t Info: Using environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin 
Info: Loading facts
Notice: Requesting catalog from nessus.puppet.net:8140 (10.16.114.35)
Notice: Catalog compiled by nessus.puppet.net
Info: Caching catalog for nessus-transformer.puppet.net
Info: Applying configuration version '1736432610'
Notice: /Stage[main]/Epel/File[/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8]/ensure: defined content as '{sha256}cd1db21a863185127f2e3b264c97fb1c6c44c316385707999041ea475c110d1c'
Notice: /Stage[main]/Nessus_transformer/File[/opt/puppetlabs/nessus-transformer]/ensure: created
.
.
.
Notice: /Stage[main]/Nessus_transformer/Systemd::Timer[nessus-transformer.timer]/Systemd::Unit_file[nessus-transformer.timer]/Service[nessus-transformer.timer]/ensure: ensure changed 'stopped' to 'running'
Info: /Stage[main]/Nessus_transformer/Systemd::Timer[nessus-transformer.timer]/Systemd::Unit_file[nessus-transformer.timer]/Service[nessus-transformer.timer]: Unscheduling refresh on Service[nessus-transformer.timer]
Notice: Applied catalog in 31.79 seconds
[root@nessus-transformer ~]#

Run Nessus Transformer task

# bolt task run nessus_transformer::run_nessus_transformer --targets nessus-transformer.puppet.net
Started on nessus-transformer.puppet.net...
Finished on nessus-transformer.puppet.net:
  {
    "status": "-- Logs begin at Thu 2025-01-09 04:42:06 PST, end at Thu 2025-01-09 06:29:08 PST. --nJan 09 06:28:37 nessus-transformer python3[8714]: Max retries: 3, retry interval: 10\nJan 09 06:28:37 nessus-transformer python3[8714]: API call to /vrs/v1/command/register-transformer/3997ed5f-7768-5457-bb9d-6291354e786a returned status: 201\nJan 09 06:28:37 nessus-transformer python3[8714]: Registration pending with status 201. Retrying in 10 seconds.\nJan 09 06:28:48 nessus-transformer python3[8714]: API call to /vrs/v1/command/register-transformer/3997ed5f-7768-5457-bb9d-6291354e786a returned status: 202\nJan 09 06:28:48 nessus-transformer python3[8714]: Registration pending with status 202. Retrying in 10 seconds.\nJan 09 06:28:58 nessus-transformer python3[8714]: API call to /vrs/v1/command/register-transformer/3997ed5f-7768-5457-bb9d-6291354e786a returned status: 202\nJan 09 06:28:58 nessus-transformer python3[8714]: Registration pending with status 202. Retrying in 10 seconds.\nJan 09 06:29:08 nessus-transformer python3[8714]: Registration successful. Transformer is pending activation.\nJan 09 06:29:08 nessus-transformer systemd[1]: nessus-transformer.service: Succeeded.\nJan 09 06:29:08 nessus-transformer systemd[1]: Started nessus-transformer.service."
  }
Successful on 1 target: nessus-transformer.puppet.net

Accept Registration

In the Puppet Enterprise Console, On the Patching -> Vulnerabilies page (https://pe.puppet.net/#/vulnerabilities), Accept the Nessus Registration.

Rerun Nessus Transformer task

# bolt task run nessus_transformer::run_nessus_transformer --targets nessus-transformer.puppet.net
Started on nessus-transformer.puppet.net...
Finished on nessus-transformer.puppet.net:
  {
    "status": "-- Logs begin at Thu 2025-01-09 04:43:08 PST, end at Thu 2025-01-09 06:40:59 PST. --\nJan 09 06:40:48 nesssus-transformer python3[8887]: API call to /scans/8/export/1387764080/status returned status: 200\nJan 09 06:40:48 nesssus-transformer python3[8887]: Export status: loading. Waiting for 10 seconds.\nJan 09 06:40:58 nesssus-transformer python3[8887]: API call to /scans/8/export/1387764080/status returned status: 200\nJan 09 06:40:58 nesssus-transformer python3[8887]: API call to /scans/8/export/1387764080/download returned status: 200\nJan 09 06:40:58 nesssus-transformer python3[8887]: Scan downloaded successfully\nJan 09 06:40:58 nesssus-transformer python3[8887]: Adding results for transformer 3997ed5f-7768-5457-bb9d-6291354e786a with scan date 2024-09-03T04:23:22Z\nJan 09 06:40:59 nesssus-transformer python3[8887]: API call to /vrs/v1/command/add-results/3997ed5f-7768-5457-bb9d-6291354e786a?scan_date=2024-09-03T04:23:22Z returned status: 201\nJan 09 06:40:59 nesssus-transformer python3[8887]: Results added successfully\nJan 09 06:40:59 nesssus-transformer systemd[1]: nessus-transformer.service: Succeeded.\nJan 09 06:40:59 nesssus-transformer systemd[1]: Started nessus-transformer.service."
  }
Successful on 1 target: nesssus-transformer.delivery.puppetlabs.net

Vulnerabilities are now displayed in Puppet Enterprise Console. These can be refreshed at any stage by running the above task. The task is also configured to run daily. This is the default value but cadence can be updated. See section below.

Scheduling

To update how often vulnerabilities are refreshed with Puppet Enterprise, module parameter sync_schedule can be updated. The parameter must be configured in OnCalendar Format. Some examples are listed below;

Explanation                           Systemd timer
Every 1 hour                          *-*-* *:00:00
Every 12 hour                         *-*-* */12:00:00
Between certain hours                 *-*-* 9-17:00:00
Daily                                 *-*-* 00:00:00
Every 7 days                          * *-*-* 00:00:00
monthly                               * *-*-01 00:00:00
Every quarter                         * *-01,04,07,10-01 00:00:00

Tested operating systems

We have confirmed the ingestion of vulnerability and package data on the following operating systems:

  • Red Hat Enterprise Linux 7
  • Ubuntu 18
  • Debian 10
  • Suse 12
  • Rocky 8
  • Windows 2019
  • Windows 2022

This list will be updated within future releases as we continue to test.