Web App Scans

Required Additional License: Tenable Web App Scanning for Tenable Security Center

Web application scanning in Tenable Security Center allows you to scan and address web application vulnerabilities that traditional scanners cannot accurately assess.

Web app scans in Tenable Security Center are configured using Tenable Core + Tenable Web App Scanning or Tenable Web App Scanning in a Docker deployment routed through Sensor Proxy. For more information about Tenable Core + Tenable Web App Scanning, see Welcome to Tenable Core + Tenable Web App Scanning. For more information about using Tenable Web App Scanning as a Docker image, see Deploy Tenable Web App Scanning as a Docker Image.

For more information about web app scans in Tenable Security Center, see Manage Web App Scans and Web App Scan Settings.

For more information about your Tenable Web App Scanning for Tenable Security Center license, see License Requirements.

To fully configure web app scans with Tenable Security Center using Tenable Core or Docker image:

Note: Tenable Security Center allows four concurrent web app scans per configured Tenable Core + Tenable Web App Scanning or Docker image at a time.

  1. Apply the Tenable Web App Scanning for Tenable Security Center license, as described in Update an Existing License.

  2. Ensure the Tenable Web App Scanning plugins are updated, as described in Plugin/Feed Settings. The plugins automatically update when the license is updated.

  3. Add a Sensor Proxy to Tenable Security Center if there is not one added or if a new one is required due to network architecture.

  4. Add a Tenable Core + Tenable Web App Scanning or a Tenable Web App Scanning as a Docker image to your environment.

  5. Add a Web Application Scanner to your Sensor Proxy.

  6. Add a scan zone in Tenable Security Center, as described in Add a Scan Zone.

  7. Add a universal repository for the scan data in Tenable Security Center, as described in Add a Repository.

  8. Configure your Tenable Web App Scanning credentials, as described in Add Credentials.

  9. Create a Web App Scanning scan policy, as described in Add a Scan Policy.

  10. Add a web app scan in Tenable Security Center, as described in Add a Web App Scan.

To fully configure web app scans using a Tenable Nessus scanner:

Note: You can use a Tenable Nessus scanner to perform web app scans, however this will be deprecated in a future release. For more information about Tenable Nessus scanners, see Tenable Nessus Scanners.

Note: Tenable Security Center allows only one concurrent web app scan per configured Tenable Nessus scanner at a time.

  1. Apply the Tenable Web App Scanning for Tenable Security Center license, as described in Update an Existing License.

  2. Ensure the Tenable Web App Scanning plugins are updated, as described in Plugin/Feed Settings. The plugins automatically update when the license is updated.

  3. If you are configuring a Tenable Nessus scanner:

    1. Ensure you are running Docker version 20.0.0 or later on your Tenable Nessus host. Tenable recommends the official Docker builds and install packages.

      Note: If your scanner is configured to connect through a proxy, ensure that you configure the proxy settings directly in Docker.

    2. Ensure you are running Tenable Nessus version 10.6.1 or later.

    3. Ensure your system meets the hardware requirements for Tenable Nessus with Tenable Web App Scanning enabled.

    Note: The following platforms do not support web app scanning in Tenable Nessus:

    • Any host system that does not support official Docker builds.

    • Any host that uses an ARM-based processor (for example, AArch64 Linux distributions and macOS M1 and M2 systems).

    • Tenable Core + Tenable Nessus, or any instance of Tenable Nessus that already runs within a Docker image.

    For more information about Docker support on virtualized hosts, see the Docker documentation.

  4. Enable the Tenable Web App Scanning Capable option for the Tenable Nessus scanner in Tenable Security Center, as described in Tenable Nessus Scanners.

  5. Add a scan zone in Tenable Security Center, as described in Add a Scan Zone.

  6. Add a universal repository for the scan data in Tenable Security Center, as described in Add a Repository.

  7. Configure your Tenable Web App Scanning credentials, as described in Add Credentials.

  8. Create a Web App Scanning scan policy, as described in Add a Scan Policy.

  9. Add a web app scan in Tenable Security Center, as described in Add a Web App Scan.

What to do next: