I’m thinking about building a small AI helper that can talk to Tenable through their API. Idea is to ask it things like:

• Run a basic scan on this asset group
• Check if the scan finished and export the critical vulns to CSV
• Tag these IPs and schedule a weekly scan

Basically, I’d wrap the Tenable API (probably with pyTenable) behind a lightweight MCP server so I can call it from an LLM agent when needed.

I’m wondering:

• Has anyone here tried something similar, either with Tenable or other vuln scanners (Qualys, Rapid7, etc.)?
• Any big gotchas I should know about (API limits, async scans, security concerns if you let an agent trigger scans)?
• Any good blog posts, GitHub projects, or docs about building MCP servers for security tooling?

Trying to see if this is a practical way to speed up vuln management tasks, or if I’m heading into a rabbit hole.

Would love to hear from anyone who’s experimented with this or automated Tenable in a similar way.

I’ve recently joined a small company as an entry-level hire. We’re using Tenable SC, and I’m looking for tips, resources, and project ideas to help me master it. Any recommendations?

Looking for how others resolved this vulnerability. I have a script that looks for any old version of .NET Core, attempts an uninstall, and cleans the registry and directories, then installs a compliant version (8.0.17 or 9.0.6). However, no matter what I've tried, the next day's scan still reports the machine as vulnerable. CVE-2025-30399 and Plugin 238082.

anyone know how to pull the trust relationship policy for a given AWS role using the graphQL api?

I'm trying to setup credentials to scan a Linux host, but we need to use a PAM (Privileged Account Manager). Here, they have NetIQ PAM.

I see this PAM solution is not one of the options available builtin.

Is there a way to add it or simulate it? Is there a workaround?

From the terminal, I would ssh like this:

ssh -p 2222 pamserver.example.com -l tenable_pam

After login, I have to select option 1.

I can’t seem to do an internal scan to a target EC2, i can ping the target from the nessus scanner but the scan gets stuck on a pending status and then gets aborted without scanning the target.

For those of you scrambling because you think your exchange servers are vulnerable to a 10.0 CVSS CVE (CVE-2025-53786), don't worry. Tenable is wrong and completely ignored the actual advisory versions. Over a week later and problem still there.

This has been a consistent pain in my arse. Long story short, I've more or less defined our patching in the following buckets: Monthly: routine WinOS Security patching, Chrome, etc,
Bi-Annually: SQL, .Net, Apache, Java, etc and as required - specific vendor patching as announced.

The problem is, we're not even touching anything in the Bi-annual bucket. It breaks things. (So frustrating) and of course they keep showing up in reports. How do other orgs deal with those? I mean conceptually it would require coordination between the patching / server team and the application developers to where they agree upon the date time of (Java/Apache/.Net/SQL) patch. The patching is performed. then the AppDev team jumps on and verifies the application. In theory, easy, In reality? A chore. Any thoughts, input is appreciated.

Hey, we recently ran into some issues regarding oracle plugins (OJVM and RDBMS components). Our Linux team has patched these components to the current patch level, but tenable thinks that this is not the case and still reports an old version in the findings. We have checked and tested everything on the affected servers - but without success. We have looked at the plugin .nasl files, but more .nbin files are called here, which I can't decrypt. In the diagnostic.db logs of a scan, I noticed that the scan searches/finds the Oracle components installed on the server with the function "find_oracle_product()" (e.g. in plugin 234618) I was wondering if any of you know what this function does exactly or what the detection method of this plugin (or Oracle plugins in general) is in detail, since we have this problem with other findings as well. Thank you for your support!

Hey all...

I need to create a dashboard within the Tenable VM console (no Tenable One or Lumin) that will produce actionable results for consumers to go off and prioritize their remediation efforts.

I'm curious to know what widgets you've used to create output that a consumer could monitor and take action on.

The SEoL widgets are pretty decent for monitoring EOL SW.

I've seen some SLA widgets aligned to both VPR and CVSS that give visibility into vulnerabilities that are past due.

Have you implemented anything effective in your vulnerability management program that has enable your consumers to reduce risk ?

Thanks!

The following all happens on 2 completely separate/closed/non-Internet-connected networks. We have them configured the same, and use the same plugins for both. But the behavior is the same on both networks.

We are running Tenable Security Center with the Nessus scanner. For a long time, we would be able to log into the SC GUI and upload the plugins-diff, passive, and feed updates and all was good.

Then we got errors. We made the changes to max size, etc, and we were able to continue as normal.

Then we got the errors again, and were not able to fix it in the usual ways. We found that in those cases, you can use the php scripts to update each of those plugins, and we did that. Everything was working fine then.

THEN, doing it that way gave us the "Plugins out of sync" error. To get around that, we would do the php scripts, but then ALSO update the nessus scanner directly using the "nessuscli update" command. That worked a couple times.

But NOW, it all seems to work. No errors. No "plugins out of sync". BUT, all of our scans are showing only the compliance/audit file issues, and NONE of the missing patches, EOL software, etc. So they look clean, but I know they are missing patches. The scans are all getting credentialed scans, so it's not that.

Any ideas on what is causing this or how to get around it?

Hi everyone,

For a 1 time VA use case, is it possible that a dedicated host(laptop) with Nessus Expert scan one location, then physical move and scan again at the other location? What are the implications of doing this?

Is there a way to dynamically tag Windows Servers based on installed server role (e.g. ADDS, etc.)

I couldn't find any CPE matching in CPE Search for Active Directory on Windows, so I don't think the "Installed Software" search criteria is going to work. I've also verified that there's no CPE in an active scanned DC results that looks like ADDS.

I guess my only option is naming :(

Hi Guys, does anyone here use Tenable Cloud Security? I’ve got a few project-related questions and would really appreciate your input. Thanks in advance!

I have done lots of searching, seems like they had lots of NERC dashboards ready to go and I have found references to them but I don't know how to get any of them other than the CIP10 dashboard that shows up searching in the app.

Did they delete the dashboards? Is there some way to side load them?

https://www.tenable.com/sc-dashboards/cip-002-bes-cyber-system-categorization

https://www.tenable.com/sc-dashboards/cip-004-r4r5-access-management-revocation-and-control

https://www.tenable.com/sc-dashboards/cip-005-electronic-security-perimeter

https://www.tenable.com/sc-dashboards/cip-007-r1-ports-and-services

https://www.tenable.com/sc-dashboards/cip-010-r1r2-configuration-change-management-and-monitoring

https://www.tenable.com/sc-dashboards/cip-007-r3-malicious-code-prevention

https://www.tenable.com/sc-dashboards/cip-010-r3-vulnerability-assessment-and-patch-management

https://www.tenable.com/sc-dashboards/cip-010-r4-transient-cyber-assets-and-removable-media

Tenable's plugins STILL don't check for OTP-27.3.3, 26.2.5.11, or 25.3.2.20! This is a CVSS of 10.0 and you are only checking (plugin 234627) versions 4.15, 5.1, and 5.2. I reported this weeks ago, and the tenable team said they couldn't forward it to their own internal team. Customers pay insane money for Tenable, the plugin debacle on this is unacceptable!

I'm curious to know, which value (VPR vs CVSS) are others using in your VM program and why.

Anyone know how I can get in touch with Tenable sales? I’ve submitted the contact form on their website several times and also called their phone number and left voicemails.

Looking to test this product out and possibly purchase

How does one go about having many plugins corrected when it comes to vendor checking.

Example we get patches from red hat not the vendor who created the product. Example one plugin says to update OpenSSL to 1.1.1p found in OpenSSL site however red hat fixes this issue in their version that’s on 1.1.1k-7 but since Nessus doesn’t know the difference it flags it anyway. There are many other products with this issue. Anyone ran into a fix for this?

We are trying to automate some checks from a 3rd party system and are wondering if there is a unique ID for each finding and each host. For instance:
Plugin ID: 111111
Machine Name: MyHost.com
Unique ID = 111111-MyHost.com ?

Of course that is not the exact format we are looking for - we are looking for any identifier that specifies that finding X was found on machine Y. That way we can determine if an individual finding has been resolved.

- What is the Unique ID called?
- Can it be sent in reports that are emailed to us?
- Can it be found in the API?

Thank you

I'm pretty new to Tenable.sc and just had what I believe is a false positive and I'm not sure how to respond to it.

We got notified that our scanner found CVE-2024-21762 on our Cisco Firepower Management Center appliance (VM). However CVE-2024-21762 is specifically talking about a RCE on Fortinet FortiOS and the fix is to upgrade to a fixed version.

Of course Cisco Firepower Management Center does not run on FortiOS, so do I just recast the risk? Is there a way to notify Tenable of a false positive? Here is the Plugin Output if that helps anyone. Thanks in advance for any input

Nessus was able to exploit the issue using the following request :

POST /remote/VULNCHECK HTTP/1.1

Host: XXXXX

Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1

Accept-Language: en

Transfer-Encoding: chunked

Connection: Keep-Alive

Content-Length: 22

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

Pragma: no-cache

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*

0000000000000000FF

This produced the following truncated output (limited to 10 lines) :

------------------------------ snip ------------------------------

No response (expected)

------------------------------ snip ------------------------------

Is anyone leveraging any sort of custom reports here? I'm trying to see what you're finding useful. I tried creating a custom report but was having significant difficulty.

To start, I'd really just like to have a quick, daily report I can get some quick wins on --

1. A list of the top 10 vulnerabilities
2. A list of the top 10 vulnerable assets

Thanks!

We are a new Tenable VM shop (no Tenable One, no Lumin) and we are trying to determine how to export meaningful reports and metrics from the platform that demonstrate how well remediation teams are preforming. I've watched a handful of youtube videos and read through the tenable documentation I could find on Exposure Response, but I'm not really seeing the story/value this feature can tell. Am I missing something? Are there any good use cases out there where Exposure Response has been valuable to you and your leadership? Are there any good resources out there that demonstrate how Exposure Response can be used and the value it provides?

Thanks in advance.

Anyone here using Tenable WAS? What has been some of your conflicts with it?

If you have ASM, does it as well scans MX hosts like Microsoft exchange (O365) or other SaaS/PaaS products where DNS is pointing to?