Auth Failure Analyzer
ContributedDiagnoses Tenable Nessus authentication failures by analyzing plugin output from scan results or live MCP lookups, identifying root causes and providing actionable remediation steps.
Powered by Hexa AI, Part of Tenable One
Auth Failure Analyzer is powered by Tenable Hexa AI
Hexa AI is the agentic engine of Tenable One — the AI-powered exposure management platform. See it in action.
Request a Demo →A skill for diagnosing why Tenable Nessus credentialed scans succeed or fail on a given host. Provide a hostname, IP address, asset ID, scan ID, CSV scan results, or paste plugin information directly — the skill identifies all auth-relevant plugins, classifies the overall authentication status, pinpoints the root cause, and gives numbered remediation steps.
What it does
- Accepts a hostname, IP, asset ID, scan ID, CSV scan results, or pasted plugin information as input
- Identifies authentication-relevant Nessus plugins (success signals: 141118, 110095, 10394, 10400, 20811; failure signals: 110723, 104410, 21745, and others)
- Classifies overall auth status as ✅ Success, ❌ Failed, or ⚠️ Partial
- Checks plugin 19506 (Nessus Scan Information) as ground truth for
Credentialed checks: yes/no - Diagnoses root cause in plain English and provides actionable remediation steps
- Distinguishes Windows (SMB/WMI) vs Linux (SSH) authentication paths and flags mismatches
How it works
The skill follows a structured lookup strategy:
- Live MCP lookup — if a hostname, IP, or asset ID is provided and the Tenable MCP server is connected, it queries
workbenches_list_assets→workbenches_get_asset_vulnerabilities→workbenches_get_asset_vulnerability_detailsfor auth-relevant plugins - Scan ID lookup — uses
scan_resultsandscan_host_detailsto retrieve plugin data for a specific scan run - CSV or pasted plugin information — if plugin data is provided directly, analysis proceeds immediately without any MCP calls
Results are presented in a structured table with root cause explanation and prioritized fix steps.