Tenable One OT Exposure

License

Before you begin, you must ensure you have the appropriate licenses allocated to the product. For more information, see Provisioning Licenses for your Tenable One Products.

Tip: Follow the Tenable One OT Exposure License Workflow outlined in the Tenable One OT Exposure User Guide.

Configure a Reporting Console

If you license Tenable One OT Exposure through Tenable One Foundation or Tenable One Advanced , you can self-provision a Tenable Security Center companion license, now called a Reporting Console, from the Tenable Account Management portal.

Important! This applies only to Tenable One OT Exposure licensed under Tenable One Foundation or Tenable One Advanced packaging. It does not apply to standalone Tenable One OT Exposure customers.

Before you Begin

  • You must have an activated Industrial Core Platform (ICP) site on your Tenable One OT Exposure product. The option to create a Reporting Console does not appear until you activate an ICP.
  • Only the primary contacts on the account, or users delegated to administer the Tenable One OT Exposure activation code under Tenable One, can create, update, or delete a Reporting Console.
Tip: For steps to create and manage a Reporting Console, see Manage Reporting Consoles and Product Details in the Tenable Account Management User Guide.

The Reporting Console status changes from Unactivated to Activated after you enter the 20-digit activation code in Tenable Security Center.

Deploy Tenable One OT Exposure

To deploy Tenable One OT Exposure:

Note: You must install, at minimum, version 3.18.

  1. Install the Tenable One OT Exposure appliance according to the steps outlined in the Tenable One OT Exposure User Guide.

  2. (Optional) If you want to pair your sensors with the Industrial Core Platform (ICP), install the Tenable One OT Exposure Sensor according to the steps outlined in the Tenable One OT Exposure User Guide.

Note: To integrate multiple ICP servers with Tenable One and enable SSO, you must use a Tenable One OT Exposure Enterprise Manager. This is necessary because the Tenable One workspace tile links to only a single ICP interface, so the Enterprise Manager acts as a central hub that consolidates access to multiple ICPs. If you only need to ingest data into Tenable One, you can integrate without an Enterprise Manager. For more information, see the Tenable One OT Exposure Enterprise Manager User Guide.

Link Tenable One OT Exposure to Tenable One

Once you have downloaded and licensed Tenable One OT Exposure, you can link the application to Tenable One.

  1. Generate a Tenable One OT Exposure Linking Key and determine your Cloud Site according to the steps outlined in the Tenable One Vulnerability Management User Guide. Copy and save this information to link the connector to Tenable One.

  2. Integrate your Tenable One OT Exposure appliance with Tenable One according to the steps outlined in the Tenable One OT Exposure User Guide.

  3. Configure SAML on your Tenable One instance to access Tenable One OT Exposure using SSO according to the steps outlined in the Tenable One OT Exposure User Guide.

    This enables the OT Exposure tile on the Workspace.

You can expect to see your Tenable One OT Exposure data in Tenable One within the following timeframes:

  • It can take up to 2 hours to see your OT data on the Inventory page.

  • It can take up to 4 hours to see your OT data on the Exposure View page.

Once the initial sync completes, Tenable One OT Exposure automatically syncs OT data with Tenable One every hour.

Onboarding Milestones

Tenable suggests you complete the following milestones to ensure your success before proceeding with your Tenable One deployment process:

  • Access the Exposure View page, where you can reveal converged risk levels and uncover hidden weaknesses across the IT-OT boundary. You can continuously monitor and track potential vulnerabilities with enhanced OT data:

  • Access the Exposure Signals page, where you can generate exposure signals that use queries to search for asset violations. Simply put, if an asset is impacted by a weakness related to the query, then the asset is considered a violation. Using this, you can gain visibility into your most critical risk scenarios.

    • Find top active threats in your environment with up-to-date feeds from Tenable Research.

    • View, generate, and interact with the data from queries and their impacted asset violations.

    • Create custom exposure signals to view business-specific risks and weaknesses

  • Access the Inventory page, enrich asset discovery with OT-specific insights, such as firmware versions, vendors, models & operational states. Access OT intelligence that standard IT security tools cannot provide:

    • View and interact with the data on the Assets tab:

      • Review your AD assets to understand the strategic nature of the interface. This should help set your expectations on what features to use within Tenable Exposure Management, and when.

      • Familiarize yourself with the Global Asset Search and its objects and properties. Bookmark custom queries for later use.

      • Find devices, user accounts, software, cloud assets, SaaS applications, networks, and their weaknesses.

      • Drill down into the Asset Details page to view asset properties and all associated context views.

    • View and interact with the data on the Weaknesses tab:

      • View key context on vulnerability and misconfiguration weaknesses to make the most impactful remediation decisions.

    • View and interact with the data on the Software tab:

      • Gain full visibility of the software deployed across your business and better understand the associated risks.

      • Identify what software may be out of date, and which pieces of software may soon be End of Life (EoL).

    • View and interact with the data on the Findings tab:

      • View instances of weaknesses (vulnerabilities or misconfigurations) appearing on an asset, identified uniquely by plugin ID, port, and protocol.

      • Review insights into those findings, including descriptions, assets affected, criticality, and more to identify potential security risks, visibility on under-utilized resources, and support compliance efforts.

  • Access the Attack Path page, where you can optimize risk prioritization by exposing risky attack paths that traverse the attack surface, including web apps, IT, OT, IoT, identities, ASM, and prevent material impact. Streamline mitigation by identifying choke points to disrupt attack paths with mitigation guidance, and gain deep expertise with AI insights (Not supported in FedRAMP environments).

    • View the Dashboard tab for a high-level view of your vulnerable assets such as the number of attack paths leading to these critical assets, the number of open attack techniques and their severity, a matrix to view paths with different source node exposure score and ACR target value combinations, and a list of trending attack paths.

      • Review the Top Attack Path Matrix and click the Top Attack Paths tile to view more information about paths leading to your “Crown Jewels”, or assets with an ACR of 7 or above.

      You can adjust these if needed to ensure you’re viewing the most critical attack path data.

    • On the Top Attack Techniques tab, view all attack techniques that exist in one or more attack paths that lead to one or more critical assets by pairing your data with advanced graph analytics and the MITRE ATT&CK® Framework to create attack techniques, which allow you to understand and act on the unknowns that enable and amplify threat impact on your assets and information.

    • On the Top Attack Paths tab, generate attack path queries to view your assets as part of potential attack paths:

      Then, you can view and interact with the Attack Path Query and Asset Query data via the query result list and the interactive graph.

    • Interact with the MITRE ATT&CK Heatmap tab, select the ICS heatmap option to focus on ICS (Industrial Control Systems) tactics and techniques

  • View and interact with the data in the Tags page: