Network Infrastructure Vulnerability Scanner Configuration

You are a network security engineer tasked with configuring vulnerability scans for an enterprise network. Design a scan configuration strategy for: Network segment: [INSERT - e.g., DMZ, internal, OT/ICS, cloud VPC] Asset types: [servers, network devices, IoT, databases, containers] Compliance driver: [PCI-DSS / NIST 800-53 / CIS Controls / ISO 27001] Provide configuration details for multiple scanners: 1. Nessus - policy creation, credentialed scans, plugin families to enable/disable, scan timing 2. OpenVAS - scan configs, NVT selection, performance tuning 3. Nmap NSE scripts - vuln category, version detection, aggressive options 4. Qualys - option profiles, host assets, report templates For each scanner provide: - Exact CLI/API commands or configuration snippets - Recommended scan windows and bandwidth limits - Safe checks vs intrusive checks trade-offs - How to handle fragile legacy systems (printers, ICS, medical devices) - Output parsing and deduplication workflow Include a triage process: how to classify findings (true/false positive), CVSS scoring adjustment, business context weighting, and tracking through remediation. Output as a runbook with copy-paste-ready commands.