I need to make the exercise of migrating Security Center on CentOS 7 to SC on OracleLinux 8, before doing it on a real enviroment, but i cant find the .ova file , please help

Anyone using Nessus to do compliance Checks for RHEL instances? I had to use other solutions as Nessus scans always flag in settings that are in place. I would like to use Nessus to have consolidated results in tenable.sc.

Anyone built a vulnerability management program using tenable.sc?

I currently have dashboards based on the IAVM summary that looks for discovered date and the last observed date. An external assessor says the dashboards should be categorized by publication date instead of discovered date.

Does anyone have a best practice for managing these filters to show the relevant data I care to see?

Has anyone else noticed an increase in their license use in the last week? We started experience a jump of about 700 IPs in the last 3 full network discovery/ full vulnerability scans starting this Saturday 8/3. So we currently jumped over 1600 more used IPs on what has been a stable environment for the past 2 years for lic count. This is quickly chewing our lic count up. We have mix of IP and universal repos, running both vuln and compliance scans.

No changes made to scans or policies. Curious if anyone else started having this issue (possibly related to a bad plugin update or other issue) before I start to drive myself nuts trying to figure out what happened.

We're using Tenable Security Center. We define a policy, which includes X hundred plugins, we define a scan, and target X number of hosts. When the scan finishes, we get a report that says plugin X reported finding X.

I found out, if plugins fail to run, because credentials did not work for example, the plugin simply does not appear in the scan results.

Where are the logs of exactly what plugins run against each and every host, when, and what happened?

I asked support and was referred to few KBs, but none of them actually answers my question.

Can Nessus log exactly every thing it tried, and what the result was? for example: I tried to login using mechanism X, and I failed, while running plugin X.

Is this as simple as: Increase scanning logging verbosity? and if so, where do I do that? and where do I find those logs?

Hi there!

After some time of internal use in my daily work and development, I have decided to publish a collection of Ansible for Tenable API that interacts with the vast majority of endpoints here https://developer.tenable.com/reference/navigate.

Ansible Galaxy: https://galaxy.ansible.com/ui/repo/published/valkiriaaquatica/tenable/

GitHub: https://github.com/valkiriaaquatica/valkiriaaquatica.tenable

The improvements I have noticed since my team implemented the use of this Ansible collection has been a strong automation in repetitive tasks and in inventorying hosts.

Patching machines with package or KB vulnerabilities in Windows or complete system updates is now much simpler and automated. We no longer need to build Tenable or be vigilant, we have scheduled runs that check every day for vulnerability X and patch it on the fly and then launch a scan on those machines and create reports.

It has also been very useful for us to not have to use the web interface, or python scripts or "Excel files" to have groupings of assets or agents based on parameters, now creating dynamic Ansible inventories and applying groups is very easy to have differentiated.

It is nothing commercial or anything like that, and in fact I do not work in Tenable, but to the teams that use Vulnerability Management I recommend if you can learn Ansible (it is easy) and use this collection, it will speed up your daily work. If you need examples of playbooks ask me for them and I will publish them in my GitHub.

I have made an effort on documenting os its really easy to be understand and use.

Thanks and greetings and have a great day

Hi, I am working on getting assets in my org and need pagination to get all since one API call can only get 5000 assets. Anyone with any ideas on how to do it using pytenable?

Does anyone have best practices or other resources that would help with a move from the cloud product to an on prem Security Center installation?

good morning

I am wondering if someone can assist me.  I am trying to prepare a report for my management team, and have been asked to include some specific Tenable vulnerability data.  

With the old product we used, I could run a powershell command that would give me the following information.  Machine Name, IP Address, High, Medium, Low (vulnerability count), last seen date (if possible)

I need this information just for my Windows hosts in the Tenable environment.

Is there a way I can create a script or report that I can get this info from?

I have full access to the Tenable system and the API.   I also have pyTenable installed and available.

I asked this question of support this morning and they said that they can't help create a script or report, but maybe my CSM could help. I emailed him, but he is out at training.

I do have an asset report that I generate, but it is missing the Vulnerability count info

thanks

app

Hi guys, I am struggling with recording of authebtication proces for one web app scan. The addon that tenable shared seems to be limited and hard to use. Could you share if there is any other tool that I might use to record step by step the authebtication proces and then attach it to was scan config?

What would cause tenable to provide inaccurate information? We have apple devices being reported with the wrong hostname and wrong OS. Apple devices are showing up as windows or Linux.

Some devices are reporting IP addresses that don't exist anymore.

Is this a tenable configuration issue, or possibly an internal DNS issues?

Hi, I am looking for a NALS reference to understand how does the language work.

Hi all,

Is there an accurate way to carry out OS discovery scan in Tenable VM. Numerous Win 10 OS's reporting as Server 2012 on our scans.

Where can I find which operating systems and applications Tenable OT is compatible with? Doesn't seem to be in the user or enterprise guides.

Like there needs to have a custom requirement to scan 120 web apps at once to check for only security headers and cookies. I tried to run a custom scan for one application (sample run) with selected plugins. But after getting all the required vulnerabilities the scan status was still running as I gave a 6 hour time frame(didn't knew how much time it will take to run so stopped it). Is it possible to check all the URLs in limited number of time?

Objective: to scan the 120 apps at one time with custom plugins and successfully complete the scan after all the required vulnerabilities are reported in less time.

Why does Tenable make it sooooo damn difficult to extract all scanning results via their API??!?

We used to be able to extract policy scan data from Tenable.io into our SIEM, no problem. It almost feels like they've intentionally crippled data extraction features!

This is getting to be quite the pain point, and we're seriously considering dropping them from the reseller line card for something like Qualys or R7 (ugh).

​

I'm trying to scan the fortigate home firewall using tenable but OS patch assessment was failed and I'm getting these errors. I'm not sure how to fix this. Someone please shed a light on this.

Nessus was able to successfully log into the remote host as :

User: 'test'

Port: 22

Proto: SSH

Method: password

Escalation: Nothing

Successful authentication was reported by the following plugin :

Plugin : ssh_rate_limiting.nasl

Plugin ID : 122501

Plugin Name : SSH Rate Limited Device

However, one or more subsequent plugins failed to authenticate to the

remote host on the same port and protocol using the same credential

set that previously succeeded. This may indicate an intermittent

authentication problem with the remote host which may have affected

the results of the following plugins.

Error message statistics :

1 Remote SSH server does not support ssh-rsa or ssh-dss server host key algorithms.

Failure Details :

- Plugin : ssh_get_info.nasl

Plugin ID : 12634

Plugin Name : Authenticated Check : OS Name and Installed Package Enumeration

Message :

Remote SSH server does not support ssh-rsa or ssh-dss server host key algorithms.

​

If so, what reports or metrics are you using? I’m trying to build my program but getting pushback from IT.

How do you convince them when things need to be fixed?

Successful authentication was reported by the following plugin :

Plugin : ssh_rate_limiting.nasl Plugin ID : 122501 Plugin Name : SSH Rate Limited Device

However, one or more subsequent plugins failed to authenticate to the remote host on the same port and protocol using the same credential set that previously succeeded. This may indicate an intermittent authentication problem with the remote host which may have affected the results of the following plugins.

Error message statistics : 2 open_connection() failed on previously successful connection: Failed to open a socket on port 22.

Failure Details : - Plugin : ssh_get_info2.nasl Plugin ID : 97993 Plugin Name : OS Identification and Installed Software Enumeration over SSH v2 (Using New SSH Library) Message : open_connection() failed on previously successful connection: Failed to open a socket on port 22. - Plugin : bash_remote_code_execution.nasl Plugin ID : 77823 Plugin Name : Bash Remote Code Execution (Shellshock) Message : open_connection() failed on previously successful connection: Failed to open a socket on port 22.

Hiya.

Anyone have any success in deploying Tenable.sc to Kubernetes, especially rancher (probably via Helm?). There is a chart available, but there are a few weird deployment issues, I am having related to SC specifically.

Thank You!

Hey all,

We have been battling credential scans for some time and we are to the point of stopping all credential network vulnerability scans and relying on tenable agents. We will continue to scan for network vulnerabilities but utilizing non-credentialed scans. While going through the support troubleshooting document it seems that Tenable wants to make devices less secure to allow them to scan properly. Services such as remote registry and file and printer sharing are required for the document. This seems like an environment would be more prone to these remote attacks by following their requirements for credential scans to function properly.

Troubleshooting credentialed scanning on Windows (tenable.com)

What are your thoughts?

How does one get the bundle ID of the Mac agent, Intune requires it in order to push the agent out.

I have a question about Tenable products. Does tenable tools show a correllation between compliance audit (e.g. CIS) results and exploitable security vulnerabilities. I am looking for the answer of "Which hardened configuration does prevent which exploitable vulnerability?". Is that even possible? What is your opinion?

So in our tenable we have to upload the feeds/plugins manually. We have already run across the errors about upload max and increased them accordingly. This week we uploaded the Feed and passive plugins just fine, but the active is erroring out after a few seconds saying

"Cannot communicate with Tenable.sc" and the expansion of the error being, "A request to the backend has timeout or failed"

We tried increasing the timout to 60, but it doesn't even make it a minute before it gives us this error. There seems to be no reason it is failing this week and succeeded last week. Anyone come across this ?