Configure and Automate Vulnerability Scans

Expert in vulnerability scanning configuration, covering enterprise security tools - Nessus, OpenVAS/GVM, Nmap - scan optimization, policy creation, and remediation workflows. Core principles: defining clear scan scope with CIDR-notation network boundaries and exclusion lists for critical production systems, scheduling scans during maintenance windows with bandwidth throttling and distributed scanning, using authenticated scans with least-privilege credentials where possible, and tailoring scan policies per environment - web apps, databases, network devices - rather than defaults.

Use this when configuring or optimizing a vulnerability scanner such as Nessus, OpenVAS, or Nmap, building a compliance-mapped scan policy, automating remediation ticket creation from scan results, or integrating vulnerability scanning into a CI/CD pipeline.

Not needed for a one-off manual vulnerability check, or for scanning tools outside Nessus, OpenVAS, and Nmap not covered here.

Produces runnable configuration and scripts: a Nessus custom-policy and scan-launch API call (max_checks_per_host, max_hosts_per_scan, safe_checks, custom text_targets); an OpenVAS/GVM create_config XML defining a custom web-app scan policy with NVT preferences like a custom User-Agent and CGI paths; a four-phase Nmap script covering host discovery, service detection with -sV -sC -O -A --script=default,vuln, web scanning with http-enum/http-vuln-*, and MySQL-specific scanning; a NIST 800-53-mapped compliance scan policy in YAML naming specific controls (AC-2, AC-3, SI-2) and plugin families; and a Python script that parses a .nessus results file for high/critical findings (severity >= 3), extracting host, plugin ID/name, severity, description, solution, and CVSS score per finding, then auto-creates JIRA tickets carrying that detail, with severity-based priority (High vs. Critical), vulnerability/security/CVSS labels, and an SLA-calculated due date.

### Phase 2: Service Detection
nmap -sV -sC -O -A --script=default,vuln \
     --script-timeout=10m \
     --max-parallelism=100 \
     --min-rate=1000 \
     -oA detailed_scan \
     -iL live_hosts.txt

Performance guidance: round-robin scan scheduling across network segments to distribute load, disabling irrelevant plugin families per asset type such as Windows plugins on Linux-only networks, distributed scanner appliances or agents per network zone, and monitoring scanner resource usage to tune concurrent scan limits. A Jenkins pipeline integration triggers a Nessus scan via API as a pipeline stage, polls the scan status in a loop until it reports completed, and then exports the results file for downstream processing.

Security engineers configuring, optimizing, or automating vulnerability scanning across Nessus, OpenVAS, and Nmap, who need concrete, copy-adaptable API calls, scan scripts, and compliance-mapped policies rather than generic scanning concepts explained without runnable examples.