3. Loading Your Scan Data

Everything in NESSviewer starts on the Files page. Until a scan is loaded, the Dashboard reads zero, the Analyze grid is empty and the reports have nothing to describe.

3.1 The Files page at a glance

The Files page has four tabs: Files, Baseline, eMASS POA&M and Remediation Plan. This chapter covers the Files tab, which is where scans are loaded. The other three tabs are covered in chapter 4.

The Files tab has four parts, top to bottom:

1. A row of loading controls: Load Files with a dropdown of recently used scan files, and Load Folder with a dropdown of recently used folders.

2. A toolbar above the grid, carrying the export commands and — once you tick a row — an Unload button.

3. The grid of loaded scan files, which doubles as the drag-and-drop target.

4. A panel headed Reference Files with a row each for Baseline, eMASS POA&M and Remediation Plan.

3.2 Loading scans

Using the buttons

Load Files opens a file picker titled Select Nessus file(s) that accepts .nessus and .zip files. You can select several at once.

Load Folder opens a folder picker. NESSviewer then loads every file it recognises anywhere in that folder, including files in subfolders.

Important

A folder load reaches every level below the folder you picked, and it does not only take scans. If the folder happens to contain a spreadsheet, that spreadsheet is treated as an eMASS POA&M; if it contains an XML file, NESSviewer checks whether it is a remediation plan. Point Load Folder at a folder of scans, not at a general project folder.

Using the recent lists

The dropdown beside each button lists the files and folders you loaded most recently — up to ten of each. Choosing an entry loads it straight away.

Note

The recent dropdowns always look empty. That is deliberate: the selection is cleared the moment your choice registers, so the box never shows a “current” value. Choosing the same entry again simply reloads that file.

Only files ending in .nessus are added to the recent-files list. If you habitually load .zip bundles or use Load Folder, the recent-files dropdown stays empty — use the recent-folders dropdown instead.

Drag and drop

You can drag files or folders from File Explorer straight onto the grid area. While the grid is empty it shows the prompt:

Drag and drop .nessus scans, a test plan (.tpln), remediation plan (.xml), POA&M (.xlsx), or a folder of them — or use the buttons above

While you are dragging over it, the prompt changes to Drop scans, test plan, remediation plan, POA&M, or a folder of them. Dropping loads immediately, with no confirmation step.

Note

The drop target is the grid area only. Dropping onto the toolbar or onto the Reference Files panel does nothing.

3.3 What NESSviewer accepts, and what each file is

NESSviewer decides what a file is from its extension. There is one exception: an .xml file is opened and accepted only if it really is a remediation plan.

Extension	Treated as	In plain language
.nessus	Scan	A Nessus or ACAS scan export. Contains the hosts, the findings and the plugin write-ups. This is the file NESSviewer is built around.
.zip	Scan bundle	Opened automatically; every .nessus file inside is loaded, including scans inside nested zips.
.tpln	Baseline / test plan	Your site test plan: the authoritative list of hosts and which STIGs or ACAS batteries each must be tested with.
.xlsx or .xlsm	eMASS POA&M	An eMASS POA&M export — your open items with their statuses, milestones and completion dates.
.xml	Remediation plan	A remediation plan keyed by plugin ID: action, category, estimated completion date, point of contact, details and mitigation.
Anything else	Ignored	Silently skipped. See section 3.7.

3.4 What happens when a scan loads

While files are loading, the grid dims and a spinner appears in the centre. There is no per-file progress or “3 of 20” counter, so a large folder can look inactive for a while — the spinner is the only signal that work is happening.

Behind that spinner, NESSviewer:

• Parses each scan, several at a time, and extracts the findings, the per-host software inventory and every host property the scan recorded.

• Works out a scan status for every host — whether the scan actually succeeded on that machine — from the authentication plugins that fired. Chapter 5 covers what each status means.

• Judges each scan file against your business rules and fills in the Compliance column.

• Joins the findings to your eMASS POA&M, if one is loaded, matching on plugin ID.

• Joins the findings to your remediation plans, if any are loaded, again on plugin ID.

• Fills in blank hostnames and host descriptions from the baseline, if you have turned those options on.

• Works out which findings are old enough to require a POA&M entry.

Note

Loading the same file twice does not double the data. NESSviewer replaces that file’s rows rather than adding a second copy. Two different files that both contain the same host do each contribute their own rows, which is correct — they are two separate observations.

3.5 Reading the Files grid

One row per loaded scan file.

Column	What it shows
File	The file name on its own.
Report Name	The report name recorded inside the scan export — usually the scan job’s name in Security Center.
Compliance	Whether the scan passes your business rules: OK, Issues, or blank. Blank means no rules are switched on, so there is nothing to judge against.
Scan Date	When the scan finished.
Plugin Date	The date of the plugin feed the scanner was using. A large gap between this and Scan Date means the scanner was running on stale plugins.
Type	Always Nessus.
Path	The full path the file was loaded from.

To find out why a scan shows Issues, go to the Dashboard’s Scan Information tab and click the scan — the details panel lists each broken rule in plain language. Section 5.2 covers this.

Tip

Use the search box above the grid to pull up one scan out of a long list. It highlights matches rather than hiding rows, so you keep your bearings.

3.6 Removing scans

To take a scan back out:

1. Tick the checkbox at the left of each row you want to remove. You can tick several.

2. Click Unload in the toolbar — it appears as soon as at least one row is ticked.

Important

Unload takes effect immediately with no confirmation and no undo. It removes the scan’s row, all of its findings, its software inventory and its host information. Everything downstream — the Dashboard totals, the Analyze grid, the reports — recalculates without it. If you unload every scan, the whole application returns to its empty state.

Unload does not touch reference files. To change the baseline, POA&M or remediation plan, use their own tabs (chapter 4).

3.7 Reopening your last session

NESSviewer can put back everything you had loaded when you last closed it. The switch sits under the load buttons on the Files tab:

Reopen these files when NESSviewer starts

Beneath it, a line tells you what that currently means — Nothing is loaded yet — whatever you open will come back next time., or {n} scans, plus the reference files open alongside them.

With it on, the next launch reopens, in this order: your scans, the Baseline, the eMASS POA&M, and every remediation plan that was open. Scans go first so the POA&M and remediation joins have findings to match. Progress is shown on the splash screen — Reopening 3 scans…, Reopening POA&M… and so on.

Behaviour	Detail
You are never asked	There is no “restore last session?” prompt. With the switch on it simply happens; with it off, nothing is restored.
Missing files are skipped	A file that has been moved or deleted is passed over silently — the Files grid just shows what came back.
Files that fail to load are reported	Once, the first time you open the Files page, using the standard dialog described in section 3.8.
Walkthrough samples are never remembered	A walkthrough’s sample scan can never become “your session”.

Note

Your Analyze views come back regardless of this switch — they are remembered separately.

Tip

Turn it on if you work on one system for weeks at a time. Leave it off if you move between systems, where reopening the previous system’s files is a nuisance at best and a mistake at worst.

3.8 When a file does not appear

NESSviewer tells you when a file does not load. After any load — button, drag and drop, recent item or session restore — anything that did not make it is listed in a single dialog titled 1 file was not loaded or {n} files were not loaded, with one line per file and the reason.

Line	What happened
{file} - file not found (removed from recent files)	The path no longer exists. It has also been dropped from the recent list.
{file} - not a file type NESSviewer opens	An unsupported extension — or an .xml that turned out not to be a remediation plan.
{file} - The file is empty or has no root element.	The file is empty or truncated.
{file} - {reason}	The scan could not be parsed. The reason is the underlying error: malformed XML, invalid characters, a permissions problem, or a file open in another program.
{file} - skipped: identical to the already-loaded {path}	The same scan, byte for byte, is already loaded from somewhere else. Not an error — NESSviewer declined to load it twice.
{file} - skipped: identical to {path} in the same selection	You selected the same scan twice in one go, from two different folders.

Note

Duplicate detection compares the contents of the file, not its name or location. A scan copied into two folders, or renamed, is still recognised as the same scan. Re-loading a file from its own path is not a duplicate — that replaces its rows, which is how you pick up a re-exported scan.

A few things are still passed over without a message:

• A corrupt or locked .zip, or one containing no .nessus files.

• A .nessus file containing no hosts — it loads successfully and produces no row.

• Any .xlsx or .xlsm is assumed to be an eMASS POA&M, on its extension alone. Load spreadsheets deliberately rather than by dropping a folder that happens to contain one.

• A scan exported without XML Plugin Attributes loads completely, but every finding arrives with no Description, Synopsis or Solution. The only signal is a compliance issue, and only if that rule is enabled.