- nmap scripts are a valid start as the engine is readily available. My luck comes in from writing to file every detection as it comes in. Huge pain in the ass, still setup python script to read and parse as it comes in.
- scripting metasploit: getting details from db_nmap isnt nearly as nice as actually running nmap, but the basics are there for version and os detection, apparently the preference on tutorials seems to be using nmap for port scanning aux scanners for everything else. Still, output waits until complete unless you want to read from file as new line comes in. automate inside msf? nope. just nope. aux or nmap or anything else, might as well make a bash script to start monitoring script, then have it start your scans. you handler script may want to leverage more nmap scripts or more modules or other scripts (searchsploit + data as needed).
- stop relying on 10 or 20 + yr old sw to scan for you. I personally like this one. With unified and open source detection databases, there is absolutely no reason to continue using the same 2 or 3 programs shy of personal convenience. Even if you gotta use packet forging tools like scapy, ostinato, wire edit, whatever.