ICPs

Required Tenable One OT Exposure User Role: Administrator, Supervisor, Security Manager, Security Analyst, Site Operator, Read Only

Use the ICPs page to view all ICP systems paired with the EM in a table format.

Note: After you pair an ICP with the EM, you must perform all updates at the EM level so that the sites and their sensors receive the latest version updates.

To access the ICPs page:

In the left navigation bar, click ICPs.

The ICPs page appears with the list of paired ICPs.

The ICP table includes the following columns:

Column	Description
Name	The name of the ICP paired with the EM.
IP/Host	The IP address or the hostname of the ICP.
Status	The status of the ICP: Connected Pending Approval Disconnected Update in progress
Last Data Sync	The date of the last data synchronization between the ICP with the EM.
Version	The version of Tenable One OT Exposure.
License Status	The status of the license: Active Expired
License Type	The type of license: Perpetual or Subscription.
License Expires	The date when the license ages out for the ICP.
Licensed Assets	The number of licensed assets for the ICP.
Computer ID	The unique ID of the ICP system.
Sensors Info	The online or offline status of the connected sensors. Click the sensors link to go to the Sensors page in Tenable One OT Exposure. Note: To return to the Tenable One OT Exposure EM interface, from the profile button, click Return to EM.
License Usage	The number of licensed assets currently in use.
Last Nessus Plugin Set	The date of the last Nessus plugin update.
Last IDS Engine Ruleset	The date of the last IDS Engine Ruleset.
Memory Usage	The percentage of memory usage by the ICP.
CPU Usage	The percentage of CPU usage by the ICP.

Manage ICP Pairings

You can perform the following actions from the ICPs page:

Approve pairing requests automatically

To automatically approve ICP pairing with EM , enable the Auto Approve ICP Pairing Requests toggle.

Approve pairing requests manually

To approve ICP pairing requests manually, do one of the following:

In the row of the ICP you want to approve:
- Right-click the ICP and select Approve.
- Click the ICP row. This highlights the row and enables the Actions button.
Click Actions > Approve.

Disconnect an ICP pairing

To disconnect an ICP from the EM, use one of the following methods:

In the row of the ICP you want to disconnect, right-click and click Delete.
Click the row of the ICP you want to disconnect, then click Actions > Delete.

Access the ICP from Tenable One OT Exposure EM

To navigate to the ICP from the EM:

In the row of the ICP that you want to open, click the link in the Name column.

Tenable One OT Exposure EM opens the Tenable One OT Exposure Dashboards page.

When accessing the ICP from ICPs page, the Tenable One OT Exposure header displays the ICP label.

To return to the Tenable One OT Exposure EM interface from the ICP:

In the upper-right corner, click the profile button,

A menu appears.
Select Return to EM.

Tenable One OT Exposure EM interface appears.

Prepare Paired ICPs for Centralized Updates

Before an EM can update its paired ICPs, you must configure each ICP to receive packages from the EM instead of updating independently. Perform this procedure once on each paired ICP, including any ICP paired at a later date.

Before you begin

The ICP must be paired and approved, with a status of Connected.
You must have command line access to each ICP with sudo privileges.

To prepare a paired ICP for centralized updates:

On the ICP, list the contents of the offline ISO directory:
Copy
```
ls -l /srv/tenablecore/offlineiso/
```
If the directory contains an offline update ISO, delete it. An ISO file stored locally on the ICP causes the ICP to update from its local copy instead of receiving updates from the EM.
On the ICP, disable and stop the automatic update timer:
Copy
```
sudo systemctl disable --now dnf-automatic-install.timer
```
Verify that the timer is disabled:
Copy
```
systemctl is-enabled dnf-automatic-install.timer
```
The command returns disabled.

On the ICP, disable all Tenable repositories and enable the EM shared repository:

Copy

sudo dnf config-manager --disable 'tenable*' && sudo dnf config-manager --enable 'tenable-em-shared'

Verify that tenable-em-shared is the only enabled Tenable repository:
Copy
```
sudo dnf repolist --enabled | grep tenable
```
Repeat steps 1 through 5 on every remaining paired ICP.

Note: Until you complete this procedure on an ICP, that ICP may not display an available version when you click Check for Updates, or its update attempt may fail.

Update ICPs

You can update the ICP and its operating system to the latest version, or you can update only the operating system. Updating only the operating system helps reduce system downtime, but Tenable recommends updating both components.

Before you begin

The offline update ISO must be present on the EM at /srv/tenablecore/offlineiso/tenable-offline-updates.iso. This ISO contains the update packages for all Tenable One OT Exposure components (EM, ICPs, and sensors) and it is the only source the EM uses when updating ICPs and sensors.
The ICP must be able to communicate with the EM on TCP ports 28305 and 8000.
The EM must be running version 4.1 or later. For example, an EM running version 4.1 can update ICPs running version 4.0.
Each paired ICP must be configured for centralized updates. See Prepare Paired ICPs for Centralized Updates.

Important! You can update the EM online or using an offline ISO file. However, paired ICPs and sensors receive updates only from the ISO stored on the EM. If you update the EM online without placing the ISO on the EM, clicking Check for Updates does not return available ICP versions.

You can download the ISO file from the Tenable Core Offline Update ISO section of the Tenable Downloads page. For more information, see Update Tenable Core Offline.

Note: The ISO requirement applies to ICP version updates only. You can distribute data ruleset updates (Nessus plugins, IDS Engine, DFE) from an online EM. For more information, see Manage Data Updates.

To update ICP and operating system:

On the ICPs page, in the upper-right corner, click Check for Updates.

The Version column of the ICPs table displays an updates available message.

Do one of the following:

Update	Action
A single ICP	To update a single ICP: In the ICPs table, select the checkbox next to the ICP you want to update. Tenable One OT Exposure EM enables the Actions button in the header bar. Click Actions > Update ICP Version. The Update ICP Version panel appears. Select one of the following options: Update ICP Application to version xx.xx.xx, including OS (recommended) (default). Update OS only Click Update. The Update ICP Version panel appears with the message that the update process of the selected ICP is starting.
Multiple ICPs	To update multiple ICPs: In the ICPs table, select one or more ICPs you want to update. Tenable One OT Exposure EM enables the Actions button in the header bar. Click Actions > Update ICP Version. Select one of the following options: Update ICP Application to version xx.xx.xx, including OS (recommended) (default). Update OS only Click Update. The Update ICP Version panel appears with the message that the update process of the selected ICPs is starting.

Update

Action

A single ICP

To update a single ICP:

In the ICPs table, select the checkbox next to the ICP you want to update.

Tenable One OT Exposure EM enables the Actions button in the header bar.
Click Actions > Update ICP Version.

The Update ICP Version panel appears.
Select one of the following options:
- Update ICP Application to version xx.xx.xx, including OS (recommended) (default).
- Update OS only
Click Update.

The Update ICP Version panel appears with the message that the update process of the selected ICP is starting.

Multiple ICPs

To update multiple ICPs:

In the ICPs table, select one or more ICPs you want to update.

Tenable One OT Exposure EM enables the Actions button in the header bar.
Click Actions > Update ICP Version.
Select one of the following options:
- Update ICP Application to version xx.xx.xx, including OS (recommended) (default).
- Update OS only
Click Update.

The Update ICP Version panel appears with the message that the update process of the selected ICPs is starting.

Note: The update process can take up to an hour to complete. During this time, Tenable One OT Exposure application is inaccessible.

During the update, the Status column in the ICPs table shows Update in progress. When the update is complete, the status changes to Connected.

Manage Data Updates

Use this option to manage updates across environments, even in air-gapped or internet-restricted sites. For more information, see Manage Data Updates.