Listen to this Post
Introduction:
Vulnerability assessment (VA) reports exported from Nessus or Tenable Security Center often contain thousands of rows of “Info” severity findings, duplicate plugin entries, and uncredentialed scan noise. Analysts waste hours manually pruning spreadsheets before they can prioritize real risks. The newly released Nessus VA Report Cleaner—a local, browser-based HTML tool—automates this process, reducing a raw 170-row export to just 41 actionable findings in seconds, all without sending sensitive data to any server.
Learning Objectives:
- Identify common noise sources in Nessus exports, including uncredentialed IPs, plugin ID 19506 (“Nessus Scan Information”), and Severity = Info rows.
- Implement automated filtering and de-duplication logic using client‑side JavaScript and the SheetJS library.
- Apply similar data sanitization techniques via command‑line tools (Linux and Windows) to integrate with existing VA pipelines.
You Should Know:
1. Understanding Nessus Report Noise and Credentialed Scans
Raw Nessus CSV exports contain three primary types of noise:
– Plugin ID 19506 – “Nessus Scan Information” (provides metadata, not a vulnerability).
– Severity = Info – informational findings that do not represent risk.
– Uncredentialed IPs – hosts where Nessus could not authenticate, leading to incomplete or false positives.
The tool automatically checks a “Credentialed Scan” column (if present) and filters out IPs marked as uncredentialed. This ensures only reliable, deep‑scan results are kept.
Step‑by‑step to manually identify noise in a Nessus export:
1. Open the CSV in a spreadsheet or text editor.
2. Locate the `Plugin ID` column – delete any row where `Plugin ID` equals 19506.
3. Locate the `Severity` column – delete rows where `Severity` equals Info.
4. Locate the `Credentialed Scan` column (boolean) – delete rows where value is `False` or No.
- Manual Cleanup with Command Line (Linux & Windows)
For analysts who prefer scripting, here are verified commands to replicate the tool’s filtering without a browser.
Linux (using csvkit and awk):
Install csvkit if needed: pip install csvkit Remove Info severity and plugin 19506, then keep only credentialed IPs csvcut -c Plugin_ID,Severity,Credentialed_Scan,IP,Name nessus_export.csv | \ csvgrep -c Severity -r "Critical|High|Medium|Low" | \ csvgrep -c Plugin_ID -m 19506 -i | \ csvgrep -c Credentialed_Scan -m "True" > cleaned_report.csv
Windows (PowerShell):
Import CSV, filter out noise, export to new CSV
$raw = Import-Csv .\nessus_export.csv
$cleaned = $raw | Where-Object {
$<em>.Severity -ne "Info" -and
$</em>.Plugin_ID -ne "19506" -and
$_.Credentialed_Scan -eq "True"
}
$cleaned | Export-Csv .\cleaned_report.csv -NoTypeInformation
De‑duplication (by Plugin_ID + IP) can be added in PowerShell using `Group-Object` or a hash table.
3. Building the Local HTML Tool: Core Functions
The tool runs entirely in the browser using the SheetJS library (XLSX) for parsing Excel/CSV and vanilla JavaScript for filtering. No data leaves the user’s machine.
Step‑by‑step to build the tool from scratch:
- Create an `index.html` file with a file input element and a “Process” button.
- Include SheetJS via CDN: ``
- On file upload, read the workbook using
XLSX.read(data, {type: 'array'}).
4. Convert the first sheet to JSON: `XLSX.utils.sheet_to_json(worksheet)`.
5. Apply filters:
let filtered = rawRows.filter(row => row.Severity !== "Info" && row.Plugin_ID !== 19506 && row.Credentialed_Scan === true );
6. De‑duplicate using a `Map`:
const uniqueMap = new Map();
filtered.forEach(row => {
const key = <code>${row.Plugin_ID}|${row.IP}</code>;
if (!uniqueMap.has(key)) uniqueMap.set(key, row);
});
const deduped = Array.from(uniqueMap.values());
7. Write back to XLSX and trigger download using `XLSX.write` and a Blob.
4. Automating De‑duplication Based on Plugin + IP
Duplicate findings occur when the same plugin reports the same vulnerability on the same IP across multiple scan intervals or export rows. The tool’s de‑duplication logic ensures each unique (Plugin ID, IP) combination appears only once.
Step‑by‑step to implement de‑duplication manually (Python example):
import pandas as pd
df = pd.read_csv('nessus_export.csv')
Filter out noise
df = df[(df['Severity'] != 'Info') & (df['Plugin_ID'] != 19506) & (df['Credentialed_Scan'] == True)]
Deduplicate
df_dedup = df.drop_duplicates(subset=['Plugin_ID', 'IP'], keep='first')
df_dedup.to_excel('clean_report.xlsx', index=False)
This method preserves the first occurrence of each vulnerability, which typically contains the most complete description.
- Enhancing for Tenable Security Center and Other Formats
Tenable Security Center exports may use different column headers (e.g., `severity` lowercase, `pluginId` without underscore). The tool can be adapted by mapping column names dynamically.
Step‑by‑step to add column auto‑detection:
- Read the first row of the JSON to get all keys.
2. Define a mapping dictionary:
const colMap = {
severity: ['Severity', 'severity', 'Risk'],
pluginId: ['Plugin_ID', 'pluginId', 'Plugin ID'],
credentialed: ['Credentialed_Scan', 'credentialed_scan', 'Authenticated']
};
3. For each expected column, find the first matching key in the data row.
4. Use the detected keys in the filter conditions.
5. Log the detected mapping to the processing log for transparency.
6. Privacy‑First Approach: Client‑Side Processing
Many VA teams are prohibited from uploading scan results to third‑party cloud services. By running entirely in the browser, the Nessus VA Report Cleaner guarantees that no data is transmitted over the network.
Step‑by‑step to verify no data leaves your machine:
1. Open the browser’s Developer Tools (F12).
2. Go to the Network tab.
- Upload a sample Nessus CSV file and click “Process”.
- Observe that no HTTP requests are made except for loading the HTML/JS files themselves.
- The generated XLSX file is created locally via a `Blob` and
URL.createObjectURL(). - For extra security, save the HTML file and disconnect from the internet – the tool will still work.
7. Integrating into Vulnerability Management Workflow
The cleaned report can be directly fed into ticketing systems, dashboards, or executive summaries.
Step‑by‑step workflow integration:
1. Run Nessus scan → export CSV/XLSX.
- Open the local HTML tool → upload export → download cleaned XLSX.
- Import cleaned file into Jira/ServiceNow using CSV importers.
- For weekly reporting, schedule a PowerShell or Python script (from section 2) to run the same filters on new exports automatically.
- Use the processing log (timestamped actions) as audit evidence for which findings were removed.
What Undercode Say:
- Key Takeaway 1: Automating noise removal and de‑duplication reduces VA triage time by over 75%, allowing analysts to focus on true positives.
- Key Takeaway 2: Client‑side processing (HTML/JS) is a privacy‑first alternative to cloud‑based tools – essential for regulated industries handling sensitive asset data.
Analysis: The tool addresses a pain point that commercial vulnerability managers often overlook. Many SOC and Blue Team members still rely on manual Excel filtering, which is error‑prone and unscalable. By open‑sourcing a browser‑based solution, the creator empowers analysts without requiring admin rights or installation. The inclusion of a processing log also supports audit compliance (e.g., ISO 27001, SOC2). Future enhancements could include automated severity weighting or integration with the Tenable API to fetch plugin descriptions. Overall, this represents a shift toward lightweight, utility‑first security automation.
Prediction:
As VA and pentesting reports grow in volume (often exceeding 10,000 rows per enterprise scan), the demand for automated pre‑processing tools will skyrocket. We predict that within 18 months, most commercial VA platforms will bundle similar “report cleaner” features natively. Meanwhile, open‑source scripts like this will evolve to incorporate AI‑based false‑positive detection, natural language summarization of findings, and direct SOAR playbook triggers. The key differentiator will remain privacy: organizations will prefer local‑first tools over cloud uploads, driving innovation in WebAssembly and client‑side machine learning for vulnerability data sanitization.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Madhan Kumar – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
