Configure Tenable One Vulnerability Management Scans

Required User Role: Standard, Scan Manager, or Administrator

To configure scans with the AWS Secrets Manager integration in Tenable One Vulnerability Management, complete the following steps:

  1. Log into your Tenable user interface.

  2. In the upper-left corner, click the Menu button.

    The left navigation plane appears.

  3. In the left navigation plane, click Scans.

    The Scans page appears.

  4. In the upper-right corner of the page, click the Create Scan button.

    The Select a Scan Template page appears.

  5. Select a scan template.

    The Scan Configuration page appears.

  6. In the Name box, type a name for the scan.

  7. In the Targets box, type an IP address, hostname, or range of IP addresses for the scan target(s).

  8. (Optional) Add a description, folder location, scanner location, and specify target groups.

  9. Click the Credentials tab.

    The Credentials pane appears.

  10. Click the credential category that matches your target — Host (for SSH or Windows), Database (for PostgreSQL, MongoDB, Cassandra, DB2, MySQL, SQL Server, or Oracle), or Miscellaneous (for VMware ESX SOAP API, VMware vCenter API, or Nutanix Prism Central).

  11. Within that category, select the credential type, and from the authentication method dropdown, choose AWS Secrets Manager.

    The AWS Secrets Manager options appear.

  12. Configure the options described in the following tables.

    Note: You can configure multiple AWS Secrets Manager credentials in a single scan policy — for example, one credential for SSH targets and a separate credential for Windows targets, each pointing to a different secret.

    The following options apply to every credential type that supports AWS Secrets Manager.

    Option Description Required
    Username Username to log in to the target. Optional — when blank, the username stored in the AWS secret is used. No
    AWS Region The AWS region where the secret is stored (for example, us-east-1, us-west-2, eu-central-1). The default is us-east-1. Yes
    AWS Access Key ID The AWS IAM access key ID with permission to read the secret. Yes
    AWS Secret Access Key The AWS IAM secret access key paired with the access key ID. Yes
    AWS Session Token Optional session token for temporary AWS credentials issued by AWS STS. Leave blank when using long-lived IAM user credentials. No
    Credential ID The ID, name, or ARN of the secret in AWS Secrets Manager that contains the login credentials for the scan target. Yes

    Additional options for Host > Windows

    Option Description Required
    Domain Domain to use to log in to the target. Optional. No
    Use Kerberos KDC When enabled, Kerberos authentication is used to log in to the Windows target. Reveals additional Kerberos KDC fields (KDC host, port, transport, domain). No
    Fetch Domain When enabled, the integration uses the domain field stored in the AWS secret instead of the Domain field above. Default Off. No

    Additional options for Host > SSH

    Option Description Required
    Use Kerberos KDC When enabled, Kerberos authentication is used. Reveals a KDC Domain field. No
    Fetch Domain When enabled, the integration uses the domain field stored in the AWS secret. Default Off. No
    Elevate privileges with Privilege escalation method (.k5login, Cisco 'enable', dzdo, pbrun, su, su+sudo, sudo, or Nothing). When set, an Escalation Credential ID field appears. No
    Escalation Credential ID The ID, name, or ARN of an additional secret containing the escalation or sudo password. If blank, the integration falls back to the secret named in Credential ID. Yes, when Elevate privileges is set

    Additional options for Database

    Option Description Required
    Database Port Port the target database listens on. Defaults vary by database type (PostgreSQL 5432, MySQL 3306, MongoDB 27017, Cassandra 9042, DB2 50000, SQL Server 1433, Oracle 1521). Yes
    Database Name / Instance name Name of the database (or, for SQL Server, the instance name) to connect to. Required for DB2; optional for PostgreSQL, MongoDB, and SQL Server. Varies
    Auth type Database-specific auth type. SQL Server: Windows or SQL. Oracle: SYSDBA, SYSOPER, or NORMAL. Yes (SQL Server, Oracle)
    Service type / Service Oracle only: the service identifier type (SID or Service Name) and the value. Yes (Oracle)

    Additional options for VMware ESX SOAP API, VMware vCenter API, and Nutanix Prism Central

    Option Description Required
    Fetch Domain When enabled, the integration uses the domain field stored in the AWS secret. Available for VMware ESX SOAP and VMware vCenter; not present on Nutanix Prism Central. Default Off. No

  13. Save the credential and launch the scan.