AlienVault Feed for Nessus FAQ

  • Why do you create an additional Nessus plugin feed?
  • Isn't the official Tenable feed enough for our needs?
  • Who works on this feed?
  • Do you accept contributions / sponsoring?
  • What about the license ?
  • Can I use OpenVAS for scanning ?


    • Why do you create an additional Nessus plugin feed?

    It depends on the type of user you are. We feel Tenable's movements during the last years have been taking them further and further away from the Open Source community, with this last move clearly upsetting a large part of the user base. Basically we felt we had to create this feed in order to continue providing a basic feature to the average ossim user: vulnerability scanning.

    Isn't the official Tenable feed enough for our needs?

    Depends of the type of user you are. Quoting some entries from Tenable's feed faq: 

    
    Q. I am a home user, can I download Nessus and scan my network and my friends networks for free?
    A. Yes. You can download Nessus, subscribe to the HomeFeed and use Nessus to audit any
    computer or network, as long as you use it non-commercially.

    Q. I work for a non-profit organization and I use Nessus to scan our network,
    am I required to subscribe to the ProfessionalFeed to use the latest updates for Nessus?
    A. Yes. If you work for a non-profit organization and are using Nessus to audit the
    security of the non-profit you work for, you must subscribe to the ProfessionalFeed
    to use it commercially with the latest updates

    Q. I work for a company and I use Nessus to scan our lab network prior to using Nessus in
    production, am I required to subscribe to the ProfessionalFeed to use the latest updates for
    Nessus for our testing purposes?
    A. Yes. If you work for a company and are using Nessus in a lab for testing or research
    purposes of the company you work for, you must subscribe to the ProfessionalFeed to use it
    commercially with the latest updates. A HomeFeed cannot be used commercially.
    If you read through the entries it quickly becomes clear that OSSIM's target audience has to pay, even if it's a small company scanning their own network, somebody evaluating nessus against a lab network or some non-profit organization protecting their infrastructure.

    So unless you're a home user (not the typical ossim user) or you really make money through scanning (where paying for the license is most definetively justified) you're left out of the game.

    Who works on this feed?

    The feed started as an initiative of Alienvaults own Vulnerability Research Team, but we are already in talks with other groups and users in order to create a plugin consortium which guarantees the continued availability of a high quality feed.

    We've also used code and plugins from OpenVAS and will be bundling the high quality plugins from the guys at SecPod.

    Do you accept contributions / sponsoring?

    Sure we do, contributions are most welcome. Please write to code@alienvault.com for more information on how to contribute. After launching the consortium we'll provide a much user-friendlier interface for individuals and organizations to contribute.

    On the sponsoring side you might have noticed the logo of our main sponsor, Telefonica, on the feed site, and of course we're open to other types of sponsoring which will allow us to further enhance this service.

    What about the license ?

    Plugins released by AlienVault are being released under GPL v2. Plugins are and will remain free. Plans on specific or delayed feeds such as Sourcefire does have been under discussion but are being discarded right now.

    Can I use OpenVAS for scanning ?

    Of course, in fact it's encouraged since you can check the source code of what you're installing. OpenVAS is Nessus natural successor in the opensource world.

    We've been assigned the OID 1.3.6.1.4.1.25623.1.3 by OpenVAS, and all of the released plugins will feature this new naming scheme.

    OpenVAS testing has been limited tho, so any feedback from that side will be more than welcome.