Nessus Configuration

[Berenice Pretlow]

YourCyber Essentials certification body may have asked you to configure your environment in preparation for this, this is a requirement and failure to not have a successful credential patch scan will result in your audit failing.

This guide walks you through the process of configuring your environment in preparation for an audit. There are several parts to this configuration and this guide will concentrate using the group policy management tool as a way of configuring the environment. All the configuration settings can be added to the one Group Policy Object.

Go to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security. In the right pane, expand Windows Firewall with Advanced Security until Inbound Rules visible. Right-click on it.

Welcome to Tenable API Explorer! This API Explorer provides complete reference documentation for all available Vulnerability Management, Web App Scanning, Identity Exposure, Cloud Security, Container Security, PCI ASV, Attack Surface Management, MSSP, and Downloads API endpoints based on OpenAPI 3 (formerly known as Swagger) specification. You can try most of the API calls out of the box.

The Tenable Vulnerability Management API enables you to programmatically manage assets, scans, and policies from the cloud. The endpoints provide actionable insight into your entire infrastructure's security risks, allowing you to quickly and accurately identify, investigate, and prioritize vulnerabilities and misconfigurations in your modern IT environment.

The Tenable Web App Scanning API endpoints enable you to automate the security management for your web applications. You can safely and accurately scan web applications, providing deep visibility into vulnerabilities and context for prioritizing remediations.

The Tenable Identity Exposure API enables you to secure your infrastructure by anticipating threats, detecting breaches, and responding to incidents and attacks. You can programmatically monitor indicators of attack and indicators of exposure to allow you to discover underlying issues affecting your Active Directory, identify dangerous trust relationships, and analyze in-depth details of attacks.

Tenable's PCI ASV streamlines the quarterly external vulnerability scan submission and dispute process as required by PCI. You can use the PCI ASV API to retrieve a list of PCI ASV attestations, disputes, and scans.

The Tenable Cloud Security API enables you to programmatically scan multi-cloud instances and the infrastructure-as-code (IaC) used to provision the environments. The Cloud Security endpoints can be used to onboard cloud accounts, manage projects and repositories, and retrieve scan results.

Tenable Attack Surface Management enables you to identify internet-accessible assets that may or may not be known to your organization. Attack Surface Management identifies assets using DNS records, IP addresses, and ASN, and includes more than 180 columns of metadata to help you organize and inventory your assets.

The Tenable Managed Security Service Provider (MSSP) Portal API provides a secure and accessible way for MSSP administrators to manage and maintain multiple customer instances of Tenable products. Endpoints in the Tenable MSSP Portal API allow you to view and manage your MSSP customer accounts.

The Downloads API enables you to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.

Does anyone else out there scan their firewalls with Nessus? Just curious if you have some other definitions defined other than what tenable has listed on their support site. I've tried google but its not helping much.

This document -room/whitepapers/auditing/palo-alto-firewall-security-configuration-ben... help guide you through all the basics to help ensue you are not missing anything obvious. Taking a more agressive response with your IPS responses (default actions of reset and drop) and using an exception response of block-ip will reduce the effectiveness of a scanning tool.

Compliance requirements from our customers. As for unseful info, not for me with the baked in plugins and compliance checks they have. It looks for some best practices stuff that could be useful to someone that has not configured everything or just a quick check to see if things are configured.

Thanks for the information. Could you please provide more details about configuring to conect to Tenable.sc or Tenable.io ? I'm struggling to determine how the Agent was installed on Red Hat 7 and 8. I haven't found anything named "Nessus" except in the user directory

No ports used by Tenable/nessus are open on the server. I've checked both active and inactive services but can't locate a service named "Tenable" or "Nessus". Could you suggest a command to help me find the elusive agent and its configuration file? It's perplexing; I can't locate it in /opt or anywhere else.

The server is detected by cloud.tenable.com, and it reports vulnerabilities. Despite trying all the commands you mentioned, I can't figure out how it's configured. Is there an alternative way it might be set up?

I wrote a Chef cookbook for installing Nessus agent, but it does require that you have the agent link key to enable it. I won't post the entire cookbook here as I originally wrote it for AWS automation, but here are some excerpts that might help you find where it is, installing the RPM and linking it to the Tenable Nessus server.

We have installed the Tenable Add-on for Splunk to our HF as prescribed by the TA documentation. The necessary account on the Teanble side has been created and the API key pieces successfully generated. We have been able to validate this API key using various curl commands as well as testing the API endpoints through developer.tenable.com.

However, when we attempt to configure the Tenable.io account inside of this TA, we are consistently given the "Please enter valid Address or configure valid proxy settings or verify SSL certificate." error message. There is no proxy in use here (again, the programatic API calls from the CLI all return valid results for various endpoints).

Has anyone else encountered and successfully resolved this issue? My gut tells me that if I could successfully create a valid config file (ta_tenable_settings.conf?) that stores the API keys and account details (typically populated by the Web UI for the add-on), that this would all work just fine. However, I do not have an example of a valid configuration file that stores the details of the Tenable.io account.

I was able to solve my own problem with some additional digging. It turns out that the README directory that ships with the TA includes sample configuration files, one of which is called ta_tenable_account.conf. Of course I only found this file after reviewing the various python files in the app's bin directory and extracting the configuration settings it was leveraging

Upon manually creating an account stanza in this file and restarting Splunk, my account was recognized/registered and I could successfully create an input and index data.

The integration works by querying Tenable for scan results over a given period of time (typically 30 days upon first run, and then from the previous run until the current run for subsequent runs) and downloading those data. The data are parsed for CVE tags, which are matched against CVE data within ThreatConnect Indicators and Groups of the type(s) selected in the configuration. Any found Indicators or Groups are then updated with the data for that CVE from Tenable, and, if desired, a Tag is applied to indicate that matching Tenable CVE data were found for that object.

With more than one million users, Nessus is the world's most widely-deployed vulnerability, configuration and compliance assessment product. Nessus prevents attacks by identifying thevulnerabilities, configuration issues and malware that hackers could use to penetrate your network.

LinkedIn and 3rd parties use essential and non-essential cookies to provide, secure, analyze and improve our Services, and to show you relevant ads (including professional and job ads) on and off LinkedIn. Learn more in our Cookie Policy.

- [Instructor] We've already run a couple of simple vulnerability scans in this course, but now let's explore the process of setting up a vulnerability scan in more detail. I'm back in Nessus and I'm going to set up a new scan from scratch. After I click the New Scan button, I'm presented with a series of templates to choose from. These are pre-configured scan settings that I can choose if I don't want to set everything myself. I'd like to look at all of the options, so I'm going to select Advanced Scan. This allows me to choose my own scan settings. The initial screen that I see lets me enter some basic information about the scan. I can give it a name. I'm going to go ahead and call this Mike's scan. I could fill in a description here if I wanted to, but I'm going to leave that blank for now. The most important part of this page of settings is the target's box. That's where I can figure the scope of the scan. In this box, I can enter system names, IP addresses, or network ranges that contain the systems that I'd like to scan. I'm going to set my scan to run on a lcoal network. I'd like to scan all of the systems in the address range 172.30.0.0/24. That's 255 IP addresses that Nessus will scan. First to see if systems are active, and then it will perform vulnerability scans on those systems that are up and running. Notice there's also an Upload Target section of this page with a link to add a file. This is useful if your organization has a separate asset management tool. You can export a list of systems from that tool, and import it here so that you don't have to retype or cut and paste the entire list of systems. When I'm creating a scan program, I generally want to organize it into a series of scans that each include systems that will be scanned at the same time. For example, if I decided that I wanted to set the scanning frequency based upon the types of data that the system processes, I might create different scans for systems that process confidential, sensitive, and highly sensitive information. This allows me to set different schedules for each of these system groups. We've already taken a look at the Schedule tab, I'm going to go ahead and configure this scan to run every day. And then I'd like the scanner to email me a report when it's finished. So I'll go to the Notifications tab and type in my email address. And then tell Nessus to actually attach the scan report to the email message so I can read it right in my email. Now let's take a look at the discovery options. This is where I can provide Nessus with instructions about how to decide if a system is alive on the network. I can configure the types of network pings, and how Nessus should handle devices like printers and NetWare systems that might react negatively to a scan. On the Port Scanning tab, I can set the specific network ports that I'd like Nessus to scan, and also tell it which protocols to use when scanning for open ports. The default settings for Nessus include all commonly use ports. So I'm going to leave that setting alone. But if your network uses custom ports, you can configure those here. In the assessment section of the scanning configuration, I can set the scan sensitivity level. This is an important setting. When you're performing any type of scan, you run the risk of false alarms. These an waste the time of cyber security analysts. By default Nessus uses what it calls normal accuracy. Think of this as a medium setting that seeks to balance the risk of a false alarm with the risk of missing a real vulnerability. If you'd like, you can change this setting to err on the side of reporting a vulnerability. This will give you more false alarms. You can do this by checking the override normal accuracy box and then choosing the show potential false alarms option underneath that. I'm going to go ahead and switch back to normal accuracy for this scan. The last settings page that we'll look at is the Advanced page. This has a few important settings. First, notice the first box that's checked here. Enable safe checks. This setting tells Nessus to avoid performing scans that might disrupt the system. It's probably best to leave this box checked when you're working in a production environment. You may wish to uncheck this box if you're scanning systems prior to their deployment and production to get the most thorough scan results. There are also some other settings on this page that allow you to alter the performance of the scan. You can stop scanning hosts that become unresponsive during a scan. This is important because it stops wasting bandwidth and if the scan is actually disabling a host unintentionally, continuing the scan will increase the amount of time that the host might be unresponsive. So it minimizes the impact on production systems. You can also, under the performance options, slow down the scan when network congestion is detected. And there are plenty of settings here that customize how that works. This allows your scan to accommodate other traffic on the network. So if the network is busy, the scan will slow down and use less bandwidth. And now finally let's take a look at the Plugins tab for this scan. Nessus uses plugins to perform vulnerability checks. Each plugin is designed to check for one specific vulnerability, and plugins are organized into families by the types of systems that they affect. You see the settings for plugins here on this tab. I can go ahead and customize my scan for my own environment. For example, I know that there are not any AIX systems on this network, so I'm going to disable those 11,392 plugins. I'm going to do the same thing for Cisco because there aren't any Cisco network devices here. And I know there's not any Debian Linux. And there also aren't any F5 devices or Fedora systems. And I could continue down this list, disabling any of the plugin families that I know won't be necessary on my network. Disabling plugins that are not relevant to your scan improves your performance by reducing the amount of time that the scan takes. Vulnerability scanners offer a wide variety of configuration options that allow you to customize the scanners' performance. If you find yourself tweaking these settings, be sure to create your own custom templates so that you can easily reuse those settings across many scans.

3a8082e126