Download NESSviewer

Beta

NESSviewer 0.0.20

Posted 5 October 2026

This build follows the 21 September beta (0.0.17). The headline change is how NESSviewer tells scanned machines apart: two machines that share an IP address are no longer treated as one. The POA&M Update page now keeps track of which project it belongs to, and several reported problems are fixed. This review build runs through 31 October 2026; a newer build will be posted before then.

Feature-complete and in testing. Includes the baseline module.

What’s changed

Machines that share an IP address

Until now, NESSviewer told hosts apart by IP address and hostname. Reusing private addresses across enclaves is common, so two different machines scanned at the same IP could be folded into one host: one Scan Status row, one status built from both machines' results, and one host in the Dashboard counts. Hosts that Nessus could not name were affected worst, because all of them were grouped together when working out scan status. Each machine is now counted on its own.

• How machines are identified. NESSviewer uses what the scan itself reports about the machine: the AWS instance ID, BIOS UUID, Active Directory computer account, McAfee ePO GUID, fully qualified domain name, MAC address and hostname. Two scans that report the same machine are recognised as one machine, even when its IP has changed between scans.
• What is deliberately not used. Tenable's host TAG is ignored, because a cloned machine carries the same TAG as the machine it was cloned from. If a scan reports nothing that identifies the machine, that scan's host stands on its own rather than being merged by IP.
• A machine scanned more than once is shown once, with its best scan. "Best" means the most successful scan status, and the most recent scan when two are equal. The Scan Status tab has two new columns. Scans shows how many loaded scans saw the machine. Asset ID shows what identified it. Analyze also has an Asset ID column.
• Each scan's status comes from that scan alone. A good rescan no longer hides a failed scan, and another machine's results no longer count towards this one's status. The Files compliance flags judge each scan file by its own hosts in the same way.
• Counts are per machine. Hosts scanned, top hosts, asset totals and all three Ports views now count machines, not IP addresses.
• Hosts without a name show their IP. A host Nessus could not name used to have a blank hostname. It now shows its IP address, so no host is nameless in a grid.

Severity totals on the Dashboard still count every finding in every loaded scan, as before. If you load several scans of the same machine, its findings are counted once for each scan.

Baseline and scanned hosts

The Baseline now works with the same picture of the scanned machines.

• In Scans and Host Info Matches Scan compare each baseline host against the scanned machines, not against hostnames. When two scanned machines share a baseline host's IP, the MAC address and then the hostname decide which one it is. If nothing tells them apart, the column reads "Unclear: 2 share IP" and the tooltip names the machines. NESSviewer does not guess, and it does not offer Use scan, which would copy the other machine's details onto this host.
• Add/Update Hosts from Scans no longer writes one machine's details over another's:
  • Two machines on the same IP that Nessus could not name are added as two hosts, named "10.0.0.5" and "10.0.0.5 (2)". Rename them to their real names.
  • A second machine found on a baseline host's IP is offered as a new host. It no longer proposes updates to the existing host.
  • When nothing ties a scanned machine to a baseline host, no change is proposed.
  • Adding a host never replaces a value you already have with a blank.
• Fill blank hostnames from Baseline treats a host that shows its IP as unnamed and fills it in. Turning the option off puts the IP back. The Scan Status tab picks up the filled names. If two baseline hosts share an IP, that IP is not used to fill either one. Only a MAC address or hostname that identifies one of them is used.

Two machines on one IP: the workflow

If your scans could not name two machines that share an address, and the scans report their MAC addresses:

1. Open your baseline and choose Add/Update Hosts from Scans. Both machines are offered, each with its own IP, MAC address and FQDN.
2. Add both, then rename them to their real hostnames.
3. Turn on Fill blank hostnames from Baseline. The MAC address ties each machine's findings to the right name throughout NESSviewer.

POA&M Update

• An update now knows which project it belongs to. The first time you use an update with an eMASS POA&M export loaded, the update is linked to that system's name and eMASS item IDs. Afterwards, a bar on the page shows the linked system and how many scanned hosts are loaded. NESSviewer warns you when:
  • the loaded POA&M belongs to a different system
  • none of the items being updated are in the loaded POA&M
  • no POA&M is loaded
  • the loaded scans do not contain any of the update's hosts

  These are warnings only, and nothing is blocked. If the system was renamed in eMASS, you can re-link the update.

• The two exports can no longer be mistaken for each other. Export to eMASS writes POAM_Update_eMASS_Import.xlsx, which is the file to upload to eMASS. The grid's own Excel export writes POAM_Update_Working_View_NOT_FOR_eMASS.xlsx, and its tooltip says it is a working copy.
• Fill from Defaults:
  • It now applies a default you have changed, not only defaults filling blank fields.
  • Each row has one checkbox, labelled Overwrite, which says whether to replace a value that is already filled in.
  • The risk defaults now save.
  • Milestones that already exist in eMASS, and items being closed, are never changed.

Fixed

• An opened POA&M Update document closed itself shortly after it was opened. Fixed.
• Excel exports drew an X through every cell. The POA&M, POA&M report and test-result exports now have normal grid lines.
• The DVL per-scan Excel export failed without any message. It now saves, and if it cannot save it tells you why.

Earlier releases

More on NESSviewer

• NESSviewer overview: what it does and how it compares
• User guide: how to use it
• License agreement: the NESSviewer EULA
• All downloads: every product’s current version