Jason Adsit jasonadsit

Useful Tenable Plugins (and how to parse them)

These examples assume you're using my Get-TenablePluginOutput PowerShell function. You can load it from the web here:

$Content = Invoke-WebRequest -Uri https://gist.githubusercontent.com/jasonadsit/db19229634c788276419c5a4134a1b7e/raw/Get-TenablePluginOutput.ps1 | Select-Object -ExpandProperty Content
. ([scriptblock]::Create($Content))

Also assumes you've already set your working directory to one with some .nessus files in it. ;-)

Enumerate Files from Tenable Plugin Output

These examples assume you're using my Get-TenablePluginOutput PowerShell function. You can load it from the web here:

$Content = Invoke-WebRequest -Uri https://gist.githubusercontent.com/jasonadsit/db19229634c788276419c5a4134a1b7e/raw/Get-TenablePluginOutput.ps1 | Select-Object -ExpandProperty Content
. ([scriptblock]::Create($Content))

Also assumes you've already set your working directory to one with some .nessus files in it. ;-)

	RecommendationNumber	CISv7SubControl
	18.9.102.1.2	2.4
	18.9.16.4	2.6
	18.9.102.1.1	2.6
	18.8.22.1.2	2.7
	18.9.45.14	2.7
	18.8.4.1	3.4
	18.9.17.1	3.4
	18.9.102.2	3.4
	18.9.102.3	3.4

	$PathsToInventory = 'D:\','E:\','F:\','H:\','I:\','J:\'

	<#
	It's assumed that the sources are drive letters.
	It's also assumed that all files have been copied to the same
	root directory under a folders corresponding to their drive letters.
	The culling should have been done first but here we are :-)
	This may need to be refactored if UNC paths are used.
	Set-Location/cd into the working directory before you begin.
	#>

	New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS -ErrorAction SilentlyContinue 2>&1>$null
	Resolve-Path -Path HKU:\*\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice \| ForEach-Object {
	$TheComputerName = $env:COMPUTERNAME
	$TheUserSID = $_.Path.Split('\')[1]
	$TheUserDefaultBrowser = $_ \| Get-ItemPropertyValue -Name ProgId
	[pscustomobject][ordered]@{
	ComputerName = $TheComputerName
	UserSID = $TheUserSID
	DefaultBrowser = $TheUserDefaultBrowser
	}

	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
	$wc = New-Object System.Net.WebClient

	if (!(Test-Path "C:\Tools")) {
	New-Item -Path "C:\" -Name "Tools" -ItemType "directory"
	}

	# SYSMON
	# Download Sysmon
	$SysmonDirectory = "C:\Tools\Sysmon\"

	Get-TenablePluginOutput -PluginID $PluginID \| ForEach-Object {
	$IpAddress = $_.IpAddress
	$NetBiosName = $_.NetBiosName
	$_.PluginOutput -split "`n`n" \| Where-Object { $_ -cmatch '<Block matching regex>' } \| ForEach-Object {
	$Lines = $_ -split "`n" \| ForEach-Object { $_.Trim() }
	$EachOne = @{}
	$Lines \| ForEach-Object {
	$Key = ($_ -split '\s:\s')[0].Trim()
	$Value = ($_ -split '\s:\s')[-1].Trim()
	$EachOne.Add($Key,$Value)