Nessus scanning of SO2

[TheDude2741]

Hey there,

Just wondering if it's possible to vulnerability scan Security Onion 2 itself with ACAS/NESSUS?

Upon initial search in the great web I typically only saw info regarding CVE-2020-27985 and of course Log4J. Is there anything more that can be picked up with Nessus?

[TotieBash]

Yes it is possible to ACAS/NESSUS scan Security Onion 2. It will respond to scan just like any linux distro. I always scan my SO Oracle Linux9 image and also with my RHEL9 network install during pre and post patching just to double check. The biggest caveat are the SO docker containers, by default ACAS or more specifically Tenable Security Center does not scan on the container level. This actually works in our favor since the IA or cyber guys does not know that big caveat so to their eyes the system looks clean and it shows up as credential scan. It does not work in your favor if you are the IA or cyber person then now you know that ACAS does not scan deep down the container level.

To scan at a container level you need another Tenable product which is Tenable Container Security Scanner but it is being phase out and replaced with a cloud product Tenable Cloud Security. As of now the current DISA ACAS product does not have this container scanning figured out...
REF: https://docs.tenable.com/vulnerability-management/Content/ContainerSecurity/Dashboard.htm