Do not scan operational technology devices

###
#   (C) Tenable, Inc.
###

include("compat.inc");

if (description)
{
  script_id(109142);
  script_version("1.12");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/04");

  script_xref(name:"IAVB", value:"0001-B-0526");

  script_name(english:"Do not scan operational technology devices");
  script_summary(english:"Exclude OT devices from scan.  Optionally enable OT Discovery.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host appears to be a fragile device and will not be
scanned.");
  script_set_attribute(attribute:"description", value:
"The remote host appears to be operational technology device. Such
devices often react very poorly when scanned. To avoid problems, Nessus
will not continue to scan this device unless the scan policy is configured to
scan OT devices.

If you would like to safely assess security vulnerabilities on this device,
Tenable suggests contacting your account representative to discuss employing Tenable.OT,
which is purpose built to address vulnerability management on devices of this type.

Some OT discovery is available in Nessus using a special 'OT Discovery' scan template.

Note: OT devices often have nested interfaces or additional attached devices that
may not be accounted for in a traditional scan");

  script_set_attribute(attribute:"solution", value:
"If you are not concerned about such scan behavior, enable the 'Scan
Operational Technology devices' setting under 'Fragile Devices' in
the 'Host Discovery' section and then re-run the scan.");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);

  script_copyright(english:"This script is Copyright (C) 2018-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Settings");
  script_dependencies(
    "dont_scan_settings.nasl",
    "scada_profinet_network_detect.nbin",
    "scada_cip_list_identity.nbin",
    "scada_modbus_coil_check.nbin",
    "scada_bacnet_detect.nbin",
    "scada_siemens_simatic_s7_plc_detect.nbin",
    "scada_app_7t_igss_dc_detect.nbin",
    "scada_app_igss_odbc_detect.nbin",
    "scada_iccp_cotp_detect.nbin",
    "scada_omron_udp_detect.nbin",
    "scada_omron_tcp_detect.nbin",
    "scada_crimson_detect.nbin",
    "scada_dnp3_device_detect.nbin"
  );

  exit(0);
}

if(isnull(get_kb_list("Host/scanners/*")) || len(get_kb_list("Host/scanners/*")) == 0)
  return exit(0, "No port scanners are configured in the scan policy");

if(has_ot_proto())
{
  replace_kb_item(name: "Host/OT", value: true);
  var extra = 'Operational Technology protocols identified:' + '\n';

  # report ot protocols detected (if any)
  var proto_list = ot_proto_list( );
  var key = "";
  foreach key(keys(proto_list))
  {
    # report ot protocols detected (if any)
    extra = extra + key + '=' + proto_list[key] + '\n';
  }

  var otscan = get_one_kb_item("Scan/Do_Scan_OT");
  var otscout = get_one_kb_item("Scan/Scan_OT_with_Scout");

  if((isnull(otscan) || !otscan) && !otscout)
  {
    # general OT dont scan is not set (safe scanning enabled)
    # and this asset has indicated OT dont scan
    # marks the asset as dead, dont scan
    set_kb_item(name: "Host/dead", value: TRUE);
    extra += '\nHost is marked dead.  Scanning will stop.\n';
  }
  else
  {
    var scout_only = otscout && (isnull(otscan) || !otscan);
    if (otscout)
    {
      extra += '\nThe OT Discovery engine will be used to assess the target.\n';
    }
    if (otscan)
    {
      extra += '\nScan settings allow a full scan against the target.\n';
    }
  
    var portscanner_kbs = get_kb_list("Ports/*");

    for(var kb in portscanner_kbs)
    {
      set_kb_item(name: "OTScout/" + kb, value: portscanner_kbs[kb]);
      if (scout_only)
      {
        rm_kb_item(name:kb);
      }
    }
  }

  security_report_v4( port: 0, extra: extra, severity:SECURITY_NOTE );
}
else
{
  exit(0, "The target host was not identified as an OT device.");
}