# Tenable Host Doctor

> Diagnoses why a single host failed a Tenable credentialed scan, from its .nessus export.

- Type: Agent
- Author: ddangthatscrazy
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Source repository: https://github.com/ddangthatscrazy/tenable-host-doctor
- Repo state: not archived
- Last push: 2026-06-18T03:57:42Z
- Stars: 4 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: platform-operations
- Tags: tenable, nessus, vulnerability-management, credentialed-scan, troubleshooting
- Date added: 2026-06-18
- Listing page: https://exchange.tenable.com/agents/tenable-host-doctor
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/agents/tenable-host-doctor.md

Tenable Host Doctor is a local-first, deterministic diagnostic tool that explains
why a specific host failed — or only partially completed — a Tenable Nessus
credentialed scan. It reads a host's `.nessus` export, classifies the root cause
from the actual plugin evidence, and produces an actionable report. An optional
LLM layer adds plain-language narrative on top of the deterministic findings.

## What it does
Given one host from a Nessus scan, it determines the single most likely reason
credentialed local checks didn't run as expected — distinguishing genuine
credential failures from privilege, registry, database, integration, connectivity,
agent-vs-scanner, and host-discovery causes — and returns specific remediation for
the protocol involved (SMB/WMI or SSH). It also surfaces scan-tuning, port-coverage,
and scanner-placement context where the evidence supports it.

## How it works
The tool parses the `.nessus` export (plugin outputs and policy preferences) and runs
a set of deterministic analyzers that key off verified Tenable plugin semantics. It
reports a single primary verdict plus additive findings that can coexist with it, and
is built to assert only what the plugin evidence supports — ambiguous signals are
surfaced as leads, not conclusions. The deterministic core runs without any AI; the
optional LLM enrichment layer interprets the findings in plain language.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/agents/tenable-host-doctor.json. The full index and how to read it: https://exchange.tenable.com/llms.txt