Configure ARCON Integration for Tenable One Vulnerability Management

Required User Roles: Standard, Scan Manager, or Administrator

The ARCON PAM integration exists as an authentication method within the supported credential types in Tenable One Vulnerability Management scans.

Required Permissions

The ARCON API user configured in the scan policy must have permission to retrieve credentials for the target accounts in ARCON. Refer to the ARCON product documentation for the specific roles and permissions required to authorize API-based credential checkout.

Scan Configuration — SSH, Windows, VMware, Nutanix, or Database

Complete the following steps to configure Tenable One Vulnerability Management with ARCON using SSH, Windows, VMware, Nutanix, or Database credentials.

  1. Log in to your Tenable One Vulnerability Management user interface.

  2. In the left navigation pane, click Scans.

    The Scans page appears.

  3. Click Create a Scan.

    The Select a Scan Template page appears.

  4. Select a scan template.

    The scan configuration page appears.

  5. In the Name box, type a name for the scan.

  6. In the Targets box, type an IP address, hostname, or range of IP addresses.

  7. (Optional) Add a description, folder location, scanner location, and specify target groups.

  8. Click the Credentials tab.

    The Credentials pane appears.

  9. In the Select a Credential menu, select SSH, Windows, VMware ESX SOAP API, VMware vCenter API, Nutanix Prism Central, or Database.

  10. In the Auth Type drop-down, click ARCON.

    The ARCON options appear.

  11. Configure the following options:

    Option Description Required
    Arcon Host The hostname or IP address of the ARCON PAM server. Yes
    Arcon Port The port on which the ARCON API communicates. Default: 443. Yes
    API User The username for authenticating to the ARCON API. Yes
    API Key The password for the ARCON API user. Yes
    Authentication URL The path portion of the ARCON authentication endpoint (host and port are taken from the fields above). For the Digital Vault API, enter the base path (for example, /dv/api/sdk); the integration appends /GetToken automatically. For the Legacy API, enter the full token path (for example, /arconToken). Consult your ARCON administrator for the correct paths in your deployment. Yes
    Password Engine URL The path portion of the ARCON credential retrieval endpoint (host and port are taken from the fields above). For the Digital Vault API, enter the same base path as the Authentication URL (for example, /dv/api/sdk); the integration appends /GetTargetDevicePassKey automatically. For the Legacy API, enter the base API path (for example, /api); the integration appends /ServicePassword/GetTargetDevicePassKey automatically. Yes
    Checkout Duration The number of hours for which the credential is checked out from ARCON (OpenForHours). Must be a positive integer. Set this value to exceed the total expected duration of the scan to ensure credentials remain valid throughout. The maximum accepted value varies by ARCON deployment — consult your ARCON administrator. Yes
    Arcon Target Type An optional override for the target system type string sent to ARCON. When left blank, the integration uses a default type based on the credential type (Linux for SSH, Windows for Windows, the database engine name for Database credentials). Use this field when your ARCON environment uses a non-standard platform type string, or for VMware and Nutanix targets where a specific platform type is required. No
    Kerberos Target Authentication When enabled, uses Kerberos for target authentication. No
    Use SSL When enabled, uses SSL/TLS for communications with the ARCON API. No
    Verify SSL Certificate When enabled, verifies the ARCON server SSL certificate. Requires SSL to be enabled. No
    Elevate privileges with (SSH-only) The privilege escalation method you want to use to increase users' privileges after initial authentication. Multiple options for privilege escalation are supported, including su, su+sudo and sudo. Your selection determines the specific options you must configure.

    Note: By default, Nothing is selected. For more information, see the Privilege Escalation section.

    		 No

  12. Do one of the following:

    • If you want to save without launching the scan, click Save.

    • If you want to save and launch the scan immediately, click Save & Launch.

    Note: If you scheduled the scan to run at a later time, the Save & Launch option is not available.