Tenable Nessus Scanners

For high level information about active and agent scanning, see Active Scans and Agent Scans.

In the Tenable.sc framework, the Tenable Nessus scanner behaves as a server, while Tenable.sc serves as a client that schedules and initiates scans, retrieves results, reports results, and performs a wide variety of other important functions.

You can add Tenable Nessus or Tenable Vulnerability Management deployments to Tenable.sc as Tenable Nessus scanners in Tenable.sc:

Managed or unmanaged Tenable Nessus scanners

Note: Tenable.sc cannot perform scans with or update plugins for scanners running unsupported versions of Tenable Nessus. For minimum Tenable Nessus scanner version requirements, see the Tenable.sc Release Notes for your version.
Tenable Nessus Manager instances

Note: If you enabled clustering on Tenable Nessus Manager, add the parent node of the cluster to Tenable.sc. For more information, see Clustering in the Tenable Nessus User Guide.
Tenable Vulnerability Management instances

For more information, see:

For information about Tenable.sc-Tenable Nessus and Tenable.sc-Tenable Vulnerability Management communications encryption, see Encryption Strength.

Tenable Nessus Scanner Settings

Option	Description
Name	A descriptive name for the scanner.
Description	A scanner description, location, or purpose.
Host	The hostname or IP address of the scanner.
Port	The TCP port that the scanner listens on for communications from Tenable.sc. The default is port 8834.
Enabled	A scanner may be Enabled or Disabled within Tenable.sc to allow or prevent access to the scanner.
Verify Hostname	Adds a check to verify that the hostname or IP address entered in the Host option matches the CommonName (CN) presented in the SSL certificate from the Nessus server. Note: Confirm that the correct CA certificate is configured for use by Tenable.sc. If you are using a custom CA, configure Tenable.sc to trust your custom CA, as described in Trust a Custom CA. You do not need to perform this step when using the default certificates for Tenable Nessus servers.
Use Proxy	Instructs Tenable.sc to use its configured proxy for communication with the scanner.
Authentication Type	Select Password, SSL Certificate, or API Keys for the authentication type to connect to the scanner. For complete information about Tenable Nessus SSL certificate authentication, see Manual Tenable Nessus SSL Certificate Exchange.
Username	Username generated during the install for daemon to client communications. This must be an administrator user in order to send plugin updates to the scanner. If the scanner is updated by a different method, such as through another Tenable.sc, a standard user account may be used to perform scans. This option is only available if the Authentication Type is set to Password.
Password	The login password must be entered in this option. This option is only available if the Authentication Type is set to Password.
Certificate	If you set Authentication Type to SSL Certificate, specifies the nessuscert.pem file you want to use for authentication to the scanner. For complete information about Tenable Nessus SSL certificate authentication, see Manual Tenable Nessus SSL Certificate Exchange.
Certificate Passphrase	If you selected SSL Certificate as the Authentication Type and the private key that decrypts your SSL certificate is encrypted with a passphrase, the passphrase for the private key.
Zones	The scan zones that can use this scanner. For more information, see Scan Zones.
Agent Capable	Specifies whether you want this scanner to provide Tenable Nessus Agent scan results to Tenable.sc. Agent capable scanners must be either Tenable Vulnerability Management or Nessus Manager 6.5 or later. When using Nessus Manager, you must use an organizational user account to connect from Tenable.sc.
Organizations	When the Agent Capable option is enabled, or you select API Keys as the Authentication Type, specifies one or more organizations that you want to grant access to import Tenable Nessus Agent data into Tenable.sc.
API Keys	When the Agent Capable option is enabled, specifies whether you want to use secure API keys when importing agent scan data from Tenable Nessus or Tenable Vulnerability Management scanners. For more information about retrieving your access key and secret key from Tenable Nessus and Tenable Vulnerability Management, see Generate a Nessus API Key in the Tenable Nessus User Guide and Generate a Tenable Vulnerability Management API Key in the Tenable Vulnerability Management User Guide.
Access Key	When the API Keys option is enabled, specifies the access key for the Tenable Nessus or Tenable Vulnerability Management scanner. When you select API Keys as the Authentication Type, specifies the access key for the Tenable Nessus Agent.
Secret Key	When the API Keys option is enabled, specifies the secret key for the Tenable Nessus or Tenable Vulnerability Management scanner. When you select API Keys as the Authentication Type, specifies the secret key for the Tenable Nessus Agent.