Agent Profiles

Required user role when using Tenable Nessus Manager: Administrator or System Administrator

In Tenable Nessus Manager, you can create agent profiles to customize and manage the behavior of your linked agents. An agent profile allows you to configure a range of settings for a specific group of agents.

You can use a profile to:

  • Assign a specific agent version for testing or standardization purposes.

  • Limit the amount of host CPU processing that agents can use.

By assigning agents to different profiles, you can apply distinct configurations to various segments of your environment, which provides granular control over agent operations.

There are two types of agent profile:

  • Default — The profile to which an agent or agent group belongs to unless you assign it to a custom profile. You cannot copy, delete, or edit the name and description of the Default profile.

  • Custom profiles — A custom profile that you create. Custom profiles allow you to associate and configure different agents and agent groups based on your business needs.

Note: You can only assign an agent to one profile.

Note: The agent profile version overrides the agent's update plan setting. If you assign the agent a freeze window, the freeze window overrides both the agent update plan and the agent profile. In this case, the agent remains on its current version and no software updates occur for that agent as long as the agent is assigned to the freeze window.

To manage agent profiles:

  1. In the top navigation bar, click Sensors.

    The Linked Agents page appears. By default, Linked Agents is selected in the left navigation menu and the Linked Agents tab is active.

  2. In the left navigation bar, click Agent Profiles.

    The Agent Profiles page appears.

Use the following procedures to manage your agent profiles:

Note: You cannot create an agent profile for an end-of-life (EOL) Tenable Agent version.

To create an agent profile:

  1. On the Agent Profiles page, click Add Agent Profile.

    The New Agent Profile page appears.

  2. Enter a Name for the agent profile.

  3. Select the agent profile's Version. This is the version that agents assigned to the profile are upgraded or downgraded to. The default value is the oldest version available in the drop-down menu.

    You can set the agent profile to stay on the latest major version release (for example, 10.x) or the latest minor version release (for example, 10.4.x), or you can set the agent profile to a specific patch release (for example, 10.4.1). If you do not configure a Version, the agents assigned to the profile follow the configured agent update plan.

    Note: Before a version can be applied to agents, the version package must be present in Tenable Nessus Manager's remote/agent_versions directory, which can be found in the following parent directories:

    • Linux — /opt/nessus/var/nessus

    • Windows — C:\ProgramData\Tenable\Nessus\nessus

    • macOS — /Library/Nessus/run/var/nessus

    You can download missing version packages by enabling the Enable Agent Updates setting or performing a manual software update.

  4. (Optional) For CPU Limit %, enter an integer from 1 to 100 to set the maximum percentage of the host's CPU that the agent can use.

    Note: This setting only affects agents on version 11.1.0 or later.

  5. (Optional) Enter a Description for the agent profile.

  6. Click Add. Tenable Nessus Manager adds the new profile to the Agent Profiles page.

    Note: Unless you perform a manual software update, Tenable Nessus Manager does not download the packages for agents added to an agent profile until the next update interval. In turn, agents will not receive and apply those packages until their next update interval, which is every 24 hours by default. Therefore, it may take up to 48 hours to complete an agent profile version change.

    You can run the nessuscli fix --set auto_update_delay=1 command on Tenable Nessus Manager and a pilot group of agents to reduce the update interval to one hour, after which it may take up to two hours to complete an agent profile version change, providing there are no environmental issues.

Use the following procedures to add an agent to an agent profile or remove an agent from an agent profile in Tenable Nessus Manager.

In addition to using the Tenable Nessus Manager user interface, you can link an agent to a profile by running the nessuscli agent link command and specifying the optional --profile-uuid argument. You can link an agent to a profile during deployment by specifying the profile-uuid in the config.json file. To find a profile's profile-uuid, see View an agent profile ID.

Note: The agent profile version overrides the agent's update plan setting. If you assign the agent a freeze window, the freeze window overrides both the agent update plan and the agent profile. In this case, the agent remains on its current version and no software updates occur for that agent as long as the agent is assigned to the freeze window.

To apply an agent profile to an agent in the Linked Agents user interface:

  1. In the top navigation bar, click Sensors.

    The Linked Agents page appears. By default, Linked Agents is selected in the left navigation menu and the Linked Agents tab is active.

  2. Click the row of the agent that you want to assign to the profile.

    The Agent Details page appears.

  3. Next to Profile, click .

    The Add to Profile window appears.

  4. In the table, select the check box of the agent profile that you want to assign the agent to.

  5. Click Apply.

    Tenable Nessus Manager assigns the agent to the agent profile.

To apply an agent profile to an agent in the Agent Profiles user interface:

  1. In the top navigation bar, click Sensors.

    The Linked Agents page appears. By default, Linked Agents is selected in the left navigation menu and the Linked Agents tab is active.

  2. In the left navigation bar, click Agent Profiles.

    The Agent Profiles page appears.

  3. Click the agent profile to manage.

    The agent profile details page appears.

  4. Click the Agents tab.

  5. In the upper-right corner, click Add Agents.

    The Add Agents window appears.

  6. Do one of the following:

    • In the agents table, select the check box next to each agent you want to add to the profile.

    • In the table header, select the check box to select all agents.

  7. Click Add. Tenable Nessus Manager adds the agent or agents to the profile.

To remove an agent profile from an agent in the Linked Agents user interface:

  1. In the top navigation bar, click Sensors.

    The Linked Agents page appears. By default, Linked Agents is selected in the left navigation menu and the Linked Agents tab is active.

  2. Click the row of the agent that you want to remove a profile from.

    The Agent Details page appears.

  3. Next to Profile, click on the profile you want to remove from the agent.

    The Remove Profile window appears.

  4. Click Remove to confirm.

    Tenable Nessus Manager removes the profile from the agent.

To remove an agent profile from an agent in the Agent Profiles user interface:

  1. In the top navigation bar, click Sensors.

    The Linked Agents page appears. By default, Linked Agents is selected in the left navigation menu and the Linked Agents tab is active.

  2. In the left navigation bar, click Agent Profiles.

    The Agent Profiles page appears.

  3. Click the agent profile to manage.

    The agent profile details page appears.

  4. Open the Agents tab.

  5. Select the checkbox or checkboxes of the agent or agents that you want to remove the profile from.

  6. In the upper-right corner, click the Remove button.

    The Remove Agent window appears.

  7. Click Remove.

    The agent profile is removed from the agent or agents.

You can link an agent to a profile by running the nessuscli agent link command and specifying the optional --profile-uuid argument. You can also link an agent to a profile during deployment by specifying the profile-uuid in the config.json file. Use the following procedure to view a profile's --profile-uuid.

To view an agent profile ID:

  1. On the Profiles page, click the agent profile that you want to view the ID of.

    The agent profile details page appears.

  2. In the Profile Details tab, the --profile-uuid is listed as UUID.

To edit an agent profile:

  1. On the Agent Profiles page, click in the row of the profile that you want to edit.

    The Edit Agent Profile window appears.

  2. Edit the agent profile name, version, agent CPU limit, and description as needed.

    Note: Before a version can be applied to agents, the version package must be present in Tenable Nessus Manager's remote/agent_versions directory, which can be found in the following parent directories:

    • Linux — /opt/nessus/var/nessus

    • Windows — C:\ProgramData\Tenable\Nessus\nessus

    • macOS — /Library/Nessus/run/var/nessus

    You can download missing version packages by enabling the Enable Agent Updates setting or performing a manual software update.

  3. Click Save.

    Tenable Nessus Manager saves your changes.

    Note: Unless you perform a manual software update, Tenable Nessus Manager does not download the packages for agents added to an agent profile until the next update interval. In turn, agents will not receive and apply those packages until their next update interval, which is every 24 hours by default. Therefore, it may take up to 48 hours to complete an agent profile version change.

    You can run the nessuscli fix --set auto_update_delay=1 command on Tenable Nessus Manager and a pilot group of agents to reduce the update interval to one hour, after which it may take up to two hours to complete an agent profile version change, providing there are no environmental issues.

Delete an agent profile if you no longer need the agent profile. You cannot undo an agent profile deletion.

To delete an agent profile:

  1. On the Agent Profiles page, click in the row of the profile that you want to delete.

    The Delete Agent Profile window appears.

  2. Click Delete to confirm the deletion.

    Tenable Nessus Manager deletes the agent profile and removes all the linked agents from the profile.

Manage agent profiles in offline mode

Use the following process to add a new agent profile Version option while Tenable Nessus Manager is in offline mode.

  1. Download the nessus-agent-updates-<agent version>.tar.gz file from the Tenable Agent Downloads page.

  2. In the nessuscli tool, run the following command to upload the tar.gz file to Tenable Nessus Manager:

    Copy 
    nessuscli update <tar.gz filename> --agent-version

    The tar.gz file uploads to Tenable Nessus Manager.

    Once Tenable Nessus Manager downloads the file, the new agent version is available to choose in the Version dropdown when creating or updating an agent version. For example, if you uploaded nessus-agent-updates-10.9.1.tar.gz, you can now set your agent profile versions to 10.9.1.