Install OT Security Sensor

Note: This section describes the procedure for configuring a sensor version 3.14 and later.

Installation of OT Security sensor involves pairing sensors with the Industrial Core Platform (ICP). To pair sensors with the OT Security ICP, use both the ICP management console and the sensor’s Tenable core user interface.

You can either enable automatic approval for incoming pairing requests, or disable automatic approval and allow only manual approval for each new sensor pairing request.

Before you begin

Make sure that the following conditions are met:

Note: Tenable recommends a dedicated ICP user with administrator role for the process of pairing sensors, to prevent disruptions in connectivity (see Adding Local Users). You can add a new administrator user to pair multiple sensors.
Note: For information about applying offline updates to your Tenable Core machine, see Update Tenable Core Offline.

Pair the Sensor

To pair a Sensor version 3.14 or later with the ICP:

  1. In the ICP Management Console (user interface), navigate to the Local Settings > Sensors window.

  2. To enable automatic approval of Sensor Pairing, ensure that the Auto Approve Incoming Sensor Pairing Requests switch at the top of the page is toggled to ON. If not, all pairing requests require manual approval.

  3. Open a new tab, leaving the ICP tab open, and type <Sensor IP>:8000 to open the Sensor's Tenable Core user interface.

    Note: You can only access the Tenable Core user interface from the latest version of Chrome.
  4. In the Tenable Core console login window, type your Username and Password, select the Reuse my password for privileged tasks checkbox, and click Log In.

    Important: If you do not select the Reuse my password for privileged tasks upon login, you cannot restart the sensor service.
  5. In the navigation menu bar, click OT Security Sensor.

    The OT Security Sensor Pair window appears.

    Note: The Tenable OT Security Sensor Pair window only appears the first time the page loads. To open the window after this, click the button in the Pairing Info section of the Tenable Core console.

  6. In the ICP IP Address box, type the IPv4 address for the ICP to pair with this sensor.

  7. To use unauthenticated (unencrypted) pairing, select Unauthenticated Pairing and skip to step 8.

    Note: Sensors that use Unauthenticated Pairing can only passively scan their network segments and the ICP cannot manage them to send Active Queries.

  8. To authenticate the pairing, do one of the following:

    • In the ICP User box, type the ICP username and the ICP password in the ICP Password box.

    • In the ICP API Key box, type an API Key for the ICP.

    Note: Tenable recommends that you create a dedicated ICP user for pairing sensors in order to ensure connectivity during the pairing process (see Adding Local Users).

    Note: The authentication method that uses username and password offers the advantage of non-expiring credentials unlike an API Key, which eventually ages out.

  9. Click Pair Sensor.

  10. To use a certificate offered from the ICP:

    1. In Tenable Core, in the Tenable ICP Certificate section, under Approval Status, wait for the certificate information to load.

    2. Click Approve to approve the certificate.

    3. In the Confirm Accept Tenable OT Security Server Certificate window, click Accept This Certificate.

      If you prefer to upload a certificate manually:

      1. In the Tenable ICP console, follow the procedure described in Generating an HTTPS Certificate.

      2. In Tenable Core, in the Tenable ICP Certificate section, under Upload Approved Certificate, click Choose File.

      3. Navigate to the .pem certificate file to upload.

        Once a valid certificate loads correctly, its Approval Status in the OT Security ICP Certificate table shows as Approved.

  11. In the ICP user interface, navigate to Local Settings > Sensors.

    OT Security displays the new sensor in the table, and the Status shows Pending Approval.

  12. Click on the Sensor’s row, then click Actions (or right-click on the row) and select Approve.

The Status switches to Connected, indicating a successful pairing. Other possible statuses are:

  • Connected (Unauthenticated) — The sensor is connected in unauthenticated mode. The sensor can only execute passive network detection.

  • Paused — The sensor is connected properly, but paused.

  • Disconnected — The sensor is not connected. For an authenticated sensor, this may result from an error in the pairing process. For example: tunnel error and API issue.

  • Connected (Tunnel error) — The pairing is successful, but communication over the tunnel is inoperable. Check the connectivity of the port 28304 from the sensor to the ICP. For more information, see Firewall Considerations.

Once OT Security completes the pairing for an Authenticated Sensor, you can configure Active Queries to run on that Sensor. See Active Queries.

Note: Once the pairing completes, Tenable recommends that you use only the ICP page to manage the Sensor, and not the Tenable Core user interface.