What Information Does the ARCON Integration Collect?

The ARCON integration retrieves the following from ARCON at scan time:

  • Username — returned by the ARCON API for the requested account

  • Password — the credential value checked out from ARCON for the target system

  • Escalation Password — A distinct password utilized when privilege escalation is active; escalation usernames are not retrieved automatically as they require manual entry.

API Requests Per Target

The integration makes one login request to ARCON to obtain a session token, followed by one credential request per scan target. Because ARCON credentials are requested by supplying the target's IP address, each target requires its own API call — request volume scales directly with the number of scan targets. An additional credential request is made per target when privilege escalation is configured with a separate escalation account.

Retrieved credentials are cached for the duration of the scan to avoid repeated requests for the same username, target, and system type combination. While the integration caches responses to avoid redundant calls, the cache is not shared between scan chunks, so each chunk produces a minimum of one login request and one credential request per target.

Note: ARCON API responses may take longer than other PAM integrations. The integration uses an extended read timeout to accommodate this.

Credentialed Scans

Credentialed scans allow the Tenable scanner to log in to the target system directly and perform a deeper assessment than is possible without credentials. This includes checking installed software versions, configuration settings, patch levels, and compliance status.

What the ARCON Integration Does Not Collect

The ARCON integration only retrieves credentials for use in target authentication. It does not collect vulnerability data, software inventory, scan results, or any information from ARCON beyond the specific credential returned for each target.

Note: If a scan is missing results for a specific target, verify that the ARCON credential is correctly configured for that target and that the account has sufficient privileges. Configure additional credentials as needed for targets not covered by the ARCON integration.

ARCON Integration Limitations

  • The ARCON Host must be network accessible from the Tenable Nessus scanner.

  • Credentials are retrieved per target IP address — one API call is made to ARCON for each scan target. Large target lists produce a proportionally large number of API requests.

  • The ARCON Digital Vault and Legacy API variants are both supported. Which is appropriate depends on your ARCON deployment — consult your ARCON administrator.