Agentless Assessment FAQ

• Amazon Linux 2

• CentOS 7

• Red Hat Enterprise Linux (RHEL)

• SUSE Linux Enterprise Server (SLES) 11.4 to 15.2

• Ubuntu

• Debian

• Red Hat Enterprise Linux (RHEL)

• SUSE Linux Enterprise Server (SLES) 11.4 to 15.2

• Ubuntu

• Debian

Make sure that a newly created snapshot is scanned. For more information, see Create AWS Snapshot and Create an Azure Virtual Machine Snapshot.

Cloud instances do not need to be running at the time of a Tenable Cloud Security Agentless Assessment cloud scan, but you must have at least one snapshot of an instance’s primary volume for Agentless Assessment to see data.

For AWS, you can use encrypted EBS snapshots with Agentless Assessment. In AWS, you have access to the default encryption keys unless you have an IAM policy that explicitly denies it. You can use your own KMS Key or the default EBS Key. For example, if you are using a KMS Customer Managed Key (CMK), add the read-only role as a “Key User” under the Key Policy, or add the necessary KMS permissions to the role for which the key would be used. If you are using the default EBS key to handle encryption, Agentless Assessment uses that key for decryption prior to gathering the EBS data.

For Azure, the virtual disk snapshots must be encrypted with the Platform-managed key.